{ "Event": { "published": true, "date": "2023-02-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-07", "timestamp": 1675814581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d64c95ae-49fb-44b2-987c-30d8bd6ce522", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "993dd599-a721-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675799826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799826, "uuid": "d306a887-932f-4fbb-8971-f53cdca15443", "comment": "Malware payload", "value": "605ee6efc29914e5cce94c613da483b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799826, "uuid": "f86a4fae-7b72-47b0-bade-352320a59775", "comment": "Malware payload", "value": "00376c5214c38afd08d7ba5fc6b3c586816838e91ecb5aae7558babd90b75dd4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799826, "uuid": "ddcd6ca3-659a-4c4e-badb-b4991e6bcab0", "comment": "Malware payload", "value": "5c047d65c6e4e53ed49f51b9f6e4c5edccbb3cab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799826, "uuid": "fbb00c02-e615-4754-a496-97a9bf2982c1", "comment": "Malware payload", "value": "a54ffc39bf38306cce848e828d8ecacf1bc89150d5fde5dc8b77b49965db2ddd698f3f649c09dc41279a886690cc06cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799826, "uuid": "af72737f-2bda-49c3-be88-cff029d7e756", "value": "T17FB633A7FAD158F9E4F42931FD98C43825BB3146674939E97E2D3D0041AAB243867F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799826, "uuid": "9ab4327d-f9e5-4688-aef8-96162098cbc9", "value": "196608:uNqVPhXfjBPfgJwuQSA/tYJcb3voiEM/AyKqTAtFrVH+7kkT3+CJU5cGY7thJ:uNqVPhXp4HA/db3vVT8/rVHRRCJU5cLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675799826, "uuid": "08ec86cb-c36e-4fda-9ec0-c3f3e6b421b7", "value": 10949280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675799826, "uuid": "a9f32cd2-1cb5-4c21-8c6f-fbeff36979bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799826, "uuid": "8a9d9e88-386d-407f-a0d2-1a6b78a34f41", "value": "afghan.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cd5a53-a722-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675800141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800141, "uuid": "7348b269-e706-430a-89b0-ec6b9013cef9", "comment": "Malware payload", "value": "6a6a6e3c4d8d666d6a04546bbb1048e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800141, "uuid": "89319bf8-b54b-41c8-8039-c0fc2451afdf", "comment": "Malware payload", "value": "008174dccc753ff549d7cbb9387f66ae1423ba14a216989b2a95803353d9d632", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800141, "uuid": "fca072b0-27b1-4a6d-ac1d-c56128c07e98", "comment": "Malware payload", "value": "f343d183364d436c51da911468b31324ec4343b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800141, "uuid": "f2c6f8c4-9386-4f8d-b0a4-86fe2da31a68", "comment": "Malware payload", "value": "7f127bb8f977022f490ad461299013e1dbc90afc4331e87fcbc1620fe980fbf7909bce0882322f578a1eabd5a13c28fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800141, "uuid": "ddd3299d-7548-4e41-8c52-458ff596cc76", "value": "T1E265F101B5D0C436D47325320AE896BA9A7EBD30071A58EFA3D41F7E5F306E1FA31666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800141, "uuid": "e832ed79-ca72-4a6b-9c4f-555703ff3343", "value": "5e92449db587ea19cb79d11ecf315006", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800141, "uuid": "d407bea2-9c35-4d15-988b-dd144056cb81", "value": "12288:y21/ynpKHkMInZUTmViFzWd6sSLa3Hf2QysWPjZUU:4pwAn+TnzWP2xsW7W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675800141, "uuid": "3949aec3-1c80-436b-92e0-83dc12e72df5", "value": 1546752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675800141, "uuid": "20ad40f5-3e97-4a85-88af-885c0a5af9ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800141, "uuid": "b9f36480-a7ef-475b-a317-2cc0245ae8b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea8fcdf-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675761556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761556, "uuid": "ddee92dd-a385-4fec-b197-eff36c6c49af", "comment": "Malware payload (AgentTesla)", "value": "9b273c781403d005ca76515542e5ab21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761556, "uuid": "fc3ccce8-ed38-4e55-a84b-4ae1203b9fda", "comment": "Malware payload (AgentTesla)", "value": "009b4de6d61871ef45ca8a91d5918d6940a9ad8470bc9b746d398033c3b9557a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761556, "uuid": "e87aa2d8-5b2c-4dcd-a924-b97b85105348", "comment": "Malware payload (AgentTesla)", "value": "16a4711247bbfb9ad19eb1ec49c1c9de8e10ef75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761556, "uuid": "448ab858-d21a-46eb-bd9f-61bdb87a85d7", "comment": "Malware payload (AgentTesla)", "value": "867ceaecc25e8ba8ca42524a93151a8a2762d959f2a972e02ab9cd6b8cfccb5e34c3127f017440cd3486bc4d126c6ab8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761556, "uuid": "87433860-cf7b-4953-bc93-2093edb9002b", "value": "T195544DAAF6AA46D0F95C4CB074DB8135171B3C33BA9C19E1D80B37D313F5268A09ADE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761556, "uuid": "9b3ce50a-278d-4c0e-ac87-2a6bcc4375af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761556, "uuid": "eb693ede-dfef-4e56-9779-dda855126c2d", "value": "6144:SOe7vYYo2U4YRNNbKL4pTYdkhVoi4Fc+dVkR52:SNvYYowYtiisdkEDFc+7kr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761556, "uuid": "89316e96-97cc-44d0-88ca-56e6da57e499", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761556, "uuid": "88ea288d-71cd-4573-abbf-21beff88fe62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761556, "uuid": "91d026c8-3d3d-4670-b09f-ae257037976f", "value": "9b273c781403d005ca76515542e5ab21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df03b47-a715-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675794519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794519, "uuid": "40920923-6b84-4e7a-900e-475388cf6f0c", "comment": "Malware payload (Amadey)", "value": "3efa97c5cfd6b4929581b93bb732c035", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794519, "uuid": "76afec1d-51d3-4418-8e36-601f0c69b089", "comment": "Malware payload (Amadey)", "value": "0103ef85334688b32751684e54bfcb1b8535aa257a53e35006799d9618ba3c8f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794519, "uuid": "acea33ce-fd07-48f9-829b-447735bf50ac", "comment": "Malware payload (Amadey)", "value": "0827d2a0d71b3b75eef422f679900b7f4493d322", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794519, "uuid": "044c60e4-0a6a-4a30-ba46-f3f59c115700", "comment": "Malware payload (Amadey)", "value": "b82d83d115b021a9beda6a734a560afd7d5258adcf53da5ea41f5de9f5c9dfa32e8af63052883aba7866919de408e030", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794519, "uuid": "8b65efd3-cacb-4ba1-a9f7-df4b79b4028d", "value": "T11DB40247F6ECD072D8B55B7009F703C30A36BD621A38836B265E6D8918732B1667637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794519, "uuid": "5b3a75c1-20f4-4f5d-938d-43282090dd85", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794519, "uuid": "5b765d6a-f695-405a-bad8-7cb29f6e48c7", "value": "12288:GMrdy90IGgVfsqic5CHtySic86qLBmgi:HyhfVy+Lkgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794519, "uuid": "4a36dc3f-b953-4158-9e36-b3c5ca2f717c", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794519, "uuid": "4c6154c8-3e7b-4367-8042-41856a0fa45c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794519, "uuid": "a7a8165c-da31-4478-a221-21c2c41f7f3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db182dc6-a6cc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675763429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675763429, "uuid": "6d641711-c306-42f7-8e8d-f1183ff4b9ff", "comment": "Malware payload (RedLineStealer)", "value": "3a68f98ff16400570319ea20ee95ed7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675763429, "uuid": "83a2355a-daa0-4ced-98ec-ceded6b19db7", "comment": "Malware payload (RedLineStealer)", "value": "01a09f4a93941e4d0d1afabb4f49f7aa1b9f91cc202cc1d7eba5ca52ebecd317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675763429, "uuid": "87825462-89da-405c-b659-4707ac3322a1", "comment": "Malware payload (RedLineStealer)", "value": "f224c44539adca907f74f21b050a2d837a0f7083", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675763429, "uuid": "4f467912-fd1c-47e5-a2c4-3938fab299bf", "comment": "Malware payload (RedLineStealer)", "value": "db7f7a099a4e2d2064ef939e7873bf1a4066844d5c76cb8bb36b2f5ea8d56155a325d194bdb524960d55989fdedfd5e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675763429, "uuid": "aad1596b-4cd5-42d4-946d-136758e74b29", "value": "T17264F2227692C071CDA729316814D7916BBFF43162398A1B77D817AD8F707D0AB7A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675763429, "uuid": "efb960ca-ec56-4428-8af8-218db243b864", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675763429, "uuid": "214cc199-ba38-4231-be3d-8a9e5f890809", "value": "6144:oHSjlDBLkgUqxFxqjVhbud58LFWYMyYkyKW:oHSjldwgUQqLE52FWYMyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675763429, "uuid": "8ec4d11f-f646-48c2-80b0-61e993fbe389", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675763429, "uuid": "d5469b05-aa9b-43fe-a536-38c6966ee1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675763429, "uuid": "85d07672-da63-4ac3-b349-daed7b4b7393", "value": "3a68f98ff16400570319ea20ee95ed7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a593e078-a67e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675729839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729839, "uuid": "5bbc2ffa-4b53-4ad4-9d8e-6169d2b3493a", "comment": "Malware payload (RedLineStealer)", "value": "b8bf26020795619ce354b7e04759b43f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729839, "uuid": "7b96f0e7-2a00-48a4-9ec9-ec6cf70ae0c4", "comment": "Malware payload (RedLineStealer)", "value": "01e13b44e35da843ecf04bfee0e174a3d668b8cba7e2015545fd34ca78f94a47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729839, "uuid": "4ad8eb7e-9987-442a-b142-307bf50aef56", "comment": "Malware payload (RedLineStealer)", "value": "672016d2eae3b964f9dfc39fda55ca77aca27b69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729839, "uuid": "9cb9d619-3e45-4617-94fa-f0e55d15fa7c", "comment": "Malware payload (RedLineStealer)", "value": "64093f013421ee24eb402dbb196db3294576c9c524dd029554217222e174fddf7361c904847d05b4f827061e54d1b305", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729839, "uuid": "1500461d-86e0-4910-9f3b-ec53cf98ba7c", "value": "T1F0740A887670FD9EC857C47F8A681C64E6676866570BA203B05313AC993D79BFE130B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729839, "uuid": "e84b47fd-deff-42d4-bca2-4bceccccf2f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729839, "uuid": "30b4954c-b901-4c8c-9197-600a6caf204b", "value": "6144:iCi6CiedZMCoJut7btyErLnPDfT4BPNlJq5OtHRXhxLa+ySApXmD:4JH4EMw5OtHRXhxLa+ySApXmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675729839, "uuid": "0dcb32c6-29b8-4484-b186-e6983bc394ed", "value": 343043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675729839, "uuid": "c9901bf6-4b62-4f08-9f28-cdbfc1ebdfa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729839, "uuid": "68458f9b-44d2-4e69-972c-e6d4f8a2880d", "value": "b8bf26020795619ce354b7e04759b43f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ec335a-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675788189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788189, "uuid": "24343d53-7840-471d-819f-80142ce9b920", "comment": "Malware payload (Amadey)", "value": "d5a395110e42f50473678ed5bd354aa9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788189, "uuid": "ef2328de-c372-496d-8450-4046a981a4f0", "comment": "Malware payload (Amadey)", "value": "02cab8fca6e940166ec20ac4c36d2b4dc1c45f2fbbae0dc1d5733c7bb266a5ad", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788189, "uuid": "494f86c9-8091-4b0b-b15a-4e7d1bbc81e9", "comment": "Malware payload (Amadey)", "value": "6cb46545d6eae4c834e3b62f352272591172d521", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788189, "uuid": "c0afe7c3-710f-4da6-a278-ddf79c7c1914", "comment": "Malware payload (Amadey)", "value": "072beebbf3853b49f89b7d0bdd04770e19786965208d4619de83807b841463e3c2f410d6e43d6efdf8d2864cd1f3a058", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788189, "uuid": "624ec9dc-1f85-4701-9543-6978f981dd80", "value": "T196B40207BBECC032FCB557B119F503C3097A7D61AA38865A275A6C5E0DB21B4B63532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788189, "uuid": "a948e63c-04f6-4c00-8413-04877c39bc88", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788189, "uuid": "e53afd4a-e932-418f-9f99-fe8423e5fbb4", "value": "12288:mMroy908xy7CWVfbKSLRdhRELkdPOSegm2CF3I4b:aytxyhVPREodPTeNF3Bb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788189, "uuid": "ae31fb89-93ac-451a-9b6c-d6074d5595a9", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788189, "uuid": "3b4d497b-88f8-4c81-8193-4974a7d5f932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788189, "uuid": "e8e059a0-702e-4089-9e2c-2eb38d9b96cb", "value": "02cab8fca6e940166ec20ac4c36d2b4dc1c45f2fbbae0dc1d5733c7bb266a5ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067e9619-a6b1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675751476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751476, "uuid": "57e37b19-e3f9-414d-99e2-7e50ea56ebc6", "comment": "Malware payload (GCleaner)", "value": "4f232250d1be80660d48612ed0410f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751476, "uuid": "804e2397-f550-4d47-98c9-2dbf9364abf9", "comment": "Malware payload (GCleaner)", "value": "0374c66f31519812a03ac7e9a4f991ef54f664078589c2ba52c32adb06efa56a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751476, "uuid": "784bc60a-3f51-45c6-a12d-a5c31f130565", "comment": "Malware payload (GCleaner)", "value": "a216cde79fcae338e0f387ef20a6baa80a114e98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751476, "uuid": "fd923046-ed17-46a6-9114-de4aa7ff7713", "comment": "Malware payload (GCleaner)", "value": "8a0881107541e3428d683a85059342b1013291d4b2791cbfbc68a194dbde42a6169ed89b4f9b7db6832467b6b2ffd736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751476, "uuid": "a7e44f2c-34d2-4fd5-b38e-f93d95dd25b2", "value": "T1E5C5E00A1C94D0A3D1608F71D9D76DF64C12EE6FE8BA419323007FFBB632246E95A934", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751476, "uuid": "8d6d1872-c518-41c4-9a89-de0b43cabac5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751476, "uuid": "292272f0-dc32-4c34-9b7f-03ae734fcce4", "value": "49152:wDZV7qILFyNW5KFGM1oVcqvUP1wh/h9OgDXDrHBdYlIDIs6LCgv2MR:+ZUyJKFzAUPSTjQNsSv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675751476, "uuid": "f2d9039f-22b4-4012-a73d-c3c80fd445d0", "value": 2731649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675751476, "uuid": "7f3b9de3-3af2-4206-9a93-37e23ceb29fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751476, "uuid": "1fb0873b-621d-4fb7-a6e8-90c7d319d8c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0f7be4-a6b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675752292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752292, "uuid": "b526653b-042c-4070-92b9-afb366d4bf04", "comment": "Malware payload (Guildma)", "value": "949873a27073ffd9dfe502a617e4053c", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752292, "uuid": "95f0951c-4144-414c-a5cb-9553ba87ae45", "comment": "Malware payload (Guildma)", "value": "03aa9ce2ae0f950d6563859f4a98db0b80035125ced8fbb956c12d497fd84469", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752292, "uuid": "0ed22532-34ba-4c84-aee5-f044eaa76de5", "comment": "Malware payload (Guildma)", "value": "43e55ecf9135126c4442f0b695f47ea4ce47a698", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752292, "uuid": "6e50ff22-8463-4a4e-a034-c9c8d5486e44", "comment": "Malware payload (Guildma)", "value": "59d04a74b249f4fd3bc738c8a8c53f4b6775a412632afb0d8f4ea6da70f7074b2ec4968bcde937126d9930aeb513638a", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752292, "uuid": "f43923a1-25fa-4a50-99da-8d7868737c5a", "value": "T1F0F0AB4EB0001FC1D028113ECD0A07040DACBAD62F08155A6A4D03C84D61FCC7F4A5F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752292, "uuid": "6592238f-a340-4b5a-894f-4a8d047c9573", "value": "12:8rflM8OBE6ZGQWgk5LaxUTGjdmDLtUOmUNFm7+TWvKpRI0h:8loGQWFVaxkG0DLaOTFm7bWI0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752292, "uuid": "a9f9cb7b-9592-4248-8d1d-294d818e9719", "value": 481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752292, "uuid": "d4b01d85-a5d1-4e15-88ab-7678687d423e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752292, "uuid": "54239cfe-1ef8-4817-bf39-fd8d54ec8e14", "value": "949873a27073ffd9dfe502a617e4053c.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8cd0b6-a67b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675728532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728532, "uuid": "e2175476-95f0-405e-862b-9b7fa7d158a7", "comment": "Malware payload (CoinMiner)", "value": "45745cc2b7e41ad2e663e73112e1d4eb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728532, "uuid": "c613df09-fa59-42a9-9832-3caefd9c4e9b", "comment": "Malware payload (CoinMiner)", "value": "03b961537434ed16b110e1187856d6fd83887488126e6f36627beff091b1eb72", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728532, "uuid": "4f718933-0f54-4473-bdbb-d8315435c293", "comment": "Malware payload (CoinMiner)", "value": "27a58c48caedeb235a046e8657c9f05df829a585", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728532, "uuid": "61177746-78bb-4eea-a103-138f749cd948", "comment": "Malware payload (CoinMiner)", "value": "adb7d20b8a79d3fdaa8a3a30bb97cbfc469da366cbd1446898b31277af845a07cb8cdf87c9f7e6745ba484b9d47112b9", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728532, "uuid": "df234d2d-098a-4002-b7f2-4f65ecdcbb94", "value": "T16E644A4393F1BE84D926CB73EE1EC6E87A5FB9408E7937652218AF9F11B0072D163611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728532, "uuid": "ed701cb4-c557-4174-b0df-98e2b991f9f7", "value": "e8720dc2abfc37e1a047ce92fd890111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728532, "uuid": "6b11e1e3-9dbc-48e8-a9d8-e9d4bf33008f", "value": "6144:C/SlLSuD8yVmbWuM3XPbRO0uQj9JKO48a:CKlG/ykipXI0ljK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675728532, "uuid": "771519df-d765-4411-8f83-eb4f34d84026", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675728532, "uuid": "c61a973f-381e-4e75-8d5a-a6594eaa631c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728532, "uuid": "df8a6d8f-ad69-44ee-b472-e7667be22511", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd342c2-a69c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675742526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742526, "uuid": "955320c3-cefb-43a7-b9d6-5574317f5ab4", "comment": "Malware payload", "value": "ed80f4b9a6d0798d08d23ac7126f9997", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742526, "uuid": "58c646f7-fba3-4e91-881f-87a0f8332c1a", "comment": "Malware payload", "value": "03e5a25d601802182017e65b678a230cc9a481b50af2f9c92fd5b356ac8c1367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742526, "uuid": "47c42417-7b2b-4efb-ac2a-0b2eee9381c3", "comment": "Malware payload", "value": "e9aa0c7ec74cef83234f1efd4a10483fb1dd9e41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742526, "uuid": "2112e76e-c361-4792-91a6-563a241b4150", "comment": "Malware payload", "value": "11e488480cb47e9df0c48ba57240b8351399113dcc45a1cbb2da1969502a86edecbcf32d216123c723ace3171be7a6ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742526, "uuid": "2872127b-4ca3-4fd5-95ce-fad54cf51470", "value": "T123136C20FAA1C073C45264B54C34D161AA7E79125BB1C84B3BD80FAE8F213D697BF31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742526, "uuid": "c1882936-1e54-40a8-a768-a620a80d4266", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742526, "uuid": "f9ea5c1e-f3aa-45d2-be2f-ee046ce0b836", "value": "768:RGeR2b5wwCPrKYMQca/roSQ0LBwyeSh7J8KW7CuRmP:pR2b6b3MQBDe0LK87JiRmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675742526, "uuid": "7368b5f0-348b-40d8-b48a-0df1856326b6", "value": 42829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675742526, "uuid": "95e613c5-9a48-43f2-ad2d-ec12ad9e6bd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742526, "uuid": "b9e23f85-2149-4274-8e73-7c67c58dd1ee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a934c9-a699-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675741380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741380, "uuid": "34df2910-9d12-4e79-87d2-3ec4a19a5c51", "comment": "Malware payload (Tofsee)", "value": "980a06ca329c6295024f08ecd8b1640d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741380, "uuid": "9c3bd75b-0a64-4de9-8169-81fec1a61d84", "comment": "Malware payload (Tofsee)", "value": "041c575dc41719ec9d6cc01d5c3ec9f50d7b6a78765c3f8497f49439567eefce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741380, "uuid": "fcdb1f1e-d62e-4985-9096-d293f2b75cf2", "comment": "Malware payload (Tofsee)", "value": "4cabfe28997293048a737a1e837c5154cfecfbc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741380, "uuid": "71ca576e-1454-49c9-b07a-d2917bc599f9", "comment": "Malware payload (Tofsee)", "value": "ef17b8a2f1dbd756f51734d04553651b77093c31a185401413f30697010f8a6db63d41a49e3470d312feab60243b0bf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741380, "uuid": "83d0fd8d-2036-4bd1-ab43-26b3417badc6", "value": "T1D7544B4393E1BD40E92A8B72DE1FC2E87A4DF9418E7D77653218AEDF16B0276D163210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741380, "uuid": "1fdc63d4-47fc-4e1c-b801-35cb6ddc157d", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741380, "uuid": "d9232cc5-8440-49b0-b090-2274aa555f5f", "value": "3072:pIb6b3XLnwRmJJe+wJfci8KNr2ys4rAukSFHHInWuQjiMTE5dXa5D:ewXLn3JJPGfcxs2N4r/fFnIWuQj9Ga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675741380, "uuid": "2c3344f7-b5a7-453b-b7d3-ffd306cbf197", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675741380, "uuid": "baf86715-15cf-4bf9-bb80-2c7ec34c9895", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741380, "uuid": "abdda8a7-3f81-4dd3-9743-b662a44c19d3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94b3459-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758621, "uuid": "d6a4d2d3-c40c-4732-948c-e2a3fa175f17", "comment": "Malware payload (Gozi)", "value": "a7c5e22b91718cd34e02f1531dd442ab", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758621, "uuid": "98b0415d-5096-4986-a65d-fa78cb73179b", "comment": "Malware payload (Gozi)", "value": "042f6ac88f3b8fe80d57a96ca0d6623d6a9b840fef03fb44eca8fb1b62e2afe1", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758621, "uuid": "df1b24c3-e6ea-48bc-8e2c-d8913aabe367", "comment": "Malware payload (Gozi)", "value": "0166758218595bf40aba3a5a461e50f11ea76ed2", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758621, "uuid": "0a86cebf-ae57-4e28-8a80-1df27298ce35", "comment": "Malware payload (Gozi)", "value": "d19a6a7bf0ca284ec6c6b934377c23d332cb91ec32dc43abc314c47650070c21706d64cd15f4c465a5d82adf8bee0c48", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758621, "uuid": "f2099007-3e0d-43b1-a9e0-2671057e60df", "value": "T156A18F346B39B10F8D28580C9083C66F219F0089167E24B81AEFD06A85FCC3CB906DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758621, "uuid": "a2b89c6d-ff17-412c-a913-420a0a44c0ca", "value": "96:wQ+rTrcK8v5EP/Vtd2yujRWe36EKYIWyGV8L4/goeHMRue:STrqv5CtA6EKD0i4ooe5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758621, "uuid": "34f5aaef-d41e-4fe0-805d-d17e9bad885c", "value": 5068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758621, "uuid": "31119a72-7ed4-4cc4-8e2e-845fe5ae8e7f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758621, "uuid": "daad6da8-7799-424f-a113-1f80220170e3", "value": "azienda_18.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c0480e-a696-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675740041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740041, "uuid": "71698246-75fc-49c1-a60a-382c32c32340", "comment": "Malware payload (njrat)", "value": "cb4f7930f33e22b601bfaf19cd3aa4fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740041, "uuid": "9bcd1924-04c1-4b9c-a7ee-4a0994c226a8", "comment": "Malware payload (njrat)", "value": "045433322ca0eafeb348d1f3d03915f8723edfc2cd299daba7423f734aecfc49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740041, "uuid": "7aba9e6a-7872-43d0-a548-960d59d9e069", "comment": "Malware payload (njrat)", "value": "8f29117a1f1128bae3a7b13193f98ce21098d25b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740041, "uuid": "93143992-ce16-43f8-a1fc-a9a4945ff3fb", "comment": "Malware payload (njrat)", "value": "9674cc95af19ebd1c4c5227f00ff7cb24b633fffe5387e2e61fd9f733591e7def3ee884d1f1d3cc77ff30df3229d2c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740041, "uuid": "088f3e0b-88a2-48cb-9abc-67f6c81ede28", "value": "T1B7032A4D7FE18168C5FD157B05B2D41207BBE04F6E23D90E8EE564AA37636C18B50AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740041, "uuid": "671940eb-3572-4069-9ecf-bb41a0c09b5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740041, "uuid": "0cef1e1b-7e52-47d5-b706-d0e00640968b", "value": "768:z3iHpR9EfasrauCCsIZrM+rMRa8NuLo2t:zSHpRytrYm6+gRJNQo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675740041, "uuid": "b854e34b-315c-49c9-8b9e-675a1d56f565", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675740041, "uuid": "b738ad6d-c004-4455-9df7-6f8a85e6e8c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740041, "uuid": "0e55030c-bfbc-453e-a789-c15918ad9bca", "value": "045433322CA0EAFEB348D1F3D03915F8723EDFC2CD299.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6d0aab-a6e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675772667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772667, "uuid": "19112a44-b243-4ca4-9b0a-cf41d6017046", "comment": "Malware payload (SnakeKeylogger)", "value": "77f09e38ffda6ba8f7a51f40d11ad555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772667, "uuid": "b084284b-a48c-4218-805c-1a8dc5133715", "comment": "Malware payload (SnakeKeylogger)", "value": "04678ba1322f3fcb1f5cfb0ef0389da80d1c786e753f74a39d38407558b3bf41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772667, "uuid": "854eb61d-9f6f-465d-9ed1-6e39ab524581", "comment": "Malware payload (SnakeKeylogger)", "value": "841ed8c5ebb30603a94b7cd8c19fd28272059a4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772667, "uuid": "9e49a546-1688-4566-9b3b-535769ef3c4c", "comment": "Malware payload (SnakeKeylogger)", "value": "242c7183c20c1b9130fcaa61f8b1775f9da676846fe681473706d4b25465435d6662fc1105f3a509c03a2df47d7721a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772667, "uuid": "f61ef19e-4dc3-4927-ab45-c98b1e58f5f2", "value": "T1EBA4D090F24798D1E85207702C3BEA211727AE7B7870C51E365E767B67F334264A7B0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772667, "uuid": "ee055757-8637-4a4c-ba2c-7ccc27b1b42e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772667, "uuid": "5102715b-6f5f-47a4-bea0-527bc84ba3dd", "value": "12288:8YnF2b1e70hdlfLK2wD7BOgDMoKRbvfEh65hik:8Yq007FLKh7BpxO7EUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772667, "uuid": "5b8e5836-8aa0-4618-833e-98766015a51c", "value": 476269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772667, "uuid": "483298ab-0ac1-4eb8-b05a-5dcc3d3a9ab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772667, "uuid": "6b75b948-3375-4850-b448-1ba4ca9ee652", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c337ecb6-a728-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675802903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802903, "uuid": "1fb03c6b-17e3-4e76-a41a-6b511a1d91c7", "comment": "Malware payload", "value": "ae57065c9eaa415c86d954ea6d845f1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802903, "uuid": "d20f7d36-4bb7-466b-bba1-de760d57631a", "comment": "Malware payload", "value": "0487ada935afec7c7f5294262fe05521f6b87f2c2bbf5d32ddcda49aca140fa2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802903, "uuid": "0774e1be-385a-4b14-a95c-f2b7c861e9bc", "comment": "Malware payload", "value": "5e625d2449748aadb131b1c1b3668c2784bdae32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802903, "uuid": "87bbba6f-d760-422a-b906-9238558bda58", "comment": "Malware payload", "value": "af2de596fba023d1ab0abbcb38d11a42f39ce28302d5801f1de7e24445a58037e72f1309b3d4f537eeff28d4f2b7134e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802903, "uuid": "16817bc3-55fe-4c49-9161-2a5d950dfbf3", "value": "T186936B03B5C18871E9B21E355871CA604A7FB9204E658EAB779416BE0F781C0EE36F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802903, "uuid": "327ad7cf-dcd6-4c4b-b66b-49f00d634789", "value": "a574b1a2dc5b65060c1168f7825c38ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802903, "uuid": "f7789bda-febf-415d-b2f6-bb93f57521b7", "value": "1536:mDak+waM6QmZmLkSdP02Qq8OZedFzaaHcdfDlqHJ19jXW/6acNYJ3LsWMM1cdmUD:8aM6Qe2UKedNaUiDoH9jS6joiMEmUGRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675802903, "uuid": "e3a878b6-155f-454f-8120-a18c06033172", "value": 90816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675802903, "uuid": "85ef2a99-7ae1-4a5f-acad-936888711338", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802903, "uuid": "f2f57583-6958-424a-87ab-d18be8d67025", "value": "SecuriteInfo.com.Win32.Trojan.PSE1.NRZE7D.510.977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a043d2-a737-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675809074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809074, "uuid": "943c394e-7fd3-4836-a9da-99a536a2b104", "comment": "Malware payload", "value": "a27995e7e8cd2e41978238d07a9c1a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809074, "uuid": "2ce0f7dc-7a47-403b-b1d5-92e5f9ff6160", "comment": "Malware payload", "value": "049223749555a4cd446f8099437b6a26cf4d619456298285ef4a4943880dbde3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809074, "uuid": "12019eb6-8a80-4b19-bca9-63578104eff9", "comment": "Malware payload", "value": "9f9ca8e96ecc45bc0d75e6ecf82bdb5ca3025984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809074, "uuid": "7cca8238-0be2-414b-ab72-449873830cd6", "comment": "Malware payload", "value": "23d955616b01bdfa67847bfeba296f626ec470fb95323527bb73aedffeb97aec949adae0178738797b501c5dcece3bd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809074, "uuid": "f691db91-6691-4c52-b775-97a31f25fa3e", "value": "T16064F1327680C4B2C9B6157098B1DBB05BBEB8305A75892777A807AD9F343D1E63731B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809074, "uuid": "6df46107-e837-47f8-82fb-dc989fa23aea", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809074, "uuid": "7afd10d0-98c7-49d8-b34c-0d17ec082ccb", "value": "6144:qWP5fuy+LghXM+Nhw9Sz95CLQjYoaWQPXc9i:qWP9n+chc+/wUmQjYdWQPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675809074, "uuid": "94ff8876-8358-4789-8546-ff98888cb319", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675809074, "uuid": "dcf196bd-6fc7-465e-b447-e0737eb25d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809074, "uuid": "5fbb9f3a-1c36-4ba1-9195-e1f73da05687", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84873f31-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757271, "uuid": "328637d9-a83b-4014-9c6f-8414c6434c21", "comment": "Malware payload (Gozi)", "value": "0b9f7fa72219b75a75bc325af30de850", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757271, "uuid": "b6e57947-2050-4072-be4f-fac231c9fbe7", "comment": "Malware payload (Gozi)", "value": "04b5784000d66093995c13dddb0f346996aea2b7fc9ce0d420f5b596ad70fe72", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757271, "uuid": "68376b6f-32be-4f3f-b0b7-cd7b2d4ebc65", "comment": "Malware payload (Gozi)", "value": "9a1508b0e849ae24ae741d54b602821e07eff468", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757271, "uuid": "84924bb1-775e-4137-bc0d-f387b9ee3bee", "comment": "Malware payload (Gozi)", "value": "70f2d895bd175b629c9b8ed44a052af725e033d93b6e5d5147f13a1d6ce10aca216b4036efa24cc3f13015c8e2c5cbbb", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757271, "uuid": "5c3d2631-ead2-448f-a411-55d3aa3b6735", "value": "T1DEE18D8E9DDB641BA78181EFF2733C20FB60197AD9697204B5E1F70E6A63B27014121C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757271, "uuid": "09eafac3-0652-4f3c-8f86-69db0d1d4b15", "value": "96:wiN8lqzLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dh9j:/CIU77rIKdn863jMM0OD9+VVF4nx4kuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757271, "uuid": "2823aeba-6a05-4026-95cf-d02f058cd9a8", "value": 6975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757271, "uuid": "748b4b1b-80fb-46d5-913c-971ed730ecd0", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757271, "uuid": "e6cc0383-5cfa-490f-aa62-772b34aaeea6", "value": "azienda_08.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a1d244-a68e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675736568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736568, "uuid": "63adfada-5d52-42f4-bfab-f86e8a0001c2", "comment": "Malware payload", "value": "d1b168703c974724277b6df2214d8a82", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736568, "uuid": "525dd2ff-6532-46a9-9320-8f3416a3797d", "comment": "Malware payload", "value": "051e178449098ea7932917618c7587d54f18eab1d906febc193801d37e2b9caa", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736568, "uuid": "47485c76-10e8-480d-ac43-4c9b04881f9f", "comment": "Malware payload", "value": "d2b9296254f44ed63888305c318ff6df1e2e8ce5", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736568, "uuid": "1e5dda07-d081-4a18-84f3-c607953f70fa", "comment": "Malware payload", "value": "5b6d95896bdc94805b4f12b6ccb92605155cc112fe6821d9f31203cfc4aca16fe832b32890e73da88974eb4eda430303", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675736568, "uuid": "17bd05b6-0579-4e2a-94b7-404cd84e220e", "value": "T138E6229AB755583ECC7B15724D7A1231266B4D828E83DB837844370C6DBB6D80F9ABCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675736568, "uuid": "e1a0aaf0-492f-4b36-9ded-62bd6dff88a7", "value": "393216:9WlBhiPyFwbfDR2eo5tJtqNfoRO+FoVij4W2sjca:9WDhia2bbR2r3UNfoRO+F8uJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675736568, "uuid": "59612e33-0cde-4be8-b4d6-44e0f0ae0a45", "value": 14520762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675736568, "uuid": "52a1f7e5-f153-4d2a-acfa-e43fabd359ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675736568, "uuid": "09edc8c2-214d-4b28-a79c-dee32fa6010c", "value": "aplicativo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70295f6f-a6f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675778712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778712, "uuid": "b11436c6-695a-4679-96b2-c1d42ba76880", "comment": "Malware payload (DarkCloud)", "value": "29d4b33608c5d6a8fce8856abb441a3c", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778712, "uuid": "d00f8c6d-c228-4716-a438-4eb5b2ae9f92", "comment": "Malware payload (DarkCloud)", "value": "052b8e587b327635a7263e24089b0ba1109a38005fc4718834a2761970ea7df4", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778712, "uuid": "a8153e61-1294-4cdf-8681-fbc1e9b997ae", "comment": "Malware payload (DarkCloud)", "value": "7d2d6f053232d5c3c9999f194cc28eb5277e62c0", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778712, "uuid": "63294ab0-4bba-454c-a817-118a6545c76b", "comment": "Malware payload (DarkCloud)", "value": "fe161eab16d38b0d6773539cdb65c0dc682e12a1b988c9622f5d261da02044e03274163d3b68bcf14b458623fbe433d5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778712, "uuid": "892acc2c-5147-4428-be27-0069fc7dd446", "value": "T10194230A35E7F8FAD816053115B28B7BC73363344172495F9F6A4BAA9D321CB0B1D19B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778712, "uuid": "ae27e2b0-1e16-4b80-905d-69591ff03001", "value": "97318da386948415d08cef4a9006d669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778712, "uuid": "4509de90-6c63-4698-9012-48b5eae0c852", "value": "12288:e0vPwsbgmcQZm3r+FjIkT3cCzwgHG2PTMuO/mKZKmQxDda:e0vP0mc1i1rTsQb/qmKEvxDda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778712, "uuid": "84027549-149d-4362-97cb-888a2cc0a21c", "value": 443970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778712, "uuid": "52f1bc8c-7979-42cf-ad7e-695622d06535", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778712, "uuid": "b811f1e2-f765-4360-a856-e7a7a4149c89", "value": "052b8e587b327635a7263e24089b0ba1109a38005fc4718834a2761970ea7df4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef6bc2e8-a6f5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675781073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781073, "uuid": "9ea55889-e45e-4122-8b91-0f3be935510f", "comment": "Malware payload", "value": "4d6e210693090eba29fc2cd985511727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781073, "uuid": "bc7b04b0-6950-4ce0-9b17-a55da965ed76", "comment": "Malware payload", "value": "055607b0d3dc64647387d47bfa52ce64be4e9a4710d47343614f33e16ad1d975", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781073, "uuid": "6735f609-62d8-4adb-b333-3c773526f587", "comment": "Malware payload", "value": "463697c2d343febaafb7960f1c5e5e7d16b63042", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781073, "uuid": "9d54fe8e-8129-4af3-afa9-420fb715cfd0", "comment": "Malware payload", "value": "5641e824efd298d450b91c60b8664f444f47f72493743a43f40a70a4b8fa76ab67d6ccd3ccf042ffb36bb34f283df1b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781073, "uuid": "cea065ca-f059-4c0e-a169-de609cc0d502", "value": "T1BC0733918973489CDECFC278C99AE5B1A17CFD300291E42690119FB47F17FE06A58A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781073, "uuid": "fc5f7fb3-a16a-4f75-8896-5b9a63d4fd5c", "value": "17b0697e03f7522ed78b3cafa7b4608b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781073, "uuid": "3cb93f41-e1b4-43df-ac68-635db5a85841", "value": "393216:hqZQsptshAfqz4WIxeIukTUyesWZncse5LMC89s2zJXz:sQsIXMW4ukQyesWZcP5KsWJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675781073, "uuid": "253ddb69-ff75-4fc9-92be-be14d55d2bb3", "value": 17670512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675781073, "uuid": "c281ff2b-38a5-471a-a5d2-a72ead653973", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781073, "uuid": "d6606d30-f5c8-42e9-a6e9-95e52c664cc8", "value": "QmXGVHdFFsMMgLdiLVgNbUbRp6cAxknWRKKugYK37rMkAo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c152c6c-a711-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675792905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792905, "uuid": "b0af7d33-ca7f-4966-a3f3-9ffb43edb7d7", "comment": "Malware payload", "value": "1788277e84df2caa100d0f893c989ba7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792905, "uuid": "1fea8f5a-f4cc-41a3-8047-690ca5fd8a9f", "comment": "Malware payload", "value": "060a4a5e6d0a3f30889013f8f2996a6eda681eb1ccc12ba4a55a7012618dfb7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792905, "uuid": "bcbcb436-602b-4f14-a788-2b9aaa685902", "comment": "Malware payload", "value": "5eaef9acd086f73e576a4c7b2c62e7fd6a993d53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792905, "uuid": "04a07d87-8e14-41d7-b712-b3d167b3e2c2", "comment": "Malware payload", "value": "d544445f18688447df161d741603a4148154c108f7510d28d013b7f2858d8a3017e65ae0b6db297cbdd132e539bd9463", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792905, "uuid": "69c6fdfc-0a29-4e93-a36c-58d263e53fca", "value": "T134456C417BE8EA27D15E5776F0A241244BF0D806B753FB4F26A8A5AD2C437407C892FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792905, "uuid": "9e9fa7c6-04b5-4b73-89bd-6ea7217e72e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792905, "uuid": "5437d433-b055-4ca3-b251-ec2d9e48732e", "value": "24576:T8QQ2Mcf4EcP27BovjgUpf7yJ1rga/v7fLsuwB:T8Q3cgo7Srf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675792905, "uuid": "efca5bbb-9ab1-47fb-ac7c-ec36c81d268e", "value": 1187328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675792905, "uuid": "6ea00c01-9d7e-46c8-8ec1-ff75a3c033ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792905, "uuid": "39570c47-8510-45b9-999e-c8e20382c72a", "value": "1788277e84df2caa100d0f893c989ba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb45892-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788906, "uuid": "f27cca0e-c349-42c6-a951-c82998848049", "comment": "Malware payload (SnakeKeylogger)", "value": "fd1d6ed34a1ebe9297c73366bca7386d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788906, "uuid": "7733cbc5-7df6-4140-813b-2d85b00e2327", "comment": "Malware payload (SnakeKeylogger)", "value": "061ee3375dc3333d8c4266e773535e516206935d4f7dbbc3f0319d253840213d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788906, "uuid": "d7c930b1-35e1-44b8-ac41-8b2db138ae6f", "comment": "Malware payload (SnakeKeylogger)", "value": "7bead77117d9941d0b60eaeeb3241c26fd79e0fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788906, "uuid": "c7b72196-45d1-4266-b718-8e674d9c62b5", "comment": "Malware payload (SnakeKeylogger)", "value": "4597233c7b1d2cad9f9132ceb1bee83080d75d11c045b271070d513c2d5d8b4f250f356da807149e4289981825dcef93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788906, "uuid": "a1953ba5-d5bc-4429-8b01-d800e4942b71", "value": "T124F4221F6FFC6B35CB7D25F952B01560837AA4067122F76F0E8261EB2CAAF900541B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788906, "uuid": "fcc9e630-7175-4cb8-9d59-63011b734dc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788906, "uuid": "f7aebc8e-7cd3-4e54-9270-a2c7bd2bb217", "value": "12288:IgfeEMHSzDtcCgp8hw8FBy3bAW4AkWgyqkvZt0XNSOawHRr/CB06KuLpmbDDlG:IgOHGThDFMAobqUt0DawxO5dmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788906, "uuid": "d9fadc38-0a3c-4f70-a12d-aea2770f7776", "value": 769024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788906, "uuid": "e6bc304f-5408-4691-8cb4-2176141d5dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788906, "uuid": "484ed2ff-edc3-429e-9848-dd7b66b4ecfc", "value": "swiftbildirimi01pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf30bb6-a6b9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675755188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755188, "uuid": "58a0c5cd-cb18-4ed1-a2f0-47d5bc459a98", "comment": "Malware payload (RedLineStealer)", "value": "b900e3714cf2a467bea8691bc090edb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755188, "uuid": "f94e58be-9b53-4b75-aecf-d71da48a093f", "comment": "Malware payload (RedLineStealer)", "value": "067899d5b4c3c9dbd546e81865ee458ccd96cfb9c310edb35503550ca9358240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755188, "uuid": "e33eba75-82a5-4d59-9d86-2b2448d92dc7", "comment": "Malware payload (RedLineStealer)", "value": "e2a148501c588f92df619ff898749c688dda082a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755188, "uuid": "764cdbd4-7d0f-4a1e-af40-43f5645b9286", "comment": "Malware payload (RedLineStealer)", "value": "fd5f65266f646409599e51439b9c772ededa8d453368027b6749f396c883166f09ae5f8de6ce83db004007a44224cffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755188, "uuid": "f2fb1a1f-e687-4283-a8cd-7e67947586b9", "value": "T11B05BF123AFB945CF3B79BF60FD878AE0BB6F5B76508A0B9399117014731A818C12776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755188, "uuid": "9f8e4ffa-e2b4-4907-922b-d8cdc36a1318", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755188, "uuid": "b3cae89a-b714-444c-9ecf-e56e938b9380", "value": "12288:idlcagI4uMEGLBBBBBBBBBBBXBBBBBBBBBBBxZhC1BG6Q3sDT7D/yWC6+XPRXxNE:42IAiw6Q3sDT45/RXwu+cZN1sgFsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675755188, "uuid": "10840872-228d-4b0b-af3f-9dfca052c49d", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675755188, "uuid": "41c56aa4-7ff7-42c0-b345-2f49eb6ec964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755188, "uuid": "c1b21429-f3ea-415c-b8ad-6b71dee53d71", "value": "SecuriteInfo.com.Trojan.Olock.1.22147.6649", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d06976-a728-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675802899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802899, "uuid": "fee72802-ebb5-4934-979d-e55ad663a7b4", "comment": "Malware payload", "value": "693d444f63df65a9db3b9a60dbcbabfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802899, "uuid": "97f07256-bd52-4d6f-b742-5cda48a20489", "comment": "Malware payload", "value": "0679e6728baedd08eb7ff2d8f0ffb914004b13be7422365149e8755745d07172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802899, "uuid": "1e5ad70e-784a-4205-8b40-c9439761e852", "comment": "Malware payload", "value": "e592210a6265774966751fcb115489e35409c997", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802899, "uuid": "429ce0b5-c33f-4d26-801d-914ef73d7a84", "comment": "Malware payload", "value": "adf10a5cc9a4e68115532e76d1d14836ae238cd7f1f2050f4caf1e66a77a15c86f2a909c8c5b4c688830fa119172bcb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802899, "uuid": "bb8a1e6e-27d0-4b0c-9604-3ff336e2886c", "value": "T11DF48D203781813AE5B245714EBCAB69017EFE320B3566DF93C85A2D1E745D26E32B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802899, "uuid": "3d6ec6b0-55b6-432b-ab49-dc1a4bf6b8fd", "value": "0d73d1b610f62295bb40298e25d81152", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802899, "uuid": "d4b8b408-125a-4ff4-8e20-4c091d255d58", "value": "12288:v7MwGcOjgoUD1o//I2ofrIDRmxOM5PdiuPXqSBjMuiPlo50JsXKbEf5+lVGbAiOT:v7MwDO8oJI2of2mxO8XzBjMuSlk0KXKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675802899, "uuid": "82005721-2021-40e7-8ea3-fb76f6f9ceb0", "value": 763144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675802899, "uuid": "0a83f9f0-1e33-48a3-b2d9-cf95d8a35844", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802899, "uuid": "3450fc33-35b8-4461-93b9-cabcdc077246", "value": "SecuriteInfo.com.TrojanDropper.Agent.12893.32703", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a361cf-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788848, "uuid": "1f9a0897-231c-4e64-bbc7-d01ce47a93ba", "comment": "Malware payload (SnakeKeylogger)", "value": "78a05df4e909a68085148b93962aa7a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788848, "uuid": "4eed72f4-31ad-4032-9750-ce2c0f90ee15", "comment": "Malware payload (SnakeKeylogger)", "value": "06c1c257d4b8f81deb628aa0a30b296f836e0fc919558e35af90b5c9e36c56c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788848, "uuid": "db3936f2-0e86-474f-b7df-57f20e7fed4c", "comment": "Malware payload (SnakeKeylogger)", "value": "313b30e5261e99f46b79c1bedeb7bf6450047904", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788848, "uuid": "cdc9f44e-121e-4c79-847e-8094f8af6018", "comment": "Malware payload (SnakeKeylogger)", "value": "4a6e1e71fd63b0ebb94468c5b0f695ec9b9e2f93abe6d4c487a84b41c1f7be0a34a0af4bc2d34c1131957c1b8e97d644", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788848, "uuid": "83d5cca7-74e6-498d-b268-50f13c6ac475", "value": "T17DA57E3ED86D4137CEE8C36DE590842EF6E4A6633911BD3ED8D72384492B58278C616F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788848, "uuid": "a20a35d1-4003-4f9a-b55c-a878e978fa4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788848, "uuid": "3e855f52-9134-497a-b6a2-9cae87ad829e", "value": "6144:nMaBzET2c9zBZ/01ofWOnr+ogt7A6LnjZRBLp7UCKeO+dYBjGk2BDQAIwe:MaBs2c5LeXPdtp7O++9GTQ/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788848, "uuid": "8669d08c-db5a-4082-9d41-5915a1306e1b", "value": 2135040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788848, "uuid": "faf83cd1-9e3c-4270-aab4-06d4da6fc8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788848, "uuid": "facf9e93-6653-45ca-ad7c-61afefe8c6ab", "value": "PO 00292002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b90e6ce-a72a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675803615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803615, "uuid": "3615482f-fba5-467c-8509-097bd8bc5d36", "comment": "Malware payload", "value": "273473978e14fcb6c200ae6d748da05e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803615, "uuid": "2c21ccec-29c0-4484-9cc8-3e2e1fe8994e", "comment": "Malware payload", "value": "06d1c44415fdc995cfdfcb738651c3f0ea7509f0e9bc3210ea7ada578c60dfff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803615, "uuid": "8e458ac2-c961-4161-b693-b06345a362c1", "comment": "Malware payload", "value": "753256bee63851cee7f85732f0e6964a7b1b1a5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803615, "uuid": "5908dddf-aeff-438b-9d6f-e93334f89310", "comment": "Malware payload", "value": "bb24021946e7ae481fe0d8356b667ed8867a5315f65aaed06e1eb5f5c608ef68ad7a41dd2fd83732bad1eac148936c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803615, "uuid": "2539c6be-ed78-4c15-b553-1446675b68b6", "value": "T117B40107F6FC9432D9B4077019F602E31B367D905B79979B235E6C1A1CB2AB4A23076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803615, "uuid": "5ebd821c-a6e7-4998-b199-30dde6805571", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803615, "uuid": "983dc555-8431-43f5-bdbb-d16bd7db109a", "value": "12288:5Mrmy90sSVU9x6Vf0n/0jQ4f1Q7nS0hQWntPIsNr:fy5emSDQz7SEdtgsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675803615, "uuid": "ca6dcabe-3ce5-41bc-b309-7eca57f6140a", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675803615, "uuid": "147ef441-4ac8-466d-8000-e7bec122b01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803615, "uuid": "90758331-6341-43bb-8aec-478f4ee49a85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93194a2-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756930, "uuid": "c46e14a2-b1c6-4223-a800-94543f35c491", "comment": "Malware payload (SnakeKeylogger)", "value": "7ad288f8343b0cc5df4be5403a5a259c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756930, "uuid": "974ca00d-b782-456c-b3cb-4b8c95aa7ed3", "comment": "Malware payload (SnakeKeylogger)", "value": "0720dd196a11abe5f77b1499faeffa7f2533fff67026337c11558324db3fc4e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756930, "uuid": "c20f4106-049e-4126-a391-b459e70b7cf1", "comment": "Malware payload (SnakeKeylogger)", "value": "862b4028e1cfac9fd74532ad39ee0aadba87220a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756930, "uuid": "dd508c5d-921f-4bd0-8e90-f8b120615028", "comment": "Malware payload (SnakeKeylogger)", "value": "7190e2be539fd5343e863c489b838e6bba9753281874fd78b5e5712684e071ed854042c8aee976f29c9a3ec3e8d2d90d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756930, "uuid": "fe0813ac-ac6c-4ea5-b6a9-1c9323ee0252", "value": "T1A0F42350B159C9A0D8FED9F9B7B065E8037D93256423EA4C8DFC50CFDA35B899AA1303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756930, "uuid": "76ab41e6-ba8f-42f9-bacd-59227e60b098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756930, "uuid": "90631f49-41f6-47a2-9e57-153bc851476b", "value": "12288:BpkEPA7+RM0tt/47xfhE18/7sd/JroMhAX4jjgWZcMUrmXLwKGzQVcXnyXx6q16T:9A7+R/6Bg8TsdxFu4jVemc101NMS5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756930, "uuid": "52cb2956-f8c7-4961-a9ea-92b367d52e64", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756930, "uuid": "b6d712b3-babd-47a2-9180-9a1d9c0ce8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756930, "uuid": "0ceeddc4-84c1-4451-a3e9-ad8c5dadeec9", "value": "7ad288f8343b0cc5df4be5403a5a259c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff654a0f-a683-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732137, "uuid": "4ff2a570-26b1-45fb-a9f3-b8d6c6a26878", "comment": "Malware payload (Gafgyt)", "value": "73d56c9d0e8805ba441eb17fb0d98b77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732137, "uuid": "a18984b1-7425-4624-9624-5fb95dfc48de", "comment": "Malware payload (Gafgyt)", "value": "074249d8552b2b70b1c74851d8306caa791b0a2f10fbf9be473fcb90866c887b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732137, "uuid": "1923c228-406a-4322-9a1f-1df840c3fc9f", "comment": "Malware payload (Gafgyt)", "value": "1eeaa5ae90d8c8705a96278fdd9ea60e722ef4a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732137, "uuid": "389d5600-d4c9-4226-871a-f8cb85131c02", "comment": "Malware payload (Gafgyt)", "value": "6cfe95437036d96450e9f9cc029da6b426ecabd7037200deec8426c7615c32e599639faa165be912b709097d696e32e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732137, "uuid": "21cc8e53-aa6f-44fd-8347-c1db18fb260d", "value": "T186830802BB40CAB3C44305B6169F9B110A33F9FB1E57AE56F36D6CF09E15585B222F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732137, "uuid": "1ee2bd94-06bf-4782-b25e-595d99948d63", "value": "1536:tG0P74qU9kUM9HqjjoXow5jvl7MHdJfuu6YK0m55hYdddddVbdQl5+mYHc0r6jmy:tG0THU9kUM9HqjjoXtjvZM9duTd5hAb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732137, "uuid": "71a97be8-e977-4919-86c2-d6fa9b834f02", "value": 85756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732137, "uuid": "22697acb-7ae7-4384-a3ab-ef367a22e189", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732137, "uuid": "09948c17-f453-444f-bc17-dc4fbfa059d7", "value": "73d56c9d0e8805ba441eb17fb0d98b77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d902d52-a72d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675804934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804934, "uuid": "4eca838d-3f25-487c-b0db-6698d9e3250f", "comment": "Malware payload", "value": "1138843b65d264b81454ef437c51f921", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804934, "uuid": "0841b17c-5f1b-4367-a041-295698f53910", "comment": "Malware payload", "value": "07d5a39ca170a240d1b7670e0a378f329e53a5cbc767cbc1dfd698817012d345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804934, "uuid": "fa48a5a1-51f7-47df-9c77-2d8999229f67", "comment": "Malware payload", "value": "3de5434ff104c177cd56df959db3a6e5d53bbab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804934, "uuid": "ed5ae3f5-a8b5-4753-9be4-8c17cfce73c1", "comment": "Malware payload", "value": "2b3ac7d56e43fa0f5efc1239d744624eb678694d9b8e1adb8f753a16a0642481cb9778ac00f6eeb9a9c342d0f4d32fa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804934, "uuid": "b0772ed2-bdcd-447c-8a4a-f72cff239156", "value": "T1C3B40207E7ECC126E5B41B7119FA03D31A36BE505E39838B264E5C6D0E727A0B63176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804934, "uuid": "e5a78c81-f80b-4633-a9f9-8f86b59858bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804934, "uuid": "12379d73-8b17-4efe-8934-a6ed6e52ca38", "value": "12288:LMrQy907Rg4PiTeCGW1yC9GTHThte2eiBeDmag+BBJF2tKm:zySaZd1yCmu2BBsmaBxFav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675804934, "uuid": "75cf8a32-5a47-45f4-a311-19e0e7142268", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675804934, "uuid": "3afaf03b-7df1-4e1c-b9fe-b205bc99ba50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804934, "uuid": "bd4461ec-704b-40fe-8cbc-081b56d66663", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ecc4fd6-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675789715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789715, "uuid": "3bfba6ab-930e-41f1-9bf5-72247ebee816", "comment": "Malware payload (Formbook)", "value": "6df9213dd65135dd35c056943d5c8034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789715, "uuid": "cbffe626-88a2-4455-a4d9-ebe9325d16a9", "comment": "Malware payload (Formbook)", "value": "0802394968eda97506836e12c3deb32af74ad1ffcc86b22e4d654d10b865241c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789715, "uuid": "7e2ebf2a-ffa5-4420-b97e-61965960447c", "comment": "Malware payload (Formbook)", "value": "8a248204ed3dc2b22d4c72cf849d9f9e7cbe42cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789715, "uuid": "5ae012ca-2bb0-4486-beff-31c999529982", "comment": "Malware payload (Formbook)", "value": "ab322ae412d12365bd061a2579095fe84f95ef49997220ffd71d1650f76a42dc8108963186da7453bc455c98f67452ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789715, "uuid": "6b380793-5781-4a1c-a338-0c282a3200ad", "value": "T1F905231C3BFDDB21D41D1AF9A8701760837368267612F31E5E9770EA2DA6BF48A01B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789715, "uuid": "21c10016-c777-4081-a150-373d7cedd486", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789715, "uuid": "e49e99ff-e955-4c0b-9dbd-b688ade29cd7", "value": "12288:psawHRr/CB06KuLphq8KoPZOGmyyGIuWo4A5RGgMVSAx6dEeT4X3WRX0XFHbDDlG:psawxO5dhqT82AESAfE4X3QX8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789715, "uuid": "a06035a5-bd59-4bc6-8121-d3e62a4dba2b", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789715, "uuid": "8f171343-c4f2-4bfc-87da-747f240b907c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789715, "uuid": "cdf53fc1-75c8-4b58-8985-f95e5cb288cc", "value": "quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9719b400-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758591, "uuid": "0d540156-2eb4-4696-948a-287318ea81bd", "comment": "Malware payload (Gozi)", "value": "4b070868200e99165735d853c1c76fab", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758591, "uuid": "3ab2087b-50dd-4754-bed6-d6f7a3707d65", "comment": "Malware payload (Gozi)", "value": "080376c1c3c45989d1a51b669e95bf297b11eeb46e6f85c88c042a69665087ad", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758591, "uuid": "d8ebe443-8ed0-4c2e-94d4-dd3de9d6a70b", "comment": "Malware payload (Gozi)", "value": "222d14c244e7016c881aad939818486601a11d5b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758591, "uuid": "127ef621-6991-4a91-bd66-e626540068b7", "comment": "Malware payload (Gozi)", "value": "124d26b212dc7dd8988912e7d3baaa51391272791afa3f4de14b2335e6120706c162b626cc1cd1b37e08c27bb84d262b", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758591, "uuid": "b637c362-be5b-45cf-82f5-da6ce9eedbb2", "value": "T1ADA18EF2BBBF084989195676F24B73414CC6ACE0881749DBEDBE0171B06091B402E5E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758591, "uuid": "fed69407-7a28-4dcf-b6c6-ffcb10cb9e23", "value": "96:EZif5hckpKsfDLOSX+YgabaLTeFNi8c3DgXuE7k7NLxE7VROOIny:JBzKU9aLTr38XL7stCV4bny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758591, "uuid": "dd09d221-ee88-40c6-9627-8daf60f31b85", "value": 5085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758591, "uuid": "b5a118be-ad45-4a14-9e7b-baf9d7caca26", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758591, "uuid": "bcb9b256-8918-4441-ba1e-029503b9dc04", "value": "azienda_13.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07a4177-a67c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675728971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728971, "uuid": "467448d4-3f33-43e1-8adc-1d981657280a", "comment": "Malware payload (Smoke Loader)", "value": "afc1de57455861ff97bf20c27cfaba6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728971, "uuid": "fc29ce2a-e8f6-4fc2-b6c9-1e01814b82b3", "comment": "Malware payload (Smoke Loader)", "value": "086f98376b2a5d38f1215467ef57d7803523984b3ff745fc5438eea791da7985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728971, "uuid": "73fc2c2a-2d48-408d-a099-796ecafc3701", "comment": "Malware payload (Smoke Loader)", "value": "00bd80516cbf5a309b48730abc76eedd9c5c688f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728971, "uuid": "5048db9c-858e-4b52-8e2c-ea00e50c82ce", "comment": "Malware payload (Smoke Loader)", "value": "8b4f584be21697656c058ea539bd5023a740f0045ba1718172355236116308716d29119d8bc19093df8a8d66f38cd685", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728971, "uuid": "ab3fee58-4b9a-4419-a41b-6f50c741d739", "value": "T1AA544B4393E1BD40ED268B72DE1EC6E87A4EF9508E7D77652218EEAF10B2076D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728971, "uuid": "da6b9023-5f99-45bb-b53e-fdb72357a2c6", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728971, "uuid": "ccbe2d82-1354-4fb6-907d-42325efdf393", "value": "3072:Aqb6bEcjNLqKRmaVrAndcjlYJZnQ6jJC9GS6AEn11uQjiMTE5wY3ta5hN:1vcjNLqJaVYeCjJoEkE11uQj9EaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675728971, "uuid": "4d2a7ee8-960a-4789-be6f-f8dd24e56d86", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675728971, "uuid": "e86ce1f1-5ce0-4da2-96c5-77fc43728b93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728971, "uuid": "0f20511d-c5fc-4375-b260-437b73bb9de4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ae2bb4-a711-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675792926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792926, "uuid": "2b5d61a2-b085-4157-8238-90f58635b001", "comment": "Malware payload (RemcosRAT)", "value": "135ec341e42d29055bbb86a4260e0910", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792926, "uuid": "509fce60-1906-479f-8227-1a7be35de5e9", "comment": "Malware payload (RemcosRAT)", "value": "08bc96eb8f857b9e84b4536d96ddb85e8be8329f8572b8b91d4d645e79a84ccc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792926, "uuid": "1b822eac-fda5-4a30-a504-95b329a0bec6", "comment": "Malware payload (RemcosRAT)", "value": "c353879205d7873f77b013b8d84dae49894eab84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792926, "uuid": "36b4f27d-994f-4fb8-8fb2-5af2fc29a36d", "comment": "Malware payload (RemcosRAT)", "value": "e9e91b0f63299a3275a842f45d172e22c2317d383cd8f8376dc44fc21ecd355e267c4d4f7724e5a1820a84b29e4913bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792926, "uuid": "d13f17aa-caed-406b-b0e0-86c042c8de58", "value": "T19D85B3B095FB44E9E00FC9541ABCFCF512B672F3CDC60D65436CB6081E7AAA87E4950A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792926, "uuid": "3ef6ae57-fe5f-4f0f-9a18-3178e30b194e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792926, "uuid": "00e88c2d-c79b-4cf6-9870-c7069871f94e", "value": "12288:BiqoGE0dxbTSMZapERETEK8zukxEWBNES8ZLSYg4a1Gmk5VSiCPTQArp0c3exD3W:HDAL2v1JGIQsRed3x5DDinv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675792926, "uuid": "6ab855ce-9ae1-4c2f-a19b-24496bbb871d", "value": 1825280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675792926, "uuid": "77aa28e6-0a4a-4f71-a103-dcac497d0823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792926, "uuid": "0b396e13-7dc1-4fc4-b875-7ed3c1a66e8d", "value": "135ec341e42d29055bbb86a4260e0910", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3af1d14-a6b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675751337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751337, "uuid": "06643a0a-a5b7-4574-ae28-0daf6003c65e", "comment": "Malware payload (CoinMiner)", "value": "a3d4eda318b9be250155095c4f017d14", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751337, "uuid": "76d22d55-dac4-43b9-8c0f-f3f05b35b338", "comment": "Malware payload (CoinMiner)", "value": "08ef48c2102e62088e54eb0e6caaba827846a7a9d373972c5d1c2aeb925c18d3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751337, "uuid": "2410c7b9-cca4-4684-a579-923dcd20a548", "comment": "Malware payload (CoinMiner)", "value": "29f50912b7f76359c33fdc387c4f57ea79346309", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751337, "uuid": "a3885c2a-705f-4f6b-a35d-5d94e345e264", "comment": "Malware payload (CoinMiner)", "value": "d180c0e869dd8e8da0a81d32d15846efa5de539b34d6b932adb1861295ffd0db16e6ce4e7afe6ce0a6a2d55fd0c4b2da", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751337, "uuid": "6a761706-69f8-46c7-9bf0-04ca320501f2", "value": "T18814D0223A90C073C57B15705824EBA53BBEB5305678F55B7B9812BE5F306E0AB3634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751337, "uuid": "062efb53-1993-4a90-be91-db09d7920cef", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751337, "uuid": "9da18449-3b0f-480b-b82c-dfe4e00bf152", "value": "3072:7I+Odq/SLq0bLy+qWaXE5niT9eHuvvhK0P+mM29QcxPK2Vgi:7I+LcDLPqXTA8JZ+Ex8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675751337, "uuid": "46de4d2a-9664-4395-ac33-0b184f48e498", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675751337, "uuid": "f23d1789-c41a-4b71-a996-c9cf84a8d76c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751337, "uuid": "c1fbef95-318a-45ec-9389-bdf166d8f5c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3374f3-a6d5-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675766949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766949, "uuid": "40ae46c8-c3e4-4237-ac0c-113b8b967484", "comment": "Malware payload (SystemBC)", "value": "a4bc151814a8f8e9ba2a3160c23a3b32", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766949, "uuid": "215da00e-bb95-41c1-a168-fede596719fb", "comment": "Malware payload (SystemBC)", "value": "08fdb6c4bdfd23bbd7e438eb0644eaf2f204e6d1aeff3e6cbaf7513beba2e717", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766949, "uuid": "d56bcba6-5f43-4144-966c-c7f102fb8683", "comment": "Malware payload (SystemBC)", "value": "798b6e0d95948ddadfdf43ed3799d728c7d6a486", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766949, "uuid": "71cb2c57-1e07-4677-969b-45c279a1a1aa", "comment": "Malware payload (SystemBC)", "value": "ea8e31f7aaa8a47c1fa41d2e90d18b175ed367257d47a3cd3d8bbc876e7085bd0c0f1bcb0ee6e5b8e30d62ac1eb06541", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766949, "uuid": "37ee37bd-6d2c-479c-aaeb-8fa9e02dc379", "value": "T1C465F1A57207BDC7CCA86C70DCEBC2107670AFDA49C05D560F9EBA0B4A399B5870F562", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766949, "uuid": "920b5f77-0022-4bee-b716-f2954614b40f", "value": "a2833106949ae6e20c40ed0128f9df4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766949, "uuid": "b01ab2e9-eeea-428b-b74d-72b6c44383f0", "value": "24576:Cnn39uRRlsmAukvhe/z+KrsHc5OHo3iwdabM/gJur7di6opc4KTG165mlt11MzsM:Cn39ssmAukCz+4sHc4I3BEZsrM6o1KTh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675766949, "uuid": "87de5d9b-a63a-4eeb-972f-b77892d1e308", "value": 1522576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675766949, "uuid": "23c71280-eb78-41ee-b81f-6995bce76510", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766949, "uuid": "bce58965-1b0c-488f-9138-200106fa0c6e", "value": "SecuriteInfo.com.Trojan.GenericKD.65353582.8245.14486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a25ec06-a72e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675805330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805330, "uuid": "d20e1c27-18d0-4c8c-9584-82c76fefe15c", "comment": "Malware payload", "value": "a265b95a1a5a8f33bedd8173914aade2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805330, "uuid": "4b36c6f3-1106-46f0-91ca-6d884f35a7ae", "comment": "Malware payload", "value": "093bf45c5f81152aca1fcfb6ab103445ad960c08efec46fe8a017b459c5518d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805330, "uuid": "1ee61e9f-42ba-4532-93ae-e9d2c2b2daa3", "comment": "Malware payload", "value": "656b8e60075203c749774dfc705f7849108c55a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805330, "uuid": "179d3548-1b25-4838-bf02-f936cfcb8f85", "comment": "Malware payload", "value": "b32b4574048f7aca28b2a5f0928cb93f07ef9b60dcc544077a8ec2caf0c2b913363fe96be4738eff166d56d00accb033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805330, "uuid": "fddd1b25-d1a5-4230-848e-a3ae8c975653", "value": "T17DB40207F7FC8132E4F457701AF602C31636BA226E39865B278E6D6D1D722B0A631767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805330, "uuid": "70e4233f-3ade-4a9f-90ce-e3d8bde38f22", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805330, "uuid": "95e6a100-52a6-4074-ac36-d6dc7f61c1c0", "value": "12288:nMryy90HY0SYcJV4GQTHxhJs2eiBe1mxJQXPh7/9fJC:RyaSYsV4TG2BBymLQB9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675805330, "uuid": "984d5aa6-a264-4b0d-a98b-77e18190566b", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675805330, "uuid": "ab869bc7-d5d1-4a67-aa03-233239d5929b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805330, "uuid": "b20dbeb5-97ad-4d94-ab68-5ec2d49a841a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d283dbe0-a71d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675798204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798204, "uuid": "08e96c30-6ba2-4eae-890f-881fc5b98a98", "comment": "Malware payload (Amadey)", "value": "32295660110a572b6c3887b83897c36c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798204, "uuid": "8365083a-7108-46dd-8f39-d5bb6ff9fa11", "comment": "Malware payload (Amadey)", "value": "09a757e78cb32b84a1ddc3de2c8b824099b7c210f24e6261ce8f3fd3e54d9ade", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798204, "uuid": "73fcc6bd-bb55-4cb3-82e8-c959dac5b2e4", "comment": "Malware payload (Amadey)", "value": "34fe6af847a8cef36d64929df87d46187d2190de", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798204, "uuid": "cced2e56-6eb7-4ca6-81a4-792a2d32d6cb", "comment": "Malware payload (Amadey)", "value": "e2a07affdb85ea41b03599eb0bde54556ba9d9732764012d36ca819149e568b5b931f69a628086d3fe7edf1b8727c201", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798204, "uuid": "4e12d710-fe9e-4908-a9b6-4837ae16d85c", "value": "T18CB4020BEAE88026E8B557B00CFB43D31636BD916A784397274FAC5A1C72670B57173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798204, "uuid": "89ea505c-1dc0-45f7-a682-8ff8894bff73", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798204, "uuid": "774e136a-dcf7-4ddf-97a3-0bf99f3229c5", "value": "12288:uMruy90zfobgGVtIbOY5VtfAEI604DZdB:8yuobgiWbOctfAELDZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675798204, "uuid": "ff892740-e009-4378-81c5-8a21ec906344", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675798204, "uuid": "133cd62b-b99a-485f-8d1f-2ae67c17753b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798204, "uuid": "61679a35-5625-4b40-a8f3-277ce275fc41", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fc933b-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675758586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758586, "uuid": "e65419a1-9e32-4a6b-bbb1-bc66252129fc", "comment": "Malware payload (Loki)", "value": "99ab551c6192ceb58cea0bac7f4ac455", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758586, "uuid": "e777e06d-b2cd-46b3-862c-3530728156a5", "comment": "Malware payload (Loki)", "value": "09e8530ee34bbf8a56ac3d8e688a5c8d79d28ada9eb9a5253dd57416322011ce", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758586, "uuid": "74fca035-fd33-4d1c-bbff-cdfdbaa9cd69", "comment": "Malware payload (Loki)", "value": "856f1b0f87aec5414c0636f07a9d67870b9e4652", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758586, "uuid": "28540741-eb53-4778-b359-283c1fe448bd", "comment": "Malware payload (Loki)", "value": "c172b21f6cc45b0b57b4ab2f1a4dd70af0d1cf2615ae4c2c2190f7a1019771b5669b030bafd4965918b03d54af1edfee", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758586, "uuid": "11db606e-52e3-4e94-be2a-633fadd21992", "value": "T19E431A2EE74F0955DF55A77B034A4E4A09FCB22DB38140B139AC973437ADC2E4A6297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758586, "uuid": "d1b1fcdb-e4d2-49f8-990f-ed466b661c27", "value": "1536:8t3kvJ+fjdgWIHvzT8vm289cG5XcIppYwEB6O14DqNcnfJ+QaBK3z:w3kvJ+Z4rT8vm2lGSgpYwEgO1sqNcnfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758586, "uuid": "408322bd-1ddc-4c08-a43e-1931c3278393", "value": 59860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758586, "uuid": "455ef4c5-3b97-4e84-b689-0043601da639", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758586, "uuid": "61c7f65c-1184-4b55-ba6c-f5f1476fd7a2", "value": "IN-001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dfd00aa-a689-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675734336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734336, "uuid": "4794dc0c-36e3-4f79-ab43-f44a4b6a225f", "comment": "Malware payload (DCRat)", "value": "c5bcc2792bf807e8ce538dc818d59cbd", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734336, "uuid": "c8a4ecf2-2369-4ae8-a098-40a3395f7e34", "comment": "Malware payload (DCRat)", "value": "0a036a013baccd70fa2e95cb8529d599dc5c2b33bd20d2ce1b5788a24332de63", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734336, "uuid": "d8f92560-fb9b-4394-8349-bbdda78ab8a5", "comment": "Malware payload (DCRat)", "value": "2fa5c93f7a59a5a3276985434061458a07009975", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734336, "uuid": "10e1f510-ea87-45e4-a54c-f56807669cb1", "comment": "Malware payload (DCRat)", "value": "cae8ccdb045d799d485f28190bf637be44f24fad6b79a7815dc4c96b2c4cfa0f556eaa1f41aac6edd793fc9cbeb7d522", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734336, "uuid": "dbfcac9c-21ad-4034-894c-bdd3b72094e2", "value": "T1BD455A027E84CE11F0191233C6EF454887B499516AB6E32B7DBA376E65133A73C0DADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734336, "uuid": "f1e4eaf4-ce49-4545-995f-c46442c499d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734336, "uuid": "01a89f04-b33a-4575-b47e-9ef4b091198c", "value": "24576:Lm2evs/11n0kZj5WX7fj8XlllzqVaoF89qLSSUUaxBGHd+ZcSi:LvKejZNrn8EoWwLSSSECP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675734336, "uuid": "f528de47-0196-4416-a17d-5d68fcea0089", "value": 1264128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675734336, "uuid": "f08ca508-b5b9-48b6-b14a-72918b83f0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734336, "uuid": "7927e7d0-45af-46d9-9280-caf8887c6a1f", "value": "c5bcc2792bf807e8ce538dc818d59cbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4a66e5-a707-11ed-88f6-42010a9c006e", "comment": "Malware payload (Adware.DownloadMR)", "timestamp": 1675788476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788476, "uuid": "166bff15-a3c3-4d09-9a5c-9f362d30a45c", "comment": "Malware payload (Adware.DownloadMR)", "value": "5ee4572308895a3322f74160399e0e63", "object_relation": "md5", "Tag": [ { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788476, "uuid": "0d3956f1-94c2-4a5a-a46c-f0834822f645", "comment": "Malware payload (Adware.DownloadMR)", "value": "0a1fe129f4d95b580c7533d0d7b0b787174b41d6dacf222956aba9586232445e", "object_relation": "sha256", "Tag": [ { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788476, "uuid": "3d4f844a-3c64-48f0-bf62-ba519e9779ca", "comment": "Malware payload (Adware.DownloadMR)", "value": "0e511a972055cc02c278b30b874a0dbb032f0cb1", "object_relation": "sha1", "Tag": [ { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788476, "uuid": "5d416b1a-67fb-423d-8b18-8262b95f35ce", "comment": "Malware payload (Adware.DownloadMR)", "value": "7c757564e0f6be42a5a8ea3a36c9754ba5455aad88cde98079520b407d6402d095d855ae8cca7c52236ed4e688e2a9ef", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.DownloadMR", "colour": "#005C2D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788476, "uuid": "6ced5d93-b593-4806-80d9-f0030f57e277", "value": "T1E204E042A55001C1ED4AC47313D7D1CA5D2BA8EBDA9A7EE760B8803728A162C37F4DFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788476, "uuid": "97374442-a701-4602-9b69-983040f2f797", "value": "8cb024602ea2f1b923f7ee0e7d9b3bab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788476, "uuid": "9f3afb7e-56da-417f-8ce5-eb683c6a3112", "value": "3072:eXhaoP7Ddc4kJ5sXegDChJo8p8+EOjBPD3hSEE9TCcGZflRJueUhVQqWKBGoutb1:pf5gtCh2dLOjBT8E2fG1l3jcwKMoSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788476, "uuid": "e4668be9-3bf3-40d8-a1ee-cf55bf7cb0c8", "value": 176952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788476, "uuid": "f969f692-09d9-49f8-b112-3110fbedb83f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788476, "uuid": "61be3a2a-d3c9-45dc-98ba-0499d2042586", "value": "Google Chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37772b2-a6ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675749619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675749619, "uuid": "a728b496-0c82-4c1a-aca5-e5f6894ac326", "comment": "Malware payload (GCleaner)", "value": "8eae49116713962d05dbbc7e0f6c0b90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675749619, "uuid": "25490d4f-d644-4808-9893-0eed39a1edab", "comment": "Malware payload (GCleaner)", "value": "0a80581f5f675c1a8020b804a47abd82bd389b1bcad77677979599aa4eb8f1eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675749619, "uuid": "35809386-8cb4-4ea6-b601-3e95e2574139", "comment": "Malware payload (GCleaner)", "value": "e1d5c627918857e5459638a97c3d73791ddfe388", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675749619, "uuid": "ae76fe90-7811-4c15-a8b3-340e20567038", "comment": "Malware payload (GCleaner)", "value": "eccc43b1bb862ce2e9a1afeb71761c4531594a04a26ea0a2a58fb9c65b72cf11187c00dbf6ad12505ece59fa81a28e8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675749619, "uuid": "cd430e03-d952-4b52-9d41-c5e7d4c9fdee", "value": "T10CC5E00A1D94D097D1718F70D9C76DFA9C12EE6FE8BA409723047FFAB671605E80A938", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675749619, "uuid": "3c6aeb57-e9d8-4a38-90ba-c05b22b2cf36", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675749619, "uuid": "dc4e10d6-780b-4b0d-8a34-5f54113538da", "value": "49152:wDCvEUEXjP2wjGVsyvL2pwNrGEZCNeMMk1/WfP1n62LCgv2MR:+gEbjP2eGVZUw8EaeMMcW16mv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675749619, "uuid": "3d5fc860-332a-4153-b500-e070b74b448d", "value": 2708907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675749619, "uuid": "830d1106-e3a0-444a-a217-b64731ff1ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675749619, "uuid": "c9947c0e-619b-4b05-878c-3fb0bf6870fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4480f9-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675756985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756985, "uuid": "a71c05cd-52f8-4af3-91ae-ff560be523c3", "comment": "Malware payload (Mirai)", "value": "4152dc14917435b8382f35f6e236ad49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756985, "uuid": "5a0d0f37-43d0-4bee-9bf5-5f618571b076", "comment": "Malware payload (Mirai)", "value": "0b0fce9c160b1965ddf30f726ac58b5cb3e04f91c2634fbf9cf08c7e017bd9a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756985, "uuid": "8dbefb44-9807-4f66-a75e-9fa858d0e3ba", "comment": "Malware payload (Mirai)", "value": "8f4f95104e161cbf019c7158e5b32ec11813e35f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756985, "uuid": "761868fa-3b68-4892-845d-4d40f0ee7f6a", "comment": "Malware payload (Mirai)", "value": "93f4730b951be58462c4f6913035db11f5e79f88ff2020541ad1f1ce91fb6bb3dfdea3af4641507cb28c341c756d7f97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756985, "uuid": "6de12348-c1f7-4c8d-abb6-58b826fc66f1", "value": "T19ED3C72ABE11ABBFE16C863103FB6F20C39531E62E919341F16CD6581E7125D2D5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756985, "uuid": "d642e864-c170-41cb-b7d0-6a042519a1af", "value": "3072:JTcqSmxQXRB+2YK9Z9zINu5Xt3QjDA6FCtBLvC9UBY9nHVhmvjeq+TstG2j:ulLC0YZVhmvjeq+TstG2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756985, "uuid": "3e826913-33cf-4727-a36b-1fc941f3e282", "value": 135221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756985, "uuid": "6836b504-44cb-43a2-9f21-a114be48ec74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756985, "uuid": "7812b1e7-9733-400c-a3b7-f8b520cfc48e", "value": "4152dc14917435b8382f35f6e236ad49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e414eff-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675783272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783272, "uuid": "d893a89c-e785-492e-937a-16c1d5093b3f", "comment": "Malware payload (AgentTesla)", "value": "78d940c8e7c89ccc29c9e635b81de17b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783272, "uuid": "fc09e48d-c8c1-4f89-b617-a9da7095e492", "comment": "Malware payload (AgentTesla)", "value": "0b925f368ddf2753572f29bdce29e1caa3fb3f34461d18095ea61ee35b7491dc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783272, "uuid": "2ff5b81b-a4a3-459a-a042-119de801caef", "comment": "Malware payload (AgentTesla)", "value": "6d66e8d7d01d15c4a0b591fd129d8b032f32d5fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783272, "uuid": "92d76761-7a8e-48e6-8a3c-7ca0be33a1fc", "comment": "Malware payload (AgentTesla)", "value": "0c0f043e58987ab75c75242aefdc1f4b28b473be94f16e0565719ab22915f6160999f6eba5db95cd1bad10a1643e3832", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783272, "uuid": "b7348771-7cfb-42f6-ae1d-9e91a8bc0104", "value": "T185F43354BDDFD777BB230122541A20B5B86EC2D7B66871C7E60FBA531A84CA23C45C2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783272, "uuid": "40b5c457-83f7-42f7-b52d-8b45c4ad1a74", "value": "12288:xkXAI8HrzLPy89Q48zY0azm+rz5dc8nKZty0/4Rwpt4Gu+kXISu9:mXuz7fDzvrz/Wb/7pt47+IHu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783272, "uuid": "8d2ce027-24ba-4ec3-adfd-d5ba41cdb5e1", "value": 728441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783272, "uuid": "12e52149-f69c-42dc-b2e0-3ea7444e0f5a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783272, "uuid": "bfe68134-2456-4866-a4c1-064bb6da5e34", "value": "PO-7654321_1.BZ2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1453ee84-a6e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675772545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772545, "uuid": "149d17a4-ade7-4ccb-adca-9ab0f2177e1b", "comment": "Malware payload (AgentTesla)", "value": "09480cdcc91a7e730e809867d57a121c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772545, "uuid": "485bcb75-b056-4c05-8851-9d65bd55b88d", "comment": "Malware payload (AgentTesla)", "value": "0bdcd6ec4a60eb1485eaccc7378d394e69f237be4099167d1b199d6bf7226a91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772545, "uuid": "1455f798-0ede-48ce-8d5f-f4f5b153546b", "comment": "Malware payload (AgentTesla)", "value": "56376dac8693e454cb0f7c5342f6df3e5acccdd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772545, "uuid": "e1ef3c49-bff1-45ce-8894-e3048c3f1353", "comment": "Malware payload (AgentTesla)", "value": "b9925281c7dbf126271c3703b18ecd836811c15d32cf287870df746d925a5171c31a3cfff7f9ae5a7d8f6ff4f1db4073", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772545, "uuid": "bf3ae50d-77b3-4c9b-8487-9a86d7369c81", "value": "T15805231E2BF99B12C56947B9A4F01510477AA421B212E37E6FD2B0EF2C76FB04641BD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772545, "uuid": "afcdf690-f747-4ce0-a18e-720d47d56f04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772545, "uuid": "0c872f8f-e5a2-4b4b-84b8-239d4557c910", "value": "12288:JrSxXEbm08aA9VqdJHZm4BL+/Zwcb4SBB6kXMXVXbawHRr/CB06KuLpObDDlG:J2x4WVqV+Tb4YMkKawxO5dOZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772545, "uuid": "3a33805c-23f9-4ef5-936d-eac0d8e9a2bd", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772545, "uuid": "824bcab5-4849-46f8-82ef-ef9b0325bd25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772545, "uuid": "b59fc65c-d1fc-4aac-9467-d4185a9cd8eb", "value": "RE RFQ AQQ - NUEVO PEDIDO,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5295be4e-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732706, "uuid": "def4936c-2fcb-4097-891f-61c175f7bc5c", "comment": "Malware payload (Gafgyt)", "value": "ef245f5ba6f0b774c7298fc01ebedf75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732706, "uuid": "dde13ea4-55dc-4f31-9cea-783e114a404f", "comment": "Malware payload (Gafgyt)", "value": "0bec75dbbf474d22c27ceba3f1afdf150023b1ae54c7e19e476baccba98fc6fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732706, "uuid": "260d25b7-a9b3-4779-bd82-32a6408b8ed4", "comment": "Malware payload (Gafgyt)", "value": "c41240e5d27f7ae81c9ea600f0cfd8e871c79f9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732706, "uuid": "86b5d554-a860-493c-aff5-8cbb32615048", "comment": "Malware payload (Gafgyt)", "value": "4ff5081fed319da04b9423ff52dadf3fa4a6032b680f558c663381d911e7ea09fe8f655609c590e4c70da083af9ce7a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732706, "uuid": "c32086b8-4a1c-42ae-baa9-1f8921732496", "value": "T1E2933A4785719EB3C042AAB92AFB99740713A8624B0B1F64612DABF4070FECDFC4D765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732706, "uuid": "0c04b347-06c4-44c1-bf83-76d4f71ce3b8", "value": "1536:fd0LyAb4TLU59a8dEonRBnpYuVqMHmoDsN5SYEcB:fOys4TLUvrhYuVfm0sN4YEcB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732706, "uuid": "f0f4aeb7-7594-4a42-b0af-26b6631daca7", "value": 97344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732706, "uuid": "25649633-b49a-4ec7-a1a0-a746f210a6ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732706, "uuid": "7bd286fb-c945-4eba-a951-48792fde6357", "value": "ef245f5ba6f0b774c7298fc01ebedf75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6eb54d-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675788158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788158, "uuid": "9797e688-9b99-4c75-b51f-9c9bffb93dd8", "comment": "Malware payload (Amadey)", "value": "bfc3b8c71698b8ac06cb521ee95099df", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788158, "uuid": "5e14d93a-f278-41d6-a2c2-3a2e2029008f", "comment": "Malware payload (Amadey)", "value": "0c2e015c1f2dd3c0b61a247d472b6e456188d7151935ac6d548f61bb3c8128b5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788158, "uuid": "e0708c5c-07fe-4298-820b-c80bf3f41089", "comment": "Malware payload (Amadey)", "value": "38c2e97fc3d5e608efa66daeeea51ca59e2ecf40", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788158, "uuid": "c1e517c3-a08b-47a2-aa08-866207a2d289", "comment": "Malware payload (Amadey)", "value": "bb9daf6ef3264902e39d5c33190d60ba311bcca80a840816096c998523abbe05676317ca34706a5b9b2150425883b8c5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788158, "uuid": "59fe1e95-2b6b-4f6d-8f53-009634f99f60", "value": "T1D3B40207F6ED8163F8B417705AF503C30A367E916778826B674E6C5E08B22A4F23576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788158, "uuid": "9013210f-0f13-4a31-886d-3d59f30ada19", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788158, "uuid": "af499471-59b2-4758-a8d6-168558d8c6f3", "value": "12288:oMrMy90qtrN6WM6s4uTVTkdhO8e1FyDDqVzzc:UytN6WM8uSdhBeTouzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788158, "uuid": "91666234-041c-4ccc-8e56-2636b26ccd42", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788158, "uuid": "701b5181-8c65-48d6-a57f-6c54337292c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788158, "uuid": "42c31ce1-f2f9-4bbd-9f67-47bf2fdd4d87", "value": "0c2e015c1f2dd3c0b61a247d472b6e456188d7151935ac6d548f61bb3c8128b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154b2deb-a739-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675809913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809913, "uuid": "4ae96d05-3e90-4b78-a796-28df134427b4", "comment": "Malware payload", "value": "39cd853d3cbbe48e14409b67f130ec4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809913, "uuid": "f2f19c02-5bda-4570-91de-9fd1f9e3b80e", "comment": "Malware payload", "value": "0c4bcf9f156031e4aff123c06411283951d4a6e41ee4c4a4cb5603cf312d2c1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809913, "uuid": "4d770393-1307-4105-a6c2-2cd8a1408568", "comment": "Malware payload", "value": "5ab6abdb8771a98fae0a3abb64cccfe1f7963e62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809913, "uuid": "2e0115bc-1380-48b7-8414-c4e44cb5f4f2", "comment": "Malware payload", "value": "76e3e8cad8713a3ac483659744d6b1338aedfbadd599e4b5f93f22c1d53d4b0c56171e85f860d219cad13396803a1a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809913, "uuid": "d3181ee0-154f-4260-b5a9-79768a6a892b", "value": "T11314C0223690D472C17B64335C60EB65EBBEB930F53589577BA807BA4F302E1673A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809913, "uuid": "711ca040-104d-4183-896e-18479e703a42", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809913, "uuid": "9e12597d-5b7a-424b-9991-1cfd67567d5b", "value": "3072:pdeOdZO1v2AvaLabGWNP5bUoVYQ9A8L+QzxqB:pdeocraLqGYRhr9yQzxqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675809913, "uuid": "d63696b3-483d-49e1-8f5c-0ed50ff69953", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675809913, "uuid": "27707ee5-f65d-4347-b0be-fc0f47c08837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809913, "uuid": "bf852dc7-ffd7-46e6-bbf9-4312e09d5dd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ecba20-a696-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675740005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740005, "uuid": "fed3185a-9d6a-44b1-8746-e9a510d038ac", "comment": "Malware payload (AveMariaRAT)", "value": "a4e060ebd5bb75b17e61e711c97b8ec0", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740005, "uuid": "a226c153-a79a-4503-9f9b-1d250e9d9565", "comment": "Malware payload (AveMariaRAT)", "value": "0c904d84b3edcea793d00182f0a98d0d39ece6920fa6d685b1dbf26d9cce054e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740005, "uuid": "b0ff515b-138e-43ce-b06e-f9b9cd7a04dc", "comment": "Malware payload (AveMariaRAT)", "value": "1b4ae0ef24fb82fdda481a556ee48b158b7232aa", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740005, "uuid": "441d9169-9adc-4522-9445-ce65ac1f635d", "comment": "Malware payload (AveMariaRAT)", "value": "f653715e9611d2ee821ef90a24de1a6e86cabbff49184df64800ef8d395a9ff2fea54f98cd3a1e03657a1b86f3310e92", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740005, "uuid": "250d5d42-7247-4891-81f6-c03da2ad49a8", "value": "T1F855D60277991967F4E299F142FE602B7035DFB2930898D357A83DC9A7392F5BC32606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740005, "uuid": "440e1669-6ade-43f1-a010-f51f6d4bc9d7", "value": "998288a19e8050ed5a88195fc11cf00c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740005, "uuid": "39c11974-175c-4f53-8565-86e535839578", "value": "12288:GHs3k6pbTKiiEuuSl34BMtWTUagOOM7PUEUz6EZKuo0HHCCCBjsBkp:es3k6pbThoW4agOOM7UP2rj6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675740005, "uuid": "dd57c622-7c81-48e2-b20a-2cbf3425d0d0", "value": 1356800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675740005, "uuid": "0f310038-2c95-4ef2-a107-d55ae37ed5d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740005, "uuid": "9d171471-ee53-4ea0-b0db-f284e671f5f7", "value": "Invoice # W0005588 deposit receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28bcc8c-a6e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675774528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774528, "uuid": "e393ea71-2492-46d5-9da3-76d7e4bd6a6f", "comment": "Malware payload (AgentTesla)", "value": "4685f215690c381fb8351c23abc3fe74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774528, "uuid": "21fd00fa-60d8-4674-ac41-097af7f52bc7", "comment": "Malware payload (AgentTesla)", "value": "0ca8dc2c091cdfb307d9d67268fbff66f248d8e572c158b583d0169bc15494f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774528, "uuid": "5f11a248-2486-4833-aaf3-5fa4a048bc55", "comment": "Malware payload (AgentTesla)", "value": "b4001208f28d615cf812d243db86dd3bd0a207df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774528, "uuid": "85d039a2-1f65-4b2f-91b8-8f5e6ea3f7d1", "comment": "Malware payload (AgentTesla)", "value": "060a8f1b9e0618b93f5b50761a6ec811bcb4c97a3188be8ccaf820dbff0d726ef8fd37ac46765b7642269a6499a90ce3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774528, "uuid": "5c8e4b5d-dbc2-4aa1-b502-ec007dd09193", "value": "T12D135C5AE38F02648F411277231A4E899ABDB73EB35045B1786C933433EDC3E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774528, "uuid": "cfd56167-6cee-40a6-9dcc-ee05051b898c", "value": "768:MFx0XaIsnPRIa4fwJMZ3bA6JHyIplIGZHwg3purp9X3Z1deY28BDGVu/wR7D:Mf0Xvx3EMZLJJErp9X3Z1Av8BDGVkwFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675774528, "uuid": "f338e607-1fa6-41e3-84d4-2b48d4d4d9cd", "value": 43781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675774528, "uuid": "eb836564-d122-46b3-922f-396b35e2dfbe", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774528, "uuid": "567f6014-caaf-4039-adf3-418d90bf6400", "value": "20230206-873283.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d9a6b7-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756916, "uuid": "95de4210-cdd9-4f3a-a4d8-b7b791ed6360", "comment": "Malware payload (SnakeKeylogger)", "value": "89929d80f67f6a1877528eec7206f78e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756916, "uuid": "f82332b3-c874-4d39-a470-e29fd95c1e0e", "comment": "Malware payload (SnakeKeylogger)", "value": "0cba5aa5d28e18f2fbdbe749950d645bac7037fdc138c3b75ee06120ced809ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756916, "uuid": "accf0e82-ad50-4df7-ad1a-533a38a27624", "comment": "Malware payload (SnakeKeylogger)", "value": "200b1e174de02c330fd086b0f5c997a2f71bfa72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756916, "uuid": "639e5a20-e822-48e8-9535-efcf38f2c3f0", "comment": "Malware payload (SnakeKeylogger)", "value": "c5b9355a8d144b9408cc1ff143f3732d34e318cd2003a89ea07efceb92eae8c8af36b076e7afb2279b90ddf9bc76c364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756916, "uuid": "170412ea-5782-487f-8e59-f8f3c094bd2d", "value": "T16D961B3D98AE523B5AB4D766CBE4541BF4D0E9233603AC3EE0D7178246169437EC623E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756916, "uuid": "917de80e-8d73-4d8f-986b-64a6ebd58c1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756916, "uuid": "646f3928-d1b8-460e-848d-e849c8eff58e", "value": "6144:+pb6ghqHmoKSBZaJw05QtnbqlAnQ291YP:HHmoKSfaJw0qtnbqlAN7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756916, "uuid": "ee03d677-fbde-4ede-832e-1dd8cd8ea199", "value": 9346048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756916, "uuid": "e28b292c-1e4c-4f61-a2d9-ec9d60752df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756916, "uuid": "ae4467c5-9766-445e-a87a-2cdc97a3ef24", "value": "6543457654345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89abe7b0-a733-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675807531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807531, "uuid": "7707b175-23fe-40b1-b5b3-fee3459d7767", "comment": "Malware payload", "value": "bf958e7e5b9bcaee668ef2f91d53bcfc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807531, "uuid": "bf8c07a1-03b3-4150-bb7a-225db19a2ec7", "comment": "Malware payload", "value": "0d349948758ce8da0c83fe51c40637da3957180862fbb8314a5cf280540f8f87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807531, "uuid": "b5e928e2-6511-4cd5-93a6-907115a9cfa4", "comment": "Malware payload", "value": "a33d89a35d153ff5d16f9bea851ad4b435416b19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807531, "uuid": "3ea3e822-4af2-4bec-a527-ef90c3e38fb9", "comment": "Malware payload", "value": "a453172da062f9014e2a169d82158a562c687e8c9de754b81b40909e490d9ac1c1d13dc5829b72c476e41552c0db9604", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807531, "uuid": "299c3ebe-8c00-44e3-8603-9f4061551420", "value": "T14914D02535D0C073C4BA50305868EBA46BBEB870867CC917F76817BE5F702F1667A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807531, "uuid": "30b3cbe4-92d1-4795-898f-e002d990c506", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807531, "uuid": "14c9c49c-a041-4aa6-8690-f35ba30454b9", "value": "3072:9W9OJcVFJxSL9ihqWPx5DKNrXg9d0qZzgIl33j/oxbpuV6g:9W9XZSLqqikLed8Il3DgpuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675807531, "uuid": "aab1ffe6-0dc2-4dd3-a582-1bf459ee9db0", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675807531, "uuid": "1265e046-c7df-462e-8fe5-6eb7a6f3543b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807531, "uuid": "a7478bc9-c35c-46b4-9389-7570e02fb7d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4a0c2e-a693-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675738900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738900, "uuid": "b5e37743-d280-4eb1-84e5-a9921e12c8a9", "comment": "Malware payload (RedLineStealer)", "value": "7ed61df0773d87197bbe21e0f6d8e5ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738900, "uuid": "6f910b79-d0c5-4269-b838-9a2a61082f16", "comment": "Malware payload (RedLineStealer)", "value": "0d508393e05d4d39c96b797330f892cedaa7b563a32e36ff6bcd6bc2d6423421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738900, "uuid": "8f0c51f5-b959-4ec2-b933-43331fa5b2b4", "comment": "Malware payload (RedLineStealer)", "value": "f03e5f08c58922c2f1141b1c83f71334fd158735", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738900, "uuid": "a04617b5-8283-46a3-89cd-e600c09ab3e0", "comment": "Malware payload (RedLineStealer)", "value": "b6f5e1c4eca8b2e9f4ab2d0d2103e2df7464eb371af4dc222b6b135180b2d09ad6d16ea2d07c99c7a76b9ba4f47a3d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738900, "uuid": "b44efe22-56bb-463b-8b4b-199cf7ac5a1f", "value": "T11C848E83B3E1BD40E92A8B72DE1EC2E87A5DF5908E7D37653218AE9F11B1172D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738900, "uuid": "ced3aa6c-43b4-464c-941e-4032fb76c336", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738900, "uuid": "9439b1bf-d697-45ed-8640-91e5364a5e06", "value": "6144:ASrL490uvdT4khgpHhzRTNuhtTIb/+SAR3Yu/WZqTuQj9+dJa:xrM2u1TxgxxNNuvGWSGYu/WZqTljOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675738900, "uuid": "fa56f0b2-451f-423f-a72d-9cd4c0fa5275", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675738900, "uuid": "84064e9c-6aac-49ee-aa6d-322aa45699c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738900, "uuid": "a9eee83a-4bcd-4cab-9111-e0ab8df7666a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4d940d-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675796157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796157, "uuid": "16395e1b-3ece-4da0-8d6e-3986e3218f9b", "comment": "Malware payload (Formbook)", "value": "3cf917f426d87cf2e6cefc4f2bb2531e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796157, "uuid": "37eac0d8-0661-4be3-a629-581a59648acc", "comment": "Malware payload (Formbook)", "value": "0d8e7bb7da2c64a94fc9b21f1a39079b7ac761ff4797c7091eaac4dd9b07473b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796157, "uuid": "515620ad-d584-49ea-8634-2c8b75edf0af", "comment": "Malware payload (Formbook)", "value": "59defc0c15cffc943833d8ddc7444ca07f95fe8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796157, "uuid": "af0f3f90-96a0-48c3-a4f6-b06be84e3175", "comment": "Malware payload (Formbook)", "value": "dbae9b81e7638a825a23ff425baadea273712ed0c7af3c1992e816fe0022aa46280429099c361816bf5666f70b182e1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796157, "uuid": "4b3a1d18-6a3f-4005-9923-03b28f5d97c0", "value": "T1FE0502993210B0EEC897CD32D9A82D646B71717BA30BD61B951325ECDE0EA96CF051F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796157, "uuid": "1f3babdb-b6b1-43a3-a1aa-c86ee4a2ef4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796157, "uuid": "585a5461-91e6-4c79-bb7a-c68bd8e8e1b6", "value": "24576:+9A3BrxN5IC54TWM2aE7+biE3jyWzrGURl4bltd/:BRtgiME7+bLjpGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796157, "uuid": "a3086571-4511-4374-80a7-1a650162c11e", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796157, "uuid": "72daae8d-f494-4e32-8d8b-38dd97bbcd04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796157, "uuid": "bfcdac08-c12e-4964-829e-0ce9d1d7d5bd", "value": "3cf917f426d87cf2e6cefc4f2bb2531e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32571a7b-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758422, "uuid": "95448903-3758-46a9-b2d9-acff65db7fa1", "comment": "Malware payload (Gozi)", "value": "3247f4e6865474d3e72db0e35b1398d7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758422, "uuid": "91c8209d-923e-4dbc-9752-7bfba190b5c1", "comment": "Malware payload (Gozi)", "value": "0e34b4a7b619cef883e796c0665810814f9455e166cc7b15111b431933978f12", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758422, "uuid": "dd6a264e-7338-42c4-b448-0a531d5427c0", "comment": "Malware payload (Gozi)", "value": "f9d7dbeec832253e17fd487d489b7ddd17cf3a96", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758422, "uuid": "0fd1b6bd-0e3c-41f0-93e1-7b521ae4fbbb", "comment": "Malware payload (Gozi)", "value": "cdb53b8e3306d25e6be0e7d7d29d07d5852b90442418212fbbe48174173e626da6fd256b8a360591611c29c5c6064afb", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758422, "uuid": "137786de-c014-4553-bcbd-59bc16cbd725", "value": "T17FE17E8EDDDB541BAB8091EFF2372C11FB64557AD9297204B1E1E70E6B66B27014121C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758422, "uuid": "ec9e88ae-4afd-4a1a-bbec-97ba110da4e3", "value": "192:IRHBWU77rIKdn863jMM0OD9+VVF4vx4kuO:IRL7EOM7/F4XuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758422, "uuid": "c3492d28-94a3-41d2-bc03-175182e0b841", "value": 7045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758422, "uuid": "e32fb16d-0043-4631-9078-9e51e1f24b42", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758422, "uuid": "fd97eeac-fabf-4387-87ba-f74b40170640", "value": "azienda_28.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3f1bcb-a6bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675756534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756534, "uuid": "39c59692-13f3-42eb-bb48-867fef91f4d7", "comment": "Malware payload (RedLineStealer)", "value": "78fefbefb0d648c24aefb72e6435e7ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756534, "uuid": "9e4d6369-9273-4c9e-bc9d-0e8b7fd89e90", "comment": "Malware payload (RedLineStealer)", "value": "0e5a2fe272129c522049bdd7a506d754826d8342ea7cfe1c1a3c23c81a2d17e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756534, "uuid": "43500783-5f16-4547-b363-dbdf6af262b6", "comment": "Malware payload (RedLineStealer)", "value": "9abfdeee785eb7458ab3e7384738f4c52ff141ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756534, "uuid": "67aabb5d-04bf-4a41-9c15-f6ded29e0e9a", "comment": "Malware payload (RedLineStealer)", "value": "9099dfe3acb05658ddcc2f631530207268e17479e5870f9b9b9a01ce93ddc74f36d7a49a6266be167e30cfa434ee0023", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756534, "uuid": "de9ffc03-59dc-476c-a138-1838a17a7cf7", "value": "T17764F1233550C432D6AB0474A970DAA56BBABC325579D90B77E837BD5F306C0EA3630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756534, "uuid": "8346940d-4bda-489a-abed-e95b63eee378", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756534, "uuid": "c1825fcc-0975-4732-9617-d9666408bbe4", "value": "6144:yjSTPLmXcqXTGRzjTM0xqla/KGNIr1HjZ7t4tuB:yjSTPSXFCUkDylct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756534, "uuid": "9516a256-0c28-444b-947f-8113eb2d4aa4", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756534, "uuid": "c1bc81ff-600a-4c3d-8154-3eda95a12eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756534, "uuid": "aab34d52-d40f-4e13-850c-72d9556c6f8c", "value": "78fefbefb0d648c24aefb72e6435e7ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff06bf0-a722-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675800052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800052, "uuid": "c919a6c2-42c0-4a9b-b303-caf092d334a8", "comment": "Malware payload (GCleaner)", "value": "2fb67e4d2abc506abab6d933c1736a20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800052, "uuid": "aff951d7-347b-41dd-be5a-6e6600445104", "comment": "Malware payload (GCleaner)", "value": "0e61f2de13eadbf3116d9fff9bf217307f0cf062ef5d3000350b4cf76366bf66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800052, "uuid": "6f2af795-de7e-4ae1-b294-eceb60102584", "comment": "Malware payload (GCleaner)", "value": "67ea92c15d979493f33755547e1fe2617a9a6646", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800052, "uuid": "02841954-8371-4d83-b3f6-fb14d5e3183d", "comment": "Malware payload (GCleaner)", "value": "c3424fb3bb8200c0f604ae8dc4cba6acbbc5c78a9a9e9cbb0a0b37362ce472d26249f545693a5a6c3d93b7411962a41a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800052, "uuid": "ddbc22c5-2a40-42bf-97e5-cbda37baeddd", "value": "T1C4C5E01A1C94D0A7D1608F70C9DB6DFA9C12EE6FE8BA419713043FFBB231645A84AD35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800052, "uuid": "5250da9c-82e6-4716-86ed-6e0b1d75d0c2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800052, "uuid": "c9a7c2a2-b9a8-46e0-975f-15c6f9e2cb96", "value": "49152:wDMOJZNJtLjSzVZGykmVarIJJa+rXnOktcY9HcA3QALCgv2MR:+MAZNnLpykmVarN+rXOktKA3jv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675800052, "uuid": "1352a904-6c1d-4d64-a6b6-6d43485aefe5", "value": 2738945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675800052, "uuid": "c1823bdd-1d06-4ee5-95ed-cd7cc79b80af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800052, "uuid": "94757c18-ac2d-49bb-929c-5915c03130f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0674f3c-a71b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675797342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797342, "uuid": "b3eb928b-fa8c-4276-8cf4-89d6b6fd37db", "comment": "Malware payload (GCleaner)", "value": "4babe064f2417e7eaf8999f23ef007a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797342, "uuid": "6dd68ca2-68f3-42d4-a915-e1d6c409060a", "comment": "Malware payload (GCleaner)", "value": "0eccd15d65f5ef02001147d7047eeeb92fd888364fb5eb045483ec47b3baf142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797342, "uuid": "a54f9dc2-8366-48ee-a409-3b369da79224", "comment": "Malware payload (GCleaner)", "value": "a0ffade3cffff1988d1599eb2d9bf8ee88cbd8f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797342, "uuid": "9b13992a-1448-4946-86ab-805812820965", "comment": "Malware payload (GCleaner)", "value": "726b35646b7591dc352cd293fe38792d98d371c6c88525bd6550af7032d0dcf7588c8bfc9b97407abdfa90cf12146777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797342, "uuid": "2b32a045-ddbf-4b8c-96b2-079e9e90072b", "value": "T114C5E00A5D94E0A7D1608F70C9C76DFA8C12DE6FE8BA009713007FFBB671245E85A979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797342, "uuid": "7d4845f6-4404-4cf4-8ff9-019cec0fa1a3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797342, "uuid": "19a276ea-5866-4670-a9a3-18943d8e10e4", "value": "49152:wDVaT6GlcKaOYTYCv13hH8KnywyoVnOwl70uygFuJ6lHztC8v6pwvg+tY2PbLCgt:+z/L13hH7nGoVnOwl7ugFuJsoRwvgp2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675797342, "uuid": "bde84664-91bb-4435-9d39-a0bc2c93ecf9", "value": 2706235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675797342, "uuid": "46ecb544-dc5f-4eab-b6da-b9a4df6c6f1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797342, "uuid": "20e6b283-2143-4488-8d3a-3ba97eedb774", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c545ca3-a6bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675755996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755996, "uuid": "d54e250c-20e0-473f-b54b-a7112a215745", "comment": "Malware payload (Mirai)", "value": "0b2a7a8604672d2106df050c8d322545", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755996, "uuid": "0950e11b-0759-42ac-8535-ed3861d1b8fc", "comment": "Malware payload (Mirai)", "value": "0fa7eaa1bc2a2a0af86a21da3ecf06f563c1505588eeac91530bad75dabd5284", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755996, "uuid": "883df414-b6ff-47c0-bb7c-5eb37fdd57a9", "comment": "Malware payload (Mirai)", "value": "9d82e24cec9abc371b474f759a3449e618eeb22e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755996, "uuid": "415816dc-4a62-4b5b-9fd7-351432a21200", "comment": "Malware payload (Mirai)", "value": "2c206474ccd5206898dfe35d89e1f7eecff0126daf06de95cef292f4af9c4315527ced009594e98a99158edf9bb1ad65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755996, "uuid": "4d8db70a-a9ca-4861-a6d9-4743da1a90d7", "value": "T1BAB31A01F9004753C2C22BBAA78F474D7B3657B957DB3311AA385DB42FC1B991E3A9A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755996, "uuid": "d6c0b60c-9d0f-49bb-ba9b-9d47771efaea", "value": "1536:On0YKdAPeQFuB1jm7gYFRlgVFLmvvjDOZYWx9TrhW8rmtcDQFb/FmXUkrj:9A/ijmrgavCx9TrhWUmtcDQFbtmXU+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675755996, "uuid": "febc8589-0203-43b5-8815-3b7d92fc0c80", "value": 110520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675755996, "uuid": "343380ec-8036-49d0-8fa9-53edb8acf1ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755996, "uuid": "91e89620-151f-474b-812a-ade03e9ec438", "value": "0b2a7a8604672d2106df050c8d322545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a62251d-a72a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675803667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803667, "uuid": "a76a08b7-4120-49ee-aaa4-83e37b812cad", "comment": "Malware payload", "value": "5075e0c1b239f5b7587bb6a7d2ee8c90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803667, "uuid": "f2b6962d-2dfe-4bc3-9990-7e830e9423a6", "comment": "Malware payload", "value": "103e346328d6ff2973c1fb98c37c003f3b0c8defcdeb0ccdf522b5a6ee4fec94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803667, "uuid": "b84b64ab-a0d6-45d3-8fc1-507b73debc82", "comment": "Malware payload", "value": "46975fec782f3d30ce61f1c79daaef712f612343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803667, "uuid": "ac07b361-4dc2-47cf-9592-1e4cd8d7ea37", "comment": "Malware payload", "value": "ab8eeebd922a6d331163aa43bbfff3a2940033d5bc4743ed92bc975ecada7751d7fd2d7f2945c0ac2101d8319679631e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803667, "uuid": "76a4edbf-1996-4491-899e-2504cb8638bf", "value": "T104C5E00A1C94E0A7D1608F70D9D76DF68C12EE6FE8BA019317107FFAB631649E84AD35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803667, "uuid": "a671b5a5-b1a7-4a28-a308-506001c5700e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803667, "uuid": "ef1cc875-4871-40c5-a3c1-e08c90580012", "value": "49152:wD46+vWwKtKpG0BeEQe+jw/pa0wC+edPJcLg6kCIWLCgv2MR:+BulpGceVhjwY0/dBcLg6tFv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675803667, "uuid": "a8285f70-e86f-493a-83dc-1e019f4c93f8", "value": 2737342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675803667, "uuid": "b0764cdc-0c00-4b89-b744-815412990db1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803667, "uuid": "502f8461-330a-46de-bb4c-7142f2b5ec8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e6d16f-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675789866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789866, "uuid": "62ad60f8-1833-4504-8706-d17018af079b", "comment": "Malware payload (Formbook)", "value": "b40a49302fa36034d2a78497a0a23713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789866, "uuid": "ce61d2de-e10a-4e2a-90d6-e43b866c599d", "comment": "Malware payload (Formbook)", "value": "10cdd9119cf9d3bdd4eda712d160a49c77f469989053ec08291f63078cea5a99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789866, "uuid": "a20f957c-cd45-4c03-b10b-f30defaf8eb7", "comment": "Malware payload (Formbook)", "value": "f86de095adee3c29fa7e3f309e62747e8f98c0ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789866, "uuid": "b3f64981-386d-410e-90c5-e3e122ff3a00", "comment": "Malware payload (Formbook)", "value": "ba29f3765586f6d8fd3b30cf4fff7d860c5f3253f33386d9a65490bd764f6dcafd999afe93f12f2d9b9e1b3fe1eb7f84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789866, "uuid": "4fc8abc7-0b2a-4841-a0b2-6fc4c8563f19", "value": "T1DEA4D0C0C99CFCC1E83209B564BA5A1A352EEC7F94BA1D6A1A56B0042C734C3B57BD1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789866, "uuid": "7c5f3745-8a51-4672-bee7-3bf70f0ba5ab", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789866, "uuid": "5a205b8c-eea7-453d-98e1-c1d57b408e7e", "value": "12288:8Y1eRh3nWUJgq4F4ywdzwXS4WEcRoJhuvQuVUUjr:8YAh3+q4tQeS4WEcRoJYQUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789866, "uuid": "9215d8d3-bd2e-4891-a7ca-4459b499bde8", "value": 456962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789866, "uuid": "cfd3c2f4-b0a9-4807-b200-472a1d9db8cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789866, "uuid": "3d760ab9-1b10-4f14-b63e-9e58c0f81c15", "value": "HSBC Payment Advice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0c18f84-a717-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675795651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795651, "uuid": "88644f41-2cdb-4641-ada5-b00f529600d3", "comment": "Malware payload (Amadey)", "value": "a32a6c77c098bb58c004023b225438aa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795651, "uuid": "e257e1da-e603-4da1-abea-d9328139b275", "comment": "Malware payload (Amadey)", "value": "119a7d5e283ce6e3f89dbd2d2b760f37cda06b4e5933e556b92dd940cd8727ed", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795651, "uuid": "bf0cbb43-5777-4cec-89a8-72b1c9f0b5b4", "comment": "Malware payload (Amadey)", "value": "fb26e2d8f3a7460f045342cdf1802815333e1e8f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795651, "uuid": "c8740e8f-bbfb-44f5-b64c-d2b581b090b7", "comment": "Malware payload (Amadey)", "value": "64244deacdb2eb133303e7b0925fe46848644c591e1b742a7c240ba205db7b2049a1a17fb9d6e58c1adebbcc6bdc0b53", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795651, "uuid": "808f6361-5657-47b1-82e2-c01cf1c00148", "value": "T141B4024BE7FC8172D8B657B029F303D31537BD501B398396229A6D5A1CB35A0B23672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795651, "uuid": "6868f27a-1020-4fe1-bcca-fe2a5f45acdd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795651, "uuid": "258332fe-f31a-4f88-885b-2791e784e3f2", "value": "12288:9Mr8y90QkJ2OVYp4snwqdc49IAAPzBDRNuJA+wKv0Xe03Whjs:dyZslV7snbIVbBNNuJUKv4Ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795651, "uuid": "9a5f9d2b-dfe4-456a-9adf-c8e1700bdabb", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795651, "uuid": "ce4e63a6-406a-47d4-b6cb-e1b55966a378", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795651, "uuid": "dd840327-948f-43ff-aa03-c6b67146b5cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d888618a-a70d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675791342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791342, "uuid": "1eb7b659-93b1-4388-938a-a32f899788f3", "comment": "Malware payload (AgentTesla)", "value": "1e1b0f4e7d8cfa562f3944e08b82d05b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791342, "uuid": "bb51f586-cb03-481e-b6ab-1eda75af3e40", "comment": "Malware payload (AgentTesla)", "value": "11aa28ab798f7feee2d8758fc0daa220202c79c39b92b2eebf1d27ef74d5b8f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791342, "uuid": "0db6afb9-853f-41ab-8786-192b4a76987b", "comment": "Malware payload (AgentTesla)", "value": "e7764e8f6fb41c0848ec8b01e9bd9434ccd63f7f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791342, "uuid": "2ad80376-eccc-4020-96f9-4701d803dc5b", "comment": "Malware payload (AgentTesla)", "value": "39770166c927dc269d64a192ded7342ff4f1ea41d983294acf4e15f641e744df105d60a331d4457af1f422f5dc966840", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791342, "uuid": "c7fb3112-ddae-4df9-b64e-a28f07435632", "value": "T15384E100F84A910874F75E2B1D9BFA9D53BBB5C06A359D6A02CC190D9BDF940CEA27F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791342, "uuid": "0df9805e-8182-4e57-a96c-b725fa98af8f", "value": "96:fJq36v7fq36vzq36vmq36vwf2f2f2f2f2fMDf2f2f2f2f2fyf2f2f2f2f2fX+9fR:fQF9O78+FRUAzXg9SEKAoZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675791342, "uuid": "67e463aa-0917-4e37-a198-12c23659690e", "value": 402782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675791342, "uuid": "b82df4c9-6ef0-41eb-b0a2-ad7f356e7dea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791342, "uuid": "91f3e2a2-bbb6-4b3b-ab49-a40285afd600", "value": "nuevo pedidoO06708.PDF____________________.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1617a4e0-a688-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675733893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733893, "uuid": "a83eb53d-2ef3-4e44-94a8-16419210071d", "comment": "Malware payload (Smoke Loader)", "value": "f89b1362ab0f86b5cf3d5ae8540b8a5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733893, "uuid": "40653e17-198b-4571-b467-a7601a241126", "comment": "Malware payload (Smoke Loader)", "value": "12699211aacfad01bd4e1d6b9f4d58e49455c28746cdde26379a70260a6da798", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733893, "uuid": "2aeda5e5-ffe8-4a8a-9143-6597ccdcf3d7", "comment": "Malware payload (Smoke Loader)", "value": "bce0b2db7ccc34237ae7bc40710230b9f95b60fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733893, "uuid": "f4d82721-228b-468b-b187-d9f6c4ec882e", "comment": "Malware payload (Smoke Loader)", "value": "f3892c8093f3ae9cb91275db85516e2609d376bd2273460b3e5db1470069b97170bca315ba8dc4e6d22d32c53fb6db39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733893, "uuid": "deef50a4-af6c-478a-aeda-6d61a38886ba", "value": "T12E545B4393E1BE80E9278B72DE1EC6E8764EF5908FBD77652218AEDF05B1072D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733893, "uuid": "e1c6fd3c-ebda-46df-9ca7-a17f872ed00b", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733893, "uuid": "5b0df635-4b2f-4495-b4cb-4da925c0323d", "value": "6144:p9YKLMSuyXrh7NyzRi8dJPzgKiuQj9ja:XYKwdy7NYVXdJP0Kilj1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733893, "uuid": "b11c44e0-3e37-4948-90f9-c36ccd44857c", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733893, "uuid": "5f58e550-f9e6-4124-9359-c18753b699b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733893, "uuid": "e1207aa6-a2d4-4539-9a86-ca0163e57240", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c33c31f0-a687-11ed-88f6-42010a9c006e", "comment": "Malware payload (Casbaneiro)", "timestamp": 1675733754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733754, "uuid": "223047db-f42c-4faf-851e-3b4ebc117453", "comment": "Malware payload (Casbaneiro)", "value": "12633e3d73f45168f9822ae7cab04e61", "object_relation": "md5", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733754, "uuid": "dc835d97-a262-4e2d-b05b-328ba580839b", "comment": "Malware payload (Casbaneiro)", "value": "1277824508bcac174c37883ee7d142d18cd87a8db48e63af9b8e4e8bb1d70047", "object_relation": "sha256", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733754, "uuid": "aa703b57-a4a2-4ae3-8c32-76c1957786a3", "comment": "Malware payload (Casbaneiro)", "value": "c4837eefd8f859653f3ccc11e6d8a874e1e1d00a", "object_relation": "sha1", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733754, "uuid": "4637f6cd-0cae-4075-a006-d86130a1d5bc", "comment": "Malware payload (Casbaneiro)", "value": "7545ddaae8430b0e66eac0c025f054c33323be3473a7c87e626bde2292a4e1fc955ac9f06fc5fe1690bcca52b720b1d1", "object_relation": "sha3-384", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733754, "uuid": "c53b2fa4-5bff-49fa-99a8-0aee698ce0ad", "value": "T16A1733925AA34FCCFB87867E12D98BD6435BCA07528637CB83D490513E33677F81492A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733754, "uuid": "ecbab7fa-a5ad-4692-87da-cfd3eee2fae3", "value": "393216:UCVbbQeW9pToFR8H2qZh81K8T3G0i6GiNdPjP66GHNU43yQuJlTsQ+Mh09:T/2ToFR7qV8T2JsvPj66GJyHPTux9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733754, "uuid": "f741aa86-bea0-4f4e-8b49-4c41b7140374", "value": 20148573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733754, "uuid": "381c3916-e2e0-4352-ab74-56bc054df812", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733754, "uuid": "b3402a1b-4962-432f-814a-14828226c709", "value": "peru.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92c760e-a716-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675795209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795209, "uuid": "871a822d-084f-45d8-abe7-08d1604105e7", "comment": "Malware payload (Amadey)", "value": "b16d53f153404f5825765f11ab2b6827", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795209, "uuid": "ee484fef-c3fb-46c5-bd48-e9dc596b9c3f", "comment": "Malware payload (Amadey)", "value": "128da440dc3448874960fb1eb8d34c283ba78f6517e20b57f2faa158d84a3fd0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795209, "uuid": "ca0e95c9-8c3c-4165-937d-ed3c943ffd05", "comment": "Malware payload (Amadey)", "value": "cc5d6001624f836f5aa82e0178c6c2dc2fdac2c4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795209, "uuid": "8f404a18-ad11-411a-9a7f-39213041912d", "comment": "Malware payload (Amadey)", "value": "8dfebda8c5384d0068b85a1f9b29a44726e151057e567d89dac2c35f12f682f497935cc519a39a4a24917db5223bde69", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795209, "uuid": "488462aa-30a1-4dcd-bda4-c82e1af131da", "value": "T1E7B4024BE7EC8032D9B117B059F202C31536BE905B38939B229EAC5F58736A4E53177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795209, "uuid": "02c78795-fc9e-48ec-9c5a-3887649bdc33", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795209, "uuid": "a0523af4-a9fd-4db6-86a6-acccf34b88a8", "value": "12288:ZMrVy90wNpxJPhsvwmGAPzBU4NuJ+AlVH3Md1v:YyxNpxJ2LbBNNuJ+uVH30J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795209, "uuid": "9ab01c2b-e8d6-4f32-99a7-6f40e07a8090", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795209, "uuid": "7b89d5b8-2039-49c4-8003-44aa0f1611bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795209, "uuid": "ad401ef4-15c6-4c60-8b39-0b3c9c759232", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71098233-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732757, "uuid": "1357df07-fa80-4e45-b170-c59c3080f772", "comment": "Malware payload (Gafgyt)", "value": "0204045b6f59f5003fd115c749d6ff2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732757, "uuid": "7af723d8-fe10-4a1a-9f53-ef21027f06a0", "comment": "Malware payload (Gafgyt)", "value": "134c761a21d51d55ad979fe7ea7215debb15dcc3cdb1a924b32b7404a99e0fb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732757, "uuid": "1f932fe2-7c3a-4c29-a7bb-676607ae12b8", "comment": "Malware payload (Gafgyt)", "value": "252456940feea3ae05fdad7c88396e519edd092a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732757, "uuid": "2952bde0-bacf-422a-b04f-9311de1ff414", "comment": "Malware payload (Gafgyt)", "value": "baeb1eb2ba0fc76874b98e9d37b648f10ef73c10520c6a325b7ffd2a12017f434baae98c34233ce9d827db3ae9d60b66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732757, "uuid": "91369f4d-ad1a-4a62-9422-d1c8e9833a01", "value": "T14DA33B05FC444767C2D327B6E79F434D7B326AE457D73301AA386EB02BC1B992A39960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732757, "uuid": "d2405a0c-41c8-4eee-b7dd-f20bc2346655", "value": "3072:O+/SZgFMnZSWN5hngeBFkmFmDQFdC8X30j:OlgFMZBN5hngeQmFmDQFdC8X30j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732757, "uuid": "e3f2f353-acef-413a-82f2-693d1ed8e469", "value": 102048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732757, "uuid": "c8c84a27-6edc-4cb7-8cdc-76b878061c6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732757, "uuid": "ab7aeb1b-0d87-41ef-a051-2c2d5f4c5f3a", "value": "0204045b6f59f5003fd115c749d6ff2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abcf0e71-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675761632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761632, "uuid": "ed54aaf6-75b9-4c0d-8fd9-a8f53a7c0383", "comment": "Malware payload (CoinMiner)", "value": "f705b8fcd18c72c83bfa1b1a44bc0a41", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761632, "uuid": "0c0254ee-bc37-4056-b580-f2ea06f88f71", "comment": "Malware payload (CoinMiner)", "value": "1371bd479a8c64088b87d1a3439899bfaa2a98ffbefbcda9e9d3a6b7ba04702d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761632, "uuid": "19795923-1259-440a-840c-5e743444a385", "comment": "Malware payload (CoinMiner)", "value": "542dbd21cbd8e15a7c4f9289b3ac103a4cb97dd4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761632, "uuid": "9f3c16fc-64ba-4630-b94b-37968c1609a5", "comment": "Malware payload (CoinMiner)", "value": "4becde699d5037b4720a02127d436f900a4c7eb4a6088f4bdb0a745dcfd2c996f3bc28dd3d6651fcab9bca21c4833995", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761632, "uuid": "4c38a4e8-438c-4b2e-97d9-af22a37d7e7a", "value": "T1DB36335DBF629594C4C79BF32C6678EE744A41D2D70736295A3C8A5EC89333F328AC48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761632, "uuid": "4e1ad5bd-537f-48a5-a524-138d1d115797", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761632, "uuid": "4b80939a-9dc5-4ad8-ba64-7d87c8669302", "value": "98304:akU5/SU9MIYjw6FxzchqSQvN7pkCF4ks+vX65otrpCpXtrdHtC6M2XX:05/SU9MNFxzcwznkSaiGodcpXdsoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761632, "uuid": "56df1b9a-8765-4e32-a465-39efb2fc0751", "value": 5348372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761632, "uuid": "ebd12cd2-d88b-4744-9890-53d904894834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761632, "uuid": "a44344d3-15a0-4872-a4eb-3130514c4fe9", "value": "f705b8fcd18c72c83bfa1b1a44bc0a41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c75b159-a6b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675752426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752426, "uuid": "3ea5e162-faa8-4051-8d4f-a7a5da49846b", "comment": "Malware payload (Guildma)", "value": "03053e4e2cd4481a2322e964b66f51f6", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752426, "uuid": "be0898bc-4248-4bd7-8e27-ce3f27c5ffce", "comment": "Malware payload (Guildma)", "value": "139022b872ad49847faa867d9902cf92c25bee1a478e6ac2a875fc592e57bd23", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752426, "uuid": "32250e60-4f3f-44ae-babe-c7760505cc4b", "comment": "Malware payload (Guildma)", "value": "c4f012cbddc5f79ce201d9976e5991fcbf593812", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752426, "uuid": "526cd196-0e22-45bb-b032-e419ec689622", "comment": "Malware payload (Guildma)", "value": "e7d78f2bff56f39d28b6f3897049fe137859771145545d217cec6c4b5cc9c752861028d31d3873364fcb24acb36a61f2", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752426, "uuid": "8e1d3bb8-9fc8-4bcd-b370-b38b498fb370", "value": "T105C26DBE04768147213256E4EAF3098AF36959E5D0945288FCC49FE43E705A3A3ADF3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752426, "uuid": "ab60777f-bf44-4088-83ac-0436ed0e22ad", "value": "768:/mN7kQKTc9UThK3TGNlhks0OL44f0v5NPQo+c2jl14bLs8Ac3VsY2c900hagF48m:U7kQKTc9UThK3TGNlhks0OL44f0v5NPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752426, "uuid": "6de3ef8b-26d0-4186-be88-824b77b633b3", "value": 26824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752426, "uuid": "b481b4da-e6b0-4d41-aad4-1a36b8236803", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752426, "uuid": "48f9b6d0-2366-44ac-9369-33e2560c91c3", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b64ab5b-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675732694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732694, "uuid": "432cec34-3a75-4607-8b50-1554d529bbdd", "comment": "Malware payload (Smoke Loader)", "value": "6d009a731642082c57d26e3525e57456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732694, "uuid": "03bd1de5-a6a8-4502-bebb-483f5fee1818", "comment": "Malware payload (Smoke Loader)", "value": "13af9de5b7f7fca27f2a3f71f6139d0dd5a4fb64718252df02c3504000f713cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732694, "uuid": "ce2200d2-e858-420e-adc0-eb2e7a5ace3f", "comment": "Malware payload (Smoke Loader)", "value": "616815562a16e5fe87a514eaebf3d560f4a5f527", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732694, "uuid": "ebdb8ced-742a-4b3b-b3f8-8d82bcd8f6e4", "comment": "Malware payload (Smoke Loader)", "value": "32136ea439ddd34c0b419a89acabae71aad786fc92d56c5ff27da471cb8474fb3e06e91a6f236b957c62f1214b0a3347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732694, "uuid": "67447a12-a501-47ab-bf02-45bde2c916a2", "value": "T171644B4397E1BD44ED268B72DE2EC6F87A4DF9408E7977652A18AE9F14B0072C173A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732694, "uuid": "d77309a0-062e-40cc-8503-43ce12212e80", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732694, "uuid": "1cebbf28-a6fd-4400-8cfd-209d62ede00b", "value": "3072:Kab6bldLYwRm5GO6bBiBQdk3SHvRuQjiMTE5y8a5H:fWdLY3ybBiBkpPRuQj9b8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732694, "uuid": "e3eb66d8-71b0-44b4-be72-f890ce813ed2", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732694, "uuid": "974839c3-ddae-414e-8ba9-aed2a0e18a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732694, "uuid": "635f7c6e-b7ea-4b6c-b524-a639ba3e50a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803ada65-a6ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675778309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778309, "uuid": "28ebb3fe-1d93-4f1b-b24e-71cb69fd3fa4", "comment": "Malware payload (AgentTesla)", "value": "8f3b232b111f0bc1ea9e92eef7f39b2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778309, "uuid": "92c1ca19-81fb-49a0-af67-fb38deed2ab6", "comment": "Malware payload (AgentTesla)", "value": "14fec3e253e81227fab7ea1a9a09a9d202e6fc273c812bcdfe112ffbe3822b79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778309, "uuid": "2d82e526-eee3-4563-adc1-e420fe8e515c", "comment": "Malware payload (AgentTesla)", "value": "c3cccedb54102718c08eabb46ddaf12fad2259e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778309, "uuid": "9312de6f-378c-48e5-bf26-d8af7678bb02", "comment": "Malware payload (AgentTesla)", "value": "1f66ef1f8578c0c7d10ff060f62b8b614ca5c161882729b4c4695d67ae3add111091fc90287e6ed1f3ba34e14c9b290f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778309, "uuid": "bcc7f6ae-5395-40a4-9592-d88ea13a232d", "value": "T1C0F4231E27998B20CA9E8FB4E0E95528077E6B3CB145D32D9E8878ED5E23FD05B41743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778309, "uuid": "1a959d86-08fb-48b8-aec0-c2551ad61ea0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778309, "uuid": "b9e94559-80c4-4ad9-b557-306abcab5d80", "value": "24576:Mv+6VJX+D3AQVsffi3EdvRBtrxN5IC54TWMJA:Mv+6LX8AlfLhT9tgif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778309, "uuid": "acab8cac-46bc-4a65-9c91-bf80b6b6c322", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778309, "uuid": "521de26b-6967-4567-b243-7ad76990136f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778309, "uuid": "f0b46170-b411-4232-88ec-9d7ddd2f0307", "value": "FSSC-23-0103000RPM.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08581ec0-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675783262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783262, "uuid": "f24e2689-691b-4a19-b13d-6156093ec0d3", "comment": "Malware payload (GuLoader)", "value": "50b6e1d3d5a690aa2037423ee63a4231", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783262, "uuid": "3b5472e3-d271-4bd3-b42f-103559375861", "comment": "Malware payload (GuLoader)", "value": "16202b561b2a84a205f6ec949e7b51615de505f585bc25918878e90a405e296d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783262, "uuid": "35443734-af9b-4aaa-852f-f6095af221fd", "comment": "Malware payload (GuLoader)", "value": "62bbc28f3d9708f449c482a4bdab8dd3fa717bcd", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783262, "uuid": "d8a7a9ac-880a-44dc-9b2e-7ed479ddf99f", "comment": "Malware payload (GuLoader)", "value": "9feb1407383f2866c6ebf39a46649eae0e4706dae2f1aa7244da8f550850f70fa58f0b54f3da505895b5cee256fbcb42", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783262, "uuid": "aa383a3e-f3af-4486-9ef8-be361549cc17", "value": "T1F8F42397A0FD8998E1B6E2D7EE19561C52729BE081C246F320CD91E0C274E5C903B6BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783262, "uuid": "be5f3ca7-0ca8-4cd0-8845-be25d247deed", "value": "12288:HY73pZg6NFj/CxGut+5HzN0q0G7ja0j5UXeIe0jTcbHPZx8bAMfN2wd2sxGH:H8g6NFCGutMHz+qr72ABojTcbDWvlf29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783262, "uuid": "bed3a5fa-b92b-434e-aa37-ca6323a64414", "value": 766965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783262, "uuid": "42822e67-397d-48da-b420-ce122438e4e4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783262, "uuid": "a7d916e0-aa84-48e0-bd0f-536b9c7a7a0c", "value": "AR_STATEMENT_13740_ARIHANT_ELECTRI_02JEN06_115700.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931c3a1f-a731-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675806688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806688, "uuid": "2862825e-8653-41da-83ce-a9b1e8e851f0", "comment": "Malware payload", "value": "8a6a11b73bece4e2a805b9421c292295", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806688, "uuid": "c76a8f37-3140-4280-9b15-30675484fa46", "comment": "Malware payload", "value": "1635b0a2ee555a7a7655ca03a7af637dd994265fce6465f67b7ed57c7793de67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806688, "uuid": "f58401f5-5182-484d-857a-98b0814884bf", "comment": "Malware payload", "value": "a61bc592f5fa002e5f6ed833f1a27d8c0b0ccc5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806688, "uuid": "8d8a5026-c836-4a01-9ca9-172c785875b4", "comment": "Malware payload", "value": "b508713f5b002431bc389285beacb149ff74092c27d3b12373eed2d3602673acc519af8a0ca112207adf97fa8f0ca55c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806688, "uuid": "da2e27f7-6fdd-4f48-b8c4-89338b98645f", "value": "T12DB4020BB7FA4032E8B4577059F607C306367DA1AA39479B234FAC1D0C726A5B6317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806688, "uuid": "39885fc5-02b3-43a2-9aa6-03e0a28d75fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806688, "uuid": "700d38f5-c193-407f-80bf-589e8446ac77", "value": "12288:SMr2y902Aj2luf0PWA1FfW3J9Zd+77HEm9rb+9I1A:4yP4yWGW3J9ZeE4rC9Im", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675806688, "uuid": "73e1d901-f22c-48fe-b005-c3c5077278b4", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675806688, "uuid": "06a7b989-2038-4356-904b-c4510d772828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806688, "uuid": "54b6e9c6-77c6-451a-b04f-f86ca388bf16", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe466be5-a6a6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675747167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747167, "uuid": "8c023729-230a-4808-8871-4b9c7240f473", "comment": "Malware payload (Amadey)", "value": "6fcad745630258ee9fcd0def256d5edf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747167, "uuid": "934d6d1f-5c97-424a-992b-6b4b497ab012", "comment": "Malware payload (Amadey)", "value": "16dc59f02b1040358af3ad63dbd61ac5068147175d5134aa2528475082311ba3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747167, "uuid": "9d9238d4-554d-42fd-b7d4-ba5f3c49e0d2", "comment": "Malware payload (Amadey)", "value": "c33e358168d13883cf69ef19a33d09147e9a3bb9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747167, "uuid": "7a0af8eb-8a8e-4d94-9ac6-83622adaeb52", "comment": "Malware payload (Amadey)", "value": "b632df5494183066df9c55cf7819fcd51d60831fdceba3a97bbc1c2db55484e8867f35db053d5493b38a5e6e72e90a79", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747167, "uuid": "6689f01d-9497-45cc-9106-8b45a92a86a3", "value": "T1A3C4020BF3F94563E8B51B3019FA07D30A397DE06B788297234DAD5A1C726B0A635727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747167, "uuid": "e5d9496f-bc0f-4da5-ba0d-b01d71b063eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747167, "uuid": "1be67e62-e73b-41df-b2cc-d3781606722b", "value": "12288:uMr3y905FoIK1burSfe2XsxOCxJyHfh5qnZl9pe:hyz7ErSfe2XsxR6K/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675747167, "uuid": "02ff7722-2ab8-4b58-a570-a71f754cffa5", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675747167, "uuid": "1a692b57-fef0-47ce-ba80-a76eb9092c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747167, "uuid": "fdd1c92e-7298-456d-9f43-770a3d65ff06", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de77325-a6f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675779970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779970, "uuid": "957884a7-c92c-463a-b2d0-4a9ced7e73a3", "comment": "Malware payload (AgentTesla)", "value": "83e1648da8adbdcd1643b60436d1a967", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779970, "uuid": "4ce74fd8-540f-48bb-a226-bfff2eb5a779", "comment": "Malware payload (AgentTesla)", "value": "170ba7649101492ba098b7871fe4881a902f3db732514fd590b4871349e0012c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779970, "uuid": "7baa9bf2-f651-47b9-a693-90290eda8349", "comment": "Malware payload (AgentTesla)", "value": "657136fab727b0bea723f8a37532876f6c201322", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779970, "uuid": "031eb3de-9ff4-402f-b3bd-a467edaa95f0", "comment": "Malware payload (AgentTesla)", "value": "016b847b3a5e37320ac6a6c58d657c44ede30ebc648cf951faad1c7fb86f90496f140a2d74feada20122ab8daa4a1b64", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779970, "uuid": "dfe79a8e-3be0-4e92-9877-a82406dc2904", "value": "T12B64232D7C48A2F980EB6D158BE2B3BE54D77FD04C8E7C7587B5180F7000AB90A9621E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779970, "uuid": "4017c463-8819-42cc-bab8-bac77abb0e68", "value": "6144:Xs6jMM0em6k+fK61fylfu8NEkTWzKIXQNHT3kvFXjfBpwDKAL9XWomgG:Xa0m0K61fylxNnTWiz3kNBpVjomF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675779970, "uuid": "097868a4-e5d9-4bc6-8d39-bfa02153c0f5", "value": 310345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675779970, "uuid": "b7616dd2-1de1-40fb-9620-0cbb34b9b4be", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779970, "uuid": "0ff8c69e-c52f-4749-9091-b2ed37095a4e", "value": "RFQ-N-12192.1.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f2fc9b-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675758486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758486, "uuid": "ca975e96-f743-4267-8419-4a910aaeddd2", "comment": "Malware payload (AgentTesla)", "value": "34abb90224f8b4fd057e8fa8f5a3eb0b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758486, "uuid": "0f63ee92-3c75-4055-9f93-b7e42ad207ad", "comment": "Malware payload (AgentTesla)", "value": "172e6a908015dd956c606d2efa00ee8fe6ed43cd9000631dad346227e0ef5450", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758486, "uuid": "641792a8-0051-4cff-8cef-3a6cfe5e4ef7", "comment": "Malware payload (AgentTesla)", "value": "8199cd6f8fba690059d7b8cac0627deba569d78b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758486, "uuid": "ef890c0e-da3a-43d5-a51c-716ffd312a81", "comment": "Malware payload (AgentTesla)", "value": "bee593dba7303d98158ca705e29cadae80a3d1a98c0ca44a55bd62b2b98602bf31cb418dec75bc8893f4b1672d6c27cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758486, "uuid": "e1bf0457-be14-4170-b112-aeec3c42f39a", "value": "T1C075BFF876047DE6267F576BDA96ACDC03B61A239ACBA4CD806477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758486, "uuid": "06a39dd2-4c08-470c-b51b-e661c1704ee0", "value": "24576:XqG17EWl3Eq+1pQ3v3qb29mxmF2KXT4tFswg9ogPMGwJ8aswWVeq8smDiZvMCong:t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758486, "uuid": "d8262cb3-a5a6-4804-a625-df3b1dad9059", "value": 1672024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758486, "uuid": "4633d5c7-e3a9-41d5-b895-b5dfa4b9b23f", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758486, "uuid": "5442debe-b8f4-4f65-bfb4-a64ad7856078", "value": "RFQ-06022023.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f04792e-a700-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675785501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785501, "uuid": "17fe602a-db11-45fc-8fd4-6501e5e7e7dc", "comment": "Malware payload (Formbook)", "value": "fae15ab1a90b87eea9841daa9abd923c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785501, "uuid": "afc20d73-6433-4880-80b8-f78f2df5cf6a", "comment": "Malware payload (Formbook)", "value": "174ae377574d8702e3a1122550b06c553a492ec6c9a92f1eb71971593fe7ab0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785501, "uuid": "42eae0ff-56ae-4bed-8fc8-11b5d599320b", "comment": "Malware payload (Formbook)", "value": "2bec726bd5aebef399bb15a85da7ccddf0823128", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785501, "uuid": "88269ce2-5309-4a9d-878d-cf5115749f9b", "comment": "Malware payload (Formbook)", "value": "baf81188d732aa060e62c2731d77fd9a30961643fa627ea3056aa7dd9b343dfd11af2a52df1c4f90a64e529c06427dec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785501, "uuid": "b274b224-e25b-4b44-beda-54170453d014", "value": "T13254134A1764D6E7C4EE04321DBF862F0FE5F82A2578AB4E13B437647612593E81FB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785501, "uuid": "0effe5e1-4de6-4dfc-acb9-e5096952a0fb", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785501, "uuid": "1220419a-670c-4211-8da4-2b742ebd38e7", "value": "6144:FYa6VyDxOjxWXuvuDjR1iQxsCubUg8d/VbA3audFCAq7ysxRQxa:FYn1joDjRnsCuwB/W3auLCAq77xSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675785501, "uuid": "07655b76-de27-4aad-b4ca-73efb2c0c604", "value": 297299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675785501, "uuid": "7161a1df-b600-4254-8b7f-9a440be82807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785501, "uuid": "5c1cba31-4e7a-48fd-b86a-76c0c4f40bfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ebf2764-a69c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675742632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742632, "uuid": "c0a44f4d-91f4-4194-bc90-8e99ee326b96", "comment": "Malware payload (Smoke Loader)", "value": "edb2f7b1704e1eda304e81e97a4a7dea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742632, "uuid": "db84c90b-2b6d-497a-b286-6963a7b8b2f0", "comment": "Malware payload (Smoke Loader)", "value": "1760385bb18814263262c206e991554fc1b6e3d803014bf216a59cbf2f714161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742632, "uuid": "1162c9a5-e409-49c8-95b0-acb14356f435", "comment": "Malware payload (Smoke Loader)", "value": "7eb43053517f618168f57fa61ddbb6f2c18cb49c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742632, "uuid": "d3cb8daa-35e5-43ef-aabf-6941d0099f3a", "comment": "Malware payload (Smoke Loader)", "value": "1f5fa11574be97806be3921ed3c4536607315ef60d8dc143cd1d79e44736298d693710ef5d5fb4c42452a06429c4eb12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742632, "uuid": "0775be31-d7b3-4af7-af1b-67f1c0d8bf31", "value": "T1DF545B8393E1BD40E9678B72CE1EC2EC7A5EF9408E7977652218AF9F24B0172D173611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742632, "uuid": "ec558b2f-1583-4cbd-b278-2f9819579d41", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742632, "uuid": "988cc5ad-235d-40f3-9adc-38715d754a43", "value": "3072:a5b6beYKLM9RmxqEh8Q3cq4yp5kkuuQjiMTE5z1a5D:09YKLMSxq6045UuQj9G1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675742632, "uuid": "81e1adc6-1247-44fe-aea7-cd969b7e981b", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675742632, "uuid": "7e16c7a9-4d92-4899-94a4-73d7543bd135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742632, "uuid": "6be77215-323d-4913-bc9e-b23e44366384", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fc3b67-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675796175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796175, "uuid": "da43b48f-e8c8-4a99-9fc5-0eb3c1ac2ec5", "comment": "Malware payload (AgentTesla)", "value": "aeca0aa59566b054ca9283cfc33e45a4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796175, "uuid": "e3fe22fc-fbe0-446f-baa6-68dce51d31a6", "comment": "Malware payload (AgentTesla)", "value": "17b6e0bb426b762e1caee67606532e3350d8c752c0625994424916e0fba527ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796175, "uuid": "0156e4a0-55f2-435b-a3d6-76f163a23f8b", "comment": "Malware payload (AgentTesla)", "value": "6d2b05581244ca09de10fa011a2cde56caf499b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796175, "uuid": "c4121414-2dd6-417d-9326-4fd63b2ddcfa", "comment": "Malware payload (AgentTesla)", "value": "ad227875abb4faf65fe24d865a7aaac69215212abe10461edd1ff7a48bd6c34dc0aa8cf45fa916338e3e7b3b6345f83c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796175, "uuid": "3663aeb2-ccbf-42ac-8935-57da9ccb9186", "value": "T1CD05230D235D8B60CB4ED67AE8AD4D6843B1E61CF121E72DDEC562FE7E23B504942293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796175, "uuid": "7366cd22-e810-4703-91a7-929fefdf27f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796175, "uuid": "d75c29be-da8a-4ff4-8a0d-0b29600d044c", "value": "12288:rOrx7p58lCrd4gyQapWMswIzWzjzpzHvbBtvZY7zskIjqrMuRZaZ7Hwd1LMRuz+O:KrxN5IC54TWMKuzZ9RenquQOU8MP4mA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796175, "uuid": "95db3c8e-d91f-4bb2-b31b-f39155f019be", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796175, "uuid": "c80d7d58-dbf2-478e-9901-8ce221a98b31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796175, "uuid": "94966058-6ec9-4d78-85dc-002cd0a2fff8", "value": "aeca0aa59566b054ca9283cfc33e45a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d44fee-a6e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675772198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772198, "uuid": "f214a962-c9e1-46d9-a9a7-f421f7c23fc8", "comment": "Malware payload (AgentTesla)", "value": "66d479cf6b2398a9453889ad83ba17ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772198, "uuid": "bdb364fc-ed39-4671-89e4-3bcb7c60a8a6", "comment": "Malware payload (AgentTesla)", "value": "18b67c097448c87c28b96f9f00843bd58c8da0d2866bc69aaa5bf308d785c400", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772198, "uuid": "945f637d-e069-490f-a7d9-8bc425a77601", "comment": "Malware payload (AgentTesla)", "value": "163183fa2cf907106ea82a4ec3a23e0799a44861", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772198, "uuid": "af0d6dd7-3680-4a3f-bd10-df4ea1001105", "comment": "Malware payload (AgentTesla)", "value": "1152f9b9e83425b0567c72cd2cc45be9f93878e3f4d3a66595edeb1000eb67e1038bc29e77b9b79b815b606954125b0f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772198, "uuid": "50d2f1f5-e553-4f17-bb71-3ff70e790cb9", "value": "T128641234BA60E4F7D0F142735ABE63572F6CA81328F0872BB764A7497F62681D10E321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772198, "uuid": "25b89c4b-d4ac-4a38-9fcf-a17bd6427088", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772198, "uuid": "caf9aa02-197a-4a4b-aea2-11b6a97aba6e", "value": "6144:vYa6QsHhmMk/7K5j+70H+CkvuKZfw16P1AqVgRm1iM8ws:vYusHhXguJeCmy16NT8m1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772198, "uuid": "9de2c6b9-0a70-44b0-883f-d7b4557d3846", "value": 329027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772198, "uuid": "6375806d-a31a-486d-ac3d-a19b06c4a021", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772198, "uuid": "a37aec3a-b320-46aa-8343-4a7f55ae87be", "value": "18b67c097448c87c28b96f9f00843bd58c8da0d2866bc69aaa5bf308d785c400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bed452b-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758411, "uuid": "22a893e5-d2a8-43c5-abe2-5f595fbbb668", "comment": "Malware payload (Gozi)", "value": "dcf4e37b3c0a8b749be2bc9b3317cf54", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758411, "uuid": "c4bcc76a-f6e3-4480-b2dd-7c729703f15f", "comment": "Malware payload (Gozi)", "value": "18ea38699a473662fa01185ceb4d2ae1a7cedfc324959c4f911de1e41f95b37e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758411, "uuid": "402d3d02-f4d1-46c6-aea6-717518f26cd0", "comment": "Malware payload (Gozi)", "value": "50eb469bb458aa93a5cc397582e5aa4d6156cb26", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758411, "uuid": "c47dc2fc-9d7b-40f9-82e6-08ea92998792", "comment": "Malware payload (Gozi)", "value": "6fed41b0ae657fa9f008e06e429f90d856fefe2104c1f3df3e220e0d6ac0f83dde2213cb1848f038bc532ab4e3b9b05f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758411, "uuid": "9aae3a5c-d6f5-4a04-97e4-525238041a85", "value": "T1ABE17E8EDDDB542BB78181EFF2332D10FB60597ED9197104B5E5E70E5A6272B014125C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758411, "uuid": "a76d5dff-e14e-40ae-872b-3a2380f16f7d", "value": "96:wQ0BFLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dl96r2:hijU77rIKdn863jMM0OD9+VVF4vx4kuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758411, "uuid": "e1a03e19-c3fa-4ed3-8a38-746319cefc6b", "value": 7013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758411, "uuid": "1b57b668-f1b3-44f5-92e1-be8bfe05a692", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758411, "uuid": "e74242cf-49f5-40f2-a5a3-ea195765f08e", "value": "azienda_26.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c91cec-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675758619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758619, "uuid": "82610f6d-3f4d-4f41-afd7-51f15399b58b", "comment": "Malware payload (GuLoader)", "value": "d633e6aae75a585ac42c5c16b87d05ab", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758619, "uuid": "819bd41f-d817-4412-a046-16113f6460cb", "comment": "Malware payload (GuLoader)", "value": "198739ebfd17248a2e1e14a7da4f13cd3344d7d81eaef628e61e2a171e90280c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758619, "uuid": "f414ccf3-cc23-4589-9289-ecc4e3e4a2c1", "comment": "Malware payload (GuLoader)", "value": "4f0200dd0ed8f5bbb62fa520adae16f5111fdcfc", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758619, "uuid": "65b4edcd-d807-4901-b31b-909bf74f0c00", "comment": "Malware payload (GuLoader)", "value": "b2c57b61688d9a0d5ea11e3459e4737848ada5e1f2102ce22e187ce371c82da018909d3302d52ecef5ac2ade47627286", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758619, "uuid": "f1ed50ba-9a78-4ac3-bbc3-6ecff9e0a5bc", "value": "T197834A9CBF67D618CC3B1E6DAC821987F4FA4D775027556EBCA5038A210217C826FE39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758619, "uuid": "c1134a33-459a-4eca-a020-eca18f281ac1", "value": "1536:PASmpA5O59R1GCWsTXI0ROxipTy/Wxfi0PS6AW1zHpWARi:oSiyCPsyIKOx6Ty+xfi0PS65zJxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758619, "uuid": "13418853-424e-4046-a45a-9f6a6b5b65d8", "value": 88483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758619, "uuid": "8a028cd3-177a-469d-8ee2-f546e5001ca4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758619, "uuid": "399abf15-bc3e-48ca-ae55-4040746d1841", "value": "prodotto elencato.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fe5ea6-a6bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675755905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755905, "uuid": "e77cd8a5-f67e-4a0a-a19a-1b87c71f71b6", "comment": "Malware payload (Mirai)", "value": "95a75d70528950299a9bb6f21c7337c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755905, "uuid": "d2f70708-68d2-4153-9be9-ff9f8178db0d", "comment": "Malware payload (Mirai)", "value": "199dc89ad2c347cf35d0a41c9406f96f0bbc31cd8d137ee4cfd0e85d8c297fc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755905, "uuid": "03f6bc01-a65c-48ee-8c2e-60636932d800", "comment": "Malware payload (Mirai)", "value": "abcc2256eda6e8118b595137bc5764989d2c321d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755905, "uuid": "89015467-3731-4d9f-9d9a-ac2280d9d4ab", "comment": "Malware payload (Mirai)", "value": "8aa3a47eed47277748e5851418be2903da0c7aac5f9f62d6e34d4c072251dec062d0f2b6fcb32c5d8f42b61679c421ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755905, "uuid": "536c185d-e4bb-4b9e-be98-396ae29705b4", "value": "T18BB31A01F9004767C2D21BB6B78F474D3B3657B997DB3311AA386DB02BC17991E3A9A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755905, "uuid": "781ad0f6-c446-49d0-a93d-f38ce956978c", "value": "1536:0ioYKdAPC3ouBSaQN7nfiSLsFh2q/EOcjSv7zsT6NlMZNtjYGxmqTQQxZWvZXUkN:yALdaIdqJfsTzzTmqTQQxZKZXUyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675755905, "uuid": "2fe1c1a5-4427-41ed-bb3a-6241dd9fa265", "value": 117954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675755905, "uuid": "7978394e-d3b2-4f00-8cb1-a0ba5485e4f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755905, "uuid": "d7be1ae4-4718-43f0-a643-743059be64b6", "value": "95a75d70528950299a9bb6f21c7337c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45b7107-a716-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675795201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795201, "uuid": "73a1ce4a-c1a2-48b2-a4f7-158f3c4b286f", "comment": "Malware payload", "value": "3095e8012e4758b5234f36e073614629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795201, "uuid": "09c51323-7ef6-4645-8067-10f529a5611c", "comment": "Malware payload", "value": "1a61dd538edbe732f67fdc7d2d7da5a86844798e73309677ed5d6a69a03afd8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795201, "uuid": "321bb2cc-9e9a-4b43-ad37-6576b51a2805", "comment": "Malware payload", "value": "dffb50d19844217fa1f36ea098c27e5a5ccb6f96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795201, "uuid": "68760407-87ae-4e63-8599-d4fc6306c76b", "comment": "Malware payload", "value": "a039a1b95711da05ed8bca3329b50194a343bf0f3b557e076e17cb566d878dfc550c7252d8a0fdf5a8f4f98b670d8c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795201, "uuid": "477495cc-145a-456e-9b89-9e95cf3ffbdd", "value": "T1D4459D27EAC380E3F714117204F6473DEA7456622B25CEDB6694CEEB6C322116E772D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795201, "uuid": "1a6d1c83-eb5f-47c8-ae8a-a27111a464e8", "value": "12288:0Zg+T7rSyYJnRMEbj6xxYvIcoi3T2mVzXuAjDsCHmpNAS:ug2yyIMEj4YgryT28zX5DsCGIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795201, "uuid": "367a18e4-3060-4d85-a367-999183c0b536", "value": 1238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795201, "uuid": "33b2666f-b1a7-4b68-9209-08c877078460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795201, "uuid": "86d2308a-ac7c-4488-a6b4-c759565627ef", "value": "SecuriteInfo.com.Win32.Trojan.PSE.15MOKEC.13853.29334", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ce78f55-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789900, "uuid": "ee466acb-3b7d-4f7b-88fb-7ae2b35bfe02", "comment": "Malware payload (AgentTesla)", "value": "ec365e7c8c0a9dc8064cb4260b94faa6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789900, "uuid": "82aaac09-83a8-4fce-b1aa-dca637e3079e", "comment": "Malware payload (AgentTesla)", "value": "1a8e21dfa014136cab56a95152e43e986bbf27559ca06599a10806954b3748a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789900, "uuid": "d2ab2b1e-9f68-476b-93aa-7b802c2e1282", "comment": "Malware payload (AgentTesla)", "value": "f180324759c0f28d66c29abc962bfa644f04b379", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789900, "uuid": "7369197b-febd-4565-97a6-ca739af051f3", "comment": "Malware payload (AgentTesla)", "value": "7b7c19dc3157962f666fe45feecdd47ca99f0b764d5c039fb5293849294574912166d88383956b1d80a67d0052941396", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789900, "uuid": "695b31d6-77db-4668-bb32-30770ea0a734", "value": "T143455B8171B1C893F45B0AB168297CA83579BC4F9AD8400FA976BB1563F3352F0DDE26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789900, "uuid": "21c9ea33-90e9-4f7c-a823-d0b5a49823b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789900, "uuid": "badd0316-a96a-4dd1-b1bb-602956b46d83", "value": "24576:ep11YGDkjwJsoGlW1KQKPTCd2sepquOCfWPxRv1fVmkQ8PQ3:epfY5UsoGlrQiTCoxYRvbmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789900, "uuid": "9e246cc3-0346-4e63-8575-132039e9eb1f", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789900, "uuid": "5a1ca081-bff7-489d-bbcf-ddec757c41e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789900, "uuid": "ef859113-c669-40af-94ed-0b38579c8ec0", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adfd2d5-a711-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675792876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792876, "uuid": "1078f3d9-e6be-4e1b-a74c-8cac1219160a", "comment": "Malware payload", "value": "5e08b13aef6d61a849df9f04a481aa85", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792876, "uuid": "844298c2-d20d-40b8-913f-171780c43886", "comment": "Malware payload", "value": "1b172e3eaf9422f703c816061268e4a057eb483357c819c101e0d33e80c8c0d9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792876, "uuid": "d5b1398f-970b-4a2b-8270-adaddefc263e", "comment": "Malware payload", "value": "cfce3f3b474688d5c63fcc2f31337345b96bffae", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792876, "uuid": "e8707ace-5b5a-4523-afa4-f36861c61e78", "comment": "Malware payload", "value": "88c3563d9de43661c62735288895f82955df71dfa3952877f828b676b54343ddb94bea9f07ebe8087fb7ca640cca0629", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792876, "uuid": "46bb65d0-d2b6-49c3-83f5-0cb38aad800a", "value": "T1F59633A6F1E411542C20D6A45A5AD8F803483BF606F6133DD58AA9270DE3B778F7F1A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792876, "uuid": "71f15710-71b8-46a0-8a14-7f84db222aa1", "value": "196608:rgL1hnMxtBUxEXRYY5DaYSlIPcwsNLgOztu4D0r96rEyUH3:sBhMSxEhYYpaHlIjspgOztuU0rOEym3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675792876, "uuid": "1b3a2860-a6f5-44c7-adbd-25003c2cfef6", "value": 8878557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675792876, "uuid": "f7d02019-d785-4e45-8541-18df4ce62704", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792876, "uuid": "0c40f586-1bc5-4745-a5e3-846bbbaf14b2", "value": "Petrobras_Premmia_v3.3.19_www.9apps.com_.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3111f1c-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675794313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794313, "uuid": "bc21de82-f9e0-4e17-914d-614ce0147e6a", "comment": "Malware payload (Quakbot)", "value": "13d0eb496c91e50490d437eb86a04dbc", "object_relation": "md5", "Tag": [ { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794313, "uuid": "bea13c15-58bd-44b0-a437-5a19129b639a", "comment": "Malware payload (Quakbot)", "value": "1b553c8b161fd589ead6deb81fdbd98a71f6137b6e260c1faa4e1280b8bd5c40", "object_relation": "sha256", "Tag": [ { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794313, "uuid": "78d02ee5-2edd-4b7a-85f1-99d2971f1217", "comment": "Malware payload (Quakbot)", "value": "5d5136e19aa932c959ed3f3bf94b1f3b23f9c05f", "object_relation": "sha1", "Tag": [ { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794313, "uuid": "621fd48e-34e1-4327-b16f-7b3327dfc726", "comment": "Malware payload (Quakbot)", "value": "2f509f788a271794e91dc84da1e6c39ffa2de85ccdd87dcc4149f05a2af922facc228092f7b2f0432b07a196a329b8bb", "object_relation": "sha3-384", "Tag": [ { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794313, "uuid": "863bb287-4008-4805-9b23-de7124a92804", "value": "T1F604CF06B2D28659C7681A750CFB6F74F367BE1291A2572F9EB62A2C4DF0244CC1139F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794313, "uuid": "a7a21276-d22d-4539-9e97-1160b9457ac1", "value": "3072:qWgS2EJbyYeMYkKkyX3DWvLLATifwvAyVXRgJu:+hjZrHDgKAyVq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794313, "uuid": "fa5b0db4-0876-4f10-a31a-c60ca6a986a3", "value": 175085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794313, "uuid": "20690872-f21e-4408-b1ef-4bcc727e3f93", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794313, "uuid": "e3950b84-4c14-43d9-acc7-2dd79b09fb3d", "value": "Funds_492834.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "644bca89-a6f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675780410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780410, "uuid": "77579693-b55c-42c4-aa4d-e507503e4ee0", "comment": "Malware payload (Loki)", "value": "e6572de46de2816451d6d411894cd600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780410, "uuid": "0255fe58-4a1d-48b5-bb37-cfdbfc296db1", "comment": "Malware payload (Loki)", "value": "1b737b1d7a9cd4c45062f541952e13b9b9af313ca6377a85b36bb77146a6626b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780410, "uuid": "a03ea354-d8a8-4411-852e-b06062ad7ae9", "comment": "Malware payload (Loki)", "value": "39b28168243e5923161e38749b062d0b502e8684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780410, "uuid": "770a28c5-f0f8-4a36-b2d2-0401cc93e20d", "comment": "Malware payload (Loki)", "value": "d32db1d844a53250675756a616beaf6a86726921131feb9f9cb924630cfcc2a984b5a1489300840e10dfae0d911d3738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780410, "uuid": "f50f0331-69c6-47e5-9606-06e5945faf96", "value": "T16CE4221063B9E320D9BEDAF5B77D74E883B92204B412D96C4DFC62CDEA22B559C64313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780410, "uuid": "9ac64d98-3019-406b-85e1-308216956ea1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780410, "uuid": "428fbab0-105b-4be8-9c5c-87cf510e431c", "value": "12288:6pkePAIE/fEQWOrgoIoZTGzUdVYijJ3KeC1ZhcXnyXx6q16ahRZ5G:QAH/fzdrgEGMVDjJxC1H1NMS5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780410, "uuid": "9ad0fbc8-f04b-472c-bdfd-82803b06ca92", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780410, "uuid": "e92f1892-0907-47b7-a883-b3eb9052ebf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780410, "uuid": "f0434fbd-af4b-485f-813a-afb29c932a78", "value": "PI20230108APW Shipping Draft Documents_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa5a295-a6fe-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675784912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675784912, "uuid": "bc461c58-872d-48fc-937f-41220a45fb49", "comment": "Malware payload", "value": "c0ff5a31c391f81c1c1c12840fad84e0", "object_relation": "md5", "Tag": [ { "name": "amsi", "colour": "#C43C07", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675784912, "uuid": "e93bea3b-375d-4939-8042-0c125a643531", "comment": "Malware payload", "value": "1c027f192e468017f03d784176282ea4cbd86836d98e1c4da590b04c3640a7e0", "object_relation": "sha256", "Tag": [ { "name": "amsi", "colour": "#C43C07", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675784912, "uuid": "66802584-59bc-49de-8cf4-fcfc9dcefef5", "comment": "Malware payload", "value": "b07b0da8a253084be3beb4be59c6673f3017e1d4", "object_relation": "sha1", "Tag": [ { "name": "amsi", "colour": "#C43C07", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675784912, "uuid": "b58a2e5e-86ec-4571-9809-d282babbdc23", "comment": "Malware payload", "value": "ec3db57fcbbc3018b16d8cf4714ffe0068643728ef59fdc47e6af9f3b76937cd929ee41e7f7a464cfd19851e9942723c", "object_relation": "sha3-384", "Tag": [ { "name": "amsi", "colour": "#C43C07", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675784912, "uuid": "6c7d8046-a3ae-4045-922c-d7d26248a86d", "value": "T19931247438BDEECCDDA675F8AC1A71D8FB5C5B45240802850AB3908D75BA13255E63F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675784912, "uuid": "45ab8b27-502c-480e-9713-26be61fb2042", "value": "24:tErukI1mGQeJEmVmHmiBZttgVWJMKZkfbFLy1NElZNOLYgSHZPfVhOk4j5OjdXZQ:BPa8SKWwjFL5fM7+Xa+CmK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675784912, "uuid": "5091bcdd-c427-4c76-bc13-b659ad3043af", "value": 1530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675784912, "uuid": "b3c4aee5-c53e-4377-a989-b03cbfeacf8c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675784912, "uuid": "c07717a6-e011-459e-85a8-79c0d5b26635", "value": "amsi.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76304096-a741-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675813511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813511, "uuid": "9581cabc-4243-4d95-ab47-476b80e3537a", "comment": "Malware payload", "value": "40ffaf3733b3997ac948ec301ebf87a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813511, "uuid": "93afebb5-3788-4a1d-8946-3bb12fb92803", "comment": "Malware payload", "value": "1c8930d16133483c91dc4def460a8c2561bfd788a460a0488bc59884f183016f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813511, "uuid": "beb6b531-723d-4170-9d0e-6076a9b65e62", "comment": "Malware payload", "value": "69722e65a946841d34cc914363cfb1f308a997b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813511, "uuid": "1865f50b-9362-4fb3-9764-98cfb148d7ab", "comment": "Malware payload", "value": "d6a93ee5a8bea4505e99718fec1b6fdeb0808f257e564188cf7ca123e434dbc2a2038138181296248d162c7336e0601a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813511, "uuid": "8174ca6d-bdf6-451e-904c-0683429ea8d9", "value": "T19FB40217F7ECD022E4B5573058F613D30A357EA16A38C36A134FAC6918725B4E532BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813511, "uuid": "edd997eb-745a-4e35-816a-8784c7bda569", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813511, "uuid": "855ae87c-dfc4-4634-b6e0-7bf576c0366f", "value": "12288:AMrNy90Ozid8WbSTJlbQ5Rs58aAgwwEtBI39s4pnDV:dyNc8vtu5RsVAgwwEC9seDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675813511, "uuid": "74907cf2-220e-4238-8001-bdb2baa7aff3", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675813511, "uuid": "28942c5a-6a42-4e36-a175-e078d92ec73e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813511, "uuid": "743c3075-0f4e-4350-a023-754f10b22937", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a28f33-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758556, "uuid": "f28d268c-819a-4b24-9c9b-3e37aa5c807f", "comment": "Malware payload (Gozi)", "value": "ac4762aeceac5723fadbe875a5e45482", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758556, "uuid": "699007d0-c43a-415f-a8a5-bbb388d51a5a", "comment": "Malware payload (Gozi)", "value": "1ca3355a60dd6d310817f9ec5b9f73169c1e4e36445eac4ca12b110ff0308711", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758556, "uuid": "13b14540-3388-4ec1-ac98-ad79817b4edd", "comment": "Malware payload (Gozi)", "value": "229e3917e2bcd1f535929e63cab54e3de6d062e1", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758556, "uuid": "5bd3451e-9dd6-43e8-be90-9978b58c9fef", "comment": "Malware payload (Gozi)", "value": "236299f0d952e5f378f37920a1afefc39f3f08702350a2b3c0616fe426d662fbf39d90713ff9b382e475d90a3182f0e3", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758556, "uuid": "d6fa185b-d278-4c60-b223-65cc0e69f862", "value": "T190A18D90E98E1D77BABCD484D6BE52A9C105CEC7347F0922F32F4C6E98C2466333A185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758556, "uuid": "94fc9280-5482-411d-8e31-26cbb2994bae", "value": "96:8ZLPGjYOWFI5IdhoX1oHhOU3rHmwbi2ZI1D72a7/YaNx5xdUjo:8ZLMxWFI5Id+oBV5226DZwqnUjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758556, "uuid": "84ce6e90-85b0-44b2-8b21-a962d23b1ec3", "value": 5053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758556, "uuid": "170c084b-f9fe-42fc-95dc-5ad7031b0732", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758556, "uuid": "934e0dff-dad4-4e0f-a49a-bd2b4d4158e9", "value": "azienda_06.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83285cf8-a6bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675755980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755980, "uuid": "5e23d66e-b774-4cf7-a734-48a0b904fda1", "comment": "Malware payload (Mirai)", "value": "1db147b36207e873bc3fab7e94fb23ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755980, "uuid": "1b15203a-7bcc-44df-94cd-27e634c4cede", "comment": "Malware payload (Mirai)", "value": "1d10da957f68f353d1731c7a3e949c149e1c383088b979937842f91d9732521c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755980, "uuid": "57c0cf07-d3fb-4e54-a9be-d8182dbc7bf6", "comment": "Malware payload (Mirai)", "value": "135bf8ffa8a29e1710830c3008bdf1c93b80b2af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755980, "uuid": "3e9cbbbf-2953-46c0-abc2-54247ed3e860", "comment": "Malware payload (Mirai)", "value": "73455c84429f619967af37fbca84c9f562f2625a619c97d6bfb1db87420219803a33196751d68247b48598c06f9e52ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755980, "uuid": "bb3da868-9f16-4465-84fd-a8e2e3a35d54", "value": "T1C1F34C06EA404757C1D3277AB68F424933239BB5A7DB330599386BF43FC27AA0E36951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755980, "uuid": "e1a19540-8d28-4264-9a6b-c9cce7bc4979", "value": "3072:6d5SDWaUKVHUGcw66Aq73RjjB/r5PM/9df1gmJwwFlQS48:q5mWaUKVHzcw973RvB/r9M/9dmmJwwFv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675755980, "uuid": "80339908-8b2a-42c9-b0fb-f6b3e01a7059", "value": 171281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675755980, "uuid": "7ea43468-77c7-40d0-bc3a-3456e73a26f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755980, "uuid": "2d21c008-ae8d-4f83-b011-82d2b43be19b", "value": "1db147b36207e873bc3fab7e94fb23ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00fd9c9-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758659, "uuid": "c0cafc64-ed95-4813-a39b-274d096fc9f3", "comment": "Malware payload (Gozi)", "value": "77cc380da2b3550a329d8b01102d8a6b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758659, "uuid": "b6df6786-4350-4080-b1c1-65cd962ea617", "comment": "Malware payload (Gozi)", "value": "1d12011e9ed01e22474f828d9f3e44312d1c4032f3623f610d7adb277ccfbff7", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758659, "uuid": "4fe93fbd-6bcd-4085-8847-11a33fc5d7b3", "comment": "Malware payload (Gozi)", "value": "4d76547fe5530ee1ec423d90eb6d1b56d478e23d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758659, "uuid": "89921836-cd07-40fa-9c35-ef0ed5fc2ea9", "comment": "Malware payload (Gozi)", "value": "82e9b618a88e822442483a0953a48ad5adf41cbb59fa4f7212d5032acd7e8b52f96499bdee39e68763edf47a2f82b759", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758659, "uuid": "6e711c40-e7d7-488c-b009-f0ddef6d4019", "value": "T121A18E060E8E90B6C888546D4DCCD5DBFB485FD8C87D571B660F85EF2D32AA125A2491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758659, "uuid": "e5d79cc8-4c71-42f1-ae33-09700e592c81", "value": "96:K8+4XSmf8rQNeqWJm/hUd1dqlEnmDKdD2jSPXis7qjKtBNBmBZzOiNsaL:+4XSmfheNUJM1dqllKd7vivjKqvqiyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758659, "uuid": "aaa5be36-e0ae-4eea-a015-6d48e4413366", "value": 5056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758659, "uuid": "4cfca46b-9989-4809-a612-c392dabb9dab", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758659, "uuid": "0e9d09c3-22e3-4de1-afbd-79d025ecd4d5", "value": "azienda_25.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "740fb3fc-a717-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675795469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795469, "uuid": "612f88f5-c405-4d9c-863c-ca1d96ab0da4", "comment": "Malware payload (RedLineStealer)", "value": "a68f9c7fb241d93b34db01d4b1a78afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795469, "uuid": "7ec6e03b-bf31-4167-b9b9-7ccae4b9e091", "comment": "Malware payload (RedLineStealer)", "value": "1d5ffa1548ce6fbd5047aa5d162c4738217480e64c707102e8970f70515cf183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795469, "uuid": "158a499f-30df-40c6-a5d9-e88477856549", "comment": "Malware payload (RedLineStealer)", "value": "094f8243fc36b59f8a28c25566b1f6748d96626c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795469, "uuid": "d773570c-0d36-4e1f-b4c4-b98a92aa6541", "comment": "Malware payload (RedLineStealer)", "value": "1d22fbe45a5040ba778f1680024628b2eead45d0a0aea0e77688286a5b23e193f335ad45e839e42e4fe4e3a3d98bfb76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795469, "uuid": "68fbde18-d000-4283-bd50-0497d7899444", "value": "T14304D51437FCCD11D0BA1A3F6962A45046BFD802A942F25B76C767CD0E36B40F95BAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795469, "uuid": "386c013c-dcc2-4a89-8bfa-988823089b95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795469, "uuid": "07ff72c1-4fd5-4b5a-8767-11fb455d39d5", "value": "3072:NxqZWfLaoQ1V8tve7596h7DxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+cat:XqZ+ty6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795469, "uuid": "7f7823a0-2dce-43ac-8886-1dca94c12983", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795469, "uuid": "106da484-091d-4374-a675-021febaa25bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795469, "uuid": "4e295274-840b-4c75-87b3-70656b27bacd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfcaa9b-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756911, "uuid": "31b36721-c72e-452d-991c-ab2f51bd9fb4", "comment": "Malware payload (SnakeKeylogger)", "value": "7d9f8da2fa18478e2d97c157d0f2e747", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756911, "uuid": "1c762fae-fea8-4200-831e-470154849c1d", "comment": "Malware payload (SnakeKeylogger)", "value": "1d8026ad409084260f2dae852d0f179766b5c59e32f892e97d04b3c6cfda392a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756911, "uuid": "7145af45-a777-447a-9d61-6db975c92e49", "comment": "Malware payload (SnakeKeylogger)", "value": "881247ac1acc18c6a5d5f688fb6530a650644b44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756911, "uuid": "1f23c39e-e5ab-45e7-935f-7abdff39bb23", "comment": "Malware payload (SnakeKeylogger)", "value": "4fd30ea1bc153a4a2eb70faaf5d34e4a3934ac3e074ff552ac252b9ec29a02991ef007948be98d96ab67378e934417a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756911, "uuid": "33b98c39-4c7d-4dfd-b3dd-a13c4c769505", "value": "T18BC1D521A7DC0737ED724739ECB343400238A751684BCFAF79ECA41B6C167994A62B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756911, "uuid": "94d7f8e9-6852-46df-bec2-d9d8044d036c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756911, "uuid": "58f226e2-df10-428e-a8de-0b17790d0546", "value": "96:utBuJqkf0X8bhUI5LN1/pl2tAkljUzNt:uvuJB02hjLr/e/he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756911, "uuid": "d02cf9cb-b6ae-442c-ac5c-ebb927fa51e7", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756911, "uuid": "b817cb0c-6407-43dd-91f4-10c59e1dc865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756911, "uuid": "42585a47-d090-4ec1-9727-23de5da20f05", "value": "Ydfhvdwolyu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1edbe52-a722-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675800404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800404, "uuid": "bce85735-9686-4e94-9b64-8b93e7d5455c", "comment": "Malware payload (AgentTesla)", "value": "c7508b17f612317bde1f4611d7b84ab7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800404, "uuid": "02502ac8-c9cf-428a-a341-6ca6959b05d0", "comment": "Malware payload (AgentTesla)", "value": "1d8f55d70ae82861c011746d887f4759b1a6c8d78415fd2ad120ff28c83e1cc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800404, "uuid": "b2346a8c-0819-405f-bb4d-7e530dd607ce", "comment": "Malware payload (AgentTesla)", "value": "e8349d8f85e7e9ba0dfebfe57aa2a2875fb55b7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800404, "uuid": "302ca6f9-65c2-41f5-abfb-dc7f81846f58", "comment": "Malware payload (AgentTesla)", "value": "aeb1a428975b8a3300e5c396061c93f9018369472d5328cba80a6379902b191d02215315dbceb49d3992a5bb2bf22f3e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800404, "uuid": "7e5bed1c-a57f-4ed9-9ae0-8916f832f58e", "value": "T1916412003BD45073D5924A710FBA6373ACA9FB2B99779B5B0B14910EBB353725A0F389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800404, "uuid": "d08a46e8-7d67-4fdc-b3c9-f5d6183e8f25", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800404, "uuid": "75a36393-b4bc-474f-9f88-c8ac6e180c7c", "value": "6144:/Ya63b9i0JX5GTTfxqO7QWqcOj0HRzKQnZHOCygu2WmGDUijafgRlD8wJUnV:/YtUzcO7QWqN0HcQnZHOCyf2Wm0jafg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675800404, "uuid": "3cadf5f8-08ed-447f-bb4d-37d05aa31167", "value": 325775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675800404, "uuid": "03d9421d-85c2-4f4b-b12a-1cdf6f007892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800404, "uuid": "de703048-76ee-42b0-8386-e778f0203290", "value": "S O A-20210292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc6d129e-a716-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675795214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795214, "uuid": "17318a9e-85d2-44c8-8662-6ae688bc63ed", "comment": "Malware payload", "value": "d0adfd6a3ae38491118d11e6caacd186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795214, "uuid": "39b6911c-3fc2-426d-a405-9d465819ad1c", "comment": "Malware payload", "value": "1e7586126018ff22f443a86f027af1e94cb7746d0acdd4814c4970fe33d82b04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795214, "uuid": "4b7b2663-f9f9-425b-93eb-18f76ab456ee", "comment": "Malware payload", "value": "6ebe1f86e07fb3fbc79e518bc6d8eb02913b11e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795214, "uuid": "373666d5-0acb-43b0-8ff9-f43771f7f87b", "comment": "Malware payload", "value": "e4453c8414b1639254035394d01574c2e829380cc5afce17186e404931429b7a986956317a4f6e39dd6e7c4e261cf79b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795214, "uuid": "f731979c-463b-4ae4-b15f-bf37f8ffbde4", "value": "T10545AE72F78208E1D3101678C9FF2339DEB877960A25CD6B6694DD741E7A130BE26392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795214, "uuid": "eec7a426-886a-49e3-91d9-a59bd1f5302c", "value": "24576:8HrUZK3kA2VJT8TwnQCSPRI23bkmb5tSdaqOQgn9MX2R2XB4kVyigqlSiAClS9oD:84llE9o9GjBraKQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795214, "uuid": "093c727a-0ea7-4bb8-9110-a8befe48b8e3", "value": 1221632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795214, "uuid": "f90600e3-9f24-448b-9a3e-664cad999542", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795214, "uuid": "a2f0f01c-49e4-4fc0-b097-2e77e1169383", "value": "SecuriteInfo.com.Win32.Trojan.PSE.1G80G6X.7216.15072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f298c81d-a6b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675751443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751443, "uuid": "2a151f55-60f7-4986-b1b7-03bdd74409c2", "comment": "Malware payload (TeamBot)", "value": "7563e27ce546852f6ca535a8e1326b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751443, "uuid": "1925de1f-aa61-4cd8-9f36-18a42f520881", "comment": "Malware payload (TeamBot)", "value": "1ec8dd51c49d6dc42ecfc6668472bda5c3eb83ad10f129b686150ae4cc9d33c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751443, "uuid": "8f722b9e-8744-4a77-956e-70f41dc08a4c", "comment": "Malware payload (TeamBot)", "value": "e86611a83b813cc26e31c5cfe70bc8cb5982bbc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751443, "uuid": "c0471f48-b42b-4a0b-a4f8-40b0e71d37ac", "comment": "Malware payload (TeamBot)", "value": "bf0e912730d677bb0c50001146762aed68427385807e0cbb64cad79bc90f0bb5080f21d629ac3d4f13d581f9607ec2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751443, "uuid": "7c80cb94-aecc-48fd-aea6-fd6a1f2e7c46", "value": "T1B114D02339C8C072C56B15306C20E7A46B7FB8325675C99B779413AE8F70ED16A3539B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751443, "uuid": "510c8486-c2c7-4176-857e-0dd095d80ddd", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751443, "uuid": "e863808f-3224-45ff-872b-0f731cd7ad7d", "value": "3072:SzOOc63cn2LZe1WFpJ5DQtXG3AiPtdL57Gv+ErzNWJdMxSK:SzO4RLw1ntmZhWUD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675751443, "uuid": "8f88c1d4-0023-40e6-b2e2-dd39526daf6d", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675751443, "uuid": "4ba84abf-29a1-4e91-a68a-5dad84c3b732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751443, "uuid": "a0166a7f-f01f-4cc4-813f-c2939360a5ed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf6eb5a-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675796420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796420, "uuid": "f23c21d0-2dca-447f-a5cb-2e268faae7eb", "comment": "Malware payload (RedLineStealer)", "value": "6e2897065c6967039b56c4c77dd9abcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796420, "uuid": "562f41f6-4a2c-4d9b-a8c6-c8463fc6b6e6", "comment": "Malware payload (RedLineStealer)", "value": "1eceeaa97864dcd07dee586c379a7cb4e1e00ba3d7693844bab48601adf37d1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796420, "uuid": "4b69f166-37f1-4871-b038-5d10f5aef583", "comment": "Malware payload (RedLineStealer)", "value": "0f8bfaad9138308c5f21313cd93fcac28db92ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796420, "uuid": "eb9d358d-7d2a-4d67-b15a-e9a069375b49", "comment": "Malware payload (RedLineStealer)", "value": "b7a4435d8735f7dc989adf9b5750d1f3020ddb828f5c2330e85a89671e4f0c8f73f65ade0ce69479a3863d435059717e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796420, "uuid": "08687996-0012-4fbf-b7a4-a304235ed2b3", "value": "T13A6402323680C072C56A55744C31DAEB7BBEB87055798A933BA417EE6F206C1673732B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796420, "uuid": "ce2df6e2-0819-46a7-a2a9-de527e481e22", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796420, "uuid": "1ca80b67-2991-4244-b67f-0c2b0a4ef203", "value": "6144:sQwe5QLy+U/CqcUvi3YZUIqRr8W3fIbG9w7ZxhOoxJKLf21kCe0:sQwe5QdUbcUvi3FpRFvISMhOvL+n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796420, "uuid": "ab804bd3-dab6-4587-bf02-a37d795baafc", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796420, "uuid": "e65c9695-458f-4d64-ae3c-0c281321081b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796420, "uuid": "95ad63f9-fdc2-49c7-8f51-7115b6b6491f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5fbd3d0-a687-11ed-88f6-42010a9c006e", "comment": "Malware payload (Casbaneiro)", "timestamp": 1675733732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733732, "uuid": "cd17cfe9-f667-4244-9814-9409c5cd30bf", "comment": "Malware payload (Casbaneiro)", "value": "0556e50627259d2596982680f91388bf", "object_relation": "md5", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733732, "uuid": "fdcb224e-47cb-4136-8495-a9c045e9e7d5", "comment": "Malware payload (Casbaneiro)", "value": "1ee3b3d74a7b349cbd8c6e8c6c269f1680ed62997bc455f11f575ea3f8e889ee", "object_relation": "sha256", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733732, "uuid": "6760930f-83a8-4986-bf74-ac6eb5056fa2", "comment": "Malware payload (Casbaneiro)", "value": "6763ff3ec641d04996e25487eaecc3f3063b67cc", "object_relation": "sha1", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733732, "uuid": "abd16f34-e9a7-4e6c-97f2-593960e4fc46", "comment": "Malware payload (Casbaneiro)", "value": "931081d705d2991eb2fc8be575993ae618d923422358ebcb7a512b3ac670357f5b7e876ebc662b4c75fa44da0178dedd", "object_relation": "sha3-384", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733732, "uuid": "f0c4b9f8-8f19-4a40-9915-00dbb2c60d52", "value": "T1FC17330BA2F95CC6ECAB61FBC61C1685168CD76781D3FD87969D139DC683630E09383A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733732, "uuid": "a991ef4b-7a92-4d01-80db-5ab650dd68f7", "value": "393216:P5EXwJbFtvUAcXxw7TY/Z8rfKzGRu/s4B4Vtl/xUzspvg7+TacOp:hEifvUfwwarfg/stVtfUgpa+G9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733732, "uuid": "2a40827d-68db-49b2-8db6-8a2a1baeb8de", "value": 20148360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733732, "uuid": "b6501293-27d8-4986-8071-43519a6085b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733732, "uuid": "5edb907f-88a8-4684-b099-080e22619110", "value": "cliente.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e1ead86-a693-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675738846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738846, "uuid": "3f46c3a7-4a5f-4041-9367-6563e263010b", "comment": "Malware payload (njrat)", "value": "554d3ce646c69f1a0245f3cd954435a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738846, "uuid": "b87298c7-ca3d-4e05-b92f-fad29c03ee50", "comment": "Malware payload (njrat)", "value": "1ef5af7c9b8370f6055971865131011042f2828e4109684b1b7b27c12ce7e511", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738846, "uuid": "5b18b9c2-8667-42e3-9452-9aa4227a4549", "comment": "Malware payload (njrat)", "value": "a870343c01ff40152af5e2726958733e06f8bf2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738846, "uuid": "d4b8623d-adab-41e5-8cc8-72ba1ab2611a", "comment": "Malware payload (njrat)", "value": "7653ef72cc63d27662c1ca9a7a4b849e584927e6fafc0540c52ff2cd72f9d275ea758efdfe262f4554cddd9d21186c53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738846, "uuid": "03c9a01b-790b-4f06-9e73-ef921f79127a", "value": "T15BF4E14B3E60B06EC456C933E5981D2C56567D6EBECBD20B901F35ACDA3E6C68F014B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738846, "uuid": "5147c9f0-ed06-43a7-8e4c-2fc7df9f9842", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738846, "uuid": "ec69e932-fd79-48bd-91c2-9460daf60347", "value": "12288:d5PA3zOrx7p58lCrd4gyQapWMsKVMtUPO7ioWnA6Hooly+uhvCl5S3ObL1/waxMi:bA3CrxN5IC54TWMFMenPIolyzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675738846, "uuid": "630104a2-1f89-450f-aa74-af7e64d4e7ba", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675738846, "uuid": "00629c4c-d3f1-4ba2-a235-4092f7df5524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738846, "uuid": "949ebb3f-b5c1-429b-991a-9317c01d3f9c", "value": "IMAGE119.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c467324-a687-11ed-88f6-42010a9c006e", "comment": "Malware payload (Ousaban)", "timestamp": 1675733689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733689, "uuid": "561eecad-7c36-4537-9edb-caa4ec522ef9", "comment": "Malware payload (Ousaban)", "value": "407c99a70c52cd97d6b52221e0ef510f", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733689, "uuid": "ffb06ec6-a1ae-4e13-900a-08a0e5764cf8", "comment": "Malware payload (Ousaban)", "value": "1f3b025d1455263b6a4a9b9d3c4624de23ae432b84d43e963fc5790de57d9cab", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733689, "uuid": "d05eb4df-49f7-4fad-aec1-646d9e01de73", "comment": "Malware payload (Ousaban)", "value": "1765e9efc4c1a2d33573edb0ce417ca307fb8f54", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733689, "uuid": "c6b81097-b7c5-4259-b15e-1913162d212f", "comment": "Malware payload (Ousaban)", "value": "0ce836fe5e9c2904d8d0749184aead90173a819cafb2639c557ee060a113ca19044d71fb704a482ad41845967a8b4158", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ousaban", "colour": "#60B6EB", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733689, "uuid": "787e545b-dfa9-4f67-ba69-296edb592238", "value": "T17F27336E22438FDCF78F87BD29DE9BD81ADB16931112B6C5ABC525913E7397BE180001", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733689, "uuid": "6d56f747-1b77-4941-96fc-35004a9606b2", "value": "393216:ek79udFAsqKxIjX4v33NsNsW55HJ/2AR4ZqPuVHRHjbU9NXjm2DYXASmJ1C1:ekpudFA4IjIfesW5B0ARabHjbeNXbDYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733689, "uuid": "58604c65-c59b-40ff-98a2-ac4f7b00913b", "value": 21066599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733689, "uuid": "deafd7ff-9e62-4b43-9025-64771a46cc8e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733689, "uuid": "0ed2c3a4-3cca-4340-bb8d-d331b602d2e8", "value": "modulo.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7022f057-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757237, "uuid": "7f5b4b4a-e1ac-4c33-998f-ae8a4860b241", "comment": "Malware payload (Gozi)", "value": "6e245f764fc232e709ab229d597da208", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757237, "uuid": "239b4556-31bf-4dec-9bbe-f2a9ea32c8c7", "comment": "Malware payload (Gozi)", "value": "1f3fddaed498c61952e457b3db46ad7438ca43fdbf7593c02ea52ab2b170fa59", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757237, "uuid": "cdff5abe-dca7-4117-894b-a14b72479060", "comment": "Malware payload (Gozi)", "value": "f9ab537d3aeb31211eea9ecaeb3c8e38359a41f3", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757237, "uuid": "92bbc3d1-93e6-4a6c-ba9e-41be7d3f33b6", "comment": "Malware payload (Gozi)", "value": "9d985c7e2b8a7404a3935cb1a6e5568f4c66b16ed167937b491cfced44d03ecf4a15acc90b480bc31dde782010ca6e3f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757237, "uuid": "112fbc63-2e37-448f-b04b-b6feb9f0e7d1", "value": "T17AE18D9EADDBA41BA74442EFF2733C20FB60157AC9297204B5E5E70E6B63B27014135C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757237, "uuid": "ffbba139-24fb-42fe-b4d3-a48baa054ad5", "value": "96:w9FewLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dj296f:gw2U77rIKdn863jMM0OD9+VVF48xYkuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757237, "uuid": "c8313899-4e09-4749-87d3-065aff96eb5b", "value": 7013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757237, "uuid": "707eaded-9236-49f6-9ef7-be74b03f42e1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757237, "uuid": "4212b229-574b-4ee4-9899-b66f91a8e606", "value": "azienda_05.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4594f9-a6f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675781983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781983, "uuid": "aba1e033-02b1-44ca-8ff0-8b0af33a72c2", "comment": "Malware payload (RedLineStealer)", "value": "b543fb742395165641484a8f0b271aef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781983, "uuid": "48aee838-372c-495f-963b-518aae1fd8b2", "comment": "Malware payload (RedLineStealer)", "value": "1fed3c831601786d663cc55dad03a3f5a195dcdfdd2501229b9fb941343229b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781983, "uuid": "50f07e9f-0be6-4c63-a566-1ed2b0336c82", "comment": "Malware payload (RedLineStealer)", "value": "75667784ab45cc533d42ebb07ba62651f725f65c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781983, "uuid": "20e41477-2e1e-4b76-bf04-d02130584fa6", "comment": "Malware payload (RedLineStealer)", "value": "fe76564d279038392d0896eeec2d09ea056505510bf093f4bbac908dad485d431fd0bea8f9bc2daf99b7fb6311313da0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781983, "uuid": "a347fcc9-6018-4da0-8fcc-e90c6093683f", "value": "T1C064F23236D0C072C1AA44755820E6656BBEF8315976894737B8076E8FF32D0AB37B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781983, "uuid": "9b9035ad-eb6c-4322-9d5e-493e9bf5bed8", "value": "cdb2dd381be56018fc9552ac3271a401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781983, "uuid": "be90b323-f785-48dd-b49d-9be62dd666de", "value": "6144:NGVe6xWL3LopKa43Pt3FUH+HSZF1OZ7eRBHEJEnM57CAFR:NGV5xWDL3zFSZXukHOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675781983, "uuid": "ed993aab-ed19-486e-922f-8976e81a2dcc", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675781983, "uuid": "e611ebe6-fa1e-42a2-8a17-3d438f6d4bb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781983, "uuid": "ecdd04ad-2374-410e-84f0-ea04f4837f32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76750fb-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758725, "uuid": "f00f5b6d-3b89-4e23-8491-95ab07f123f8", "comment": "Malware payload (Gozi)", "value": "002dddf9b5bcdd839ffa9e8f29f05310", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758725, "uuid": "8df2c393-8f5a-4e3b-b2cc-affc63348bf8", "comment": "Malware payload (Gozi)", "value": "1ff4d346230746c3bb15df0049494d8b7b0807e69e97d5db3da73c96989a5fa6", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758725, "uuid": "41a038fa-652b-47e6-ae37-cd9189beb987", "comment": "Malware payload (Gozi)", "value": "104012dfddbae94c8d8fc68c066f7210cd9fc9a5", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758725, "uuid": "c825edad-26ff-421e-bacf-53602a234553", "comment": "Malware payload (Gozi)", "value": "3253e85d05dbfefc13ee09e46d378282785e32fc6a547f218ae94a29a5b9bde5ceb3bab7d1e58fe1f5efe70c4259f8a6", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758725, "uuid": "f17711c9-8246-42c9-a561-d9f131908e3e", "value": "T119B16DB2C63A774404E0891CFC3AD5A7F0C07897ADBA2B138BB2539E15E6455A833655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758725, "uuid": "adab4327-f1b3-4163-bd1f-0ffc64be4a4c", "value": "96:6LTfFh5rFT85Zn5UP/aJDa0koY+J0R6vMiuWEslne33TJKJ8BxZiX:6Xdh5rFT83nE/aJDzkoHuRqHEslqTAi0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758725, "uuid": "cdc7db63-fd5e-4bd2-bc64-14992e3b8978", "value": 5099, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758725, "uuid": "80896351-166c-461c-97dd-50de22cd53b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758725, "uuid": "b58578cb-87df-4c96-a763-515c82f33481", "value": "azienda_38.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78688546-a6df-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675771424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771424, "uuid": "9af3e6c2-757b-443c-9e50-02b5970254b0", "comment": "Malware payload", "value": "ba4f553fa6e6a87d5b31f4dbc7d56410", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771424, "uuid": "f9008213-216f-4289-9afe-278391111085", "comment": "Malware payload", "value": "20edd331517d737079b1f3a6f51e73028fcbacc1bbdf52e2932e39936e8aed6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771424, "uuid": "20896f96-58ef-4eb7-aee8-7c4ee13da67b", "comment": "Malware payload", "value": "e3df6aa9c8fb9e53958d7d27ea4bba5c521c4ca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771424, "uuid": "1494b853-b138-488d-897e-a77aa7c1bc1f", "comment": "Malware payload", "value": "99aab8681eed5237a78f6a74d06d73a42367647198b008a43bdc367b60e4a4e3ee66b24558c377c6eaf830f3f5c8b58d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771424, "uuid": "707cd137-633a-4c62-ade7-f85d59abe902", "value": "T1DEA23C01A3FE2710F2BB9B75647927D2CD72B9DAD911A7CD1688004D5AB2E408FA4F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771424, "uuid": "0ad4e07f-f4cf-4a66-88b8-7203cd1df6d9", "value": "384:VFLIOnxsbaWBCaCvDM82lKKLh0vEwUIjt9RB6wg6/szZHlJxGCm7O5rA0:Vac0c8qKLhu9tg4aZHlJXmIM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675771424, "uuid": "3854faf0-8508-4450-bc4d-c402fc3901f6", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675771424, "uuid": "601ce440-b26b-4292-ab71-90b15b471b57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771424, "uuid": "d4c4e708-8603-41e0-bdb1-2d78bb09bab0", "value": "20edd331517d737079b1f3a6f51e73028fcbacc1bbdf52e2932e39936e8aed6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e21643e-a73c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675811216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811216, "uuid": "34ed11f8-32ad-4179-acf5-c9dfd5810dd9", "comment": "Malware payload", "value": "d2abff91975a8c8d725a6553446305e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811216, "uuid": "d0d5a437-57ba-49af-af7d-6ca2a20b9afe", "comment": "Malware payload", "value": "20fdf1470b8086e729fdee2db30a0db05710d8d3bf1eb5ce75ab99cac8ed29a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811216, "uuid": "ac1a6701-77b9-4d6b-b5b7-66f38b5e0b05", "comment": "Malware payload", "value": "553ec350a357a74a859ad915bda7057bba206f28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811216, "uuid": "b91131a6-bca4-4abb-9944-8ad72ebcc05e", "comment": "Malware payload", "value": "ec4d0682aa793b70b81e83b83691fe003cdc04defaa6ec2b1a6cfb496dbe8108c63c60c0e1fe1fc7e3f774262e1895e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811216, "uuid": "4630e91c-aa5d-45d1-8890-7d566f101437", "value": "T14A14D0323A80C072C57B15305C64EBA42BBEBD3146798D5B77993BAE4F702D1673A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811216, "uuid": "828e8d25-c34f-43f0-a6ed-375ae3f5c4f1", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811216, "uuid": "35d12992-2c65-457f-8b80-728ad28de138", "value": "3072:Bd+OMaDNh/yLEKSZ7WZk5KwDsK5RNyNN3/fwmRijASdP4YSl:Bd+a/yLEz7Ef2s+R03FijAggYSl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675811216, "uuid": "14ca2e25-2f95-4d21-ad74-287d3655c2a6", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675811216, "uuid": "1d30d69d-f9a7-4067-9ecf-54693d3da181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811216, "uuid": "24517671-9114-4571-9848-a93dce6e6feb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ff4fd6-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758567, "uuid": "04332d59-0d70-4e0d-a897-18a0183012bf", "comment": "Malware payload (Gozi)", "value": "28690da8a338ef6a8a23ecd0009cb023", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758567, "uuid": "4fae37b7-4654-42aa-bf3b-7ffb27fc3322", "comment": "Malware payload (Gozi)", "value": "2143b79b0b7c54501fb794d757cbfcb237f7c9cab120a3f34944a62c64681911", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758567, "uuid": "bab06b06-2832-428b-a745-3d8380b8c51c", "comment": "Malware payload (Gozi)", "value": "3ebb0accc4aa65c47f9e683aa88d3480587e3d8f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758567, "uuid": "7eac02dd-b36c-4e7b-ba94-7a8512efa777", "comment": "Malware payload (Gozi)", "value": "529470a6552bdfebac94f8556b73a982c422ddaa2ccc9129d96b7b29257a0a17ac53ae3a8e08c7015acb6df35b64b70e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758567, "uuid": "39901c82-e815-4f8c-9bca-e90b912066e1", "value": "T1F8A18C60DBA3053526425200C0FFFFBB1558DF1228B62ABD56DC4B4E9BF81083B17B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758567, "uuid": "a568b887-c27e-46d1-ac5c-6c6b3c10b4d3", "value": "96:it3WC2LujyvRGeQEUPU3bT+zNEn6munsoKcpd/sXa/dLIW7bA62G/:QGjCjy0eoU2zSn6mu3KOEX+Rxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758567, "uuid": "bac054d7-e58c-4af5-a3c1-3e97f66eadd4", "value": 5035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758567, "uuid": "70fab5ed-6548-4fee-aff8-d0184ec90b54", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758567, "uuid": "ba49d12f-8d77-4881-b298-c4706a39cdcf", "value": "azienda_08.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11783e2c-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675789290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789290, "uuid": "cdc64008-2cfc-4e03-8e76-445b1403815a", "comment": "Malware payload", "value": "24272ec8aed7b3b5c3ef93aa3c7a8754", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789290, "uuid": "ea034867-2fdc-43bc-9573-89c05aa27533", "comment": "Malware payload", "value": "21ba88c289a87d289169c9881e8263bd4357b8a4e239a137fe181e816d58e8a5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789290, "uuid": "089984e7-57de-4d20-9df1-fc24211b2173", "comment": "Malware payload", "value": "e89c864996b9e2a36962d76aad0c053f16cab7c7", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789290, "uuid": "59b9ace7-fbc0-4e8c-b875-a07033bb6473", "comment": "Malware payload", "value": "3e353841fb8e7466f0454c84fd128ae5c4bb7847fba01af6b7f7262c0ad1bbae3413b805ea7343c6c9852fe05284f4b4", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789290, "uuid": "7a8891ed-02c9-46e6-ab5c-f6893af1abf9", "value": "T14535E007F277DD1BDE26C53CE84F248282129D3E9D19CB4E21C2B72E46327B1597EA94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789290, "uuid": "011a4359-547b-4731-9bb2-dc8c049b0794", "value": "12288:cFe7B551BkABojFeXQtqSdgFiQexdbMXUMYEbf3EuXjEVLTEVI6kc:cFeV59VojFeXQFmiQebbqUjiXKTEmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789290, "uuid": "60ae5ed8-468c-469c-a3ef-8454c5efa638", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789290, "uuid": "583e18b2-f246-4b58-af71-0407399416b8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789290, "uuid": "860c0df9-aaa1-4469-9172-308a7fc0914a", "value": "P.0415123.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4730ff9e-a700-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1675785515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785515, "uuid": "58ed1f25-b063-4b95-98fc-87de1951a342", "comment": "Malware payload (AuroraStealer)", "value": "7d26dce6ba89dedbd27455167f0a3044", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785515, "uuid": "1a9fa941-e832-4f45-be42-13d50acd9872", "comment": "Malware payload (AuroraStealer)", "value": "21bd925baf84272f5e5247e89646c8451c527fb4dbc15c4ac87615329d6d92ab", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785515, "uuid": "de6ec5ce-a722-4043-8d73-5303e3199389", "comment": "Malware payload (AuroraStealer)", "value": "19e3b77457a387ab5089b276056af074d0f8e77a", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785515, "uuid": "82a76b9d-4c6a-417a-a81e-24e358378d7f", "comment": "Malware payload (AuroraStealer)", "value": "1aa793db790d2e87f1d7bae551b05b88f3b9f0c9f8efb097e7dc9d3d30a83d4ff22aaf5b500d469d60110c5187bb8a89", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785515, "uuid": "c25c4e38-c1bd-42f0-aea6-7dbc2fb5333b", "value": "T1B976AFB979042CE6E57F427BCD96A9D823713D624F97A6CB4064B7C209733E4EE32904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785515, "uuid": "6a89900c-33a0-4e65-bf1c-e8282a0040b6", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785515, "uuid": "742020f2-49db-447b-a835-71977e33a6ad", "value": "24576:T0zKbWffNzzG+5DnKW4YRcTCDyO+QlehV7UC7vNbMWA9qIZ/QD83qZ/gbaq/EqJO:T0mbW3NzX5rtsTCAWtKCRGz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675785515, "uuid": "02882ec4-01f4-404b-ba23-b1a9b4e923ec", "value": 7665664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675785515, "uuid": "0beee727-7c4e-4cc2-bf87-1ff7c8e48876", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785515, "uuid": "7c7d3510-31fd-4aaf-bbfc-f7ac3f6b79dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebe2417-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758389, "uuid": "ca158427-d0e2-4e50-9614-e09aa2cc9b24", "comment": "Malware payload (Gozi)", "value": "d6979b7e7f15b105447fe0d2e98a53fa", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758389, "uuid": "e70289cd-7828-471a-8acb-376c0c29ad83", "comment": "Malware payload (Gozi)", "value": "21cada4bdd0b3dbdb1e5f64bb2c0a06cda4e0bddfb2d63f2e755e1a37ddf8ec7", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758389, "uuid": "a777522c-eeba-4178-9a02-ba3dd0eff46f", "comment": "Malware payload (Gozi)", "value": "a5e9f25dee72b1f3179acf5deaf0a458684457ff", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758389, "uuid": "fe8969d4-3e39-4560-a740-d5513f78e333", "comment": "Malware payload (Gozi)", "value": "5865db4736a56fc49a47925c8c1a529b450b3c4e41d52a78af69b38926675021b060b3b8e995e362b1f614960c62911e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758389, "uuid": "41c50b27-4bea-4bad-9c9a-ecaff3a2f267", "value": "T1A7E18C8E9DDB601BA78081EFF2732C11FB60187EC9297204B5E5E30E2B67727014125C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758389, "uuid": "0c8dfd7f-f263-43fd-97fd-debbda53fd47", "value": "192:PlXsU77rIKdn863jMM0OD9+VVF43xYkuE:tXz7EOM7/F4/uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758389, "uuid": "4f51316d-343e-4cd5-a9e4-ec45e4740314", "value": 7012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758389, "uuid": "891b951e-11b7-4239-8b9a-34c22cef20f4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758389, "uuid": "261ea567-e8e3-4320-bdc6-f716b15e71bf", "value": "azienda_22.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac46c38e-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756908, "uuid": "a09535c4-10a4-4d1a-baf9-7a37f2e479e7", "comment": "Malware payload (SnakeKeylogger)", "value": "a398e9f5d00b04227a234d1e56cc511f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756908, "uuid": "cdb39352-a34f-4c24-8dcc-4ba2a71e8226", "comment": "Malware payload (SnakeKeylogger)", "value": "2233a617a0675dd165ee018dae6ef94a3323c07b571b4ebf716440876b84e551", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756908, "uuid": "75357053-8aa0-4b03-9b5f-05b5b6f05e1e", "comment": "Malware payload (SnakeKeylogger)", "value": "9e40155253d0cf477ea93a2f7caab4fceff282a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756908, "uuid": "cc41f011-77fd-4177-8edc-d0cbd5119a40", "comment": "Malware payload (SnakeKeylogger)", "value": "425a541366a23038afb9c9dcb72335bc1a44d16cd265579c34af8d3bac4d1293af7a1c61e7b7189c1dd85fc5038207c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756908, "uuid": "71fa6b41-5b11-4387-9f54-6273b235dd55", "value": "T1235413593570A0EFCD9187334EBCDBDB9F61C4601878C34B1724AA5ABC67256AA2F331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756908, "uuid": "a522ea4a-b18e-42c4-b1d7-a9ec6d491cc0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756908, "uuid": "706650fd-ce8a-4930-975f-6a8d8d9162da", "value": "6144:vYa6dgmiXQSlNheaZ7guw9xRIFSvlVjV2qCCx90OI+NJ+b:vYPgmclNwakuw9xKFSvlxUqCgDIA+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756908, "uuid": "a5882c52-9e39-4738-8e79-3b408d1e6ce2", "value": 287638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756908, "uuid": "4caecca2-ab79-4b62-bd95-aa544dd5a4d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756908, "uuid": "2a282de3-5ac0-4b77-85cf-84bc8d1c2c57", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb164610-a718-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675796044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796044, "uuid": "b5a30842-28bd-40a2-8342-dffec2bb9139", "comment": "Malware payload (Tofsee)", "value": "546a040e4479958f7c6b862dead9a269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796044, "uuid": "88854693-8594-4a23-9783-6a67594bd676", "comment": "Malware payload (Tofsee)", "value": "229d8701db31564e7eccab699121e96fe75d70896daa87323e9c59da3be74be0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796044, "uuid": "9d031d3d-77dc-43fd-8be0-1d8d63f5c693", "comment": "Malware payload (Tofsee)", "value": "69a99c8f2fbfc316140690be348d6b54d6c01d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796044, "uuid": "3c88a181-5d38-4091-883c-7e1818cc6405", "comment": "Malware payload (Tofsee)", "value": "b6754d9fef1f360c8cef5b7d81b21045dd2f534f13ca3671e4844b8ffb389165e24b2d7bf101f8d59eee70901d431b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796044, "uuid": "3415c250-d3c1-408c-a4c3-657a9629489b", "value": "T18F14CF323A90C072C17B15745C64DAA56BBEB83046B9C9BB776807BE4F306D1523A37B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796044, "uuid": "f7219525-6c06-4ee6-bba5-f06cc3d48afe", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796044, "uuid": "c7c3519f-fbb8-43f1-a370-82f50c1642c0", "value": "6144:1JMjbyLY3DuTsP8d2nQO0o7MFGU15Ts+XAW:1JMjbyM3DW8qQa5TsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796044, "uuid": "8dfb121e-169b-4637-a5a9-c32fd5a3c7aa", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796044, "uuid": "aa6b0c4a-78ed-45d5-86d4-374582c76e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796044, "uuid": "fac069e8-7239-4184-b46b-97e195f0ca64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bf7752-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675789276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789276, "uuid": "8af60c59-08e3-4eb0-9825-6839b43f53b7", "comment": "Malware payload", "value": "484d14d0cadf5df8af05e33b1109c800", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789276, "uuid": "16f188e7-5453-41e2-9784-b2e44123ca49", "comment": "Malware payload", "value": "23073f04696ea6bf57f802b1cab1652ebaba661bb051861dd3c07b8c7afd4482", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789276, "uuid": "b5cf5f5e-093f-4fac-a803-d016e65f513a", "comment": "Malware payload", "value": "ff9c640780e15486064a22257ba1b0a252b13218", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789276, "uuid": "b77fb1b0-50ac-4ea3-a2fe-1701ca8e836e", "comment": "Malware payload", "value": "8634634ee63b4ef11107c0781093b7cccacb4f7e810d1660dc88daeda39c50f1d9484820d892176ddabded04f7dc4b14", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789276, "uuid": "51874fa2-98aa-46a7-8d41-7c23f313151d", "value": "T1C7440805FB04A96BF4124138A5E745D35221AC226601CE0F25DAF71E2F33FB69F76E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789276, "uuid": "a716fda7-0225-4bb8-880a-1e785a210c64", "value": "6144:BVNuVN8VYEZ+RwPONXoRjDhIcp0fDlavx+W26nAasB0GUQW:TspC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789276, "uuid": "20a1235b-5b00-49f6-9c05-37e9ed64fad1", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789276, "uuid": "9eb2867d-7789-4f81-b775-5c6afbb73107", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789276, "uuid": "ec932c58-ba95-4017-a07f-2b40a7d9089a", "value": "Purchase order MACL202224398.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d716e7f-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675783271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783271, "uuid": "14f65eab-1922-4ba7-aafb-84d72efc167e", "comment": "Malware payload (GuLoader)", "value": "db6bb137dbada59cc0d0ee55bebc2294", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783271, "uuid": "dcbfa6e7-aad7-49f1-8ac3-a28434f601b6", "comment": "Malware payload (GuLoader)", "value": "2316cba0fca6a225fd5d1b625a3926b236cde39ab020865a3dff5fd3f52d6662", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783271, "uuid": "8fe88bed-b98c-4647-8a28-2cdde2c1d342", "comment": "Malware payload (GuLoader)", "value": "2e3daa1aa18b0643b812c8c12d6dd2a29f778cf3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783271, "uuid": "3afc7fd9-7069-49d9-8527-d7dc15af7a84", "comment": "Malware payload (GuLoader)", "value": "369bdee619ef2065c10f93ae38ecb2bced6a26192d70cd3c6cb203ce72ef07a004e2d2a91633af7a489e18c808a4cd81", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783271, "uuid": "74513feb-d12f-4ea1-af37-0614b2f0ad8e", "value": "T165B4233F3E1232C522F0BA0D6D3E7A54EB615F970578941006D69EDFD938C9A8CBC6A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783271, "uuid": "6b9aeabf-5745-4283-9c5d-e77d0004c3c7", "value": "6144:er/PuiAWRsxCwk5YaLe1ezhEfCX2BE0h2szUZC/DQjmD2jg7ulnrQZqLpq82:er3NMCwuR6QufXFU8ky2jgArVpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783271, "uuid": "352db07c-150d-4492-8b48-838d79b5673a", "value": 503052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783271, "uuid": "041bde08-7226-47df-9e54-2c8eb491747e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783271, "uuid": "9126a086-0893-4913-ab95-c4dd42c63d2a", "value": "JUSTIFICANTE DE TRANSFERENCIA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45293403-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675758453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758453, "uuid": "e36378ef-61e5-4f0a-b515-66d55572cb9c", "comment": "Malware payload (Vidar)", "value": "36c4969ce66da101fa22ed04bc6a7cf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758453, "uuid": "d1f41a89-621d-4205-81a3-519dcfe76889", "comment": "Malware payload (Vidar)", "value": "2396f1b8efed3be248d271a168a65400b2aa12c117912ff43e981244199df2b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758453, "uuid": "2c322c33-bff3-467c-9a22-3cfb41b42d95", "comment": "Malware payload (Vidar)", "value": "1fe0416ebbd414702284eea1b19eaf974096a82a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758453, "uuid": "8c829ec5-f92e-4526-9560-c5acc99ba99d", "comment": "Malware payload (Vidar)", "value": "e0621e606ae5500d1ecbce92eeaa27a8dbfce0d99394f4a72893613b8ba896b10ee3ff3f2e418c75dabd1866d64643d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758453, "uuid": "40867736-b30e-4434-97b6-43cf9e37e2e7", "value": "T1B3271262FB4331D1D5E4887188277CF731B17D6B87C05B3AA4F8758108A279ABA36937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758453, "uuid": "849f857c-0014-4bb2-ac1f-1f491e61f108", "value": "9f95eae0e562cdd8c0f94b7ddd3234c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758453, "uuid": "35a4c58f-691c-4868-83ad-64b0fc451f19", "value": "98304:HAYXBtgbPrAuVAE6lu0gaq8JmGnVFJIBjg9KXQup70J8RgB0hJk48JI72P8qz7gH:FRtgPrAXEBXuwg9Mtx0JhunkJ4qz4FN9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758453, "uuid": "7b65e6f0-b11b-4a52-b75a-94271bf3c211", "value": 20963127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758453, "uuid": "541bdc9e-e3d2-4850-b248-48d6a99d04ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758453, "uuid": "6e1e4a4f-a9cc-41e8-aa7c-84138d25abd8", "value": "36c4969ce66da101fa22ed04bc6a7cf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0657ff0d-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675796144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796144, "uuid": "15df1eed-cc78-4fb2-b41e-d3196aef9e9c", "comment": "Malware payload (DarkCloud)", "value": "3b6d4bfaee1ec02d40aea7e72a7019c9", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796144, "uuid": "7bc50858-b1fc-4bce-a6cf-9d7ccf8325be", "comment": "Malware payload (DarkCloud)", "value": "23eed63b4cad2d62bc3dba9ab2bb79413c8a26686a02c7c9cd8489101b773c25", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796144, "uuid": "ca588f57-9760-4858-9714-952c154c2952", "comment": "Malware payload (DarkCloud)", "value": "b0cc90fe0390de45a5a43f36e1f8269c18508f5a", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796144, "uuid": "cbf96ef6-8e20-468e-b219-a601afcc6d25", "comment": "Malware payload (DarkCloud)", "value": "d6c8e82210497773dec8ec3569776392b731e8b5c730a071adf782dbab75d75ebd8e8629148722243d30e506b607c09e", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796144, "uuid": "4cb84d62-801e-415b-99f9-b55e1c81d646", "value": "T173459E113AF6C863F04A0E7460283DCC3A3CE4479BDD419FB972A96853A6776F9D8D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796144, "uuid": "30e84370-c930-4b0f-ad6e-a3f3068bb7b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796144, "uuid": "c63f943f-34b9-4dcf-9c23-7f41f669b245", "value": "24576:Zp1DYGDkjwJsoGlWLaXOxQjeO0eZCglfwGZBIS2Ru4W6wsX3W3:ZpdY5UsoGl7bV0+CifwGDWw6ws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796144, "uuid": "08c468fb-00c0-4b4c-bfb7-780a8e764bb5", "value": 1182720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796144, "uuid": "044369c8-220b-4cf3-ad96-50ea7e27938b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796144, "uuid": "9ed87b75-bdb5-4918-a602-d152bbf0f56c", "value": "orden de cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd6a943e-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675789203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789203, "uuid": "f12e0a49-ca5d-4f46-9eda-e517ccac4bb8", "comment": "Malware payload (SnakeKeylogger)", "value": "6be44b7fd8a33e642b44e5e0bdbdae04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789203, "uuid": "b35cb8fb-950f-4512-94ef-5d2d7bb15bd8", "comment": "Malware payload (SnakeKeylogger)", "value": "242ca6ecf909356b40f0e5938cdf6a4de7ca06504964dee91d2e0719a5e63a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789203, "uuid": "03d2806f-6a65-432a-ae64-a9919cc57982", "comment": "Malware payload (SnakeKeylogger)", "value": "95d8194436db4455ba193440510d4b3fead36fae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789203, "uuid": "59d6f642-2f67-4840-b963-55757a4b607d", "comment": "Malware payload (SnakeKeylogger)", "value": "7d9b806f2c9f3be79d96b3fe18c8c3709626533e57f141b72103bee8359550ca632503041abaf8eb791975e1ab225ad6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789203, "uuid": "a95e2a78-5ac5-4bc2-885b-9af48d7ecff1", "value": "T1D25412101368D4CBCC9206321D7E464B6BD6D83359785A3F37807969FDA29B1A82EF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789203, "uuid": "d3cab277-653b-41ef-bb4a-592093b440d9", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789203, "uuid": "55c0a068-3305-494c-b2e6-eea292e1a22d", "value": "6144:pYa6wXaAj1hYsxr7SOSr/xjfeHfvTmvG8nbzMlX+Qjc:pYCaAj1aG3SrlfeHjmLElXK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789203, "uuid": "68ae3a44-c230-4b7c-8f72-bcfa9b256af6", "value": 291166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789203, "uuid": "24a41bdc-ac4e-4b50-a7fa-35103788b8cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789203, "uuid": "67efbd4e-5036-4ae3-bb4f-46372958991a", "value": "SDG098765456789000090.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665b2a94-a72c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675804465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804465, "uuid": "e1725de5-6011-4f50-af78-f47389274c5d", "comment": "Malware payload", "value": "118e31e487dff4fdd123a96840c17d7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804465, "uuid": "e79ccc3d-1d3e-4aab-9e65-52454aa65b90", "comment": "Malware payload", "value": "244f4d6040890293116667371bf7a1875dbea9536eb2353aa31d08c50d1a1df0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804465, "uuid": "cd11c95c-c970-4399-b7bf-c1821d90e9b8", "comment": "Malware payload", "value": "0005ae43a7ba3125be0922ed90b6a244b3de4a6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804465, "uuid": "71efe287-fbd1-4a66-83c7-44c5609047d0", "comment": "Malware payload", "value": "7491ae91fdc3a90fa0bec9ff4f276c2f55d9bc4af33193de233711dcff4e9797c10f4dbeec000506f582d5d593e2426b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804465, "uuid": "f7cc76cb-c0a7-490c-9140-a881bd108345", "value": "T152B4021BF7ED8132E9B4577019F602D30A36BE915F38425E334E6C6E1872660A631B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804465, "uuid": "cae6d1a1-d464-442f-b925-e1868e308718", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804465, "uuid": "c02600a1-0407-46aa-8f66-48d17708e1c3", "value": "12288:CMrmy90yC6mRcNudHMPcuPGTH8hQe2eiBetmsVPBF2:wyJcbFuYy2BBSmd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675804465, "uuid": "2370547e-0f14-4379-84fb-4b856f58546d", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675804465, "uuid": "62c6b142-6504-4ae2-9161-823a3aa8e8da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804465, "uuid": "7664f95a-7423-4173-91a1-914827dca197", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5cabe9-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675761656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761656, "uuid": "aa815418-576a-4fd9-b13b-5bfe8d925d64", "comment": "Malware payload (SnakeKeylogger)", "value": "a64dd42719e06596cc4bff9c4e2e37e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761656, "uuid": "c5fdef8c-dfbd-4c92-bd96-198d7f9f76b9", "comment": "Malware payload (SnakeKeylogger)", "value": "2456e8dbd02a0c11f05e467a09b64e1c8ca0b254191cf330a88db37b7cdeb7b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761656, "uuid": "0d3ae4fa-0cb9-4881-920b-56aed30f48e7", "comment": "Malware payload (SnakeKeylogger)", "value": "fa10f40aaaeae0d95359fcd7834d9459a3431a34", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761656, "uuid": "bfb3dce6-dc55-41f3-8561-3765c477207d", "comment": "Malware payload (SnakeKeylogger)", "value": "473d0d4c7d7030e185c24d44b4c0a427998fc4af63829ce13af87e8d70d554d9d2eac614fff721b1bbd707887a104e17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761656, "uuid": "ff2cfff7-42ba-4cb4-b360-51d71bd53c38", "value": "T19605E1483A507C9DC877C932C4581F206E62EA66A207CE1B60F325ADD91EED6DFC15F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761656, "uuid": "334513d3-635b-4eae-b21c-e4b2f68afdd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761656, "uuid": "8c236bc0-f189-4ab5-99dd-dd51d4c33862", "value": "24576:2A38rxN5IC54TWMpyJzWtWuYVdkqmDEux05IbyncR:pYtgibqvYIq5ug7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761656, "uuid": "5d41fa33-4c5f-4f50-b555-957fadab3ab3", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761656, "uuid": "5489f13a-18ef-40ea-b3d6-f8b6d5cc5e20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761656, "uuid": "7a9bca41-8de1-4254-9459-f977545a0798", "value": "a64dd42719e06596cc4bff9c4e2e37e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5affc602-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675794138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794138, "uuid": "65431155-d396-4b4e-a2e9-c34268b119cc", "comment": "Malware payload (GCleaner)", "value": "7673d12bff164890f512e513258e142d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794138, "uuid": "957f96f5-1ed8-49dc-af52-9b613a23fb2b", "comment": "Malware payload (GCleaner)", "value": "247e39ae2dcb3de500d74c8228d1573f83f120c2a1641215cca3ac1431d92b8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794138, "uuid": "2b9d367f-f5aa-46e7-aee7-693f5bc4611a", "comment": "Malware payload (GCleaner)", "value": "a3ce9290508ac936c8b61aa35f1dd903e2b66660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794138, "uuid": "a89a0c79-e22d-483c-88d1-b3fc2c03c674", "comment": "Malware payload (GCleaner)", "value": "b9273ee1b1881a798e62c2641daa872fb5f4df2b502e9389fe71cca7c01faee44d07f1af9d399b7e9ffbee01c9168561", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794138, "uuid": "f26cc140-e773-4c8f-9598-85aa20a4483a", "value": "T111D5E00A1D94D0A7E1608F70D9D76DFA8C12DE6FE8BA409712043FFBB671249E84AD35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794138, "uuid": "51d167ed-febe-4d09-9e87-9997273f5bf6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794138, "uuid": "cdf1c91f-23c0-42d1-aea7-0829a27457b7", "value": "49152:wDCHsdt35xMeyRYIXCT8KY+xl4lTTQOu0fEmZkGo2CmuIlxP2c5wWIO/nKYszLCU:+CHsdtDM1AqqmlTEg+RcxPhCK/nFs3vV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794138, "uuid": "2c68022d-e898-46f4-a90d-20934fee8c32", "value": 2754738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794138, "uuid": "5df731a4-e2b0-4b18-b046-a8c64554e5f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794138, "uuid": "853d6ad7-2eb3-4a2a-9df7-7e98ac668fef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a736b743-a6f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675778804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778804, "uuid": "7fb2b4a9-1ff7-46f1-bdd7-0e2cf401df46", "comment": "Malware payload (Mirai)", "value": "72db994c6cf2eabb82da01875a4bc79d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778804, "uuid": "28bff1e8-f15b-413d-9fd7-9ca397e2e686", "comment": "Malware payload (Mirai)", "value": "24ba8145478b7ed9b8999cad49dc9d3efddeb8ab5ba8579337c825d75dd8821d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778804, "uuid": "11cb3c93-a891-4077-aa06-57a3a2634f2f", "comment": "Malware payload (Mirai)", "value": "75d87c8af30a11de4eb98e140a295d8b1eb85389", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778804, "uuid": "ed76a125-d2e8-4f72-ae89-306c10837509", "comment": "Malware payload (Mirai)", "value": "c7f189ecadb369af66d2cda904811d5c843433c2638f83512d2ccf99dd9e1dd59d01456ac2ffcd9fcc3426c64718e374", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778804, "uuid": "3f08f1b5-a484-481d-a247-851b26871f7d", "value": "T125931A86F9528916C5D416FEB92A10C8374B537AF2EF3302ED104F147B8AA5F0E37A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778804, "uuid": "d9270491-dad1-4e7f-8eb1-b5985c773bdd", "value": "1536:ronAsahw4ko6yrFWm3Z5ZP6PvIfiLPUhVpZOkb:gaZkBEWm33IP0VpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778804, "uuid": "82441840-e3db-4b79-9c90-5b5e312971e3", "value": 89676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778804, "uuid": "6ba4f978-0b90-467c-98f0-e40b90987118", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778804, "uuid": "ceeaea03-6328-44e6-a217-8ce467af8d16", "value": "72db994c6cf2eabb82da01875a4bc79d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc995702-a731-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675806784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806784, "uuid": "b35d40bc-0020-456d-bd22-2c19cc8fbc9c", "comment": "Malware payload", "value": "98decbdd393487b85774b35019e23112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806784, "uuid": "88cdc840-84a9-445a-bc18-fe48c11c0e1f", "comment": "Malware payload", "value": "24f2a9bea60f73ebd8bf0175e6111bd0343bfa62d4377ee014a209fd69b1b116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806784, "uuid": "ec2c33cb-af61-4796-bd74-54c51e42ecc7", "comment": "Malware payload", "value": "2ccdb17009f8b6481c38017bccada03e5dafe1b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806784, "uuid": "4779705f-179d-4c60-a4c9-7913f494350a", "comment": "Malware payload", "value": "7bf664316ccc6c537a77e60340e4523dbfe1605e81e41edcdeccddf73d61cc741157d1c18c1b8c721c63c641ce8e8bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806784, "uuid": "b81eba15-7d18-4538-be0c-5336e32cfaff", "value": "T1B0337D323AD0C072C1369470986486B5AB7E9D3052F9CD27AF6C1A359F707C1A73B39A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806784, "uuid": "2a1c59c8-6c2e-4720-b9e7-74afd608e724", "value": "768:DODWK+o9Ok20hZYLDb998OBFxOupokuAHJ0CzhbTKqSwrnLj:DODWKOk2bLxOCokuGTbeLwTLj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675806784, "uuid": "47c1dee5-5714-4e68-85f8-ef847eeeba83", "value": 51184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675806784, "uuid": "f587a56a-6c56-4256-82bb-455270ed2e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806784, "uuid": "a577f3af-0fc3-4876-bbe2-867c65a29146", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba724774-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756932, "uuid": "4221f87b-a077-440e-a706-e542ecaa12e3", "comment": "Malware payload (SnakeKeylogger)", "value": "eed761668fdd2dcf564639fad3777a68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756932, "uuid": "e8a62002-11e4-43fe-854d-216ee9c64856", "comment": "Malware payload (SnakeKeylogger)", "value": "252c354f49694430d4c918dbaf614bde85bd1d944c05d1bd5aaf742d591ebf4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756932, "uuid": "834ba4f7-4628-4128-8b74-deb2e93b84f9", "comment": "Malware payload (SnakeKeylogger)", "value": "715661d1b21994134e7e301336e74c3203c90c5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756932, "uuid": "4bb7460a-a1a6-47c5-8cb7-6c1bc43c6db8", "comment": "Malware payload (SnakeKeylogger)", "value": "fa4cd5f3a7b5317cd762c02586d3bb171b0d3b8981c52e43ba23876c7cf0a9face7cb9cc1a1f5e44f0fe3f3e40425f3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756932, "uuid": "10eadf87-6ae2-4f42-8f39-a871d0f678f1", "value": "T142552EB055FB49E9E00BC8941AFCFCF511B671F3CCC60DA543ACA6085F6AAA47F4950A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756932, "uuid": "72d79c30-7ec2-49cc-a6a9-a9698cb071f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756932, "uuid": "0a1c7ce4-9e88-4347-be5c-ba43a3caea33", "value": "12288:cqyHBXw0QvzuRETEK8zukxEWB2bGcnGOR3LxFAHe5MrFZuhHH:H1gF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756932, "uuid": "8d512cfa-df8f-4279-b70f-e638db32c85d", "value": 1344000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756932, "uuid": "00021bd8-af5e-4a50-9b22-65cc04417ddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756932, "uuid": "80012fc2-a8dd-4144-bbcd-5fc98e5e250b", "value": "Dekont_202302061533980 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "161504a8-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758374, "uuid": "5d690310-f781-4bc2-8731-f39715675f20", "comment": "Malware payload (Gozi)", "value": "fddd441719668d0d950b31a41118c529", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758374, "uuid": "0485b6e6-03a6-4ac4-856a-4fa356557fb2", "comment": "Malware payload (Gozi)", "value": "25304c7fe861c576ab7d03c1e9125651113ecf8ee0644c519a888f2e81b537d7", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758374, "uuid": "9cdb213a-a5de-4438-b709-f8cd207b9a91", "comment": "Malware payload (Gozi)", "value": "75d2f1cebd9dcea0fd421674bcec13c145041961", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758374, "uuid": "c800983e-62f0-49dc-a6d2-8b8c2a9901ad", "comment": "Malware payload (Gozi)", "value": "bfa21c40bca6d83848413d1c8541d799afa3f304524ba7f1b588ad3213a1cb311c9148ef0192b7020c98ce598bde004c", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758374, "uuid": "a4d54d64-5c1e-41da-8af3-4c6c28e73032", "value": "T10AE16D4EDED7601B6B8181DBF6733C11FB6018BBD9292104B5E6E30E2A57B67008165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758374, "uuid": "13b07d03-cd78-47d8-be34-89308c9153ed", "value": "96:wJTgfLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dRU96a:eiU77rIKdn863jMM0OD9+VVF4bUx/Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758374, "uuid": "e42816fb-f914-4595-b4b0-e5daa29b387e", "value": 7037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758374, "uuid": "509fa183-d441-4364-8f49-b12f3d558a63", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758374, "uuid": "71586cbb-9fff-49b2-8f87-9b928233fe47", "value": "azienda_19.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1750ce-a6f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675778735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778735, "uuid": "c42d0878-2693-4f6e-9f13-7ff6feb36484", "comment": "Malware payload (RecordBreaker)", "value": "a5ce82fec2db6922b4dec5489cf16a58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778735, "uuid": "69529231-fa41-4609-80c3-5fd7da00e4b3", "comment": "Malware payload (RecordBreaker)", "value": "2606ab6a5c3c3e5bdcbe313fc6bcaf6310710366ea010ed621f899247ca76b31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778735, "uuid": "af0ec19a-51af-493c-8605-1198b01b53c7", "comment": "Malware payload (RecordBreaker)", "value": "52082505ccf0fbc91e7b322491e364a136459565", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778735, "uuid": "b6bcf1bf-d5f5-4d92-8ebf-1dec5d5a2e72", "comment": "Malware payload (RecordBreaker)", "value": "e43dd7d7e637d040ff8b43cb6c895d290a82e16e009d8535400f919afef47844963fbd74343c0addefe1136afa537191", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778735, "uuid": "79634872-5258-4d44-a279-3716496a877f", "value": "T11114D0323AD0C072C66B14305870FBA16EBEB43116F58A5B7BA417AE5F307C1AA72357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778735, "uuid": "e1fe3721-6e8e-4629-ac09-6fdab6236f65", "value": "af0a92fe52cf161a7b179d1f32aa9186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778735, "uuid": "4023ba1b-6175-4183-99c5-a4a81d0ca227", "value": "3072:6UtOjaYnEnLExX49WU135dQunnNkKymRjPP2WDNthSMxlL9DdP4gnfa/t:6UtO0LaI9iunnNHjxNplL9DdPRf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778735, "uuid": "3b373974-15f9-4b91-acd7-1ae163598626", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778735, "uuid": "714ed134-8dbb-4085-9034-bab80d8df4db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778735, "uuid": "5fc53289-a3fc-4057-a7d0-aa5e26570707", "value": "a5ce82fec2db6922b4dec5489cf16a58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132b2112-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675783280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783280, "uuid": "1de47504-2f9f-4245-aafd-84d7e09ba1db", "comment": "Malware payload (Formbook)", "value": "02e30a72a68dbe953ee8f3db34baa624", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783280, "uuid": "227c441e-791c-4dc3-9f05-66f68c1d34de", "comment": "Malware payload (Formbook)", "value": "268e40829609f3ee7024ba8936a20a47dae3349485e64271549b92e723359664", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783280, "uuid": "5769a3ce-bc54-4c2a-a8d6-d5c06780aaae", "comment": "Malware payload (Formbook)", "value": "226d5bbf6ccc29ec45e1e752860192428e993b62", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783280, "uuid": "d218c241-c306-462b-8d8b-7049f11590a9", "comment": "Malware payload (Formbook)", "value": "9aff66623b492f640d0cb9f185b1fdc855b68575a97d1aaedce5abef1bff1de091fc1ab7edd10fe87533cdec8b6f01fe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783280, "uuid": "3669f75c-fee2-4042-8a5d-a81937316d73", "value": "T1B205221D937C8721DC899A70A4DA4524037AB929A372E32EFFCD65DD2B63F608643743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783280, "uuid": "090bcdcc-5b5d-4f5e-8778-8e93b291b141", "value": "24576:gxWXIYXIEA/PJDrj94p3k+jacFrxN5IC54TWM3A:pLXIEKr5OrTVtgin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783280, "uuid": "58ac1866-c56c-449c-a9e9-3b12801901c8", "value": 864256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783280, "uuid": "70a14f7d-81dd-4230-9194-1a137815b16d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783280, "uuid": "6b389d6e-e678-4f01-9cc1-e30351549df4", "value": "PRICE ENQUIRY ENQ REF_PDF_____________________________.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14077994-a6f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675780705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780705, "uuid": "351a26e0-45e4-4497-a4a6-85a4912b7e8d", "comment": "Malware payload (AgentTesla)", "value": "a108331316cdaeafcd71daa1de0dee28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780705, "uuid": "08202e36-0a94-4da8-8afb-e965a38ef717", "comment": "Malware payload (AgentTesla)", "value": "26ef0814a002bedcc9770f2b3c5c79787fd036c7bf9f48691a26fa2bfbd9043e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780705, "uuid": "e2432e31-00ed-49c0-add3-8da192f33e50", "comment": "Malware payload (AgentTesla)", "value": "9487349d9a526fb370f79cfe03049db8cd31b0bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780705, "uuid": "c0225f29-9c70-4cfa-a434-fbde6789b501", "comment": "Malware payload (AgentTesla)", "value": "6553e0ad4d49b4c0342922f2a7e85ea7a33528dcd885950df11bd4350f0469e3507cd25679794347d03e36c6df3e9644", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780705, "uuid": "df807009-6583-4eb0-8218-aa5e09b659cd", "value": "T16E05231052708638DCEBCA76D86D9A2113FA8A5FF76AF65DCE44B4FD6E00F44C29160B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780705, "uuid": "d52649ab-9486-48c2-bdf6-41ffa31c4037", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780705, "uuid": "d9b6a0bc-af10-4bd2-97cc-8d32393aa790", "value": "24576:gA3TWNGIJfua6jldEFe6rxN5IC54TWM8:/5Va6+Ttgi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780705, "uuid": "7ce8dcfb-4cad-40f3-a051-87150f1abbf1", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780705, "uuid": "bcbb762a-70f7-4c50-a51a-b8c67a6595e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780705, "uuid": "73bbd1dd-7300-4ed9-a2a9-c5348c59ab4d", "value": "FAXMESSAGE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b39ec1-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675796247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796247, "uuid": "083f7f88-4e25-481e-abbf-04e5da83b210", "comment": "Malware payload (Vidar)", "value": "cffb8a63b2c022bb8396a36c3c1d1cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796247, "uuid": "dcd5c967-e539-4bcd-af4e-673a7bd100af", "comment": "Malware payload (Vidar)", "value": "26f1a250aa1ef1102293d4da54926387a4105648e2ba457dbe1e68acf67c9911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796247, "uuid": "6fe16b37-d109-4bef-9147-1cf350110745", "comment": "Malware payload (Vidar)", "value": "e3440dace5ce5361eea33c71c3f0516dd2c39116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796247, "uuid": "88064c07-5a8a-4ae7-ac2d-cadeff6f1bef", "comment": "Malware payload (Vidar)", "value": "9833e15934ba4700b847d71b2dd86ab318673400d662734385b3809e3a562feb73384cb37f429dc90d10b18474203a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796247, "uuid": "432f41c5-d77d-467f-b05e-74912ab10083", "value": "T165647D03E7F1FC63E9128772DE1EC7E4769EF5508E59676512288E1F18B31B1C6A3228", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796247, "uuid": "313f534a-575f-4b52-a536-d2a1d04ea516", "value": "13dc564127b9f6b618808536c7e12f68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796247, "uuid": "3839c7c5-7d06-4817-8024-02f52ea3da9e", "value": "3072:CNDbt9H0LG4RPnRq6yPDrjQBiINBjpEplUizqVrZ8fR9sxA76ov3P6QOMRKT:y/H0LvdEHProiINrSlUJVN8Juk6oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796247, "uuid": "999fcfc2-dfe0-42fa-9aa6-c40fa071694e", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796247, "uuid": "a916f90a-1e8b-43f2-adfb-9c1c14c01424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796247, "uuid": "799bf837-97f7-4315-82f7-c859c192dc60", "value": "cffb8a63b2c022bb8396a36c3c1d1cc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b29c33-a6a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675745145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675745145, "uuid": "466ce272-704b-4ca7-992f-af5d5fe080eb", "comment": "Malware payload (CoinMiner)", "value": "35a33f6dc2c8e3298e21d0a29b11f109", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675745145, "uuid": "22a5be8d-a302-4aa7-84da-be382212f53b", "comment": "Malware payload (CoinMiner)", "value": "270454f0dc7e8eef8b2bc9b7c7da7d97b5e35b664d98eff40d719de1e3c052a8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675745145, "uuid": "f5d45153-77a0-4b07-82fa-5f2a3cac84ad", "comment": "Malware payload (CoinMiner)", "value": "abe23113df8be699a71482bc57f2b439acef2cae", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675745145, "uuid": "469320b6-6e04-4eb3-8287-89d9712d8cb3", "comment": "Malware payload (CoinMiner)", "value": "e3f45438fcf56b3752cf095272e2876a37b64f99c3953c8e2e1ae0065d8335aa372b28ff0c316c49b3a8f5cf961d18ab", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675745145, "uuid": "0f77bbae-ac8f-4500-81ca-2dcff33cd282", "value": "T1BA644B4393E1BD80E92A8B72DE1FC6E87A4EF9408E7D77753218AE9F10B1072D563614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675745145, "uuid": "f1e96d28-fe88-43c4-8efe-1d4d2f85168b", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675745145, "uuid": "c0aee5d4-2754-471c-8b7f-aeb69937e9f4", "value": "6144:SzgNLCbh7Ljraxhi1wTNy4PyPBZuQj9GTNaL:uIWBjGbi1mHSBZljC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675745145, "uuid": "6b283f8f-0b9d-4ca3-84dd-9fe479db88c8", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675745145, "uuid": "318be1fb-6c64-4142-ac33-580ade864a0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675745145, "uuid": "25bacceb-5ad4-4856-9553-bfe9d291d7d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1b9560-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758384, "uuid": "681e65bf-61ff-414b-8311-f90363636444", "comment": "Malware payload (Gozi)", "value": "482d0c5113759a08af068f4c326bfdb1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758384, "uuid": "bbc63b27-f44f-42e7-ba81-6296b9582c59", "comment": "Malware payload (Gozi)", "value": "27393e24d6899c5895df614304f06d350404a360fc8ddd70ca1a2f7b0894743c", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758384, "uuid": "b99ce009-90aa-46eb-bd85-209b38829149", "comment": "Malware payload (Gozi)", "value": "7b4c648e1e9ea7b9f3ab87795f4472a3c85b0163", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758384, "uuid": "5421e5d9-d6f8-4870-8035-256f1a349ea5", "comment": "Malware payload (Gozi)", "value": "043e4c1640b44e668649f061345816c567729beaab97499cc5d0c33b5fb89e277163f3317883a9e9a3dc96868872dea7", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758384, "uuid": "cf25c08f-c6b4-4a81-9e22-4447f077bbbf", "value": "T1EFE17D8F9DDB641BA74082EFF3733D10FB6019BED9292204B5E5E30E6AA2727418125C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758384, "uuid": "4ea74106-dd37-403b-b9ff-566f5ca125a6", "value": "96:wuO8BWnjLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dVh:HOxU77rIKdn863jMM0OD9+VVF43xYkuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758384, "uuid": "722501ae-4d67-4a86-8715-e54944eeb203", "value": 7050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758384, "uuid": "2de3b9b0-2494-49ac-8ad6-9c432b6e6787", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758384, "uuid": "44e36ed1-7cf2-4bad-b6fb-e197e948939f", "value": "azienda_21.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3244d5c-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675794259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794259, "uuid": "98b6efa1-b3b9-4747-9f3e-24064deb72f8", "comment": "Malware payload (RecordBreaker)", "value": "17a74a0281cefb5d9c29022fbc79981a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794259, "uuid": "f8c24224-d7e3-45aa-8256-940048da1a31", "comment": "Malware payload (RecordBreaker)", "value": "2814b2a02771e2d16ce2efb1586d8623b54b50d6e1c8dfa9ab2bbf54ab8b249d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794259, "uuid": "e11de551-cf22-479a-bfb7-aa68724d87e4", "comment": "Malware payload (RecordBreaker)", "value": "d88585c6c9488b6d28b71dd0659edb8649e32dca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794259, "uuid": "2b5a4f57-8cef-455a-834d-dea79251806e", "comment": "Malware payload (RecordBreaker)", "value": "528ef9139866f656784af31265dd35518953aa479ab149c1e0d2afc42728f564efd8aa91d9271f783eb57c01e5f029ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794259, "uuid": "01809b46-3e71-400b-bdb6-3ae70aaddfd1", "value": "T17514CF3336D0F072C96B55305834DBA57ABFB8319675899B7BA807AE5F303E06336252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794259, "uuid": "da88cbdf-c3f2-41c3-a15b-5c8aa10d00a3", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794259, "uuid": "2de09123-af3c-449c-ba91-836306cdda52", "value": "3072:hlrXO4DHzvDSyUPLoigWo351k/Z2N/BbET2tOWIbq0ES4vy3DwHkEforb:/rXbT0PL1g5W2pZETbWIULvy3UHkEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794259, "uuid": "b4dd60d8-c080-4289-a936-e56db38a0ae9", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794259, "uuid": "40f1ebfd-1cd0-415d-8eeb-fbc0f529ad0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794259, "uuid": "be8dd9a1-9782-481a-8ead-d8fcd202bbbf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa39b26-a6d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675767437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675767437, "uuid": "da37744b-b5af-475c-bf66-e5ab8b6100f1", "comment": "Malware payload (RedLineStealer)", "value": "3bda907ee07038864f137c71376b2e63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675767437, "uuid": "6f5d55e4-854c-450c-8659-8a3bbfb920db", "comment": "Malware payload (RedLineStealer)", "value": "282ed78f108bb24e9afb63f9253b8d771eed91b2a6b3089de94a84ee0928d6f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675767437, "uuid": "27fef92e-d112-43dc-80fb-fb089fa76de3", "comment": "Malware payload (RedLineStealer)", "value": "6dd8a99b8755c447de7da1e295be51fb35ae80e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675767437, "uuid": "adea6d16-0588-4742-8e73-2634f0f87bf5", "comment": "Malware payload (RedLineStealer)", "value": "717fb98050b124e866b53143a618a2e20d450e425169930f635c859578fc6af659f03f93c4affc260edc0a887c38b2e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675767437, "uuid": "5d2be011-687c-4266-8493-5557b4dd0225", "value": "T1CF64F1263690C072C56B59301824EB95BFBEB93115B5C54BB7E813AEDF307D09A7630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675767437, "uuid": "2fac033d-52ba-4bdd-93e6-e6bfef1beaaf", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675767437, "uuid": "14fda156-a187-4420-9763-2d90e8e72c18", "value": "6144:LHz4kzwLBC/asDSHAn+4+3UPemVnU38JWGKgIghQg6Fr:LHz4kzwA/aZAn+4fem1o8JWVgh9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675767437, "uuid": "2b908e1b-e3ce-4824-b9d8-680e7ccff99b", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675767437, "uuid": "d34dc20d-ce74-47df-bad4-393e910280b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675767437, "uuid": "b36cddf5-c588-4217-8cc2-8c6a5e386810", "value": "3bda907ee07038864f137c71376b2e63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e76a87-a72b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675804144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804144, "uuid": "e3d19f24-5549-4dd3-a9b5-0b8eb221d2ef", "comment": "Malware payload", "value": "14e63601e046da241cab3a8cdaf731cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804144, "uuid": "9f25804f-7982-4638-93a3-c22984b9e9f2", "comment": "Malware payload", "value": "284bf5002b432956a48d42b5e648336c14a3d1c4eba236d7825e1418106fd698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804144, "uuid": "ea9ca6f5-a951-4503-8f20-ed8d84749a8b", "comment": "Malware payload", "value": "2fb9433b70227bbc2cd6aac6f1b50bc1ecc772da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804144, "uuid": "5206c5d3-b75a-47c7-aef0-8cf057436f1b", "comment": "Malware payload", "value": "9badf399b3d1f8783dc29e281822ceb5a4a1e96251efc752cfadc273ed7d467e0f727a53c18f057908c7df1655ffc05d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804144, "uuid": "2d2d4e98-3b26-40bc-9cbb-e62632e9d32c", "value": "T108137C3239D0C072C133957098A49595FBBE9E2152F5CD2B2F28167A9F317C1973B3AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804144, "uuid": "618ae949-3410-497a-a9c7-859a4f7d42a6", "value": "768:YKdK+cROdyPhFxIbjbQC9K6WHjGHeuFoekAHN5xStpbzQ:vdiOdhbajG+moekyobk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675804144, "uuid": "53ac9168-ed78-4a77-8d5c-1e41210b7ec2", "value": 44217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675804144, "uuid": "dcdbfa16-0cb7-45d3-aab5-f8c88285316c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804144, "uuid": "81f0e0f0-293d-4f82-904f-77072a936226", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a0624f-a73c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675811247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811247, "uuid": "0e350d62-18ce-4e39-891b-a59e5b4ce9fe", "comment": "Malware payload", "value": "3653714e52bd3843236d06c1cc2dc52b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811247, "uuid": "dab55b35-aaaf-4274-b272-06ee7000ce13", "comment": "Malware payload", "value": "290091c84e0ecbb14a8d4bb591c4cf8b9e509318d1ceefff61daf125ad000f0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811247, "uuid": "350bc74d-4ce3-425c-a7a6-95553e42b36c", "comment": "Malware payload", "value": "42f4394b30489f6fd5d46b70e98b544546102a0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811247, "uuid": "fb28899d-c728-4256-a7bb-2e6dc352b9c1", "comment": "Malware payload", "value": "995220abd06fd8f80e61179bcfba649a71015711b55a794be1544229662119be962d501ab8e35d5cf2cae56ed23c6e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811247, "uuid": "8fa0e7e1-c7a8-432a-b796-1d5bc25e9e7b", "value": "T132B40207E7E88462E97567B048F607C319327EA19A38876F674F6D4A1C726B4A231337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811247, "uuid": "96d5d119-26cf-4bd8-aba2-e170372fe94e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811247, "uuid": "03d5d21c-c7b5-4114-ba2f-5d0ac5399ba3", "value": "12288:HMrgy90mCLUVIrepViqzrAwmLpBYxObxXgn:jyPVlHADndQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675811247, "uuid": "c3a8e6a7-c24e-49a4-837d-2ad0fc396915", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675811247, "uuid": "76dbae8b-315f-4e4a-88fa-7486dad4a009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811247, "uuid": "afbea982-1bf4-4887-87be-33902ed1f657", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fffe68c-a6bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675755921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755921, "uuid": "5bea55ba-e0e1-4719-a288-b1b18f4b95dc", "comment": "Malware payload (Mirai)", "value": "bfea9c770d99f5d6d68d1691bed2c807", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755921, "uuid": "2df95479-09d2-43d3-b8ac-331204413856", "comment": "Malware payload (Mirai)", "value": "2976f58cb3d5fb76969fea7778420598f7c928770542431c95e0ad62132b7221", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755921, "uuid": "e4b688ad-58fd-48b8-8aee-d78b7e58d597", "comment": "Malware payload (Mirai)", "value": "be9d8b7eb79b122c0e3bc437533c69117c19d69e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755921, "uuid": "28b0e013-01dc-4f95-af37-b07b6a25054b", "comment": "Malware payload (Mirai)", "value": "d4e46c252e829a2241d05e7cb231c6f44841d05f44ead8a32b27f12b417f373ba0e50941f908d09c95a811fb905d2132", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755921, "uuid": "dbaf5406-20dd-4258-8fb1-317c968c2ec4", "value": "T12DA33A03A8614F76C0465DB526FB69300723A9A30F6B269A71395AF0474B9DEB41FFE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755921, "uuid": "4683eae0-7efe-4179-88d7-22dcec1ce9da", "value": "1536:FwmacmBLnKOPEdsiy7r8MUhjCqLKqyntXmvj0PGLutfskPj:KKCLKOjiyChjpRyhmvj0PGqtfssj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675755921, "uuid": "0b6f8c72-8dae-41c3-96bc-834026ba4b57", "value": 98100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675755921, "uuid": "53e4db2a-ccc9-41d5-8541-11b3e7f155ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755921, "uuid": "e8fd0dc5-7691-4cf3-a33f-80e8ce212bac", "value": "bfea9c770d99f5d6d68d1691bed2c807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9e3426f-a6b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675752180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752180, "uuid": "0c7707ac-65aa-45ea-af16-c357d590eb4e", "comment": "Malware payload (SnakeKeylogger)", "value": "59680eccd688d64167a1bfc0fbe26903", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752180, "uuid": "86a2f996-f129-41f1-b95e-d0727dd1c92a", "comment": "Malware payload (SnakeKeylogger)", "value": "29d5bd8a4fea152b457fdfedbe44b9cbce7d4ea5fe0c336310b4df15744dba4c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752180, "uuid": "a4f6baf5-95dc-4f95-9d55-1852f3e058c9", "comment": "Malware payload (SnakeKeylogger)", "value": "75667c6c9ba92fc48838b7f1ae3a667acc83a09d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752180, "uuid": "47415c55-4f0d-4ba2-9938-1be1dd101413", "comment": "Malware payload (SnakeKeylogger)", "value": "b89f85a0ec811aeceec78e1cc1e0ee32fb5d5aa115ca61a4f49f46ce8207bde3909702f35ab32781d8e0992f8d4c4a07", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752180, "uuid": "54154391-3d46-48fc-8508-8f19053bd531", "value": "T123134A5AE78F02A4CF450277131A4A899AFDB33EB35554B1346C937433EDC2E0666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752180, "uuid": "351b66b8-06ee-45ff-bc0c-2e8ed7e61438", "value": "768:0Fx0XaIsnPRIa4fwJMKdrI6AsI2Yq6d9U7i/AmrjxcruGMbkL80+q:0f0Xvx3EM2ZAD2cd9U7mZjxcru4L+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752180, "uuid": "4e3e4cf5-088f-4779-be8a-01d44f2dc9fa", "value": 42734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752180, "uuid": "e1448564-2fa5-4251-9502-a29aea32f16b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752180, "uuid": "6a485c68-3235-4b8e-b5e5-8fe3d0b55a29", "value": "order requirements.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4249c3cc-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675789802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789802, "uuid": "d76ce9ec-b92f-4289-8e9a-0f484d6c21ab", "comment": "Malware payload (GuLoader)", "value": "cb94cd3fbd5c2d7bc9d43317b78b9295", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789802, "uuid": "02b89bd2-6c96-4e45-b9c1-bb8e6162877e", "comment": "Malware payload (GuLoader)", "value": "2a954efecb0cd053da1b9e25d9bde3bac97656052e97f1d4a8b63b322b8109e5", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789802, "uuid": "bd0a9e3f-f8bc-48de-8b73-d71ea48b98b8", "comment": "Malware payload (GuLoader)", "value": "fb6863217e97b1929e50743c48066b11908ca086", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789802, "uuid": "a6547ff1-2ce9-4a1c-992f-0175017724ea", "comment": "Malware payload (GuLoader)", "value": "2d8c5e2acbed4e570a00f6cb5429b8b719407828e31730c748872077b4b1a064ba8680fb7fbc53b5cea2da33309ae0be", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789802, "uuid": "539777ab-9371-4959-9c63-658dd7536aa9", "value": "T17674791E6BE42D2C061A4DE794B63B3FF46211FB0017677B28146E2406123799BBF5BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789802, "uuid": "b7fb1d8b-06f8-4be4-be23-0a4addecf14b", "value": "6144:vR/dbtBgl4tlqbs/+Yfp87VY/T9r0X0nT1QYE1IhnANxdibcIW1OAUE8cV9xRW8J:Z/dbt3tlqb09y7VITp5QYEqpTcILAUEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789802, "uuid": "26cbfa15-7d93-4b99-8c12-83473d1606c1", "value": 350984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789802, "uuid": "7906e841-683c-431c-92c0-cc757d81a601", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789802, "uuid": "3679a886-7d89-4f7f-b5bd-f412367f28bf", "value": "Facturas Pagadas al Vencimiento_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fdf00a6-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758471, "uuid": "1e034eea-eca0-4fa9-b3dc-8c4cf659ff43", "comment": "Malware payload (Gozi)", "value": "0df25caaf1360f90af9a39b230fc032c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758471, "uuid": "f8bcb4dd-8999-49d5-8932-eb085ed0b908", "comment": "Malware payload (Gozi)", "value": "2c9d85fd5b94dc9af67d408e2e269f59d89bad35a6df94dc49275ae6793a4bbc", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758471, "uuid": "4a2c8872-9bcc-4661-824d-09ea0f9419bd", "comment": "Malware payload (Gozi)", "value": "6a1b77dbd64331e47b9ddf436e7f416c80dfe8c0", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758471, "uuid": "3d0d267f-51bb-4877-a33e-6569e909eb7e", "comment": "Malware payload (Gozi)", "value": "214039c39d9fffc9a856e112ca5a4905ac3bf846de286d30f1ae10d587007123fc067458f47471afd6dfcfeca5a39386", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758471, "uuid": "02706af1-1268-4556-ac55-a7f9dc93dcea", "value": "T1D4E16C4EDEDB641B5B8091DBF6733C11FB5018BAE9392204B5E6E70F2AA7727004165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758471, "uuid": "1016ac6e-b8d6-4b07-bbc2-8a0b13d34e02", "value": "96:wEn1DLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dnr96k:PRU77rIKdn863jMM0OD9+VVF45x/CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758471, "uuid": "e14a4731-fb7e-4232-b8f9-ecc8745a8b89", "value": 6985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758471, "uuid": "d306846f-ebcc-48ef-a9b8-b7559a895fab", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758471, "uuid": "edbf8eb6-8298-4b4f-86de-46b348b259aa", "value": "azienda_37.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7e8d8c-a6f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675778682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778682, "uuid": "18074db5-a8c0-400b-995a-334eb0606e52", "comment": "Malware payload (RemcosRAT)", "value": "634ca67a67b2e1197f54c289f10fc78b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778682, "uuid": "b4651599-0c52-4976-93a3-3a2d990ac22d", "comment": "Malware payload (RemcosRAT)", "value": "2d22ca8b9903fccf7e1408139e3241b9af152065ec3810ba1166d2f6b1597ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778682, "uuid": "fe9f5ec8-f27e-4c06-ba1b-60e7c1e4ff0a", "comment": "Malware payload (RemcosRAT)", "value": "5ff0d190db9a91b1a248d2ede68231f63bd995cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778682, "uuid": "027a9c05-c057-4422-bfc3-12ab90e2341b", "comment": "Malware payload (RemcosRAT)", "value": "89f331442aea648ae17d72ac1259f12ca6f329c95567c11d0a3f5835b1b59bebf31b6fbbb14f0e08f996cb4401dba572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778682, "uuid": "6b29caf3-9d65-4381-a78d-7cf2b4919649", "value": "T1BA352319272ECF20CEDA8F79D8DA4664137A575CB086D30D1FE428FE5F62B644B42A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778682, "uuid": "75eb3113-d714-4def-b595-69381404e0ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778682, "uuid": "50ed911b-0820-4e7b-a65e-f8fddcc7a878", "value": "24576:DmywXOEXmPEm1gKL2rtHbdl7pv3x9GUdrxN5IC54TWMxA:DmXOEXmPEm1/iFL7pv3nGqtgi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778682, "uuid": "f396a762-b445-45b6-9d45-3597d85741c5", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778682, "uuid": "54316fe1-4888-4a9b-80ac-17eaf7bdfe92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778682, "uuid": "8e6e77ac-4300-40ae-b73a-07b8e6277059", "value": "EDD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7017d4b-a715-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675794776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794776, "uuid": "00e128ef-3deb-469e-88ff-ed1de92831a4", "comment": "Malware payload (Amadey)", "value": "5d3f07a8a9281edca61f52e00eeec294", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794776, "uuid": "41b1ce62-9648-4989-9f6e-74483106f539", "comment": "Malware payload (Amadey)", "value": "2d500bc3800182c6c738b37b8db2bca3415f92302393c279aa4234153a74228c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794776, "uuid": "33a0cf2e-3460-4906-8a09-d981247ccf12", "comment": "Malware payload (Amadey)", "value": "a44f1be6fa2e47c88193189711e5cb69f572d41c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794776, "uuid": "50dd3523-ad82-4b4d-8c47-e78be942f532", "comment": "Malware payload (Amadey)", "value": "bba186ac0e7b64561b460113d01451ea09b27aad5a0d29f511f07d8bb0c046bf8d215635875ee288ac4d9e9ff1e09564", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794776, "uuid": "863f4d09-4f5e-4fff-848a-bc66718bf9a1", "value": "T179B4021BABED9022E8B417701DFA02D30736BD615738536B178EAD4E18B2274723576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794776, "uuid": "db7be1a5-784e-4d67-adcd-cef6ebce8db7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794776, "uuid": "4ea9bf96-bfbf-4d64-ae4d-a682ad05679f", "value": "12288:dMrzy90Wsbf9xIvVvXMnSic8aqLB9E5dYt:uy/sbf94cN7uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794776, "uuid": "c9404b66-c773-4044-8ea9-9a2e4a8d9590", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794776, "uuid": "2b3b5920-0fb6-4d72-a421-38b6c4c55d47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794776, "uuid": "384a9b0d-5cbe-49e3-9610-633e35bf32a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40f0f34e-a739-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675809986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809986, "uuid": "cc5ee4d6-add3-46d1-8c99-6134cac1d4d1", "comment": "Malware payload", "value": "a53d4562420653a035af20eec847c4b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809986, "uuid": "66423ffb-b448-4b7f-bd79-ad45b4404771", "comment": "Malware payload", "value": "2d68196871c04f8a17ff0974ae1f331ac89caec044fdc8281f2b356d372b381c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809986, "uuid": "7370a602-b318-485f-a6c1-a3380c279d6b", "comment": "Malware payload", "value": "78fc869dbec9d957317ec2b3146cd952ecbc9a8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809986, "uuid": "d6690d7d-1c74-475a-a9df-b23050e34ec9", "comment": "Malware payload", "value": "09ea82a07974032e5f5f90033a0750c043abe36aaadb1dca95f1760c43cbdcde3514ecd46d68a7084c6a64af51b46a50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809986, "uuid": "53860234-16f2-433a-9d0f-e50303f0b788", "value": "T169D5E00A1D94D0A7D2608F70C9D76DFA4C12EE6FE8BA009317143FFBB635245A98AD35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809986, "uuid": "bdec48eb-99cb-4ed3-8b08-d5e2e8108571", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809986, "uuid": "1da446a3-8f33-4358-8a88-ec994549d885", "value": "49152:wDfSPee5t5zSZoa+atoEmkJL6k2DUkPd6ZBvvfsad+wqjDkFc1LCgv2MR:+fueGzAvNiEm2L6RZMvvfsaIkWv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675809986, "uuid": "8f5adfcc-74b5-4d4e-a241-989ff2af9c22", "value": 2754402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675809986, "uuid": "4bfa2ca7-c85c-4ddd-9995-6b1db7d3e99f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809986, "uuid": "5b6210d7-14ae-496d-8260-3928b8f8722b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f824a6f7-a6e5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675774215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774215, "uuid": "cc9743b8-31e4-4a3f-973e-01d731b7dc30", "comment": "Malware payload (Formbook)", "value": "c400fdb591634dab4a36be5c8da9c159", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774215, "uuid": "5b23cf2a-da42-44bd-b510-de3b730af64e", "comment": "Malware payload (Formbook)", "value": "2e5a68487fb25640fbf7d4c2529e17bb20b2c948b82e464e9543a25f34027176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774215, "uuid": "bba7832a-36ea-47fc-8977-941538492f75", "comment": "Malware payload (Formbook)", "value": "fcf88f192af7b007480f86199e5af303a5eb8fce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774215, "uuid": "1759b47d-a5ec-45d9-8a9c-9d2e726b1f3c", "comment": "Malware payload (Formbook)", "value": "79983a6e4626eaf941cdbd5f42127ad449a833b33d3074ac630f7309e317cf669f2fc857a7cbf588cd93ef16024b29a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774215, "uuid": "cd743dfb-0092-4ed2-870f-ce6896049718", "value": "T1B705221C2BFDDB20DA2E4BF9247809300B79AC297521F71D0DD261DA2FA3BA44552F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774215, "uuid": "a2a74fe2-5dd8-4276-a9b6-55b847408a1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774215, "uuid": "308ce7ad-5f58-4d03-8d0e-8dab05c7085d", "value": "24576:f7awxO5du+RPb7xz0yEkBB7qwvjZczOTZ:DTsfRTdz0y7j0OT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675774215, "uuid": "b90df9e3-8628-4138-aea2-265182b2bb1a", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675774215, "uuid": "69766788-1d29-49c0-9ea5-1b8cfb75c652", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774215, "uuid": "f9b8eb81-790a-48f7-941f-f37c8a0e0439", "value": "SecuriteInfo.com.Trojan.PackedNET.1822.8001.19350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d780be8-a718-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675795833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795833, "uuid": "3d76ac19-b9be-4e2a-8cdb-24bcb75b1bf6", "comment": "Malware payload (Amadey)", "value": "0af396d89197dc994ee7c05cd82c84fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795833, "uuid": "141c41c6-5a36-4593-a8ab-42796a7f841e", "comment": "Malware payload (Amadey)", "value": "2ec13bb87dddbdc8adac9585362d458bc49e1657f2f061db39163d530d530802", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795833, "uuid": "9fdc6f78-c923-43b2-a71f-d174aacc7776", "comment": "Malware payload (Amadey)", "value": "5bd34718a5b83505474401063a469d696809c1ab", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795833, "uuid": "fe12e533-ac65-4dbf-98e2-9cdbccf3a70c", "comment": "Malware payload (Amadey)", "value": "508c451bed6713e2bb5d9d65d6642899be8e180d6251267d9f4a910b63ad08b7aeb49da42bd854ccfc9ef1825cac0056", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795833, "uuid": "f36c097e-b6f8-42ce-b604-addad8e84c30", "value": "T1068601904502949B12BB9E3F54F67A475C0F2B5CFF8F5692E668A36B0426EE37C102CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795833, "uuid": "1cf3afc1-6302-451b-a297-73e37f8a407d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795833, "uuid": "95f4a9c3-986b-46bf-9d64-8cf206d58cb7", "value": "196608:+FmnP/F68J3FxrU93Eq3zPgSnbWOGGY7p:+c37RjqjPDbWhGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795833, "uuid": "e37750d2-5477-4a71-861e-9373def77dd7", "value": 7977984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795833, "uuid": "a9314b17-7db0-4587-97bf-f2456a2b6c97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795833, "uuid": "76e1f822-16f3-48ad-9638-eeb3aa4f9085", "value": "2ec13bb87dddbdc8adac9585362d458bc49e1657f2f06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8526bab9-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675788196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788196, "uuid": "3414e844-222b-4302-ad78-1bd66c17d4b2", "comment": "Malware payload (Amadey)", "value": "cd048ee948a2670fec80c50881d97d73", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788196, "uuid": "b8b2d9ae-dd6a-4665-8d71-af1af3dcf23b", "comment": "Malware payload (Amadey)", "value": "2ed840a9e51dadec7cb214002098eb2743ea3c99ad8803cb78d95ba36cea215f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788196, "uuid": "69e6efd4-57fa-45a8-986f-b2a12f4496a5", "comment": "Malware payload (Amadey)", "value": "177a2bb7adc5f4833788a0b5f557e98a4b999846", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788196, "uuid": "77f106ca-2a26-4a10-8415-c4484328bcc2", "comment": "Malware payload (Amadey)", "value": "89a1b2b02ae31fa8a6d21d2f144969f5a5952cf0c8eb6c2d34cb21b7198ffc9d657e0d8fe934bdd28ba46a17b0bac925", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788196, "uuid": "cc52cd07-ebe0-44f4-9a9d-399a8641a2de", "value": "T1AEB4020BE2FC8471E8F1577059F603D30A367E916779839B175E6C5A18B26B0A23172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788196, "uuid": "35da725f-9b34-4ffe-aa7c-dadb5e7e9fa0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788196, "uuid": "cd364fcc-15a9-4ea4-8201-d718d034758c", "value": "12288:DMr4y90R8uKXzuR6trIZj9NzkdcOreZm1sstQn:/y1bXz428Qdc4e81Qn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788196, "uuid": "45cc2d13-c6ca-45d5-9075-bec985045aee", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788196, "uuid": "e2761c45-539d-4220-819f-1f06fede4280", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788196, "uuid": "05b15dbc-f4a0-4eb2-a49f-e82bf5820a5a", "value": "2ed840a9e51dadec7cb214002098eb2743ea3c99ad8803cb78d95ba36cea215f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8efb542a-a724-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675801097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801097, "uuid": "644abfcb-539a-495e-a669-f697cabb0336", "comment": "Malware payload (Amadey)", "value": "0e93f29d721bda45a5129da9a016554b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801097, "uuid": "005734fa-d785-4dc1-ac51-b754046cba1c", "comment": "Malware payload (Amadey)", "value": "2f3a412432cbf674a076e2fc965bb7644ea20f05ff6e5dc6c9729094f06c4e33", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801097, "uuid": "1ca3600b-0b77-4c23-ac2e-99da61ef1033", "comment": "Malware payload (Amadey)", "value": "360937e8ae2d9736b08ef69b0d613ca74f65d408", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801097, "uuid": "521791a8-b869-45dc-8c4d-17cfdd2aa770", "comment": "Malware payload (Amadey)", "value": "0b715f8369e26ecb3ebc28f3dfc9938bd37762f77653bddbc1a562fc9614a8b01226400cdf21546cbc46e6e6916555d9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801097, "uuid": "bf97e900-354e-4eca-9c6c-7078bc184cd1", "value": "T1EEB4020BE6FC8032E5B4577059F217D31A35BD921A38C38B635F6D1A08B16B8A63537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801097, "uuid": "25d81286-9b07-4be9-967a-b594629bfb19", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801097, "uuid": "1c6ff962-07f7-4443-9c4a-16618a862d3f", "value": "12288:yMrKy905lIRqn4BRMf1Q7nSCY5hbX87kE:8yMlPn+RH7NYcoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675801097, "uuid": "c76f6885-2831-4468-ac86-3e9917e90f6e", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675801097, "uuid": "b49bbb62-d790-433f-b9b6-e014a4f3af70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801097, "uuid": "75cfbe21-2760-448f-afca-5928c4603c82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eb65643-a682-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675731465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731465, "uuid": "389acadc-8948-4bd4-80fa-18d2b175534b", "comment": "Malware payload (CoinMiner)", "value": "389e0bbeb62bafda651f89609f6155f1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731465, "uuid": "212bd317-bc09-460e-9005-1d2486c3fb03", "comment": "Malware payload (CoinMiner)", "value": "2f459f27c19518f315b8233ab7af6fdcd04c7c886d11a3117a23e9e28c532e2c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731465, "uuid": "383e32e0-4feb-4da6-bec0-71061fcb7fe1", "comment": "Malware payload (CoinMiner)", "value": "d1a66088ee38a570160c43f294b1e21129a55d0a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731465, "uuid": "155be9c4-3818-4fba-9c58-87b9dd9c7bcd", "comment": "Malware payload (CoinMiner)", "value": "cbc8d25f252b5e0c019c347a8956b9b664ee386211953644b96d15560ab1825c5dd989dd8d9cafb9b7527ddd590c8fe0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731465, "uuid": "03441e01-5280-4fcd-967f-3cf6efb34879", "value": "T17A644B4393E1BD44E9268B72DE1FC6E87A4EF9408FBD77652218EE9F14B2072D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731465, "uuid": "94f4d726-e4e8-43dd-bcc1-22c2b6cdaf76", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731465, "uuid": "4414f111-cc84-401d-8925-76eedbcc82e2", "value": "3072:5nb6blhL62RmhK3XIOAtjtVcT00ppPaO5M4seFd/XFuQjiMTE5jptoia5D:FWhL6l82Be3/5M4scNuQj986ia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675731465, "uuid": "93dd14f0-8e06-4696-a2d5-a97f448191b5", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675731465, "uuid": "17fbbe02-ec5b-40fd-bbbb-a45cc3793797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731465, "uuid": "0d693e10-87ac-4118-b4d9-2cd97d93278c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da59afee-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758704, "uuid": "ce6974a3-48f6-47ff-98be-fb73a4c37c19", "comment": "Malware payload (Gozi)", "value": "48b83a4066f03ef14b124fa0a11a2bf7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758704, "uuid": "180c5db2-b45e-4384-9123-7c3f4ba357fe", "comment": "Malware payload (Gozi)", "value": "2fd6442212d279f98c0918e6f3c7b0182bea03d6ce52c2120648b62ecd3c0a6b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758704, "uuid": "1d391bd8-fb65-4c60-acc7-0966defba390", "comment": "Malware payload (Gozi)", "value": "a17d34a07ecb9766f44c1946c1cf5f5615dcf37b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758704, "uuid": "97b55c15-68df-49be-8a62-3a9b148b60f7", "comment": "Malware payload (Gozi)", "value": "14c160f7b973d6ccc3be6d7f028f45b50cfb5f9c19bd0b0d28c6f6a7270134c211ae89cff293ba78df68f3a59f74e1f9", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758704, "uuid": "e96091cd-6c4e-41d3-ada7-21389a8cb20c", "value": "T110A18E83750AEA5C30F5E4289D8E6258EC58DFD25066093ADC697CEBD85C28C3E0B095", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758704, "uuid": "0c6944b4-cdbe-4b2d-a3b2-729c5d30287d", "value": "96:BHZgOu2F7bc9p7S1qPkCxf4PGtbcsBEHZTFmInfxD64QXclkqbblkWGL5A:BHZ9elS1qcCxf/tIsBUptpqsX6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758704, "uuid": "ba571533-9b03-4e99-9905-01da40be468d", "value": 5042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758704, "uuid": "1e8ccb0c-9256-4915-8388-e0efe4c413f6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758704, "uuid": "aae02f3e-a548-4cdc-a462-4a798b220c70", "value": "azienda_33.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6957a4-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732749, "uuid": "3b9750e7-4402-4461-9dcc-086e8321f18f", "comment": "Malware payload (Gafgyt)", "value": "37c2058b64d7f3feba6cba552c0d79d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732749, "uuid": "299c63d6-ebab-43a5-9e8e-923ef141f081", "comment": "Malware payload (Gafgyt)", "value": "30218be279c2815a6acb822232a25c5cb7cc14972e4a6644bc42958bdfe4f26c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732749, "uuid": "5762f6cf-8ecd-4b9e-b5ea-0c15e1007218", "comment": "Malware payload (Gafgyt)", "value": "084ba186cdbaf2038aa0e86caf82b914c73d9d3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732749, "uuid": "72a39222-59a0-4fb2-bb4e-391ad74f66ad", "comment": "Malware payload (Gafgyt)", "value": "6a5dfb96e9b5077755b531acb2a68eb97b5ac803e48891528c3b14f8bce051f9ae4ba3dd20330260b627f504fd9cba63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732749, "uuid": "279f0ab2-0064-4859-82a2-aa6ef2d51d71", "value": "T1E6934D43A8654FB3C08659B1266B5E304757E8D20F4B1B96713DAAF4474F9CEB80EFA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732749, "uuid": "0285e89b-14fa-4161-b30a-b6964294c943", "value": "1536:k6fjq+uK2XJQUwPIjBW1tCo5hxdddddvxzS16cGm/j10PILDLf3Ij:nfbB2rwPrtV5hXAGmb10PIvLf3Ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732749, "uuid": "5818c9b9-dc8e-4ced-b4f6-77139c382947", "value": 89836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732749, "uuid": "de48ede7-b864-412d-878a-ae324b9fb9b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732749, "uuid": "729fb393-90f2-4be1-a37b-65f0b7446319", "value": "37c2058b64d7f3feba6cba552c0d79d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04d0a0f6-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675796141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796141, "uuid": "f4b4244f-a8be-438f-950e-e91e559bd251", "comment": "Malware payload (RemcosRAT)", "value": "04cdaa297e911cb28e4be4a4f5c2acae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796141, "uuid": "15d3b106-7735-40cc-af2b-7f63f2db5278", "comment": "Malware payload (RemcosRAT)", "value": "305e9aa2df19b77ad92b897543e803b5dea0c851b37cf8c9b4e2206282343946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796141, "uuid": "c5bd5cb1-2ea5-48fa-aa2e-462bf0782139", "comment": "Malware payload (RemcosRAT)", "value": "7c23b14214db0e1ae2bc3dc924c2455aa0e9a403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796141, "uuid": "90b91849-622a-499b-b821-b641cb2b6605", "comment": "Malware payload (RemcosRAT)", "value": "e3171c48887c7226eaebff299c97223ebf641f2828d5fd148c8c08224ee400d97a6e772c1f878e80e7a626e15afaa1f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796141, "uuid": "88bd47e6-68c6-4007-8af2-2b279070c3ad", "value": "T127E1A611B3D84737D9BB4B7A9CB263004338FB50EDA7CF5E2984A62B5C117518A32B71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796141, "uuid": "557e5582-32d3-4eb3-92ec-621767d5d5f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796141, "uuid": "01f310bd-9b4b-4bbf-915c-059859aef949", "value": "96:3WIed0mO9VKelqcjDtLr0zY3SI6kRn1YdaKNdw6Ny8HqHzNt:PeNUvFOzYrHRjaB9Hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796141, "uuid": "d05b47f7-454f-4776-803d-ac050a48f2e4", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796141, "uuid": "1d1924cf-07c6-48b8-aa44-0ac1ae3c6f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796141, "uuid": "aae86103-ee75-40ea-8ade-e5cf5823d58f", "value": "Sasol Nov\u00e1 po\u017eiadavka na objedn\u00e1vku.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a570fc-a71e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675798587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798587, "uuid": "f0b539ed-851d-497a-82eb-e917be9afb1a", "comment": "Malware payload (Amadey)", "value": "eaaf699598de0ff8b669c3a6dab45d37", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798587, "uuid": "13497b3e-c324-4370-a497-050a72b2777f", "comment": "Malware payload (Amadey)", "value": "30903609973aac5a55cfa22a8720b907c01e4d21066896de88d1937ef3fa1337", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798587, "uuid": "2e1bb894-5f5f-4325-a9d3-6ac60baa3898", "comment": "Malware payload (Amadey)", "value": "e75f773300e252f822832b34fa464ae7729a6456", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798587, "uuid": "a580efe3-90fb-4309-a565-1185c80c05aa", "comment": "Malware payload (Amadey)", "value": "aff8f9dcd27acc11ebd4811a4781127c473a395879576726e4685ebb48efa61b7bdc0f93a66b936fd186d11a4f6f8105", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798587, "uuid": "e24a630d-c0b6-4291-b84c-2e9aa2894b1b", "value": "T122B40107E6ED5436E8B4177049F603C316367EE16A78439A368FAE9A4873160F23537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798587, "uuid": "450c1420-8e61-4129-8fb4-4e7c2d975595", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798587, "uuid": "c89d9908-60ae-4a2f-a2ae-4beb0a83f793", "value": "12288:MMrcy90jg+OgeFztZbadEsGuD8o8BDqEM:4yiKFzn+EslD8/BDqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675798587, "uuid": "20c1eed1-348b-4e6d-b476-d2b148842e17", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675798587, "uuid": "1f4189be-36d4-4d8a-911e-9a24b6cf2173", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798587, "uuid": "bf4b88fd-27ec-44d9-bb09-4f011f259e2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee0caf18-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675788372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788372, "uuid": "4b0b8964-9955-4b6c-a33e-3966682fc0e9", "comment": "Malware payload (AgentTesla)", "value": "67ebc475e9308c4813ba1d3f5a447ab1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788372, "uuid": "1091acae-a3cc-4ea4-ab37-7741527e91ec", "comment": "Malware payload (AgentTesla)", "value": "31c4050dc647c5bd89feca0aa84d283add7e27e5a3f64866096aebca7b4f862d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788372, "uuid": "ea4bb3b5-f39d-4a8b-9111-ab81e746aad2", "comment": "Malware payload (AgentTesla)", "value": "3cfb41dcb765b37dfa1dfb887fd4577db2d5f037", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788372, "uuid": "619f48d1-e13a-4f29-adfc-068522cb4663", "comment": "Malware payload (AgentTesla)", "value": "0f8b4148ff1ecdc319dfd9a03bd9a96b7653a2559775c40ffddf5ffc503e7b071191654eb71142db587e368c8acc8605", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788372, "uuid": "34cbd0ec-b125-49f7-bd50-f7bf08cbd995", "value": "T147257D013AF6C863F05A0E7460283DCC3A3CE4475BDD419FE972A96853A6B76F9D8D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788372, "uuid": "2fb467ba-4457-4d25-ae8c-235cfb96f3dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788372, "uuid": "5bff684f-7305-4821-9865-0ce417922fda", "value": "24576:vp1LYGDkjwJsoGlWL+1zzELVYQOpRVeBlni/mW8aSn43:vp5Y5UsoGl++JELVYfpRAB1S8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788372, "uuid": "60d866b3-20c0-4e00-bf87-288151ffd258", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788372, "uuid": "03b131e7-0910-4bee-ab2f-eb4d4c569798", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788372, "uuid": "9b6eb95b-22e7-462a-9c45-d143b8afbde1", "value": "AWB NO. 1456977583.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c2b08b8-a6bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675755969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755969, "uuid": "f162a839-1c93-4914-b3aa-1866a0ed25e8", "comment": "Malware payload (Mirai)", "value": "042ecb6f666f8e125717ed7c087c3357", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755969, "uuid": "6425c8d1-f119-4371-a54f-40a78d27b76c", "comment": "Malware payload (Mirai)", "value": "32298060b566259c658218fdab20b213b08795a520867cccf201c6b276b41c69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755969, "uuid": "82e347cf-8395-42aa-aa6c-6b469a1f49ec", "comment": "Malware payload (Mirai)", "value": "b1292945a59b68e155e9e35f1431e07a8515fab3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755969, "uuid": "65c50cdd-91f9-448f-aa57-cce4615ac4e9", "comment": "Malware payload (Mirai)", "value": "5005fef11e52025764c2b0756275ee08e90fdb3863a65097aa537f22005452c129b6f3fb42ee2f51f878b5164ba194b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755969, "uuid": "24ee381b-4717-45cf-a0b1-676d7cf42b40", "value": "T1E1A33B03B71C0F43C89759B029BB37F1979AB6A212E72181A91FAEC057339792123FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755969, "uuid": "6ae490be-b30f-480d-8809-b0fa2397c443", "value": "3072:B1aDonZ3/L9nmzL1p+7MMVDmaj0PXxzfsDj:B1IuZvRnmX1pCVDmaj0PXxzfsDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675755969, "uuid": "c8ed4878-6575-4132-8fe2-0e0d140c77bd", "value": 106318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675755969, "uuid": "13d0c238-a00f-45e3-9b0b-c5f3ce37defa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755969, "uuid": "1e6f5843-72ca-4092-ab8e-7848951421ce", "value": "042ecb6f666f8e125717ed7c087c3357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b66b58-a73d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675811853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811853, "uuid": "8e18597d-e924-4400-946c-d53b2bf0cb48", "comment": "Malware payload", "value": "6c679e6ac0f4e574640197f7161d8dc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811853, "uuid": "4010b0cd-225b-44fb-a540-7faf5bdef5f7", "comment": "Malware payload", "value": "3279c13f8884ee57c7d8a7d582ca7d319665897841571a5d940612837993408f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811853, "uuid": "a0e52dce-4745-426e-8ca1-7c0c43cf5a71", "comment": "Malware payload", "value": "6b97e23df46702d620e1f63b29d89c61e2da3b9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811853, "uuid": "df19c39a-eddc-4945-b3c0-a1385cb4e7dc", "comment": "Malware payload", "value": "621fd6aa0a409a5cc4d47f77ab2791db44d97d7b5ab2c8b9781f7328c6551a588386da571341cc2402a14f0eafeb0494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811853, "uuid": "be669fc8-92f3-4830-be11-126a040dc7b6", "value": "T1C3C5E00A5D94D0A7D1618F70C9CB2DFA8C16EE6FE8BA019713103FFBB671206A946D35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811853, "uuid": "4df2a57f-1c46-4a1e-b0d0-347a1adab9e6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811853, "uuid": "427cd6aa-cd41-45f9-9a40-3a59cba6854e", "value": "49152:wDtuU1O055x9plMcTamUBGgzw2oz8nPqO49aPhLCgv2MR:+j1O059vMcTamUBGgkzISHCNv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675811853, "uuid": "8a3ea078-fc20-4bf5-beab-fabf2f3a746e", "value": 2700112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675811853, "uuid": "92de612a-ea52-4a9c-88d3-976c20f80318", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811853, "uuid": "97bd0af6-6186-4c86-8a0a-ba93d4e24400", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdac501-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758627, "uuid": "62be5f21-8c4e-45d3-ba3a-0130df1ed103", "comment": "Malware payload (Gozi)", "value": "0363b3509cf546a1a48558cc1764f1c7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758627, "uuid": "cb078ee9-562f-41f9-90d1-10b9da016f48", "comment": "Malware payload (Gozi)", "value": "32e1181af943955100f3ee11b9361d671b3a5719c847d81c35890bfa8602984e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758627, "uuid": "0519dcc9-1045-4ba2-991f-80051162a0fd", "comment": "Malware payload (Gozi)", "value": "4e089283136b9f32023886d24641534d6d2ab5e4", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758627, "uuid": "62c146cd-9e3b-4a8a-988f-f2e1d33efb62", "comment": "Malware payload (Gozi)", "value": "64ea65e261d9e83e67f16e25a14247c5e3eb6d083b3ef7ba54c9c3942d01fd07055626b2cfc1d354c33559e01fdf2028", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758627, "uuid": "f70bbd8f-6164-479c-97d0-0e10140302d5", "value": "T18BB19F6C877DBC0B81D82648043AC76F85924AFEB07D14453F11B42CAD17408EE5E7AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758627, "uuid": "df79006d-fea0-4bdb-98e0-3654ed0b4f1d", "value": "96:86QP+NBGu+oFPwA2ZnKDTB50+dNM3jvSFZsSYNgjha72aB2nDuTsD1:PQGDGu+oxmKDTB5LodNgjhk2dDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758627, "uuid": "d2f0124f-3455-4aef-9990-06e91fe338ba", "value": 5097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758627, "uuid": "f77f2099-3c2c-4bbc-9d96-03ee927800ba", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758627, "uuid": "5c9a9202-ba74-4f43-87e9-a157aeb8627f", "value": "azienda_19.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf24c9b-a69b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675742199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742199, "uuid": "846e8474-f52d-449d-a923-0c3ee6f5e39e", "comment": "Malware payload (Amadey)", "value": "4c6f49053eee1f9ddf0d2b836efc6e13", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742199, "uuid": "73d9bbe0-c3a3-43d7-a7c2-455e06c854e1", "comment": "Malware payload (Amadey)", "value": "33046f41d178fea105f3c9d2d2b96a165857395989768397a6e59cff5f1db58a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742199, "uuid": "6156bc98-25b0-4cbd-95bf-5c25b14a49c5", "comment": "Malware payload (Amadey)", "value": "27773c4851fb235280a378b2fb76a996b5dab3d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742199, "uuid": "0ab01e1b-1714-4da1-b2d6-27a3b024b76a", "comment": "Malware payload (Amadey)", "value": "68d1cbc3860a73404c694b1297349421976f4363cbc7331db1acf09b0c0bbf572df78d4b4456b6a60b857d204dbc8e00", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742199, "uuid": "6cb43d75-7a59-465c-bb00-56e1e025697f", "value": "T1FEC40207FAEC4136F4B067B019F703D70236BD606A788397224E6C5918B26B5BA357B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742199, "uuid": "a9811ad1-6966-4b32-97b2-bea7d0a2b5b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742199, "uuid": "c513f1d6-52bc-4b1a-aeff-a0ddcb2eb1b6", "value": "12288:RMrAy90f131s7qMtxTALEhSmeR3MW6peZPVRc5owU3t:9y251IqMnAQhtiMsZo5Yd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675742199, "uuid": "3aa608f7-22d0-414c-bae1-485949e2be97", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675742199, "uuid": "c21fd85e-de0d-4e8b-9f04-42ddcfa55c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742199, "uuid": "eaee4fd9-d333-4abd-abb6-6f66218d2b7b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06f49f8-a6c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675760781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760781, "uuid": "f2cae0ce-8d4b-47a6-b27b-ec52b1892df2", "comment": "Malware payload (DarkCloud)", "value": "19800e55ab5b936a44b3c5fcaf177509", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760781, "uuid": "3e07a34f-8b6e-4d31-84c2-a85f9e71f957", "comment": "Malware payload (DarkCloud)", "value": "331c2f4bff1f7b905846094bf883b8d67efa9f6698c57169bff85fd4382da009", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760781, "uuid": "2afb0188-78ea-4295-9e73-7746df7d0b12", "comment": "Malware payload (DarkCloud)", "value": "90bb8c088535f82346bf5a1d6615914066447d85", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760781, "uuid": "6412f9aa-02a5-4b73-8553-41965a32121e", "comment": "Malware payload (DarkCloud)", "value": "c320a61637ba5e757491d7714719742baa501a97526fd6d16189007ebc08f84f783aa2433b2d0d5a04cb528e88072eec", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760781, "uuid": "0e2c4e95-fd66-48e9-9252-04796b4861ec", "value": "T106252305533A4774DCDA85B1E4B69B1423BBAA0EB116D35C8EF864FDAE23F14CB81583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760781, "uuid": "ab7aa36b-0588-4427-b3dd-ce8f1d2726e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760781, "uuid": "74286221-851e-4535-a84e-02f2938bfc08", "value": "24576:rA3erxN5IC54TWM0E/8Fw/ghNGgf3yKowe/lM9ZYRezar8Ij:EetgiJE/sugPN6lQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675760781, "uuid": "ad1da252-cf7c-4d5f-b60e-0fabdb66f180", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675760781, "uuid": "af126c9e-6b22-4aaf-ad0e-0bc2c121ae20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760781, "uuid": "af811c8a-3f47-4106-bc7b-008f1b75c433", "value": "FB-108N & FB-108NK \u8a62\u50f9 - \u7530\u52e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122c7a6c-a6b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675752355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752355, "uuid": "313efc09-351b-449d-aa83-80eb22e7df9a", "comment": "Malware payload (AgentTesla)", "value": "a4d4304161c5693a9f84c8ea91240812", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752355, "uuid": "8ae1da34-6d18-46e6-a1d3-4f5367d63209", "comment": "Malware payload (AgentTesla)", "value": "3413c7801a6f4e5256351c1108e34ef4fd4043909ee6505e2213503d9ded7c9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752355, "uuid": "f99c8151-7770-4de7-a9ca-2f023ada6554", "comment": "Malware payload (AgentTesla)", "value": "01daaf1b7bbbffdb0361786b572a979980a2953d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752355, "uuid": "bb32c43f-46e1-4110-9279-0e0208d8c727", "comment": "Malware payload (AgentTesla)", "value": "bcbaac22f344e38d871c7dcd9a7ad23003bef0679f01ffa1295088d5cbad6448bb4cda0fadba3ceadf090ace43425381", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752355, "uuid": "aa00fadd-b9a0-4b58-8eda-271aee6b09f5", "value": "T1F1F4121D63289B30DE598BBDE8ED592443779B2CF251F72DAFC429CA2912F508E40787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752355, "uuid": "c9825861-1630-4af5-a01a-72a04f94766f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752355, "uuid": "573a98ad-4720-4931-8c86-244da6a80598", "value": "12288:VogYcv2/vI55h1XnVlyXpcqqU8LQeYI/LiOYOrx7p58lCrd4gyQapWMs0PA:VCup5j3VAXeqqU8DYI/L3rxN5IC54TW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752355, "uuid": "1bdaa59e-bcbc-4458-b2f3-7d1630699037", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752355, "uuid": "f2393061-e5fd-457f-a055-f637f09b8bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752355, "uuid": "32cf15df-8f1d-48b9-869c-95914459662e", "value": "FedEx Receipt_2341747122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e727ead2-a684-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675732526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732526, "uuid": "29887a43-994a-4f8f-9a52-ff4da645674f", "comment": "Malware payload (GCleaner)", "value": "eb0dd507967f564df5cf43e6d88ebfa2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732526, "uuid": "358c360b-2c63-48a9-b6e9-964262037a60", "comment": "Malware payload (GCleaner)", "value": "34605e78a2bd43f2607a84c3190ba309ed97433dd4ee4b876cf4a5c385fce240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732526, "uuid": "0e3b855d-4098-4d2a-8cae-b93a389d390d", "comment": "Malware payload (GCleaner)", "value": "798c0853aa85f52be5bd829cce7f1ac8d3574248", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732526, "uuid": "310f5e26-0735-412f-85df-b97bc121f91d", "comment": "Malware payload (GCleaner)", "value": "3f109ddb0711c0b5bc8d9849c6c58a7bdf072d08a3de0b87000e488bd927fdb083e463dc9729257c94cf1ae9c691d0a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732526, "uuid": "03bee7a6-1b55-4fee-8d87-ab9298c44f7c", "value": "T19FA52358A69AC0F1E380CF79EC1E45F9763B7E60D4F45227309C3E4E7AB226D542E246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732526, "uuid": "b304de97-feb2-4c77-9603-367a68d9c238", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732526, "uuid": "88df5966-3f81-400b-bbc2-222fa2491989", "value": "49152:nZm4JvniUg9UNBM7HWBHiG+ucZkSZByaKh4XzpyDVNTHLCgv2MR:ZFqD5IiXrChdXTTv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732526, "uuid": "c941136f-66b7-4d9c-82da-58fbdc06c648", "value": 2067340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732526, "uuid": "398454e9-8522-4e9a-ab7e-a4156b349d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732526, "uuid": "07712c0c-a8f8-4562-b3da-857b08968269", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b51fea3-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675758490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758490, "uuid": "b8e8c7d4-fe5c-4227-afeb-030afedbf6f3", "comment": "Malware payload", "value": "ca4a46a15c54414b283f255a118a137d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758490, "uuid": "4a0f54c7-7623-4ea5-b168-660a489deeeb", "comment": "Malware payload", "value": "34af217203aac4784ab8f267620e94e9cf9084a1475317832e63d2fdf58671f0", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758490, "uuid": "a1144bf3-e91f-4b43-a7bd-662101f569dc", "comment": "Malware payload", "value": "bf23cecc4d1814cc4a25f5c4b5e38950ce2ecdf4", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758490, "uuid": "c322a203-8810-4cf2-b68c-5ef239390a30", "comment": "Malware payload", "value": "ff629709427df553ba38db76250d259712d82e92c257c0b94e267f1dec023aeb2b57a9e6b1dda8b5b383d5e907141902", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758490, "uuid": "93bff142-7793-43f2-80f1-f620409ae79f", "value": "T1C535020BF624DF52C81783349E138F920317EE5D7D1E62866582B36E6B331E946E369C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758490, "uuid": "4ecca59b-b178-454f-b589-6f9dafa1924a", "value": "24576:gLKUMeouOEXJAJ6paXiiGYvBB5DbbgJcmOFFOaBFgejwGY:gLKJ9uOEXJABrpgJZONrNjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758490, "uuid": "9cdab3f5-ef01-4be2-bb6c-188dead6e09a", "value": 1147904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758490, "uuid": "26391d1c-e77c-4a77-8ca1-ff860f1fd315", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758490, "uuid": "501bb0f4-e6bf-4a73-98e3-649cf786bf6e", "value": "412.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab668804-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756907, "uuid": "7381e493-0ccd-4403-8e06-fa3475875839", "comment": "Malware payload (SnakeKeylogger)", "value": "93851aa3041447effab9c4178c374a62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756907, "uuid": "64e7befb-7442-45a1-9a26-07d5ed1fb964", "comment": "Malware payload (SnakeKeylogger)", "value": "34b9ab12c430ce458e3b1236115b18ca267b7876f853aa3e353c2e4d63300b47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756907, "uuid": "f1147536-fa6b-459d-8405-65cfb827447f", "comment": "Malware payload (SnakeKeylogger)", "value": "1b5060f8e713765b5c346a952abd8d0bc2fa3516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756907, "uuid": "6f41fc34-1bdb-4ae0-a251-4db3e7b394e8", "comment": "Malware payload (SnakeKeylogger)", "value": "ff172c5effa74414fd76d73caa019ab9234caec53505b6d9098f1c834d1f4e3febd72eaf726e922a0f608cddff9d0b99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756907, "uuid": "aebf52ba-d1f4-4fd2-9c5e-c8d12c80504e", "value": "T13A45C43D58AE523B9AB5EB66CBE4541BF5D0E52336039C3AE0D3138246179437EC623E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756907, "uuid": "6fd6bcd2-63d6-47be-afd8-891dfe11e905", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756907, "uuid": "0926a60d-a854-412e-87c9-f3c1f1a531e6", "value": "6144:XTNTugPCEH8UtHrOtRxGLdu2g/e4uPwTzxj9:DhNbHdHrKGLduLW4uPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756907, "uuid": "19141000-3afa-4881-a74b-07f89636ce62", "value": 1277952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756907, "uuid": "27b42912-66ea-40cf-9422-d4b170b94ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756907, "uuid": "476a1914-8149-4e95-9da4-490d8decda5b", "value": "HEgub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e322852f-a6b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675752276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752276, "uuid": "be3c8943-e970-46b8-83b3-6b9613351362", "comment": "Malware payload (AgentTesla)", "value": "0f33e7e49d65f57bf6fad9d42faf7d58", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752276, "uuid": "e63087d7-add0-4755-b979-6fbf4fd77400", "comment": "Malware payload (AgentTesla)", "value": "351f755a15fa992f69ae30ee974f614fa0fe76f9b93c70812de0486a9c66cf9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752276, "uuid": "91cd7966-4827-46d4-9085-2730dc9a37a4", "comment": "Malware payload (AgentTesla)", "value": "5f9995d3a89a4ed2702f5eda43280d091e077910", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752276, "uuid": "fa2dfd71-97a8-4a08-9600-ccbc12d697d8", "comment": "Malware payload (AgentTesla)", "value": "314d43c0e6ccf1c7892f66a9ae970198c0ed294047b6d2604964df8a1e6e15175ac7600e0929474ced410ece3b0376e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752276, "uuid": "618d96b1-e1f6-4253-8722-008157950001", "value": "T16EF4235D63389B30DA5E4AB5E0F506082339997CB263D72DEEC851EE2D76B904F81B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752276, "uuid": "fb735d03-8a37-431d-b423-057f635f5758", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752276, "uuid": "eef68c83-765c-4e59-acc2-186f79912933", "value": "12288:SiyjrNHEhn8SiH4lyHbD8pK1Bokiq6T3TWxZNOrx7p58lCrd4gyQapWMs0PA:SxjrNkN8Siz8cOK4rxN5IC54TWMxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752276, "uuid": "0abece71-131e-4175-a8f8-d41bfb537358", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752276, "uuid": "6354961c-9584-45e1-ad4a-c8764acf8ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752276, "uuid": "1f9aba5e-11b0-43ba-87e2-48ed91e54055", "value": "order confrimation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f281a37b-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675789238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789238, "uuid": "81c0288c-7137-4226-aa2f-bc0923ae2677", "comment": "Malware payload (RedLineStealer)", "value": "0de4ae9910f5bd9c85aad6f29397c91c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789238, "uuid": "7201f0e7-c9e0-46bb-a954-e2d68601b89b", "comment": "Malware payload (RedLineStealer)", "value": "35cd53ed6908463b7904ce70f1a278f10ecc0d6517897624e3656091dab5f0cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789238, "uuid": "d7649f0c-4313-4443-a0da-cd741ca8ee5c", "comment": "Malware payload (RedLineStealer)", "value": "bc820548aaca50345368e836eade4890cba188dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789238, "uuid": "bee000eb-b02b-4e5a-a9e7-1b23720b4be9", "comment": "Malware payload (RedLineStealer)", "value": "432025b284cc5ec91056970b2ab1e89828dc6e08ea1a52f0f8608e2e417b3d95707cc8f55c0ed210d2bbd59197f3324e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789238, "uuid": "80e727ee-42e8-42cf-b08c-0a4c7c3e92b4", "value": "T18064F12236D0C033D5A761745870EAA26BBFB9316675C55BB7A423AE8F303C1977630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789238, "uuid": "9167ff65-4bf7-4283-99ea-c5948fb9df42", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789238, "uuid": "8eb157de-1eeb-468e-b7a9-86f38d1fecdd", "value": "6144:JHzm1kLM4rMXvLiX2yUFvAHmUIoSYm87Sd4R5bZkJk7B2+Q:JHzm1kw4rMXzWHLhS27+K5CJk92r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789238, "uuid": "aaa6fd2a-ecf0-47d5-9f72-3291ad0a08ba", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789238, "uuid": "0c421b35-3905-4e19-8c37-ffe7279d5207", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789238, "uuid": "2b6ca1f3-e553-4d13-9e76-2656a0828728", "value": "0de4ae9910f5bd9c85aad6f29397c91c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9d444a-a6f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675779670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779670, "uuid": "f7f751fb-189f-4d0b-a490-5b1b88b1e709", "comment": "Malware payload (AgentTesla)", "value": "f5b70d51ff2736c3d7ee00ba473a8669", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779670, "uuid": "44e331d0-fb6c-4dfe-8331-2e5608dc9dc6", "comment": "Malware payload (AgentTesla)", "value": "36275307aa740b6efc9476a55ac7a3c4a9cf4401d6477d5d89d20af987de2711", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779670, "uuid": "aa1886e2-046b-43c1-b555-d0872a5e58e7", "comment": "Malware payload (AgentTesla)", "value": "ffe486b15ac201c41cf557ea0c037f4e7ecb8623", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779670, "uuid": "4142a330-14e8-4976-97cf-2b0dbb035687", "comment": "Malware payload (AgentTesla)", "value": "54107402749b305a8aa82a896e0addce68558c83686a20cad202308d63fb67c143b4339a79f9b04e3960e0feacca33e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779670, "uuid": "b060f96e-0038-4fd7-a77d-1fb1ce2de371", "value": "T13505221C5FF8DB10D4AC17B998B049700775A422B2A3F72E5ED270EB2E79B948502F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779670, "uuid": "76debf95-a71b-42ad-b83f-1718fee2c404", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779670, "uuid": "e6a108c3-a2e6-46cf-8cee-f37a9783569d", "value": "12288:/wbzP+bep4ciCMxR3dm8bcs2WIEv0GtIBawHRr/CB06KuLpgbDDlG:/wbzSnb7tm8Qs/bv0awxO5dgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675779670, "uuid": "8fdc108b-747b-4735-aea9-c6867aa97511", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675779670, "uuid": "410aa24a-eb93-403f-b896-2ffbf4f6d56c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779670, "uuid": "3de83819-96c6-404a-9ee8-8ac0743e1cb5", "value": "PR23-10151 _ purchase list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86bbc7e7-a6e5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675774025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774025, "uuid": "e6d9d899-f3d3-4fc0-8e57-561ce2349261", "comment": "Malware payload", "value": "62a303cd3c6dcab4c2cfe74e5dac4487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774025, "uuid": "5d5ff8e0-4911-48f0-a9ad-1e273c0505c0", "comment": "Malware payload", "value": "362ebbe5aa4d13b930e8f106332aa3494bd3064c8e103ea84c85299c2248fbb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774025, "uuid": "a99436ce-2b21-451e-9ccf-14872687f6e1", "comment": "Malware payload", "value": "b30eb9f7b962789e7ef0cd980413dc23a52c3c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774025, "uuid": "f86eb419-2400-4670-9798-3480be397dc4", "comment": "Malware payload", "value": "b7c407823b15adefc94487c19466fd5ab2c0b82af224f716d9aceb2144d0be8b759f2e132e0e72064db217537b27136b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774025, "uuid": "1e3301a8-ad3a-439e-9c40-2c43842bbd14", "value": "T1B6F1E8129BD85337CDE64B7B8CF35382133CE795EE83DB4E5984524ADC067990A62FA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774025, "uuid": "87b5b30f-43ac-4156-9904-7352989c6a9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774025, "uuid": "b3930e02-b4f5-41da-b8ea-02993c2c165c", "value": "96:uT9+ennx6SN7OfkGEl33JtsrIbq1cEwzwr0Ta46k1w5uYbFnU:0Zq/ElJtskbAcEwDG4H1wMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675774025, "uuid": "fd459363-fd5d-4ac3-9f7c-b70b4de00d6e", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675774025, "uuid": "818af187-4ccc-4628-919d-9cfdd8c57034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774025, "uuid": "56dd2084-89f8-41b3-b2a2-323b3ee5fe60", "value": "362ebbe5aa4d13b930e8f106332aa3494bd3064c8e103ea84c85299c2248fbb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210f1e1b-a6f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675779868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779868, "uuid": "5c91e43d-21da-4784-a62c-4751fb52f4b1", "comment": "Malware payload (SnakeKeylogger)", "value": "f95a568151abf6cdbc78288f24352733", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779868, "uuid": "046143af-159c-4802-aa00-b0c0854b41aa", "comment": "Malware payload (SnakeKeylogger)", "value": "3669f96c22728c600ea409d6a0ebf8f66ee8ca7eaf50a5f1767f2086b7081d76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779868, "uuid": "6fa671ad-2d05-453a-8a5b-29928046c5c1", "comment": "Malware payload (SnakeKeylogger)", "value": "9e8d4ecd93cb80f07f959c850273b83e8066ddaf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779868, "uuid": "bf775f37-1998-4d8b-9c03-176add32a819", "comment": "Malware payload (SnakeKeylogger)", "value": "9ef20846a7803627ec0330d0e728cdb31c0751c0f0951cf55e3946529620b1add7c05e87148eec59b0b5eafbc2fc5b01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779868, "uuid": "f80ce964-04d1-4799-a4ab-c923e480d20c", "value": "T162F4230F7BFA9B12D96E17FA687419215739E0267157E31C4E8730DB2C6AF900502BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779868, "uuid": "362c532c-906b-4d9b-b22f-f2a60656a02b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779868, "uuid": "13b44b8a-f6df-4289-9bdb-8064051b9933", "value": "12288:hMaBkhgfZIG0UGrJPg/ZsvsbkNENbpOr9k9sb/y9AGFCRshawHRr/CB06KuLp4b8:hM+xfZIG0UGNIhs5abpOu90q9AdKhawT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675779868, "uuid": "5de26b82-04cb-45dd-a8e9-6fab1fd65087", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675779868, "uuid": "a9614069-2fd7-4941-b637-99007660e93e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779868, "uuid": "2234e12c-56c6-4533-8310-572a9b04cc51", "value": "arinzezx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d945f66-a6e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675771862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771862, "uuid": "ec9efc1a-ee77-4f8c-ba27-b94e03f6b12a", "comment": "Malware payload (AgentTesla)", "value": "8f62fe70c4f9525ba2ed2cdfe49b951d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771862, "uuid": "4b76f7ea-4a37-4589-a4a3-59d477916f4a", "comment": "Malware payload (AgentTesla)", "value": "36829f2ef5cb766c529d70e05a1ff82a8c421f8c0a21e64094d970914286bbc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771862, "uuid": "aa47b40b-94da-4a3e-a63e-4424be063282", "comment": "Malware payload (AgentTesla)", "value": "199bfea7b7619fe9d8cc66052a89cab9caee1bfb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771862, "uuid": "3ff0d566-ae0e-40eb-87eb-841174e73782", "comment": "Malware payload (AgentTesla)", "value": "fec0d2eef39cead70fba46a7ed52458047f437394e961a02e2360a4ad2d314fd6bdc002187469f31a9f4e30552b5d9e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771862, "uuid": "1bc629af-9440-439d-b149-c33b5dc99364", "value": "T1B6541394AA55CC23F59726346E767223AB9EEC2368ADD7370B208F7C7921143D90F712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771862, "uuid": "2c9d01f3-c27d-430d-b711-e2e02d58327a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771862, "uuid": "38c97f0a-4bdc-4f77-be87-956d0ffee426", "value": "6144:PYa6GbGha7904GSEeSKYtcUfvAsTE3MRxRGG57q:PYoqd4BE3r1RiGZq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675771862, "uuid": "e1d5f006-ec93-4d79-9ee3-2072ab031e73", "value": 296655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675771862, "uuid": "be73b21a-e49c-44f4-8584-ccc92ca9652b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771862, "uuid": "1adac047-09db-4d3a-be2f-21b31e82d371", "value": "36829f2ef5cb766c529d70e05a1ff82a8c421f8c0a21e64094d970914286bbc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184176f4-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675783289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783289, "uuid": "4a71c1cd-096a-4ea8-b5e8-4fe569973501", "comment": "Malware payload", "value": "69ec52345dd9aa409658fceaeead4c13", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783289, "uuid": "86220706-8ebd-44e9-82b5-5ebc2ab68386", "comment": "Malware payload", "value": "36935ec210ce57253de0951d8ad834249bf11bd21a90d852a891770852736e84", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783289, "uuid": "bf4d8d89-2767-4732-b200-ffbcf0c77e74", "comment": "Malware payload", "value": "bd2de9b0d375eb26d5b932fbfbbd86a29ef800d3", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783289, "uuid": "4db7babb-4533-4976-8b91-f9d8299e980d", "comment": "Malware payload", "value": "f64555f115c8a63b9825b5430d4fff3fd74f0c021df20cf4b1eba74ce0116d21f691ffc171034bd1aa1e9a577e480cb5", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783289, "uuid": "fea6c595-6ce3-4cd8-ae8e-b413a18bc417", "value": "T15E34FF3EEA850F19425B48CEA06E2FCD1170A37677251B997BED7097B504C291822BFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783289, "uuid": "3bf2c3e0-237c-46dc-94d9-f71248c3c9a3", "value": "1536:9lW0a2gbqeF+hc/woScpcdTGmclcljuTbUhXlc1c7Xc+cX4UQRKc2cKUUddLb1Wg:as+GD7rKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783289, "uuid": "b0945ce8-a649-4288-b13a-f8e3b50d0d68", "value": 233096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783289, "uuid": "cf8c35a6-3938-49fc-b3b0-259155d3628c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783289, "uuid": "8d2eba81-695c-4afd-95e5-e55a059ee26d", "value": "\u00dcberweisung - Rechnung AH F\u00fcrst.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f16c4e-a720-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675799409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799409, "uuid": "8f5bc705-f963-409f-86d9-90bea26e2684", "comment": "Malware payload", "value": "16fd83a682162d6edc119dc12c9990dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799409, "uuid": "30d8be6f-7f45-4f85-8d22-bc9579d2693e", "comment": "Malware payload", "value": "36be2f6cccdf3edc709e7dabcbe529d4f6390d3c624ba10fb471bd05d36060c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799409, "uuid": "c84362e7-8873-4397-96b5-f3132a063a8a", "comment": "Malware payload", "value": "4b5f38c78c8e5f1333989da0912e945335f82c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799409, "uuid": "64f0776d-90df-460c-b4f4-d377e964b39d", "comment": "Malware payload", "value": "9cf83fc9a39edeab8e8ef0206b69f9aa369dd2dab3da9bf90b3f29b200d3d09498705b1c631718cb71dae92478d445c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799409, "uuid": "f88c686c-d797-4071-ac01-1689e1f0ce2e", "value": "T1C3357D1BA26601BCD4BBD1788A235A47E775740603709BEB17D05AAA3F13FE16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799409, "uuid": "f8542d0d-1a38-4840-9acc-91edaca485f5", "value": "7440c982ea49d693b3f3d5cb31294fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799409, "uuid": "5f2e31ef-ca7f-4648-ba6b-5a91b53e6751", "value": "24576:YVaH8jJPWhQnZzrZ+7xr1rZfVlTxd43v7t5m:2AhQnZzrZSxxZfVlUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675799409, "uuid": "9d793b0a-4e08-4714-b801-d98b6527dbdc", "value": 1074176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675799409, "uuid": "1eeab3fe-4010-4fbc-8237-def1ca098e4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799409, "uuid": "9bf042d0-cf61-44f2-a8ac-7fb9c40af611", "value": "16fd83a682162d6edc119dc12c9990dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c501389-a707-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1675788423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788423, "uuid": "20611838-988e-4891-8a2b-350ff96d5f85", "comment": "Malware payload (Cobalt Strike)", "value": "f9949ce51aaeb11fd62d25daa0260a2e", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788423, "uuid": "c9b29e9e-f789-4c3e-bfc9-0f4f3f83c6bb", "comment": "Malware payload (Cobalt Strike)", "value": "36dadd6c2fd3733c5a24bf74e439aac09b6b9dc79213fe34387015c6cf95afa2", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788423, "uuid": "4ed152e5-24e8-43d7-81d9-4d4a6febc0c5", "comment": "Malware payload (Cobalt Strike)", "value": "c81611ce66b4e5ba6e8100b918d493baa69e8fc5", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788423, "uuid": "f6a60c4f-2d0a-4868-8675-047ae9b96b28", "comment": "Malware payload (Cobalt Strike)", "value": "203e45a7ae7aae96eff56ee6e730cb518f5dc753c81dd13f037920521c171d89ba46a840cc5338d5fdedc7dd43ce606b", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788423, "uuid": "98b36999-6764-443d-9921-38e30148fc1a", "value": "T16E553947B8D081B6D4AA9232896592A17B30BC491F3163D33B50BBFE2F7A7D45E35318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788423, "uuid": "0e14efe9-ca3a-4287-b744-8e3032170f6e", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788423, "uuid": "02dcad31-a974-4796-a25c-3a6eb3c5dae9", "value": "24576:M2WGY5iSuvZHV3AJmP7V7ehg5pAABBuLz1:pWGYAXxHVQYjVag5p9zuLz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788423, "uuid": "fb426019-1e6f-4b8a-ad70-1c8921b80807", "value": 1377792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788423, "uuid": "af2dedb8-ae4d-4e0f-8932-9c74464a8b81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788423, "uuid": "93e95e8c-d13c-4197-95ed-c9b17c2dc04f", "value": "f9949ce51aaeb11fd62d25daa0260a2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ecb0c4-a6f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675780419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780419, "uuid": "43f99e32-3511-47e8-afb8-a24f15f854f0", "comment": "Malware payload (GuLoader)", "value": "f11b79c769c9a90b99c94c67cb4f65ad", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780419, "uuid": "a5c59750-b2c1-42e9-9b91-49947318ab41", "comment": "Malware payload (GuLoader)", "value": "371b09b2c178417073fe144d59c489dd2aa6dcf857f2c79bc289b88e2be690bd", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780419, "uuid": "02a724e2-d6b9-4408-a7f7-803525ace0fd", "comment": "Malware payload (GuLoader)", "value": "6b240b312e2f82ed5153f6576e292149b5864e92", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780419, "uuid": "940521ab-5327-4ad9-8405-1c8611d598ec", "comment": "Malware payload (GuLoader)", "value": "fa59236618834e9bdab6fb7d94b41e1f12cd45e3be5da967dd7ed1797f6fce547124add6cd9b93fb4fb602732636f7cf", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780419, "uuid": "c0061a88-b53d-41aa-ad1a-0ca1b665a0be", "value": "T17174AC476F3006990B462F5E98F40C940C514AA23DD71E1609736AFD3F2EAFABED861D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780419, "uuid": "5a2600fc-8621-4719-96ec-8f905a89fbda", "value": "6144:Z9q7eWOWb153bxobtFhLduPYQSGFkqzPHpx4H8hp9:fqTlD3lobhLdWN9TnC8b9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780419, "uuid": "3a15a100-4410-4e64-9f82-23556e0ba907", "value": 356284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780419, "uuid": "3f63b7b1-bb76-4b42-b239-c13f07affb66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780419, "uuid": "0eadf36b-06d7-4370-9140-1e0e4a83a303", "value": "ConfirmingPagadas.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ab9309-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675758556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758556, "uuid": "335b117a-9235-4047-a67b-e82f33bdffcb", "comment": "Malware payload (SnakeKeylogger)", "value": "06dbf592dcfe18436c737b5c1e8dbbe9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758556, "uuid": "e7ee2514-51f5-4959-98a6-81677a0cebb3", "comment": "Malware payload (SnakeKeylogger)", "value": "373f8484628428495d9b815271b35e3784e2804b3858ae71ba636ccd4680a3eb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758556, "uuid": "157e1f62-4ee0-4c26-a81e-35c9bf6a17e2", "comment": "Malware payload (SnakeKeylogger)", "value": "75dbd06ad6d9c0a122e931897ff986537bf28ba2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758556, "uuid": "50062f80-17fb-408b-80d6-851901d460ab", "comment": "Malware payload (SnakeKeylogger)", "value": "8c1c1803ddc1d71a32ce13c7dc636805dba9bdf277343eeb778cbebf0ceb77598ff8f1cf2d0016a231fa4844f6a3e9cb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758556, "uuid": "319d97ad-164c-4d0c-9e0b-f69efb3dc9d5", "value": "T1F4137E4AE78F1268CF9512B7271A0E899ABDB33DB35151B1346C8334339DC3D4666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758556, "uuid": "eb3cfa91-7f4c-4ec4-9f5f-ff6ae7e59d2d", "value": "768:VFx0XaIsnPRIa4fwJMq50DV6UleYiafW/MlKpl64qP:Vf0Xvx3EMMcFAFaO/MlZ4qP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758556, "uuid": "74cca795-b118-4258-8917-6c7de9110f09", "value": 41614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758556, "uuid": "09ce01b6-8a51-41f1-b601-b5192a2d35ac", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758556, "uuid": "fd424bb3-ff23-4673-af50-b01eb071e5ac", "value": "WSM-PCS 17633.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720af2fc-a713-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675793747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793747, "uuid": "f2a4ef76-e335-44ff-b16e-2a8f9e0906f1", "comment": "Malware payload", "value": "f5338719cf9cd2f7543ebbf81305ae59", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793747, "uuid": "869845b7-7b59-4432-8d28-a0d9e8ff9e3c", "comment": "Malware payload", "value": "3757f3f40123b389de4fed7308d560e791b0619122c4ace56746e46f2cb1fb64", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793747, "uuid": "2bc9e712-f4ee-4ec6-ac05-a8d5a93967da", "comment": "Malware payload", "value": "5334efd7d995feca47e6734bfb250d3de0f6d5f6", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793747, "uuid": "0be4e5bc-cd3a-49f5-8b0a-ba74c5ab2176", "comment": "Malware payload", "value": "b572705206d4c62586100cfa4ee5d1c1ea43ed9584a9638e2014557e83c3f9b416b15d40662cf58035b477f76253eca9", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793747, "uuid": "df9eb749-52af-429d-9336-d0d14d1262f4", "value": "T100F00C22A95A430E299808C7528840AA02F4082880B837A42B4D7CEF9690E20A5A213A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793747, "uuid": "4aec94d9-ee53-47f6-8b53-c3665284f1b7", "value": "12:snT0XyAIwLgyaI4HPKC2Ewq401vCJ+SsKFGX7RciV0hZosgGyo+25hDGm2tB:iYXyAIwLCHPKC2EjE+hK8XFNV0hZoTGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675793747, "uuid": "d6390ad0-0e04-4e3c-afd6-d1b71eb5e47a", "value": 588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675793747, "uuid": "09007ff8-5583-4772-865a-67571c221f7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793747, "uuid": "09889653-176b-4c66-b563-59cd93e75454", "value": "f2c5d211-a449-4c7d-be01-095155878f08.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84a4248e-a6cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1675762855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762855, "uuid": "e90d10ab-e37b-4fce-8aac-c37978d190c9", "comment": "Malware payload (NetWire)", "value": "043487225e3f9b3e4c203e74d9ea5262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762855, "uuid": "86c4a856-2baf-48f9-8c11-8b32359e972e", "comment": "Malware payload (NetWire)", "value": "376510f81da04b06b0ea217c5cf45b7798459f50a7162dc09737faaefd8a4232", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762855, "uuid": "b737acf4-089f-4710-8fff-d00522c7ff3b", "comment": "Malware payload (NetWire)", "value": "9eabb7c17cf1bd6ae8d18612d14447c2bed4b77f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762855, "uuid": "32a477ff-5d26-4656-9341-526f7c1a8545", "comment": "Malware payload (NetWire)", "value": "43346b20941fa85288073b613cc448a9e287753584aabb3fe8879f2b6ff9683238d6e9060b7a90d9aa2fd719534fbec8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762855, "uuid": "4eef9a02-7aab-4735-a9b4-4d8ae4fc97e4", "value": "T128D1E81063984736CCB64BBADCF2A751433CE7406993CFAD68C8A31B9C11B710622B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762855, "uuid": "1abcf6d3-9dd9-45db-8ce0-3ca11abc2e32", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762855, "uuid": "d4d7a487-4876-45b9-a106-06a6a62f299b", "value": "96:2Sv26u0DjhVa6nScDjDtLr0G86kxNlTzNt:/26nbScvOJHxv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675762855, "uuid": "ab2e3cab-723d-42ef-88dc-eefde6a61289", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675762855, "uuid": "2095b9a8-94fc-4000-b5db-2e53763d1695", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762855, "uuid": "3312676a-3f27-4de8-9880-eb4a7524d088", "value": "Proof of Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f541799-a73e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675812077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812077, "uuid": "74360898-b0cf-4ed0-8fe8-0f95ae798bd0", "comment": "Malware payload", "value": "b523eef88c0139d2f95633276965f35f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812077, "uuid": "de043a09-3a6b-4f95-a01c-a3a7130a2629", "comment": "Malware payload", "value": "378f3de258bdde6953128ce7322ac32b2f7f8ae066ad735a29ad6fb9b3f2c936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812077, "uuid": "57f5f96b-8c0c-42b0-a1d8-ffe74af5634c", "comment": "Malware payload", "value": "2fe9252164536817041e12caa9e91da5979ab8c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812077, "uuid": "7608b4dd-828a-4f6e-8d0e-162cec550fce", "comment": "Malware payload", "value": "f2fda5f7f0475731d4f5838c107a884e01be82b9340bf98944efad55df27de6664d2e415c110db02b4c50328db7af298", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812077, "uuid": "6dd64056-af86-4311-8a49-daf8dc3d7104", "value": "T159B40207A3EC4572E9B5677044F742D30A36BCA0AE78836B634E2C4B2C72A75B535367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812077, "uuid": "9ed97b2c-dbf3-4ca9-aa36-255e35d3515a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812077, "uuid": "f4e3e545-7313-46b3-8d64-365d39c0fbe3", "value": "12288:sMr8y90V3ROcQFLWlRMI7Xflzo0rkzHsungjFs:QyE3PoLWj7Xfu0rkzHsugje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675812077, "uuid": "91daf58c-5b01-4bdd-bf09-735da7a049fa", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675812077, "uuid": "73283965-4989-404d-b8f8-90e9898977ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812077, "uuid": "56df3f1d-6936-4240-bfa2-b9b1c4515f94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89fb344a-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675732799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732799, "uuid": "b4a6880d-16da-47f3-ae38-3e66a94d8415", "comment": "Malware payload", "value": "ea35ceb6cab8cba2271d86f0ece91ad3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732799, "uuid": "95b8d32a-68ec-4d04-bc6f-031d6259cbf2", "comment": "Malware payload", "value": "37add5bec01c64fa0947e5a6dffc0c0e62b574b1ebae8dfb606a46eee3373eb8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732799, "uuid": "00499f0d-77c0-4ba0-98a5-de70fff18965", "comment": "Malware payload", "value": "5afad1a2a0a3ddd927f4da805997ea88ee263b30", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732799, "uuid": "e78739f9-a62d-4d34-b47d-cba29f906d8d", "comment": "Malware payload", "value": "664a94b70f7ce720351de3e18cb9c09887f082e408e304031b5ee003d8a4d5a0c8e2c4ce28ac2be3d01d43f539a115ce", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732799, "uuid": "78974b67-e9a9-4e83-93c8-ac4c22a370e8", "value": "T138E6338C5E0194D826EEC7256C55EE5C1B9E56342E2B84E703D28FADC3BE485782CDB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732799, "uuid": "49d18172-d1ea-44ff-9e0b-b3b654a691f9", "value": "393216:0oJ0cjLqoeJWqfaD0LaKGjcCGOIzDIshbGI1CL07:j0cjLGoYLaKKcCG/kuVkL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732799, "uuid": "5cd94399-a339-4424-993f-37f73d8ece35", "value": 15011620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732799, "uuid": "4304a2fa-20d8-4a62-adbc-a49c08bb20e6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732799, "uuid": "07b22e9f-0ae4-45bc-91ca-3bfa115cac74", "value": "Impuesto1675732231.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1fb980-a725-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675801572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801572, "uuid": "c16b838c-956f-4dc1-b342-8d01b4b64a42", "comment": "Malware payload (Amadey)", "value": "a10a89fd985ffbad2978965017ba5da1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801572, "uuid": "bfd5675e-1248-440e-a618-a2b783682a55", "comment": "Malware payload (Amadey)", "value": "37b43b90a54ae30dfa8868e093434f4cb00005cf7a1b2e13beaf6fdecd802893", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801572, "uuid": "c932a3f7-1296-42d3-aca2-31853f740f77", "comment": "Malware payload (Amadey)", "value": "a53f6c23c791fbf400cfc02ecad478e896712009", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801572, "uuid": "b3a0d252-3d84-445e-a0f1-ef87d6a80dd0", "comment": "Malware payload (Amadey)", "value": "b2d745ce17a8ae7d314505d2ccaf6e8598654225bd9a47e51b18e689957b6cbdc09a206003f757f140847a3d5496baaf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801572, "uuid": "29fca151-1117-4cde-a559-f44c715ef6d6", "value": "T1B3B40107F6F89533E8B5177019F703C31A3ABD619A79878A634E6D4908726F0763272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801572, "uuid": "917f9905-bc78-4022-88b4-742207e2355f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801572, "uuid": "339f0d5e-2b0d-4829-ba1b-5789f98282b6", "value": "12288:sMrAy90baxDdLe3Bb05If1Q7nWieNL/8:syxNe34D7WNj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675801572, "uuid": "a9c020fb-2c90-4865-a1bb-22d93b801802", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675801572, "uuid": "248d0376-0e21-49d1-949c-632d66e4c7f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801572, "uuid": "4eee08dd-ada2-4056-842f-9de32729477d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91405f1-a6ad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675750111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675750111, "uuid": "ed776772-07fd-4ee2-9759-35e62fde716f", "comment": "Malware payload (Smoke Loader)", "value": "f359f10d0e48664dba23f2f174fd7f49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675750111, "uuid": "b81a822c-a378-4576-bc13-718b5f79da60", "comment": "Malware payload (Smoke Loader)", "value": "37fdf18c6294edcf54678d7b9639132ebf69f02c3c313096aa3e0b5bd2cfe5bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675750111, "uuid": "75d460c4-c887-4c46-a55c-820fe8584333", "comment": "Malware payload (Smoke Loader)", "value": "11a8d5086726e8abb44cc7beb8a9a907ef182fc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675750111, "uuid": "ff343174-09ef-418e-aa7e-3c4b7ea1ca2a", "comment": "Malware payload (Smoke Loader)", "value": "7b59effc1386235cc505c82e2efc1c2e37a09d8605571330b32167e8838cb216cf18406af4a68703861dcf216030659c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675750111, "uuid": "2d9d154b-b614-456c-8545-42c2d7d68ef2", "value": "T14514D0323AD0C073C5BB15305821E7A62BAFB9332674C95B77A8166E5F307D06A3635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675750111, "uuid": "a3279ea8-bf35-4b86-9717-f56eb0b0c50d", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675750111, "uuid": "2b8125a1-3db8-47f3-86ae-dff2346de896", "value": "3072:rI+Opyv1XwWEvLC6eWLTQ53JMSvAEBzvAY+rkkoTDNVkg/rh+7OlvV:rI+DORvLje1JMiBzvAYxTDN5N+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675750111, "uuid": "3bcd2b4c-d3e4-495c-8260-9830a11e43af", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675750111, "uuid": "dcca9ef2-77f1-445f-a565-223f4bb06146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675750111, "uuid": "5f284949-4729-4358-ac6d-53bc97f8b0a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fa1c704-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675758525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758525, "uuid": "05491c7c-fedd-46ed-98bf-c2269f51c757", "comment": "Malware payload (Loki)", "value": "28c91c3972300ec87144051e544ed45e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758525, "uuid": "e9b6e6c5-1dbf-4b04-89aa-a32aa33d9d6c", "comment": "Malware payload (Loki)", "value": "39768453c17afce045164d39f94da00f2e7278130702d41812924bd9c2c3a82a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758525, "uuid": "5c94e0f2-3e0b-4e36-add4-865e74f4d473", "comment": "Malware payload (Loki)", "value": "0b3c7fa689cc170eb46d6403c4e4f832646b9280", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758525, "uuid": "e3c4a95b-df44-46ca-92dc-98973d113124", "comment": "Malware payload (Loki)", "value": "94621ea6e62eb9c72ae5aef2cdc89c9d0bd4e59881cf03ff95b8df05c2a92c03604a03023dd709b91f9ad5cfeb4e4981", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758525, "uuid": "d1587c55-ddab-4b4e-b589-4804c491dadc", "value": "T17113295AE34F02A9CF5112B7131A0A8996FDB73EB35151B174AC933433EDC2E06666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758525, "uuid": "314dcd7d-ef01-4c26-90da-87c96c1a5686", "value": "768:cFx0XaIsnPRIa4fwJMeOwtqisMbMU9YjR7/FAIBixw0dp821Dhoqg71:cf0Xvx3EM/YTCV/FTBixwOpnoqgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758525, "uuid": "b1c480de-58d4-40af-8694-464e3aa8e727", "value": 42699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758525, "uuid": "5f065919-6df6-4594-96cf-338bce06fb16", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758525, "uuid": "520227c1-7f7d-4eba-8d53-d7265094bcb1", "value": "packing list invoice.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f91243f-a722-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675800078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800078, "uuid": "c283b6ea-f23c-4e5d-ab36-0252fa968df7", "comment": "Malware payload", "value": "89a3314c05b78a79c19e461fece77f2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800078, "uuid": "309fda52-3b2d-4b64-80db-6c3a2587305e", "comment": "Malware payload", "value": "39a3382359a6254aa844a1ce6189fac18c8ff04c684272676d23a3a68599d80d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800078, "uuid": "79b38fe5-e731-4864-9608-ab9315593160", "comment": "Malware payload", "value": "33612f5c4c095d41b628dd984fdfc86509fd34aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800078, "uuid": "dc257b3a-58ef-4df3-84a8-5e4f26b0bd72", "comment": "Malware payload", "value": "bba516af03ef72fba0a6a45faa62a5f35ad9bca71c9e007b565e138de647f9c4a7871e77b793fc1111e252973e0319b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800078, "uuid": "3ade01d7-9d31-4ea7-a100-bbf4b8c4e728", "value": "T133763391F8E48B7FEA6975308D197D68EAE4CB707F031BA7327A4E0D0A4E425524F523", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800078, "uuid": "a7b90130-cc8a-4e8d-8fb4-35268fd4ed72", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800078, "uuid": "2f3f562c-b361-47ff-888a-c08a1738e752", "value": "196608:91OqmoOS7ZGONJkQnPKnKYpR7y+mc2U3Bkt9MYbDa:3ONoNGONJTPKKYphyAhx2Ha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675800078, "uuid": "876337d7-4caa-4e54-b13b-21dd980f9b31", "value": 7620375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675800078, "uuid": "6fcf6c1e-e8ce-4efa-9104-9f9801721287", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800078, "uuid": "76f6ce24-bd57-47d5-93a2-8b77a7bf6b11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a857d7-a6b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675754162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754162, "uuid": "2d39f894-48fb-46b0-9cbc-d8ef4417591e", "comment": "Malware payload (Gozi)", "value": "857ba32236124838f017d1b81b720b9f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754162, "uuid": "a69f9732-e9a2-4f75-863d-89a4f4820c00", "comment": "Malware payload (Gozi)", "value": "39be606880093abaf976d8ed43bfe1212019a76682d7f6ea3a38c5438b01281c", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754162, "uuid": "b95d8163-4dc3-46f6-9318-9d75b9dde102", "comment": "Malware payload (Gozi)", "value": "7a6a5e1050940fc97dc705dc312aae2cd73fc8f7", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754162, "uuid": "836b9b63-15c3-424b-bd45-37daf6ca962b", "comment": "Malware payload (Gozi)", "value": "41acb9b365942ad661537fd0e974f66e22fde402fd058deaa32a92a671f778ecd2ffd01e692155194ac0f53b88e70263", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754162, "uuid": "fa6ee810-5b49-41e7-9c3a-a6fb010cbc53", "value": "T18DE17D4FDEDBA41B5B8182DFB2737C11FB5028BAD9392208B6E5E30E2B53B67404165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754162, "uuid": "f7be4f87-9aaa-48d5-b61f-19ab0e2b554d", "value": "96:wp1hgEYLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dnrz:w1YU77rIKdn863jMM0OD9+VVF45x/CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675754162, "uuid": "2dac612f-47b8-4f5c-a2ec-4f876e32b57c", "value": 7038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675754162, "uuid": "71727ff2-960c-42ad-88d1-b2a450f702b8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754162, "uuid": "4df0418f-30b2-48a0-9311-f3b17682e496", "value": "azienda_36.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a5cd6c-a6e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675772057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772057, "uuid": "50adb699-c98b-427b-8e6b-a8a82713f5bf", "comment": "Malware payload (RemcosRAT)", "value": "0fb29b3596164f56c1e599e88e9de6bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772057, "uuid": "7996747c-36f1-4c41-8b37-d537a80de8bc", "comment": "Malware payload (RemcosRAT)", "value": "3a20e81b1f0bf0699007470e5a8e2a9a0d6507ea99696f0df9bd99b80910d656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772057, "uuid": "fe688b75-c8ac-48b0-a10b-0f0fa402187c", "comment": "Malware payload (RemcosRAT)", "value": "1208d75d6fd23f64b34358254421c9c817f89802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772057, "uuid": "70a996ed-1907-40b5-bfbd-284eefbbe93b", "comment": "Malware payload (RemcosRAT)", "value": "513fed581b23af99d1e820d2f53d283f7b5cb29f1566139b478dd336510610ae20ab90d71ae05caebf49a2659a0c5498", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772057, "uuid": "39b1f834-87c5-484e-a7ef-5aebaddcaa55", "value": "T1A3C56D395C738505F8EB38B04E875126BD7C290F38B6CD31ACB5DDE86BE652BE809452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772057, "uuid": "c7ffc107-6e1c-42ad-8b73-89c7f8329971", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772057, "uuid": "b81aeba3-21c4-40d4-bc00-f5d2899c45c7", "value": "49152:rAQuUQKJOdXIA+aXnFT3rXHwrg9VM51cks3tyJGbaaIadIQEOll/WZtUYEzxCWng:unArgUw5/I0IMbW2zxCWt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772057, "uuid": "b8519d31-0d48-4156-8f35-9895a8343c31", "value": 2737664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772057, "uuid": "638ff5d2-5214-489d-b63f-958556ea297a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772057, "uuid": "9da9883b-91d0-4dda-ad72-28020e94661e", "value": "3a20e81b1f0bf0699007470e5a8e2a9a0d6507ea99696f0df9bd99b80910d656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e7da6c-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732712, "uuid": "6bd7839a-b307-42fa-990e-e40f8514bad6", "comment": "Malware payload (Gafgyt)", "value": "c0d680b917c09bfa05e78ba1032143fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732712, "uuid": "f83e2522-40ec-4356-b007-dc3153589730", "comment": "Malware payload (Gafgyt)", "value": "3b1e8562d6f0ebf979d6a959593d2729f1c82881f521da30a7c6fa03ba5bd9a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732712, "uuid": "f259a29d-8f75-44d9-b8a6-b05ddadc19d7", "comment": "Malware payload (Gafgyt)", "value": "605538c126f0a04f7dad1768d041db0e0b40bc85", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732712, "uuid": "1cc90478-7b8d-450d-ba0b-94e2cdd96440", "comment": "Malware payload (Gafgyt)", "value": "6d05450e795e8f7690c0f71e3dbc1a13b09cdc63767b39df92ad9291c50f9935afa8d1e63ee6827d9bd2bd7332049ce1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732712, "uuid": "461aa158-62c7-4575-88f7-1c37e458eaef", "value": "T164E33905DB808B57C1E2277AF6DF424933339B54A3D733099A28ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732712, "uuid": "497daf97-124b-4d41-b9d8-b8be79994231", "value": "3072:bjMM7NwA7VWxbZaXmpvh7q07IppH/Wf0sgURKXmQwfHcQrAN:3MM7NZ7QZZawp+07IppH/WoXmQwfHzrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732712, "uuid": "2ee538f0-8bb6-4d8a-b78d-53754b52cba5", "value": 150509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732712, "uuid": "499be87e-c4e7-4cdd-9ee5-32f7677918c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732712, "uuid": "440a036e-7817-484f-80f3-4ee1712887f7", "value": "c0d680b917c09bfa05e78ba1032143fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5d7aff-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758524, "uuid": "7598fac1-49c8-495c-b750-9edb7bd670a3", "comment": "Malware payload (Gozi)", "value": "2d048d458542a50c79ea795540c1ed91", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758524, "uuid": "150ea9e9-ef80-4e39-91ec-84cd4d3f79e3", "comment": "Malware payload (Gozi)", "value": "3c0b6dabe9236fae0903267518fae1236a76ed847c8339bf72ad8efea16c6e2e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758524, "uuid": "0d96d97b-54c3-44b3-8fee-b3ecc2abb0d3", "comment": "Malware payload (Gozi)", "value": "771ee9df9d6414a6d866f3434ef49d6e6c351ccf", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758524, "uuid": "57c409a2-ce63-4286-9440-2adac706652f", "comment": "Malware payload (Gozi)", "value": "bb3f474028a7ea0ada8a97f5a737321b2b3d2abbd9b11b1baf6b78675224acc43516e591273e3d48fa6a08a1d5fe743a", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758524, "uuid": "6cc1633a-554d-4ac4-8685-f19e5590f653", "value": "T10AA19E88EC899F50632A28F16847863BA0F938F19084132D0B897EA34EB5E0C2CB641D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758524, "uuid": "a80f9b98-7ac6-470d-b9f0-302e286b4ff8", "value": "96:E6Ddc+a6f20XJtD0w+8L2olKIBIFoAU/xMxvXt0SBOLK35dduGtxE:c+zf2gJtIw+EHluFoAcx80wOLKJdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758524, "uuid": "164b4f01-45a1-4e4d-9d5d-34df4503ccd8", "value": 5052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758524, "uuid": "8d74a82b-c0c3-4e77-a93e-0778e178975d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758524, "uuid": "474542b5-b432-471d-9f03-6952fa966666", "value": "azienda_02.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09c49e9-a6aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675748809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675748809, "uuid": "c031ebc5-ba63-4661-b49c-07108bb5c106", "comment": "Malware payload (Tofsee)", "value": "d11d2ba691f4fb6605e6718c71635f96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675748809, "uuid": "05dd9f42-bafd-42bf-a259-5409134b7677", "comment": "Malware payload (Tofsee)", "value": "3c1a5da83c11c54c7a0c975148ebd317e308f7e7fe5d39eff830483bf24e455f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675748809, "uuid": "255aef7c-6e81-4c62-a0ac-5abccdb3d993", "comment": "Malware payload (Tofsee)", "value": "51e385bfd12916c22bc0aed12fcad0f2bd680f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675748809, "uuid": "056a1d48-83e1-4318-8da4-706d8bf5b480", "comment": "Malware payload (Tofsee)", "value": "27b0225915924bb8f0c40cbf57cdd9c6c6015197b8aa536eb4fca099d373597ba16b0e9db0e2e7d3b58e4032b4f39645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675748809, "uuid": "767a7e4c-8c12-4256-9adc-2e383bf7d5ab", "value": "T14214D0333690C472C57B14345C24DBA56B7EB9315634CA4BBBA817AE5F307D0AA3A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675748809, "uuid": "3499220c-99cb-44e5-b2a8-3c75526f4869", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675748809, "uuid": "c4527796-c738-4bb6-9e74-42dcacc8208b", "value": "3072:ez3O2GvXezUG9L/+rWaOi5p+8iiQ7GlGABaFl8/EqyLluJ7Vqr7B9eYG:ez3KgLWr5RUGlGAq01WuJBEnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675748809, "uuid": "4c1c4ddf-7eb6-48d1-947e-741a024476e7", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675748809, "uuid": "5d56ff40-8f6f-4ebe-9800-943f07fc2864", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675748809, "uuid": "9f08e6a2-70ef-494d-a64f-27d274c058af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff2649e-a69b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675742365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742365, "uuid": "dc626e5a-ed35-42d1-aa00-50739dffc759", "comment": "Malware payload (Loki)", "value": "8a86ecf19e44fdb01bebd049066ae5ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742365, "uuid": "364a9950-f641-4eb7-9a67-bdf86ea4aa61", "comment": "Malware payload (Loki)", "value": "3c74c849a09e708972e0dd3b46cd9f583059f8f5cd9d3f2db5bd3a9b8a788c41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742365, "uuid": "caff7b74-8066-404b-90ab-7dbec799aad7", "comment": "Malware payload (Loki)", "value": "7be3fa1a92526cce784e8ba0f06f0183448dd5a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742365, "uuid": "3403476f-9d37-439f-b06e-bb8e7a94dcae", "comment": "Malware payload (Loki)", "value": "e6bb71f75b46e45d70d639ffbe509698a53bb695f447bfb56551c509d1ad2a4f08e1d7333b8debd925569250460bd394", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742365, "uuid": "1614c852-346b-4d32-a670-062d78d4272a", "value": "T1A6F4230402799B20EDE5C7B5D0A9AA5423FAAB0DB131DD2CDAD825EF5B22F10DF41B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742365, "uuid": "fd1680ad-dcf1-425e-9d75-899418c5f65c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742365, "uuid": "4ad20138-3706-40a1-b79a-fd2cbf8232e5", "value": "12288:31MPA3bSkmtgIXHDiwOtUeQ9B7Nusv3ZV+hliQdRIOrx7p58lCrd4gyQapWMsN:6A3b++FQrV3ZwliQdrxN5IC54TWMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675742365, "uuid": "c93b9819-5867-44ef-8fb0-73ec2e7e8c2c", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675742365, "uuid": "e120136f-ad8f-4058-8066-0e2db1b75bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742365, "uuid": "ab8a7ed7-7895-49a1-8d36-6f686119a575", "value": "8a86ecf19e44fdb01bebd049066ae5ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97f7825-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756904, "uuid": "74c860ae-75e6-4c2a-ad2d-b4937e4831a6", "comment": "Malware payload (SnakeKeylogger)", "value": "979cc702355db748bc3efab66e9e8f8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756904, "uuid": "7512036b-87ed-467f-8aa8-55ee1c4ccd4a", "comment": "Malware payload (SnakeKeylogger)", "value": "3c767a0ad593b2c41a646cec0f17e12363e72ef2697eda72ae96313f899b9438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756904, "uuid": "cdcc7fc1-7fbb-4ce4-ad6e-1c79c50a7e55", "comment": "Malware payload (SnakeKeylogger)", "value": "b08c9350daa9667101a795ae722a8a0a83812b75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756904, "uuid": "4d7b3f86-8189-4bb1-a9f8-49d8113a2dbd", "comment": "Malware payload (SnakeKeylogger)", "value": "66b3e119abffff8353c7b89c539f183785c970fd22df9154c47a48e0121431e18b30e91e71f25ee7b63ed5e36f0232fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756904, "uuid": "c1c488be-c608-4b18-9ddb-5cf972226d17", "value": "T1FA05D09B358485ECCF6E55F7A25684403394CCBFC518E61A6BC433976EE6BE20C2271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756904, "uuid": "ce7e538f-b2d7-41ba-8b14-dff75f506e64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756904, "uuid": "5fef3153-86d6-4bbd-af62-e7e80ac1b814", "value": "12288:JFimar5VFDutOc6duxKLoaVfm3bHhmuBAqwMiaeZaK1HeDFT9N0i4AYPs9H3Ozqk:hlAAi9VHet9iPs9H3wqN6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756904, "uuid": "9633f5fc-6e0f-451c-9303-c1d5282d3544", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756904, "uuid": "18cc9c15-6eb5-42c1-93c5-aa187f999343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756904, "uuid": "13194cb7-979f-4352-b3b4-b82afbb817f4", "value": "PayAdvSupplier0000211827Remittance2000143099.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be201df-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758572, "uuid": "d59d90c9-12e2-4a77-a529-f8cf5296e5df", "comment": "Malware payload (Gozi)", "value": "b77151ac48f5fb67876ad46362901a1d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758572, "uuid": "369e7456-a0e7-4344-8a2c-38e879c8c724", "comment": "Malware payload (Gozi)", "value": "3cc44746763fcab6641b379ecfd1d4a05457406e1cbdcc42024adf5856ac3f1d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758572, "uuid": "6fd059ff-ac2c-4122-b66a-1cec26381648", "comment": "Malware payload (Gozi)", "value": "156dc1e684c5a4dbb4fcc79671d5a66928388232", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758572, "uuid": "5186a9c3-bf9a-42fe-a95c-6e833e7726aa", "comment": "Malware payload (Gozi)", "value": "624b1fd9512d9ef223625af1364616f5f755095df3d2c9f58447b410305210b6ff8811918853ba73f78aa3a86482832a", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758572, "uuid": "4e66db1b-5208-411b-9919-aec9b5720a73", "value": "T14CB18FC4881BF5A5320328250287F9D5481F7BFA909FC824132D4D7875846D7D4EF2B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758572, "uuid": "bd358630-8ee2-439c-be0a-26c12177c7fc", "value": "96:+bm2NFAFVrq2prUYf2L0+aHwIX/YNNY1gt+cypQbSkH5d:ShEVrxSL0+UsNY1s+bpQbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758572, "uuid": "4c2981a6-c8bb-4b4b-85c2-f293b8dad0d4", "value": 5089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758572, "uuid": "9727f63f-8a44-409f-b31b-97a0b6f4a090", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758572, "uuid": "60a20768-fd4a-45ee-bbaa-616fa129a767", "value": "azienda_09.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0198afe-a704-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675787436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787436, "uuid": "89470c62-10e7-465b-b7c8-4c4c218fdf8a", "comment": "Malware payload (RecordBreaker)", "value": "2df7d13ddf98555c1c140b60fee0cb11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787436, "uuid": "01e8af59-d29a-41d9-8495-f95ad06dcc46", "comment": "Malware payload (RecordBreaker)", "value": "3cd4058f19b41ba116d2662863c3bfd5f8d76d13904f748a1a3e2d6698220938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787436, "uuid": "7a50373a-7b0e-49a9-bda5-cb715856db70", "comment": "Malware payload (RecordBreaker)", "value": "aaf82760a8461b48452b69fa7c44e2dd1630518f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787436, "uuid": "8a643e80-a921-4539-9e6a-f6a8f3eee99b", "comment": "Malware payload (RecordBreaker)", "value": "91f5d75f1eb892ca3de1b13cdbb6c30667f33d2546cd8d25d6559a1ac4dc5abba2f2a44eb652e398d0ac2d8d606b042e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787436, "uuid": "f629c92d-1dbb-4bb7-a121-8a1a031c0b59", "value": "T1E814D03236D0C0B3C6AB15705C24DAB06ABEF9319675895B3BA8C7AE0F305E15B7D346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787436, "uuid": "eb0a3b13-6acb-4322-ae29-7d8d9391b251", "value": "cdb2dd381be56018fc9552ac3271a401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787436, "uuid": "c0dbd92d-aa66-4047-b1d9-a60eff725c32", "value": "3072:lGyOk8OUabPhNMLDSJWx5ZoKy4Wj9fjwNmEv3NS565Lw2QwmR9:lGyoa73MLGJwoKrHd5Lw2QwmR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675787436, "uuid": "575a4f5a-8f26-4e27-a351-b7f2082aaee8", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675787436, "uuid": "30cf3394-d5bb-4440-943a-debfc6cc56d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787436, "uuid": "d1a2adb3-88d7-453b-b1d1-dd804abb023a", "value": "2df7d13ddf98555c1c140b60fee0cb11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f06207d-a707-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675788481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788481, "uuid": "1fc87066-2acd-47ef-85f2-250186f93c29", "comment": "Malware payload", "value": "79845e9ad800315548a376188b6a37f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788481, "uuid": "a05bffd7-ef68-4485-b063-0320515f7f5d", "comment": "Malware payload", "value": "3cf0fee4143c6b2afa875dcb1201ae3506e0b21532e8cecbda7f93130bb05610", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788481, "uuid": "3082355e-c4b0-445e-abea-440166408e64", "comment": "Malware payload", "value": "69334e7e9df8adfd8a18c9a09da312016b5e490a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788481, "uuid": "224ecb16-d32a-4e17-a4dd-aea5aff4b370", "comment": "Malware payload", "value": "eb193195488730c4042b65d50c81741405d5e3939866b84220a2755ce72fbca53bfff4f27d28da9020e20e9647708151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788481, "uuid": "9b79264e-ceab-4c18-9d5d-7167d7f73e52", "value": "T111133D67A65670FCDCB5C33A8241E139B6B3F06803305BAB167659960F626F46D38F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788481, "uuid": "8fbf7b16-18b1-4055-a57d-c245e7cae480", "value": "1b9d48b9df2181ca5c23ba0508ed1a97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788481, "uuid": "89bf38e9-445f-4d05-9569-6303c05984d7", "value": "384:c2zdkS08M6PnS12SBkaOQD8w8qqs3chEkSIa7pnCr6moujO93mkSqVH9iDYAss8N:X508Mz1jOQDXUEH74K31ILk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788481, "uuid": "d5f3b23a-3f15-40e5-b4e2-1c04883a5646", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788481, "uuid": "de0e77a5-176c-4c48-b9a5-daa24462ac25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788481, "uuid": "e7e690ff-0ec6-489e-bb20-17c97aa763e3", "value": "hezuo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec0d549-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788910, "uuid": "40b46dc9-3147-4313-bc86-bde5596cbfdd", "comment": "Malware payload (SnakeKeylogger)", "value": "0fc08d0eb269523c591182cc145972e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788910, "uuid": "5067fcb8-3e1b-49ea-ba00-78bdde76e82c", "comment": "Malware payload (SnakeKeylogger)", "value": "3d3ea97b77c432b2723c3fe7417a25f1cca2c3aac1174e5591a027cf00cba790", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788910, "uuid": "ab2bd898-ed96-407f-9a87-c778df3380a4", "comment": "Malware payload (SnakeKeylogger)", "value": "aaa1ae99f11cee2e3c30dde2d9a0de85034566f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788910, "uuid": "9186c823-23cd-4fa8-a572-9c8a68b27ac5", "comment": "Malware payload (SnakeKeylogger)", "value": "bb1e15eec5b84024b9f58a19604dc4b10d09a0b1bba2eac363b136012bdb16e0f85cb5fac992523d40a4ab206ec1e9db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788910, "uuid": "f0009750-9cf3-400a-86c0-2edda0f35f54", "value": "T101F4221D1BFEAF20C67D8BFE553015614776B4256222F32E0EC7A0EB3D66B904502B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788910, "uuid": "5ba8861f-6bc1-4dd7-98a9-7669a67e2750", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788910, "uuid": "1e9e791c-a522-4d08-af8f-b01fc2e4f332", "value": "12288:PwawHRr/CB06KuLp9zdZD/meJEvGK4GP09+QzT0+1NN2AtJpSKX+XH/IdNWbDDlG:PwawxO5d9zzeeiv789+oXJ7tJpS6y/I0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788910, "uuid": "59da73ba-5fde-4178-abea-6e4cb490b32d", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788910, "uuid": "50a1fbb7-96de-43d7-a160-56fc8181b159", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788910, "uuid": "6ff16324-c126-4b5b-8169-d27213d90cb7", "value": "isqEelpP14RfF8V.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308ff19f-a73e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675812106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812106, "uuid": "94234829-ac9b-4a3e-b9ff-ef2004567666", "comment": "Malware payload", "value": "73affeed377b713471428d062782272d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812106, "uuid": "c929cc89-6eb6-481b-9083-f1ae98e84573", "comment": "Malware payload", "value": "3e15f2e2f603d0460b2457cd586fed7ee2e6195bbd39954fd05827d3ec6f4f35", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812106, "uuid": "5cadaa0a-b001-41e6-b550-5de948387a19", "comment": "Malware payload", "value": "ffffcbf0424d11e2a019997f8549033cfe80f741", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812106, "uuid": "2f0574de-83c6-4d0a-8ee0-d1118f05dfa6", "comment": "Malware payload", "value": "2d35860030fafff32095c5bb3f4986d59ec1dbf3a22e29ee75bbdb9452b41ea6c18d6bdca323af87d34bb05375af29d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812106, "uuid": "db0ca60a-0680-46f3-9e4b-ae561675712e", "value": "T1AAE48E31974558B1E6A7207D3518B33581FDE5740B20ECCFEF508AE92EA07D2AA3974B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812106, "uuid": "defaea55-c75b-44c4-aa4c-487f70562257", "value": "01ffae27bd2f4006b1c9da2adb5b805c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812106, "uuid": "761b7486-30d1-428e-b61a-a25c31ad7d62", "value": "12288:QzILjPqan+uXjXsvEkvlhciFePvIBU1P+c5jRh5Z6w/K0WfvUDG:TjPtnT4j9tFkv4U1P+cV34fcD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675812106, "uuid": "d71f6e11-45fc-450e-8c0a-3505a8fa3ad0", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675812106, "uuid": "9a4aaa23-002f-4b05-929d-f303b5295e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812106, "uuid": "78c10cb9-da26-4500-aeb2-743ca61f17a2", "value": "AphroniaHaimavati.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc1bf73-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789952, "uuid": "7a3bc412-bcd3-418a-beed-c4e57cd6dac9", "comment": "Malware payload (AgentTesla)", "value": "9c9f41d8e63cb9e62d0436427963609e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789952, "uuid": "c94f38f8-4781-48a7-973f-5abbecede19a", "comment": "Malware payload (AgentTesla)", "value": "3e71398f2c545fe979dbc8c61ccaf8bd055a7d5855d978b0bf006fa6dd1222ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789952, "uuid": "5a5413db-ac6f-4e77-9a80-fecca091ad84", "comment": "Malware payload (AgentTesla)", "value": "49e38e7da4c9e3f18de007c700834be790d67be5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789952, "uuid": "2ad06520-c7cc-4190-80bf-8fdf135d2fab", "comment": "Malware payload (AgentTesla)", "value": "90b247dc91bd8db864e0abc2ddc0940595ed609d3c25630576230c9393e38ad9b89f855d5e136e9229ca54997f395e50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789952, "uuid": "db2fb479-6650-4d1a-855a-ce534bc68619", "value": "T1F96552B894FB4AE9E00FC9511BBCFCE8127771F3D8E20DA6436C66045E2AED47E4550A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789952, "uuid": "ce220fed-7942-4345-8eef-fc15c1622648", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789952, "uuid": "cb91a493-8a8b-4f3a-80e9-2de17ced0230", "value": "12288:4nrIEdgtHUB7lceAvODldNTSt9/VyiMLOfEkuM//nId0gfiW:BMowSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789952, "uuid": "6f197cf7-67c1-4ba5-9efa-8cf90487b2d6", "value": 1411072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789952, "uuid": "b48ccce2-6972-4ba6-a767-63488ac2ab5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789952, "uuid": "0aceacbd-19a4-4762-82a5-64cc3a253d42", "value": "FedEx Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2c7a86-a67a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675728132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728132, "uuid": "13cf0ba5-7ca7-443e-86c6-24ddaea001fa", "comment": "Malware payload (RedLineStealer)", "value": "affc0e6269af242f035e5b58dc639ea6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728132, "uuid": "360fe274-73da-4c66-9112-d4c6d31d1a11", "comment": "Malware payload (RedLineStealer)", "value": "3e8b0fcddfa2383fa427f08cd54244694a1ead2dabf009910932fadc5de267da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728132, "uuid": "782aa34d-f833-48fa-ad32-73692dda4d50", "comment": "Malware payload (RedLineStealer)", "value": "9ac7d81ec1a0ad7ac79ff044e1c8708643ceaea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728132, "uuid": "4939cb6b-af3a-456f-887c-560fa10116a2", "comment": "Malware payload (RedLineStealer)", "value": "191a7850ae025703641c8da83f867c7152f10de33a39b3fb1b772464960c6500ea29252b073aefb2732697b720173e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728132, "uuid": "6c4db7f7-9d7a-43d1-9f29-6c1a01371cc0", "value": "T13A847D83D3E2BD44E9268B72DE1EC2E87A0EF9508D79776D22199EDF14B1076C163270", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728132, "uuid": "e4c3c055-e70c-43f9-b2d6-b72006ad07e2", "value": "362b00b7c7bfeb7a79c15e736bbb9859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728132, "uuid": "ad6a4642-a3e6-4b23-9efc-4f52f4d19e5d", "value": "6144:CdmHLnioziaHhAGQvqjuxDWs20l7cd40uQj9ga:CwHTZMvObs20yVlj2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675728132, "uuid": "fa6993ea-837b-49e0-89ad-1312816998f2", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675728132, "uuid": "9da3cf2f-612f-4dc1-a56a-ce363d7b25db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728132, "uuid": "856a64eb-2c16-4cb5-8601-8116cb382544", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf2c035-a6b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675752208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752208, "uuid": "c3670751-4895-42ad-bbb2-52eadfbbdeab", "comment": "Malware payload (SnakeKeylogger)", "value": "88a83162a5683602d0dd88b78d078177", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752208, "uuid": "7f8746b1-3df3-4025-b38e-68af82ad54ee", "comment": "Malware payload (SnakeKeylogger)", "value": "3ef98a92654f2057ba6271f5df8ea83de1f5f1481067525b0102a532a981e71c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752208, "uuid": "2498f038-2775-41e8-8a79-65b3cd3744dd", "comment": "Malware payload (SnakeKeylogger)", "value": "b10ece896848b4a4fc1beebb778f53f4f3f3d0c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752208, "uuid": "42ac063e-c9bc-4ed6-82b8-b6c2669f7be6", "comment": "Malware payload (SnakeKeylogger)", "value": "950bc15be5fb82131d9db7f3d2076feb34cb94cf8813ebc1723368f3921dae9db59fc86c6e4a30d9a4624968c260999e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752208, "uuid": "19bd639d-1887-4d32-a023-20603c9adb01", "value": "T1D054129555A7C1A3D6E70B73083F0F086EFC79120C19A62763104BFD78655A16C2EBEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752208, "uuid": "2eae87f9-a0eb-47ce-8b2d-d5d90ad1c277", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752208, "uuid": "d53360a2-4b6a-480c-bff5-6b53eea804f1", "value": "6144:vYa69kFYAomcSGaMtImAsNMhF+VJFFEtBINFBU:vYfkFXNcScfIuJBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752208, "uuid": "8949c037-ba36-4052-a832-ab16cb892bbb", "value": 288492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752208, "uuid": "18268627-6670-4a46-afe8-1ab75bad7c38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752208, "uuid": "b6c4270a-671a-4fdd-a687-1ccbaead5725", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd692543-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675756964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756964, "uuid": "d06f6bfe-5823-4517-b2a1-0d6b7aa48867", "comment": "Malware payload (Mirai)", "value": "b59cdb26e086283f98685df8926ff4c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756964, "uuid": "5acd72d6-8405-4a34-925e-ff95f5df76c7", "comment": "Malware payload (Mirai)", "value": "3f392069fe274d4e982cc8d22db0a3803771d78c0629af2de6ec2bf7e9b88921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756964, "uuid": "e76729e7-19f3-474e-b08b-b158b73da533", "comment": "Malware payload (Mirai)", "value": "73f1f07302db7a94280b794d78ea57678fcd8cbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756964, "uuid": "ecf376ec-b479-4e6f-b370-19bc9907e08c", "comment": "Malware payload (Mirai)", "value": "637591935e568aa8227dc79ac18a12b3bfe084e106ede4c3bc6f0ecf19e1bce7130d4575c8a4bb176db541e6cbce3052", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756964, "uuid": "655e2b0b-7183-46a3-9a87-0ab845253552", "value": "T1FD933C96EB42C5B3C4431AB1029BBB550932F67B0A2E5E96F72D2DF09F124C5712AFD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756964, "uuid": "bc01e7fd-0bc2-4e99-bef9-fd5aa96dd549", "value": "1536:vLx4SRrohSyoDh8F/JbrRQb1WT84KI4T8DMjspGoq1i6bOjsQgLmKHo0rIjNVfz3:veSRrohSyoDh8F/JbrcgY4KTTEM4pe0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756964, "uuid": "ac5d9490-b042-49c2-b4c9-ebc48e662418", "value": 94238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756964, "uuid": "e9d66e52-8da5-4788-8000-54902516bea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756964, "uuid": "7b03cfd9-3b3a-4afb-9215-4ebaa906a5f4", "value": "b59cdb26e086283f98685df8926ff4c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4d0180-a723-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675800663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800663, "uuid": "0eb7743c-6fd1-4504-827f-5aa3ed715d2d", "comment": "Malware payload (Amadey)", "value": "4d39e0a19b32edc0f7ed2133597654a7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800663, "uuid": "254b0861-7c88-49fc-a5d1-ed176c42ef89", "comment": "Malware payload (Amadey)", "value": "3f53d7764812aad2934bc42de3d045366bc67e9ce92dae8512338322e71fcca5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800663, "uuid": "071253b6-d9c2-4a66-b6b7-267bddb952ef", "comment": "Malware payload (Amadey)", "value": "7597b4b53f005c50d316789c0d457cf6558383d0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800663, "uuid": "cd59048b-c648-4bf2-93e3-cb0738596016", "comment": "Malware payload (Amadey)", "value": "fb2004a28f9b6580a69746063648984dab916384301df14ef2b4c84f3af79443f1ed797ce0f960ba79c0c7c3957ad928", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800663, "uuid": "5171e8a4-1578-47b1-b094-f44adc976226", "value": "T186B4020BA2FC9432E9F1577009F703D30A377DA69A38839B354E6C9A0D72664B53572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800663, "uuid": "3f0331d7-9b7d-44a2-b942-5aca25a5c0fb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800663, "uuid": "efbc04ca-370f-46d0-9508-7285e8ce37c0", "value": "12288:WMrwy90qV7QO4HBhLKDCGNfdEp5uDnBUxxfLXDIi:6y/K4CGzEpADnBUxVXd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675800663, "uuid": "5e5d800b-d848-4f9b-b2e4-1e358c5a8bda", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675800663, "uuid": "0d758f59-525b-4746-a4f6-f29f74518539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800663, "uuid": "ab9bcb37-9f2b-4a7c-aa8c-9d0e2538f15c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d051bfe5-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757398, "uuid": "387e3e1b-c6f4-4229-bcc6-877266fcca6c", "comment": "Malware payload (Gozi)", "value": "e1f684a4199e3d9f93e758499c575e26", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757398, "uuid": "9224925a-991b-4ce4-aebb-dddfdc80a43b", "comment": "Malware payload (Gozi)", "value": "3f7302a2c1a78689062e05e41f8435efa3c3c9de18d72b234b61066fe29ec93f", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757398, "uuid": "d06dd9f5-f091-4d65-9546-b9000d53c3e5", "comment": "Malware payload (Gozi)", "value": "52d58f1b58617ad1729cc56dd5eefd7b446feed6", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757398, "uuid": "2622d21c-b678-4b9e-a75a-2ddba52d1dcd", "comment": "Malware payload (Gozi)", "value": "1140fac64b62e3bdc66d2b7a02b105333f90962cbdc7f97634675adc3e4427ae2daad58d0a89b6af08b7e96d5cde649f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757398, "uuid": "7e8bf5cc-eee0-4cbc-b022-4893a11bf6a4", "value": "T12EE16C5FDEDB601B6B4191DBF2733C21FB5028BBD929220475E2E30E2B52B6B00416AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757398, "uuid": "e46c2422-7983-4d3b-838d-a63bf6056e16", "value": "96:wyqLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dRU96rK3:QU77rIKdn863jMM0OD9+VVF4bUx/Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757398, "uuid": "8952a7b8-1746-4163-982a-0e93632c6487", "value": 7011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757398, "uuid": "040cf70b-ca29-4bc4-bea0-b63dde237192", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757398, "uuid": "c000df9a-0814-4da6-b022-6547bce5e8d0", "value": "azienda_17.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9262d51a-a687-11ed-88f6-42010a9c006e", "comment": "Malware payload (Casbaneiro)", "timestamp": 1675733672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733672, "uuid": "8a19ae12-3b79-458b-8a07-a6fe7ef1dfd5", "comment": "Malware payload (Casbaneiro)", "value": "41119c6818c6a3931a04b7ab54b9b393", "object_relation": "md5", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733672, "uuid": "78094226-0e74-46c9-9b96-031bb220b4ed", "comment": "Malware payload (Casbaneiro)", "value": "4040b321e9b317d180670619980db51f04fcaf81a57539a26c61f302b67008a8", "object_relation": "sha256", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733672, "uuid": "e7cd6907-66a4-47df-801f-3ef494bb8afd", "comment": "Malware payload (Casbaneiro)", "value": "aee7b9250635e51ed70a77d3d30b6ea8cfbcbb10", "object_relation": "sha1", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733672, "uuid": "12dca11c-18db-452e-a1c9-3b02f22a407f", "comment": "Malware payload (Casbaneiro)", "value": "59c048e7e34b5351133a526cbc08a41e0f02e9087b3825010732e02fe2b88536a109f5711f850b1bc77d996ec0cd0523", "object_relation": "sha3-384", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733672, "uuid": "aea69a3c-e370-4211-bc9c-912fbe7b1e10", "value": "T13F67334718F11ED8EC9BA2B3E05D12404A8DD3B356C3FDAB995C8B6CC8976B4E0435B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733672, "uuid": "f9e71f36-9ee9-4ea5-bb95-fea0275e9443", "value": "393216:dtIoRraCJsqytcw8mLQQnM6vco1yxqCDNlc71jHoI1wCn/qZ3OscCNilxesCDQIM:dDwpcw8mLTnvcosq0Nu718IypA2Wck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733672, "uuid": "eddb2723-8c74-4a1b-8163-411a8f190f87", "value": 30045458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733672, "uuid": "35bda353-f61a-40bb-9c3c-35f944dce476", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733672, "uuid": "1b665adf-f943-480c-a57b-3816486dd008", "value": "modulo1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04265fb0-a712-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675793133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793133, "uuid": "68745ffc-06e3-499a-b88e-8c8ab3cd984c", "comment": "Malware payload (Amadey)", "value": "67ba878952d75b630c6a45fcb7f1e0cb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793133, "uuid": "cd73c5c2-6d8c-49df-acf3-638a8dc8882a", "comment": "Malware payload (Amadey)", "value": "4132e1da833be8b75e5642f64edf564fb99edf882f4cbe81485f31a5d40d8795", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793133, "uuid": "1f85a9cc-1d03-4879-8f50-f6bbe9f3c2ff", "comment": "Malware payload (Amadey)", "value": "6671eb0f7c375e72c1a4cff663c7387207250ebc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793133, "uuid": "3f7bf8a7-3897-407e-b6a0-0b9338c79874", "comment": "Malware payload (Amadey)", "value": "84dd5844eb029b4f20c358aa5ebbafa49ac60f5850fd6a33fbf1c43d65296ea708985411ae407091365da928676657ed", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793133, "uuid": "56c8b8c6-a6ff-41bf-beba-ce2a72567501", "value": "T1C714CF3336E0C0B2C56725305C24DAA52FBEB83052758A577BA827EE5F732D0623635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793133, "uuid": "951c2ac5-15d3-459d-b919-c4df60533e4e", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793133, "uuid": "9befda04-02d2-4399-bb9e-c5a277e6c4b2", "value": "3072:b8rLOdTYrChPVLhfZCpW+3555bDycddsJ94IFIngVShcLavV84DD:grLVKVLlopR3DsWnt84", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675793133, "uuid": "83b72d19-5e9c-4a26-8aec-c48c187ef1c2", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675793133, "uuid": "d41f73a8-1789-438a-bd5c-bf225c6c4b1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793133, "uuid": "a53bfa35-f7e2-441c-9983-57aab1a02bcb", "value": "67ba878952d75b630c6a45fcb7f1e0cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127405df-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675796164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796164, "uuid": "72e9bce5-a8ae-473d-8cf6-07bfa53e793a", "comment": "Malware payload (Formbook)", "value": "ce949701364a956a8131a4325a634d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796164, "uuid": "a65f75bf-0f67-40be-a308-006f512fc4a8", "comment": "Malware payload (Formbook)", "value": "41426da4ffb12d1285c4fe16e9f79ebc28150cd6552b7ce06292143a59caacca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796164, "uuid": "e044a232-2518-4730-8c40-262797c5ff38", "comment": "Malware payload (Formbook)", "value": "217594f0b85b63d81ba5b7e5b63ed5301250427f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796164, "uuid": "b6c7c194-5a1f-454e-a1d8-a37ec25c8b98", "comment": "Malware payload (Formbook)", "value": "4e909ed14815f147810ed5c95cfa0f44cc2027d6d3de9013e03fb252f96b38f6924990536671e02df46fec190436fbc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796164, "uuid": "391495f0-51e9-44df-9eff-9ead2ac725a9", "value": "T19C05234D537DDB62D7668A78C5FA4C2493BE9629B261F31DCFC920ED2E13F840A42603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796164, "uuid": "192d3b7a-6593-484d-aa3a-f2403a4a92e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796164, "uuid": "8ee4c86d-54a9-4beb-ae99-ecb005bec256", "value": "24576:arxN5IC54TWM536x4L2WMfcTaJ4ec08f1vBA:atgia36x4LaQuF8I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796164, "uuid": "8edb6e81-de2c-4d09-b77c-94171267bfc3", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796164, "uuid": "a1307d1e-a1f0-4532-9cdb-0f4c13f2c8b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796164, "uuid": "30b82046-8ba8-4375-b841-47df0fc6bbfc", "value": "ce949701364a956a8131a4325a634d08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c159cd-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758666, "uuid": "88e42e33-2f9b-4ed5-971e-cb20c046f71d", "comment": "Malware payload (Gozi)", "value": "c6fefd6e9aaa1ac3f2d3aee9e8935f8d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758666, "uuid": "b5723828-cdab-4c17-a359-c622e2739d0a", "comment": "Malware payload (Gozi)", "value": "424c8d5a2d52d06d8fbf5feb13a6bd95e9dec69c30ac21327a8cf16848341ef6", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758666, "uuid": "07ac7502-b21d-4dc7-8c9e-24002374aa72", "comment": "Malware payload (Gozi)", "value": "27fae1f8f4ca6aac819d7fcfc41ca9bf385145aa", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758666, "uuid": "2d925005-a15e-432c-96c8-3d6894ec76cc", "comment": "Malware payload (Gozi)", "value": "2bc8bb5b7abfdc279ecacf2bfbb2823660d9b7e5fa312288fb9170262ec695079dd9c93f1fca55dc59fa404a47743d58", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758666, "uuid": "efe28fc1-20ca-4d41-815f-504e7c7e148b", "value": "T113A1BF5A2803199A2986600163ABB3AF61E8798ECC15DE42CFD593077CEF5B173CD4A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758666, "uuid": "c0911b74-ea44-47b5-9771-2ca023ce3adb", "value": "96:Zilf0d20y2prdEuErrKOLLplKYYPIPIuIN8hNlHaXiLokKq50Ht/EWJBcKVix:cD+dE1rKqLjKrs6NYpaXi8kKq5oEGy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758666, "uuid": "2a63664d-2f37-4d4d-afc0-b94aa272b7e1", "value": 5065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758666, "uuid": "8eaf9e79-e08d-4a4d-a6cf-23f3a72cb2e9", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758666, "uuid": "72910f48-e8a8-44db-8f5e-6cebd518932f", "value": "azienda_26.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5438ef16-a734-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675807871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807871, "uuid": "401ddadd-5fcc-4adf-860b-5ff4a5e4bfdb", "comment": "Malware payload", "value": "287fb8045da547cbad78e8f224cdec83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807871, "uuid": "b782c079-482f-4a8b-a9a8-7fed74430d94", "comment": "Malware payload", "value": "424faea2e20a1ef03bfe041fa41ae54cc7c1f3d2ae601ef55a4a4134d80648a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807871, "uuid": "b0948feb-1e73-4b6d-93ca-39b33f860e75", "comment": "Malware payload", "value": "e8a2ce2a528337d53f183b39665709255f1efd11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807871, "uuid": "954862a4-2326-47d3-9f6a-2ade6ce9965e", "comment": "Malware payload", "value": "a099fc04b63017ee2582e78c848b2c678612a924de140a9eaac776e64dde893a65d5fe493d0d7ad48f2f2ebf3ae22ec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807871, "uuid": "5622a18c-2937-4f38-b460-c5b9105fddfc", "value": "T1E0B4020BBBE94032ECB467B018F602D30A36BD515A78939B274EAD1D0C72660A775777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807871, "uuid": "f2792012-247c-4533-be65-cb790adf57ba", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807871, "uuid": "74717c99-b9c9-43d0-9087-e4095027ce3f", "value": "12288:bMrty90lqcTX8r9kdaFO3JcZdt77HEmMrg8Q/:2yGJT62dCO3JcZXEpr0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675807871, "uuid": "91f217d2-dcfa-43ce-8a0e-e239dfd76b54", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675807871, "uuid": "f385e22b-2b0f-4deb-8e77-c5e6843e3668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807871, "uuid": "5ba9654e-90e7-48f8-95dc-53859d619bef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11803efb-a68b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675735174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735174, "uuid": "12c493d9-faae-4381-a781-dd651a0dfea3", "comment": "Malware payload (Smoke Loader)", "value": "00d0869728651a7afdb4f7ba59699197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735174, "uuid": "00a73aef-9439-41df-9069-bea628692b8c", "comment": "Malware payload (Smoke Loader)", "value": "42eadb52c6e534855220bf57a54694931bcd25df3c4fe2c0643771881dc3eaef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735174, "uuid": "c78068f6-61ad-4499-94ef-1c0af17f0108", "comment": "Malware payload (Smoke Loader)", "value": "c40baf73db73714c52597bc306d5e97f924f172f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735174, "uuid": "3ba4e385-1d2b-45a2-8481-54c119682d6f", "comment": "Malware payload (Smoke Loader)", "value": "476e1785cdae1c83be03eece0460b3dcb45c5e184f0a57efb0c7283b8c5a412772bc7061ee5ce529049747f4ea9e7308", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735174, "uuid": "8c7c4c66-d5ad-4b34-9c90-71fd4b2f62b5", "value": "T19D645B4393E1BD40D9A68B72DF1EC6E87A4DF5418EBB37653219AEDF21B0072E163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735174, "uuid": "8647c1d5-86ec-4a95-8073-9d14e6353713", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735174, "uuid": "6e75ca3a-25ce-48d0-ab05-d332701a4558", "value": "6144:McWLB/ZXYp1yTUx/8aGHAZ+xOzzdaT8AuQj9sy3Ta:bW9/No1h8aGH/xOdaT8Alj7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675735174, "uuid": "1eac5329-6a41-4319-a06f-297c8e56a513", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675735174, "uuid": "b08164cd-44a4-464b-a3ea-af4372d7487c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735174, "uuid": "034d429e-ee7c-48f6-af80-4f95cb139c39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9e13e7-a711-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675792987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792987, "uuid": "90bf3cba-e730-4c28-8bcc-653ad6e8b72e", "comment": "Malware payload", "value": "f1d74c41b98d187d04b98e8a45348b61", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792987, "uuid": "daa0c89a-50dc-4251-a292-d7b441516578", "comment": "Malware payload", "value": "4379d8a4a20b315bd1b14b8c1340aeb4c6fd46b3d8a0fb92e3e8ac2dc7b46e32", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792987, "uuid": "9eaa42a9-114c-4ef4-8cb6-dc4bc4bce9ec", "comment": "Malware payload", "value": "78018bca6c73b08fc68f82df61e48d6d2a9e9a74", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792987, "uuid": "3496f773-3df9-49a2-a80d-28f62b8b79e2", "comment": "Malware payload", "value": "cf9e1239ae175469c881923f85e42284baef0be97388f26d8419b9d6e84a547361d2040da726ac3ad4545cf4209e7af7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792987, "uuid": "6229e40c-3b6f-4445-afaf-34c2a0dea7c1", "value": "T145F633E1E1060E04DD8D22E3DE8281259FED2B7DCB4F15E6B7A880EDDA35F1049626DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792987, "uuid": "095c8f00-44d1-4690-af8d-95053164caef", "value": "393216:662eqB7xb9VkkXuJAHFoEqUyT0kC2m0XBNpVDJyzrHt:f4LL+JAHqEinQmLD6Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675792987, "uuid": "794ef446-798b-475c-92c5-57f6000438ec", "value": 16225406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675792987, "uuid": "ec20d62f-26a9-42f3-9a45-60c7b165784c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792987, "uuid": "998d4908-60d8-4cf9-a3b7-00a30fde88b0", "value": "Expert-PC_2023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a79e7218-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757330, "uuid": "ad0f3cab-e0d8-4fbe-a76a-28528f3851a4", "comment": "Malware payload (Gozi)", "value": "ad0967990318bfa79a0b6f9e8a9d8c8a", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757330, "uuid": "889c25eb-39ef-468f-97d1-2eff74b25706", "comment": "Malware payload (Gozi)", "value": "4389f5a9ec07c7f5f5e46a805854efb5230ea53e744b163058dfe9b3afb00651", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757330, "uuid": "9a69448a-d09d-49cd-a247-0b6b5115210e", "comment": "Malware payload (Gozi)", "value": "b42e2ddcb485a3e1c8877bc94ab152df15a8598a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757330, "uuid": "3422d172-671d-446d-ae47-62c939304afb", "comment": "Malware payload (Gozi)", "value": "3d6171560e27998e1c93252fb9306bdf7e3e562abc4ff851abb928aa07d0999b1f00486491c80dcedcd07f08ac23e514", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757330, "uuid": "881fabb2-c234-4c13-8717-272180371bee", "value": "T1E1E18E8EDDDB641BAB8141EFF6732C10FB6019BFD9292204B5E5E70E6A66727004165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757330, "uuid": "cdca8c6b-c1bd-4cfe-8717-62e9937fa44f", "value": "96:wYWxWjLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dI96V:2aU77rIKdn863jMM0OD9+VVF4GxikuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757330, "uuid": "996731c4-975d-4fa0-960e-fb5a28cd9d9e", "value": 7036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757330, "uuid": "08f8e008-ac4d-4616-a300-fff70df8f7f8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757330, "uuid": "59cbfdd5-1af4-4867-9576-9c1e3a7e2ad8", "value": "azienda_11.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca4f68d-a72b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675804046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804046, "uuid": "6ceeb781-457b-4db1-bcde-966bd07cd9aa", "comment": "Malware payload", "value": "59ba0d143fb542f99e14e93f83ffcdfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804046, "uuid": "0ffb1235-5ba5-4c40-9f8f-113c1825e93c", "comment": "Malware payload", "value": "43e16568e59b199c7f9d41ca2e44909e6f7c8ae9e468f6a3a332c2c6c0942f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804046, "uuid": "6161ac5f-2ddd-44b1-b93d-2ba67f0a3771", "comment": "Malware payload", "value": "b396414dade8e64560d3c39aab67640f2d343490", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804046, "uuid": "39bc29d1-37c7-48e1-8f78-68acb1669064", "comment": "Malware payload", "value": "8c85203a23b9c1045ad71a27dd1c3669c2e9a5205cdc6b519c199e989ab496862a27a0c4a4aae3dc1e7b921437c12bdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804046, "uuid": "5ab53d62-a252-4462-9abc-bfcd7c9df624", "value": "T174B40247F7FCD022D5A1473119F707D31A36BDA19E3C468A338E6D6A0DB25A0A232767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804046, "uuid": "94706255-99f9-4b79-bd28-8eb7dcaaee8b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804046, "uuid": "b2e58ca0-4ac5-4981-ade5-1e4449e723ac", "value": "12288:xMr2y90IQaIwpLVd58IYIplYGTHPh5e2eiBeomaK4sC/64:zyIxw5VdmQpDa2BBDmj4sv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675804046, "uuid": "847ac619-779c-424d-822f-e85315766deb", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675804046, "uuid": "8a82df02-cc47-48ac-89a8-90f22b9c9a17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804046, "uuid": "93947255-9c7f-4a97-905a-920453f6b364", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3ac311-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675794333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794333, "uuid": "d5cac332-4df3-4abe-9b36-e8deadb06bfa", "comment": "Malware payload (CoinMiner)", "value": "79d3d41651b0dda2048ad79265e96b4b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794333, "uuid": "d2915bf5-5a8f-4409-be5d-9474b38e6e55", "comment": "Malware payload (CoinMiner)", "value": "43fe7449ca1fb36149c905d262c5edd6390bbeadfa3be9ef1cb677d168948bc8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794333, "uuid": "bfc4bc85-3e0d-4b86-9dc9-c791eb771dfb", "comment": "Malware payload (CoinMiner)", "value": "5313ff3dc1f1cb390bfa4ab2892f82aff564eb39", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794333, "uuid": "23a9b313-914d-4019-873b-8258c83e29ee", "comment": "Malware payload (CoinMiner)", "value": "55b2b94eabe14500c76f693f4c03226b408ef7d685239ac792b70d8e9f36a164f8708ec51fa8bc67b0373981720d9788", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794333, "uuid": "3a96ea0c-3a61-4b81-b85c-ba11215d2bae", "value": "T1D0656B04B27ED411F699A634FB557FEC3810BD1A7A180A4F67C8B2CB97F6771490BA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794333, "uuid": "e1431005-ef2a-425f-80c0-5332d54ec12c", "value": "5752c5bc7ee390c15f4aa85df1baf8cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794333, "uuid": "56114378-5c5f-4d3e-a0fd-69e64d9ab7c8", "value": "24576:1QdArqPWwdIsjNzXEhgWpWgFHZIhSzvNmnV5ufA:1QdhPWwdIgNzgpWgZTvNmnVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794333, "uuid": "445ea9ac-1bb1-45c9-9187-f167651a95ee", "value": 1493504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794333, "uuid": "2351ff94-c7e9-4f60-99de-12dba74e5ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794333, "uuid": "576c495f-3e15-4ecb-9b03-99668e2805bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718053ce-a6eb-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkComet)", "timestamp": 1675776567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675776567, "uuid": "3be6a1ab-b5bc-45cd-83c7-6cf118ca6265", "comment": "Malware payload (DarkComet)", "value": "5f32b0f8f0d6d524969702481267cb16", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675776567, "uuid": "7ee4cbf5-be79-43ee-8707-ee715926ab4a", "comment": "Malware payload (DarkComet)", "value": "448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675776567, "uuid": "516e7f41-9d4e-46c3-976f-65237c358b8d", "comment": "Malware payload (DarkComet)", "value": "61619717f178232d276dd5cdd86290aac5ff3cdf", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675776567, "uuid": "5e924d84-867b-45d5-a0f6-01b31478c7bb", "comment": "Malware payload (DarkComet)", "value": "69f471d5e56639d20332e508a7f4c93cbfe49c33c9a6b4cc332859dee98406b8a83c84d9d7e0f1824889127d6eee68d5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675776567, "uuid": "b60cd298-6f61-4800-92bf-c26b255c204f", "value": "T18BD46BD1F240C463D8523CBC9167FE829B437AED7DF5861AC940AE473C21AD29C3786A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675776567, "uuid": "433905c1-b434-4794-b993-e27d3b2cc55e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675776567, "uuid": "501fdf72-0578-4c82-accd-0f95a733afc5", "value": "12288:W2Q+/YvU2uVApVQVraqhxJJB8Ly4bBBqoje8ze6k:WuzPYV9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675776567, "uuid": "5764eff9-6ee2-4adb-b7a4-54a3c78adc5c", "value": 614400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675776567, "uuid": "787e12c4-5e93-4fc2-a1ce-8ec52b217d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675776567, "uuid": "49455704-eb7c-426b-abb9-05ce0fb79207", "value": "448a19d4eaa753aca293afde7a8acc8024f1dbbb51649f5e85589bb72749c6d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22e75ca-a6e6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675774554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774554, "uuid": "953f35de-2f84-41d7-a08c-c1fde5569118", "comment": "Malware payload", "value": "fea51e84245bc5125a38f3303fecc27c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774554, "uuid": "304e6191-a1bf-46d6-9e1c-aac252a650ca", "comment": "Malware payload", "value": "45a8ad96e54e28b23e148fc4f5ddade388f0cd56fbf3a995dc8108d8bcd57f84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774554, "uuid": "2409476c-acba-4ada-8734-235562abc3d5", "comment": "Malware payload", "value": "dbc505b8486f0156d2f91b7ba58fe410c57afacb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774554, "uuid": "9dd213bd-5d70-44ce-9949-c4e306401bc9", "comment": "Malware payload", "value": "f4b7683374616f8a4dc3f758c9f821cb2a16414a432f18d47157cc104f22fe2565ec720a78fd9c8de0e4b51fb17222f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774554, "uuid": "f1d7d2f8-b79f-4a28-a093-8de836c269b4", "value": "T1CCB2C507C60052B2E8B6CB35D423B979022FEF627EA0928F955C7D72B7B36D20432E15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774554, "uuid": "758ec3d6-9e57-4f66-8726-2aadad7b91e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774554, "uuid": "0b763f75-57c9-4461-bc1a-2404d2bea8a2", "value": "192:RG1eUMKSpRcEXmvj+tlxDggi7fubU88CHwQQthuUrP5BVd/HrujWKQ76R5Ol9tOJ:fKmcEX0+MruViuUr3VdAJzoHOVOCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675774554, "uuid": "fe669743-988a-4179-bd8c-b882f613acf2", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675774554, "uuid": "c0da6055-72ef-4bbd-88e0-14f23846e98d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774554, "uuid": "51b47fe5-15ba-453b-b575-b020507d7774", "value": "45a8ad96e54e28b23e148fc4f5ddade388f0cd56fbf3a995dc8108d8bcd57f84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a291606-a732-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675806914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806914, "uuid": "feb4956d-3ecd-43a1-8355-3f03fa2a5d58", "comment": "Malware payload", "value": "9ae057e51548757dadefbc8034bef597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806914, "uuid": "b1d877fc-720f-43e9-8ff4-dde3fa746b06", "comment": "Malware payload", "value": "45c535ef7acc5e57737fab2836385bb8598f87bf5c3cb337993b5239a3908cac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806914, "uuid": "b447e67e-3a64-434d-8c5b-b8635862bc5f", "comment": "Malware payload", "value": "8b2813162670ecfe72e3ad40add9df7fb5e495a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806914, "uuid": "27d2ace2-7f4a-4555-95d5-8b641c13bea6", "comment": "Malware payload", "value": "b0e50f46783f2f0d7af84763d17a81e6f5a56c6cc0e201d409a99d042c14a6a1b4606bb5d67e37491e2637570cbfef5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806914, "uuid": "c6e21fa2-858b-4a60-9ebe-2ed6dfd13c7f", "value": "T13F95BE04B27DD451F685AB34FB657EEC3810BD1979190A8F27C8B2CB97F6772490BA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806914, "uuid": "f3ee427a-a7d5-48f7-bcf2-0aed20eb4087", "value": "b4eeb6dd62d853205858f8ba3f746873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806914, "uuid": "829e54d7-09dd-4ab0-8d44-e14ce76888a4", "value": "24576:eNF3mtVw+Y9MlbtzAzEh687pevEZp4WWWBpttIv3JKVBaJ9OM/A2lkS:eN5mtVu9abxAzEX74vOJptt5VBaeM//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675806914, "uuid": "82f9ab29-b96d-471d-b2ee-bd4414c5f460", "value": 2020512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675806914, "uuid": "26c7141a-15e0-4947-9887-7d44cf760bed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806914, "uuid": "c4e48fa2-4ef8-4223-8ae8-422674522e45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e464e9-a6f1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675778986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778986, "uuid": "2f55b081-a4d3-444c-b4c7-a267f98aef4d", "comment": "Malware payload", "value": "807f0dcb79889f30b5abc4fd53f8a749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778986, "uuid": "c55352fe-28d4-4a40-bef7-654b41c19187", "comment": "Malware payload", "value": "45d58bc7012e3a951adb1d4b6c5d6b731ad8cf364def8524e036b2e40169679e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778986, "uuid": "f586e134-1cf4-408d-a350-25e3c5ed5b9c", "comment": "Malware payload", "value": "b4386289c9e1c954b26f1fc0cf733cc9ce8ff5be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778986, "uuid": "c89c7683-c37b-47c7-a768-138d1caffa9a", "comment": "Malware payload", "value": "a41a8a324f53716a43ef2cba8b31524ad0dce5f4c9a640546523a59210c89b1d01b43c0f0420b5aca38e52a849b40dcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778986, "uuid": "cc5c87de-0a5a-44ef-af7b-ff41fb702906", "value": "T12C833A8374D18CB2E572093158A49BB15E3FBD165A608EAB33843A3D1F301D1DE66E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778986, "uuid": "45ed91e4-6734-4fbd-a3d5-61a28f40a595", "value": "659babcad126bcb9e5f04cb903f5eee6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778986, "uuid": "2e6c86be-f968-4503-8422-a46696c1b954", "value": "1536:6C47w33L1bvGC7zoa6PI+oXxE5jOGmJwRErkyRX/sWscdvw8yL/yV/xi:6K3L5GC7zWoXxE5jOGmRkyRzvwjL/2/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778986, "uuid": "47034d97-cc41-4cd2-bad4-5383a36b5aad", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778986, "uuid": "af4d6f06-d572-4a93-bed8-a9dac73a291f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778986, "uuid": "9f0ba624-c0d5-4122-976a-0f54b1508335", "value": "45d58bc7012e3a951adb1d4b6c5d6b731ad8cf364def8524e036b2e40169679e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa657832-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756905, "uuid": "84f02750-4888-4052-97b2-2336e68d984e", "comment": "Malware payload (SnakeKeylogger)", "value": "887add07c29e19f32096f9031093451e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756905, "uuid": "4a7462be-4b87-4a12-8b82-c96e9eb427de", "comment": "Malware payload (SnakeKeylogger)", "value": "4621513698be229fad9c0110d78e90bc26cafce628af0a436c32934c862ded57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756905, "uuid": "e347d86a-18a6-4644-96c9-e6097cedd812", "comment": "Malware payload (SnakeKeylogger)", "value": "1f0ffd3b17d75e2cabed9c451bc86f9dd18382e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756905, "uuid": "fe1aa84a-c167-4bd2-b176-f14bb2598e48", "comment": "Malware payload (SnakeKeylogger)", "value": "5ae3f62031653eb822d673f539264eba540f2a0e5adeb8d95fedf326ee1fa55b369d1cb3771f17381ba96eab7bb15def", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756905, "uuid": "6b6c6316-f3a0-4ee9-8f16-5adfa11bffc7", "value": "T1F3541210BAE4D847E9A21E71213C8316CFF8AC2748AD128F23606F1DF677AD1D91E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756905, "uuid": "be096e6c-699d-44d6-9618-f88fc6b2e58e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756905, "uuid": "636b52ba-8f25-40a4-a90b-e4d2cd8ded14", "value": "6144:PYa6F0uj7Ou4wn+kaxNmcxWG8OO8GiXuB/GPrpLAoSC:PYv0uyw+kaxNqG818WB/Y+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756905, "uuid": "3e6e9858-6ec2-45a2-9468-898d621bb614", "value": 287921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756905, "uuid": "e51c54b3-707b-4430-a9db-6417b9f022aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756905, "uuid": "8156efe1-8fee-4118-9c30-a14d15e6d2fc", "value": "RFQ 50000 - Saudi Arabia.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13ccbf5-a6c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675760782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760782, "uuid": "800d8d95-096a-41ab-b75b-1a99e91fab3a", "comment": "Malware payload (AgentTesla)", "value": "8685f16b1f5b7ebbeed1388be73bbee4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760782, "uuid": "14713d64-84f6-4f14-8b94-42211f388b18", "comment": "Malware payload (AgentTesla)", "value": "466943db1566f6847124ffe5f218d9639c337bdc4195b6c97ea8e8f579cdc9e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760782, "uuid": "600f1efb-4f26-42f9-a4cc-f84d9e6c7180", "comment": "Malware payload (AgentTesla)", "value": "9ef048cad436ed8e2fd00cacbd3cdf60b219e31a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760782, "uuid": "951e54bd-c263-47a0-9575-9746ff412a40", "comment": "Malware payload (AgentTesla)", "value": "fd63d5eaba400509230fed0ace6d2d8c5a9e6c93481f5a5a272607d847f72bd0f59024d1734446118c4f7f7313f231a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760782, "uuid": "560e43fa-4bd2-49a9-976d-99126471471c", "value": "T14FD24B1576EC5733E93A57F484E6256503F5A5925402EB9B1CCAA0CF4EE3B800752ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760782, "uuid": "b458c40d-d1f9-4ca8-a39f-5074b7a394af", "value": "384:IjzCUGYvAnp0Cu+SQCTtluRCYoVyv+Mg5LlEhXrOANb4+oPNE+PNutIcPasSW9py:IfCUhXwRCY1+xQ1rVSKjasSWKC7WY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675760782, "uuid": "81571964-76d6-40a7-bac9-f087261d3c22", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675760782, "uuid": "7f83f722-a4e3-46f1-b1e9-4cb4d1660f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760782, "uuid": "fb2194b6-c60e-49bf-b5c7-7eecf087f34a", "value": "210909836-042205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0097237c-a707-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788403, "uuid": "1eb22f86-7cdd-48a5-9623-90ab02de1822", "comment": "Malware payload (SnakeKeylogger)", "value": "d8c35317af1c658ea238409e631f5e45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788403, "uuid": "0aa60027-a65e-4068-b32e-6f47dab5e343", "comment": "Malware payload (SnakeKeylogger)", "value": "46c067d4021f6ec8d8cc8cf5211e05c860e857bfabe5e0265f9ea6914f1722ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788403, "uuid": "5cb61458-7f3d-4e86-8784-275c33f62469", "comment": "Malware payload (SnakeKeylogger)", "value": "aeffcc1e65d6659a1d008e139733280f144334ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788403, "uuid": "2b05b79d-c324-44d9-86c8-45bc716961ca", "comment": "Malware payload (SnakeKeylogger)", "value": "0b580940be65e257a2750c49eff439e33b88fd01b3a1b5e895ac279ea12af1129321d52e4f5921ef36587e0362feef26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788403, "uuid": "5600db7f-993d-4f9b-b72f-5086d3cba2ac", "value": "T14254D169D174627FD4B226F10282AEE40BF4421F5C63F13B0486278C8DF79F69D62967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788403, "uuid": "944224ff-6c2a-468b-a453-5759e1077813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788403, "uuid": "dab30261-5bff-4246-b4f1-fb4c49c7d07e", "value": "6144:ge9eENMUuiiVJlXullwiOYmZrfgGdz92aMjubs:wvUuiih6darfHB2aAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788403, "uuid": "9ee6d29b-1c63-4960-8600-20c4523e771e", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788403, "uuid": "1328b0b9-a7a6-49a7-b7f8-3a34cc50802e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788403, "uuid": "fb5d32e5-d3e4-445c-a44d-a0ed68447d29", "value": "company profile and new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efef4acd-a6e2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675772913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772913, "uuid": "e02a5b2a-701b-4c29-bde7-3d31b923a674", "comment": "Malware payload", "value": "e440fd19dd30f5a02617da245cad95c1", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772913, "uuid": "58b20b6d-16d9-4856-8093-1a7c1a0d4658", "comment": "Malware payload", "value": "4708ba2e27d475b09e5bc355cee242672113eb5ef5bd163c2e01a21b24910e50", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772913, "uuid": "8ba95d17-6108-4c1a-a9fd-6a4bd4ba4353", "comment": "Malware payload", "value": "196372e0f84a26c618704b0368a21a141b48c9d0", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772913, "uuid": "32a97988-f296-4ea3-95aa-1ca58fb4227d", "comment": "Malware payload", "value": "4e60f8f795a956bef10c4bab78971b0da3132182905ddfaf6383521c92b956ee88011594f8f2df6c4230194e524b6095", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772913, "uuid": "92e5fd17-cf4b-4064-9f75-5c724fcd7c93", "value": "T126E0F809295687A8B9E820C121088CC0625A8D3B7288B6C3B389CC0D8AD3292B4382CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772913, "uuid": "ab923e6f-fcc7-4f95-80f8-757c25110fe3", "value": "12:snEHLgyaI4HPKC2E4OL1tkL2cr4wehAwaH18f:iEHLCHPKC2EB1yCcrSu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772913, "uuid": "18f3c154-24d0-4055-80e0-ca6fb26ca536", "value": 396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772913, "uuid": "050cfa84-a841-4869-9b9c-9e8a70306f3e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772913, "uuid": "de8e9db7-0461-41db-bded-3fd46decf7a4", "value": "90843ec2-5824-4763-b52f-c48fa50dca7c.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16056da-a72e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675805477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805477, "uuid": "18a0dab1-ac0a-47cc-826a-8f475d4af0c9", "comment": "Malware payload", "value": "b3e141a1ae1098e93e181b3ac1f1e475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805477, "uuid": "1c157b80-fef1-434d-bf21-80b7a6b57e89", "comment": "Malware payload", "value": "47a14d318facfad0ff558df13f9904e776ac802cfdd1de1384f48a2fd990e35a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805477, "uuid": "54e2210e-4ba2-4ce9-bc32-d97ea3cba1a2", "comment": "Malware payload", "value": "43e9f11ad43dd0a206595e512081557f6a2be9fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805477, "uuid": "4c21403f-75fd-406b-845b-f0e5c2ecfc30", "comment": "Malware payload", "value": "6c0f3eb244698cb47510f6cf7fa06f132b7dcfe70832a581729d921233475ee33c9f684dd4248679c5048fde08a3d57e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805477, "uuid": "8d701b60-67be-492b-b8d5-14465d44729c", "value": "T1BF14D0313AD0C072C53B54301866EBA96BBEB8334671C95B77A807AE8F702D1577A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805477, "uuid": "ea3a071f-5e62-46ab-bc69-ccd89bc37e24", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805477, "uuid": "9297fdad-e7c2-48f2-bd55-805f977402a9", "value": "3072:Yd+OjL6Cn8ZqLhTmWM85lItrXYbIsgGwHKVIaFZWiLQi4GA:Yd+o8qLdmxJXYEsgGGK/PWAQio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675805477, "uuid": "6453bc0c-2a26-4216-8322-9d4ceb617350", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675805477, "uuid": "2aa225c2-f8c2-4abe-aa49-5e42e33fd634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805477, "uuid": "528fb03e-cb07-4aa6-addb-f0fdc26c7c51", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd459d45-a69b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675742388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742388, "uuid": "1b45e4a6-adf4-4677-8159-891d00514333", "comment": "Malware payload (RedLineStealer)", "value": "79f592f2efffab0491ee1b9841542052", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742388, "uuid": "44d022e4-bbfd-42bf-a6fd-ba68f6b7a3d9", "comment": "Malware payload (RedLineStealer)", "value": "48aff3ca7986edc6be811d56c88492f23dc3eeb8eeb10502a78500dc797e1bcc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742388, "uuid": "26d5ed3a-d0d2-4f42-bc84-61229fd430af", "comment": "Malware payload (RedLineStealer)", "value": "347f0083d70e9561e17b3041ec4c6426f744452b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742388, "uuid": "bdacfcb9-b2b1-4480-b821-8f058ee1686e", "comment": "Malware payload (RedLineStealer)", "value": "9cd73704b27a78e76cc7b074d11d1331c9db867586fd4c4f1107a60fe5ead5819f5c18d0c5b929bcef5fefa038b2653f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742388, "uuid": "2c01a968-4c55-4a69-8ece-4f238e25f433", "value": "T1A6948C4393A1BD80E9268F72DE1EC7E87A5EF9518E793765321CAEAF14B0072D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742388, "uuid": "cb094857-0864-45e5-ad7d-5b68fce30a1e", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742388, "uuid": "7d347bbf-4738-4d9d-b30d-3d6eb00fee21", "value": "6144:BiNLZPm+SsIjECaz+cgj+aOE3x/8SZbRQwZDA7DEEuQj9AhI1kPa:4NtxS3jECsPSEStRlZDAtlj+xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675742388, "uuid": "96d6be2a-7ec1-410a-9cd2-3576c59f8e8b", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675742388, "uuid": "3cdd8aa7-2649-4ef6-ac59-2c3fe2645a78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742388, "uuid": "5ed45829-0527-4f4c-9143-adcb1d399be5", "value": "79f592f2efffab0491ee1b9841542052", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6819ba87-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732742, "uuid": "28e108a7-a96e-4044-97c3-d5772dc2e6c7", "comment": "Malware payload (Gafgyt)", "value": "e5f68e1d47924f62c28d795e9f1f9c28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732742, "uuid": "ef5ffce1-497d-4a36-9478-9fd8637ee3fe", "comment": "Malware payload (Gafgyt)", "value": "49113bfb946d435fb6c0be900ef205b122721ead99b40d099149047728046d1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732742, "uuid": "f0d7d19e-c2b0-45bf-8421-f5068ba931b3", "comment": "Malware payload (Gafgyt)", "value": "6199623f5f54a166e5f52e10e4ee73d467fcb515", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732742, "uuid": "84d443c0-a6fe-4e56-bfc0-884f079bce89", "comment": "Malware payload (Gafgyt)", "value": "1b27f59b7b5db1f39b79d69b0dcfc9ff971ba3d8b5df889a1687920c1dfeb1ac94fe1024ea92c70aefa6f6590f2ad6d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732742, "uuid": "10f22bcc-453c-4362-a800-7f56d65684bc", "value": "T169E33A05DB408B57C1E2277AE7DF424A33339B54A3D733099A28ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732742, "uuid": "65746cec-c9b5-4e9a-a9c9-5ffd849a9770", "value": "3072:bjjMM7NwA7VWxbZaXmpvh7q07ly/V7l0sgURKXmQwfHcQrAN:bPMM7NZ7QZZawp+07ly/V7+XmQwfHzrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732742, "uuid": "fb49c75f-ba06-401f-823c-a2fda5ca5544", "value": 150481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732742, "uuid": "67465c29-d452-47da-89f1-a3466aac7a66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732742, "uuid": "65700ffc-d0ff-47f7-937c-e78e79c76908", "value": "e5f68e1d47924f62c28d795e9f1f9c28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8aaa98-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758709, "uuid": "339f5a47-5ed3-4c5f-b570-d1c0acf932e5", "comment": "Malware payload (Gozi)", "value": "9a3f0435c0c49c391975edb2c2636632", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758709, "uuid": "e1d07529-8bc1-48f8-b821-5d2cae152541", "comment": "Malware payload (Gozi)", "value": "4930620296e223e982c2cb0b9131556d928406fbd0e052c7c9130b189d441540", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758709, "uuid": "73d1faab-d10c-4d98-aa20-459b0d30a750", "comment": "Malware payload (Gozi)", "value": "4729ae2a53774f94b0d13a1bd948abe6d366806e", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758709, "uuid": "c7feea1d-9dbb-4a93-a4e3-66bf7dd1b5d9", "comment": "Malware payload (Gozi)", "value": "6719e65449896777597580b1cd980067ee36fa936f8c207e54b7dd2792f287995e3fc78c80596eb952aa03532acb6504", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758709, "uuid": "68477769-ad96-40ec-8af2-62ea86976435", "value": "T179A17D411EC64B392B5D11C704FEE129B62E525344F92739F3D9B86544F9E62B436384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758709, "uuid": "f0531ea6-2df2-44a4-beda-dad54a3d4b97", "value": "96:T+vPWy7kzIN7y0YiztAx4XAVolEAGk38h1z1pWwwtH0pe1DuUqAoQFNE5d:uWyJN76iztngo+AGkshL3wH0pepIAoQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758709, "uuid": "d18410c5-a3c0-405c-8078-3e81504b42f7", "value": 5086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758709, "uuid": "0dc2a6b2-e4e6-4022-a797-e9ad0ab794d4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758709, "uuid": "cdab1177-f98f-4b8d-845e-c5b427170c0a", "value": "azienda_34.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d347584-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732724, "uuid": "7bed2be2-7568-4421-a8d1-1abe45ac119d", "comment": "Malware payload (Gafgyt)", "value": "650a6bcb9ee0b43ab4045c617a652b83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732724, "uuid": "b01e4d20-432d-4439-b9ba-e50ffd4b3b1d", "comment": "Malware payload (Gafgyt)", "value": "4965d6fb6c3528659be65374b7113b29fc0f0f8f1684b26910c1cd92ba734e0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732724, "uuid": "25cccf3b-1bae-442c-89f4-4650d1adb06a", "comment": "Malware payload (Gafgyt)", "value": "7363ee069b67b39c2a35a528fd75254153e94c33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732724, "uuid": "d0a8b0db-cb5a-40e1-ab57-5979a81b6b2a", "comment": "Malware payload (Gafgyt)", "value": "9c44d3d754fa2b9ebc773c748a26f6f83aae30946f74bf6b8660d4738e70538379e35cbc2b7cc5b63c2fddd2a5bfbd26", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732724, "uuid": "0b35d3cb-cf30-482b-9302-2714c630c2ab", "value": "T1CFA31A63F800DF72F40AD67604D74B25B630FBE60E93266273573966AE362D52823F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732724, "uuid": "dbecfe49-c59c-453c-989f-b9071d4a53de", "value": "3072:M1i+cBcp9fmLxF5nH7Jyni3J3woemK10PZHbf3Fj:M62p9fmLxVyngJ3woemK10PZHbf3Fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732724, "uuid": "bd8b1d36-d152-4dbc-84fd-c5fb2e3742c5", "value": 101652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732724, "uuid": "2f09308c-b724-4436-94e0-c2b8ea79bb73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732724, "uuid": "081761e6-7982-44f6-9037-21d14dd9a219", "value": "650a6bcb9ee0b43ab4045c617a652b83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fff438e-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675758606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758606, "uuid": "a1de751e-b693-45e5-8031-b1d693345bc2", "comment": "Malware payload", "value": "7c2c161dcccbda70d10c0962601bb11b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758606, "uuid": "c512202d-d25e-4516-80fc-2e94adc7da97", "comment": "Malware payload", "value": "497dec7fb727a560e249393a50afa1b325178af8fd5705beb648d6190dfed917", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758606, "uuid": "674f86ef-e0c1-4c93-b02f-06fd9e501cb1", "comment": "Malware payload", "value": "d4d0d31ac8bebdfc823114d2a372b8643635b00d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758606, "uuid": "a4c09718-220d-4f27-948a-c711a6fd488c", "comment": "Malware payload", "value": "ada531e9b242c579f688b6a5915fe5249786726ef9128d3d53181f244762e109df21a5c6f2b413834c3a2efaf339eca5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758606, "uuid": "6bcfce9f-ee07-4003-803f-db2bf0462935", "value": "T17AF6332376568124E5F58939443BEFA932FA2B314B63C8FB43D56DD91A334D0A232D63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758606, "uuid": "b391043a-02b1-4d83-b4ff-88ec0475de89", "value": "393216:cuXcT5cpliu+VoU1hL/sILGXrvhz1cokOSLDQEhDEGvsLE:cIc9cplcOsr9L05cokXEG9UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758606, "uuid": "2a0181f3-5a33-414b-8381-d50b2824ed03", "value": 15503872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758606, "uuid": "8de34354-4e20-4ad6-b9ca-54ed3dc6945f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758606, "uuid": "d757b220-e1e1-47ac-a367-19226cc04724", "value": "HGZFJEQBXIAF.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86396f31-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675761569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761569, "uuid": "690e28cf-aa71-470b-b5b7-58c568291baa", "comment": "Malware payload (Formbook)", "value": "bc0b06402e7d1c9137ddc147b44bb3f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761569, "uuid": "5dbf1379-52a9-4e8e-a759-6c2d7ce8073a", "comment": "Malware payload (Formbook)", "value": "498657673492910709e321035e4fabe392e1a297e2ae2653fcb5464279d47de0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761569, "uuid": "62d68e18-0d07-4caa-b4dd-bcf96bb24b0a", "comment": "Malware payload (Formbook)", "value": "98e045b8c32bf6df991dfaddf4f03298acab0b08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761569, "uuid": "cbe7316d-e155-4f76-b6a8-3138a8803030", "comment": "Malware payload (Formbook)", "value": "884c1e587819d2f78fbd2661776fa0200ad9694e1bccd6ccde49e81ea49fcae17acf76084e123c79202b421422bd5253", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761569, "uuid": "69aeb7c8-48ff-410c-8763-13fd00f26013", "value": "T1438423019090DDFBD5964A719F3E063356F9A57278B8834B13502FAEB8371E29F1DB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761569, "uuid": "dc6330aa-d0a2-49ff-bf32-d2f4e3f61872", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761569, "uuid": "7e93d4ca-88f2-445c-a6b9-e0ad523c495f", "value": "6144:/Ya6C1CzTInAGQFHLe1ql1SVyH1yPUwYQqOpm2307iTFNotGEr3L:/Yc1CzTQAGs6S1gC1yPUwlg230mTFNwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761569, "uuid": "6ca41fe8-15b0-445b-b698-fc6cdd432833", "value": 374075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761569, "uuid": "1d527ad1-916a-410f-b1df-cd43c7852a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761569, "uuid": "2b1ab662-7777-42f1-b7df-d5581fbe4244", "value": "bc0b06402e7d1c9137ddc147b44bb3f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855a3976-a6b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675752119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752119, "uuid": "711c790e-9297-44db-81c7-94676a7afeb5", "comment": "Malware payload (SnakeKeylogger)", "value": "50b4703dce53aac106d5930b101cf46e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752119, "uuid": "76b2ec71-4c7b-4b2d-bdb5-ef5ca617308e", "comment": "Malware payload (SnakeKeylogger)", "value": "49bf8f7c260aa122204eea6bf5538aae6d8557e4ad76cbcc59cdcf0dce374705", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752119, "uuid": "799cc51e-6a97-458d-a6e2-570424fdddb8", "comment": "Malware payload (SnakeKeylogger)", "value": "507aed446db76089511afcfb3fe742f10b7122f1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752119, "uuid": "76d88309-fffd-41fc-8e15-9f9f4a0564ea", "comment": "Malware payload (SnakeKeylogger)", "value": "442cdeff3bdb5804a6641103d07ca94ea5090e60a6834f7f79322e04ac460b4e5c4ca49bcae41db3e643429b0f5281fd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752119, "uuid": "f7d26a3a-bd52-410f-a201-d801bc4adac0", "value": "T18DC49DE6A5438811FD63077E3ABD99951303FC06DB130A2BF120B79D2EF33945A52D6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752119, "uuid": "3aa8efb1-dcd4-4d68-b80e-5b2296c35bd0", "value": "6144:d0rC6zzXaMANkizCBDEk2sG3figF8ESbuQq9c5MSx5TBzcOPqGdZ+RwPONXoRjDn:l9q5TBzBZMJqkDJwk9Xmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752119, "uuid": "a85ee0d6-1749-4c34-82af-c3dc6613f35a", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752119, "uuid": "8c72cf56-b3a7-40f1-9064-1f7b7c212571", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752119, "uuid": "f4c3dfe6-48be-4aa5-a021-4e2427d0b6c9", "value": "Statement of Account.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c076fa-a732-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675807125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807125, "uuid": "5463de8b-7577-4ce1-831f-b66ca1e1dbce", "comment": "Malware payload", "value": "f4b906685385629998faa352a94a2e1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807125, "uuid": "f9f79732-bbbe-44eb-bdb1-b07fc33d8c1d", "comment": "Malware payload", "value": "49d5e821c721205ae44d6ef76450b6a1307e06308900065d18ebad11c6abe74f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807125, "uuid": "bccebfe4-b595-42d9-b30a-3d0e616bad39", "comment": "Malware payload", "value": "97ebb6ba0f496f6cabdec20d5c8af07495a00e15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807125, "uuid": "fa706231-b795-4588-bb09-8fa24f999ba0", "comment": "Malware payload", "value": "e16966cddbe5dd0e9d2539918fdd581a302c8dc0b27d4e9e174e0c6610fa101488af16dff003f45dfe85f5821f98f73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807125, "uuid": "20388fc4-5d33-4d25-9600-b096307f6dbd", "value": "T1FEB4020BB7E88032E8B1677014F902D306377EA1AB7C43D7624AAC5E1C726A4E775767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807125, "uuid": "735e2dfd-37f7-4e4d-a4ba-5c9052b5b268", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807125, "uuid": "9889f218-1380-4dac-bd69-b9a1f7d26a44", "value": "12288:pMryy90yNjwAz3QZDk3JlZdK77HEmCrh8B7l369GVzcr:fyhNjzLaDk3JlZKEfrh8Bp36A0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675807125, "uuid": "731d23b5-78ca-4c17-b6dc-37b81a41e30e", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675807125, "uuid": "72d0e53d-3c1c-4dbc-9e34-f6f040217ff5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807125, "uuid": "4791ea8f-964e-4744-b7cb-6745f4a58bd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5564b18f-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789834, "uuid": "85b6b7bc-8a6e-4e5c-883d-65bfc667a8bc", "comment": "Malware payload (AgentTesla)", "value": "666c989a85720ad2fec2cce3d883655f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789834, "uuid": "1367feba-9273-4540-be2b-63ef2f3afe7e", "comment": "Malware payload (AgentTesla)", "value": "4a5efffc818c01f738a3c79297554cbfcd6e409cb72c44dccc3ba52bbd9277f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789834, "uuid": "56eb9b97-7aee-4486-a19a-48e017340988", "comment": "Malware payload (AgentTesla)", "value": "f084d8c53564e5fd3dc67597fc18bd0cf0951bcd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789834, "uuid": "1507efd1-aa1c-416f-bbe6-db39e8df24a6", "comment": "Malware payload (AgentTesla)", "value": "fa9540bd1a32024849d454140edcf36dde3909c8663dc6ec52fb8f67208210b2a2c632fce4baedd5f373ae627da139b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789834, "uuid": "da55967c-014d-4ea2-a2e5-c688eeaacc4f", "value": "T16205182E197652D2D0B8FB7106E28520B5AD4C82772BD91D9CDAFAC47F711822ECF64C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789834, "uuid": "a3fc4998-7180-40e7-9549-1baaf9cf8b58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789834, "uuid": "d03d30ea-9ca6-400a-92f2-1237ce1e364c", "value": "24576:OiaHB8b8vOztLHKNu+A+/1bkFPc1x5ol6/9FwAud:u5oa9F16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789834, "uuid": "bd0a7b7c-6e4c-42ca-98ab-ef614a73ffd8", "value": 866816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789834, "uuid": "c78a4b40-0af3-4215-84de-b43d1aa5e67f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789834, "uuid": "4957f7dd-d80e-4f9d-b672-51cb67746926", "value": "Payment copy for 2-Naphthalenlythiol (Cas no. 91-60-1) 200kg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7147e616-a736-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675808778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808778, "uuid": "b709e4a2-5400-4a6b-a4a5-e993343358a1", "comment": "Malware payload", "value": "9668e5b53f662ca11141673b6f9714fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808778, "uuid": "b3a96d6d-6d19-4499-96ef-ac2f6f5ef6b8", "comment": "Malware payload", "value": "4aa6e82a585aee88be4538b21cce3e4b34d25f27a6e71e9e804d0801f3d401e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808778, "uuid": "6010eab6-2e7b-4bec-8afb-1b7bb23cc13f", "comment": "Malware payload", "value": "1c8a6f4dbbe2b27acbbf77b4f21534d04a6d77cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808778, "uuid": "e81b10bc-f84d-414e-ba3e-ffae8d88e6b1", "comment": "Malware payload", "value": "53fe1bad0402fa570e91f3850f9e25a81693c2ebfdee5f5701250642d31ce3aead18d55f4067a0239595902ac2be9cf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808778, "uuid": "cd1afa9d-09d0-4665-9c7e-11d98a0def4c", "value": "T10DB40207A6EC8032E8F167715CF603C30636BD616B78829B674EBC195C726A4E77532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808778, "uuid": "2813ccb0-2b57-4fe0-b92e-cb01545d7d7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808778, "uuid": "f423923b-eae1-4ffa-874c-e40700209c0b", "value": "12288:3Mr7y90i2hC8JzccePkgXu8NI2O3JRZdc77HEmMrfJNa:kyvI4cesge8NI2O3JRZgEdrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675808778, "uuid": "2ddbb8e9-6870-49d7-9edc-52dd7c6728df", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675808778, "uuid": "5e9e166c-5e3a-4b16-a7be-68d6da91fa9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808778, "uuid": "b86ea308-8043-4c08-b00b-cd895fdcfb8c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79caad4e-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732772, "uuid": "fdb298e8-46bd-4e3a-98b2-85e62ffc7c2a", "comment": "Malware payload (Gafgyt)", "value": "318c13d67e4d8be92b1b09aa43651644", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732772, "uuid": "0f03165b-e6a8-4194-aa17-ab2fc0dcb09b", "comment": "Malware payload (Gafgyt)", "value": "4ac04a289afeff3dc443889864b302ad7e50e907c7e9239684a824fb51eabd28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732772, "uuid": "607a980c-3d0d-4fea-9edf-8bf9c97ad3f4", "comment": "Malware payload (Gafgyt)", "value": "46514dc53ae3dec4239df54a25d1c362788e8074", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732772, "uuid": "c0b0af13-668b-4e64-bcd9-512ef7e8e8ff", "comment": "Malware payload (Gafgyt)", "value": "0332475e15ecbed965b0273eaff2b48ebca0d2cd6c4a05d70c2f221703c793e502dfcdbd8ad6bdbf0e2c24b163342e05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732772, "uuid": "c5e800d6-4826-404f-b486-17ca90cbad81", "value": "T115A33B53632D0647C8CB5AF02DFB27F187AAE8A022B25245951EBFC41773BB42052F5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732772, "uuid": "c1c5a4bf-36ee-4119-8d99-3f9bc2b44f3f", "value": "1536:gOEv7oAr53uUlhiTir3sofaviQRW/ZywROKTI3zO3FmsCs5pwuBN:dgU3Ubnvf5vlUK0q1mDs5muBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732772, "uuid": "a24df546-b9a6-4c8f-b618-a051f80144c0", "value": 104020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732772, "uuid": "19ee76ae-95ac-45be-9f68-9aab52504134", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732772, "uuid": "db4cd730-2ab3-4f51-a607-f3f75e891522", "value": "318c13d67e4d8be92b1b09aa43651644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abf5c4c-a723-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675800634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800634, "uuid": "e5414448-d166-4c81-ba96-a582b7fbb99d", "comment": "Malware payload (Smoke Loader)", "value": "cf82030a3dd172eeeb1e1677253dd0c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800634, "uuid": "3babdc70-65ab-40f0-ab20-292029f8fda1", "comment": "Malware payload (Smoke Loader)", "value": "4b84c0633052a46ae2e480104821333885a0e45eac478bc855ab064934515801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800634, "uuid": "b2900863-799b-4083-b06d-a95e945f8edf", "comment": "Malware payload (Smoke Loader)", "value": "4c94b813413e298442a5213e909e1250ff9a949e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800634, "uuid": "cba06a90-ffbb-4650-99f5-c74ff068d063", "comment": "Malware payload (Smoke Loader)", "value": "3b610a8f221d5084cce3baa0f22da3ac6feb5f0c7f6c52bc2101409cdf2b75314513f510c53511d4aec1d051802bfdc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800634, "uuid": "b194ec41-6370-40c5-b5e6-223d450511eb", "value": "T11914DF3236D0C033C5BB2470A864EBA46BBEB8314674995B7BE8176E5F303E1567A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800634, "uuid": "1237f839-5359-4e9b-93ec-3a240b76ba91", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800634, "uuid": "c3869616-34eb-4154-815b-7f7dc45de804", "value": "3072:gWKOrJLehPTwI6LJubBWGV52060aPA8TDLUI03kH1ZrFY/gEaBOJNg:gWKYpk/6LJuBbeuaP13UHiHp4LaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675800634, "uuid": "7d31c15c-c19b-4b8e-9feb-b2a8bb3d7b53", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675800634, "uuid": "8f40d60b-87fc-4349-8034-5f47cec5a789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800634, "uuid": "87860e23-821b-4fcf-ae5c-7344758e8a95", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732d9886-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675796326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796326, "uuid": "a7548557-c56a-47e7-9461-ef4e41746bf9", "comment": "Malware payload (Amadey)", "value": "1f6995a3aed87fad7e74b4d698c1267c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796326, "uuid": "839b3a01-8056-4be5-ba74-7d62b7d04f73", "comment": "Malware payload (Amadey)", "value": "4ba3a6c5fd265b9b0b3f869b0c2de235da8a83bcebc4c2444b99dc7816d801ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796326, "uuid": "21bf64fe-c1a9-4f79-b5d3-a3986f9e60ea", "comment": "Malware payload (Amadey)", "value": "7dceb94248f3ef2ebf618af93db12f6a6f606f89", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796326, "uuid": "f3587344-2eb7-4db5-9555-e9745f151b21", "comment": "Malware payload (Amadey)", "value": "341a82c34d4a6e3b0eb49819733272c32ba81c8bbac0fc619fd5131deb7f072328f2fce56b9ddac7955fd7700845926b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796326, "uuid": "385f966e-c334-4fad-8b4f-a60aec80fba6", "value": "T132B4020BE7ECD036E5B1077119F902D30A32BD615A3882AF278E6C5E1C736B5663176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796326, "uuid": "61d9bf1c-0dd1-44d3-b2d2-4ee97d40ebf0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796326, "uuid": "5f4ea9bd-a919-4a74-94c3-0b93074e055e", "value": "12288:jMryy90X2XtxPK1XlIEuHCSSic86qLBEb28k0cT:Fye2tVK9lMLz9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796326, "uuid": "538f6fff-1a8f-45c4-83f5-f89d3956ee44", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796326, "uuid": "e10482f0-a6f1-4813-adfa-6cd925aaa905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796326, "uuid": "df251e81-e37e-418f-96ce-c2d2041297c2", "value": "1f6995a3aed87fad7e74b4d698c1267c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6024ca1-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675794318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794318, "uuid": "2895b13d-6b3c-4033-9783-fde78c2120ce", "comment": "Malware payload", "value": "0f55324595f8f5527fdb72b12d3c0aac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794318, "uuid": "11b315de-5779-409b-acc7-4c29e731f902", "comment": "Malware payload", "value": "4c592c045ce58ce940e2396e084b7a6624920a7425af7282fb1c3e72c21f4119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794318, "uuid": "79238323-42a6-4147-8a8d-7858e8413a3b", "comment": "Malware payload", "value": "a9202c8c304a4290376592b30b30884c537731c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794318, "uuid": "db8fd748-20cb-4070-8507-c2616e2e9b68", "comment": "Malware payload", "value": "ec4bdddf85fee86d88969a9ea9609e0be3b7825f35aa675a5b1d7531d3412848668cad4af50b07e6779335e113fd50e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794318, "uuid": "24c3bc04-eb1d-48bc-a2b4-f22460087230", "value": "T1D5763317F4F5E1BFD18186B2E1913B8924966D252C63CB27074B457F1A3DF0AE38A3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794318, "uuid": "ffdab979-21ea-488f-bbf9-24e05c1415e4", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794318, "uuid": "9d564405-751b-4568-a5c8-33541add24bc", "value": "196608:91ObHZPcxmxFY66d3O19jBcDm3vaMxXBmVn2Q5nYhIWqd:3OLBjD2Dm3vaMxXBmV1Yep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794318, "uuid": "484bc6de-afca-4b97-a0a5-267b741225e9", "value": 7650919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794318, "uuid": "a4673fd8-e6b5-4f88-9d2e-79678a8e24fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794318, "uuid": "199f5a96-2fd7-4405-88ae-f5727cc11ad6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efafcba-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732700, "uuid": "2303d7b9-e987-4fe6-a29b-86a03e8e00f1", "comment": "Malware payload (Gafgyt)", "value": "9bbe4e2b931c1832d388703c48318390", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732700, "uuid": "f43f5bd0-fdbf-4b87-ad8f-ab39ea1ea7d1", "comment": "Malware payload (Gafgyt)", "value": "4ca20355bc8abfe8e69740b719ca573569c75191d049bf60e617fcbc628e4ed7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732700, "uuid": "36322cce-c377-4121-b7fe-0d682ea61295", "comment": "Malware payload (Gafgyt)", "value": "8e2894354057ff1323d757d86293d0a1bafa22c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732700, "uuid": "65b60a38-1274-4968-95bb-7a84c487d4f8", "comment": "Malware payload (Gafgyt)", "value": "20a829e785043200364b127ea6adf8c8f0fae6ae43596bb853c9a118615f509369786954d4f45b50144f48513b28774c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732700, "uuid": "8f7d6ad5-cc84-41aa-8a77-b34e5272d750", "value": "T1C3C3A72A7E12ABFFE168863107F35F70979521E327919382F26CDA581E7128D1C5FB90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732700, "uuid": "305ed557-383d-4e7e-a524-f0a2acad1a8c", "value": "1536:U7jx1Tgaq+rgIyN2rKGZS/0zO5OHeyyL2N5hJdddddh6FhdwmeFfkq+QCyRnVgj:o627zO5OoyN5hB6FHwmeRkq+QXnVgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732700, "uuid": "d8e8677c-1c3c-49cf-8790-4257337c9130", "value": 126905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732700, "uuid": "e95ca684-ba1a-4113-8ae7-2bd8a57c4855", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732700, "uuid": "9dc55f97-5520-45cd-bf15-2d9bdafd27e9", "value": "9bbe4e2b931c1832d388703c48318390", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38de0f08-a6c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675761010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761010, "uuid": "d88da066-c8bf-4a1b-8856-020512dd2e69", "comment": "Malware payload (Formbook)", "value": "ff878d72e7a393444ab11fe6d595f4f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761010, "uuid": "0cb61983-01b3-476e-8d5b-37e6a64357b0", "comment": "Malware payload (Formbook)", "value": "4ce2768ba26406a3b872e6e31d5dba57b908a56a0be7980b501ada6a587cfd02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761010, "uuid": "f34380e0-e879-4110-8406-d078529febf9", "comment": "Malware payload (Formbook)", "value": "6bdbdaf7619576241a219492f33cd6a64bbfac87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761010, "uuid": "ec42b936-2505-4011-a72c-8794b6819ba6", "comment": "Malware payload (Formbook)", "value": "0813f297676ecb0bd013271d61153be62d76bf8768419b5d2d1fd3f67a2638aa3b026d766c372401a0555081d849cb67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761010, "uuid": "2fb85eb3-c68d-4483-8824-636bf1a5d2b4", "value": "T1BB0412E1F36B69A3F426103F07B5217825631CE45ED25304713F8563AF985B4B45EB8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761010, "uuid": "98fb8cb4-f480-407f-bc11-0d02bf4f08a8", "value": "3072:Di31VYGZ9sllsbgQyqjQLOk9wQG28AL4LxnLjfcf0pr3XrGRW0bK6F+BfsPM+u5/:D41iGZKzugQVjQLOk9wQG0exnLgf0pr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761010, "uuid": "d47483cd-408b-45f7-8436-ba8d3a1d173d", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761010, "uuid": "4b23184e-d7d0-4ddb-a980-d012ee875d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761010, "uuid": "fa37c987-0f57-483e-b753-8bea70d3b1bb", "value": "4ce2768ba26406a3b872e6e31d5dba57b908a56a0be7980b501ada6a587cfd02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080f8641-a70d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675790993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790993, "uuid": "a7bdefcd-76f1-4770-95da-fdd514cd7c02", "comment": "Malware payload", "value": "31a12ae662573380939a6df764d372e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790993, "uuid": "7bb4c810-d25c-4552-9154-5cfd9f9b1703", "comment": "Malware payload", "value": "4cfcc983609d06a8b6be4472247adb4651fe4749d1b620f0ef920b5b9775b7c0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790993, "uuid": "d8c84973-ed86-4005-bffe-3f4cb3c6e6e6", "comment": "Malware payload", "value": "54701819ad994c68a06afc5b020cf35e938a1914", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790993, "uuid": "4dfd6226-2cb2-49cf-9808-43c07c215a3a", "comment": "Malware payload", "value": "d237edbc32a212f02c7eaab610758efd6dc8330ce4252589cc3775e82c485a317ca1433666a1f2d60bfc35a59baa4f57", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790993, "uuid": "2cd9a626-128b-492e-85be-4805bf77c5c8", "value": "T16E8163C3BBDD2DC5F02390B54D977838728FF07402B2DC4A9A64270F2D59655ADE9E24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790993, "uuid": "5c20c074-2056-4fd3-be7b-9ebb22d6349b", "value": "96:M4bUYnMyvcbW+jbAo2LLkZNif1Gk9UORq:liyUbJA1L0TVEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675790993, "uuid": "5346789e-92ca-41a0-b0cd-0ef88a6ea2ba", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675790993, "uuid": "85fcc74e-5ecd-4136-bb74-6aa7c4dbbb40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790993, "uuid": "ab9b9af9-3ee5-4397-8bb6-cfcf6aa1acbb", "value": "gb.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db7cc64-a6da-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675769178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675769178, "uuid": "e8b5fddc-2a4c-4440-952c-40d71bf167cc", "comment": "Malware payload (Formbook)", "value": "a5a9c8e30f549c78befd0eca9f4c5cbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675769178, "uuid": "21455ee3-8779-4f92-8640-61f46576384e", "comment": "Malware payload (Formbook)", "value": "4f83f512204dd7380d39b65d458ae6ad9a720ec93a46b422a074372de1620b38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675769178, "uuid": "ebefc167-59f7-4fd2-8bd9-8ff791988a0c", "comment": "Malware payload (Formbook)", "value": "dfb1eba6e9a5c789a042706c644c8bfc19dc1581", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675769178, "uuid": "d9e51da5-3652-4c91-bc01-3be5897d2357", "comment": "Malware payload (Formbook)", "value": "fedcc77dfa972902304eb641ef0699bb8006d8705b815e1c078e594b4ea8ab343a6a55989f8149f5332f3d542a546884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675769178, "uuid": "6f36bdc5-b9ef-43a8-88ec-c4267b760c9c", "value": "T12025C5D032A94449F1BE0B75E6735DF14B317E4799BDCA4E099A78CE10F3740892AB2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675769178, "uuid": "2aadb461-fdea-4d34-9f37-8beb38df3bc6", "value": "6144:0NqNwX3/MAMCipcUIKjKpNfEbkidGEuYAA4PcTIDsGYXvWRtqmajG2B0xmsBdwtB:YMCcZCAu3ksBCt90tr8BQ8mYEAB1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675769178, "uuid": "5d204bdc-0818-400e-952d-a12a20ec3748", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675769178, "uuid": "0bf4a5ff-e6c9-4275-9852-141fd9020255", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675769178, "uuid": "1786a7ca-6833-48b1-a47c-11311483f79f", "value": "4f83f512204dd7380d39b65d458ae6ad9a720ec93a46b422a074372de1620b38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52fdc9e8-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758476, "uuid": "1678ba9e-c642-4448-9690-1cb4ed518b1f", "comment": "Malware payload (Gozi)", "value": "aa67a0782f7e8fd0e39b0306ecacfc17", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758476, "uuid": "adf2567e-b678-463c-8f79-31077c82bd19", "comment": "Malware payload (Gozi)", "value": "4f999cd608ccf9e8cf62e41e2c7a75f50b3c758dbf290e26424d6a5a0acff243", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758476, "uuid": "b57c4014-3ae7-4615-84b7-62ee533714c0", "comment": "Malware payload (Gozi)", "value": "6f8bd5514cffcd413acfe31913fe4b7f12a7ece1", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758476, "uuid": "a902263e-2e24-4c08-b896-0e5a2af1217a", "comment": "Malware payload (Gozi)", "value": "88c8de3526f6178b20fd1ee1ad9c6c47ac338dc5cf48900f33c26560043a8b346d8d89c0e3311c18bd426b3418bf480f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758476, "uuid": "3b36f4ae-53e0-4655-89ef-e1ce61885468", "value": "T1D9E17C4FDEDB641B678182DFF2733C11FB5028BBD9392104B5E5E30E2A96B67004166C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758476, "uuid": "3489d0e6-410f-4b82-a2f1-ce660c2c54ec", "value": "96:wTgU8LVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dnr96k:pU77rIKdn863jMM0OD9+VVF45x/CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758476, "uuid": "1d935e96-e526-4249-9fb8-7ad6b5356c5e", "value": 7039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758476, "uuid": "7aafb14d-7ab0-4443-81d2-4b5d22d22341", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758476, "uuid": "b21be1a7-7471-4ba5-ba75-6562bf0eac28", "value": "azienda_38.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95dd0668-a6a0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675744415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744415, "uuid": "82f998c9-15ab-4072-a7a1-499522cc70b7", "comment": "Malware payload", "value": "b6a387258d1a78d7fab344e5d55370e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744415, "uuid": "b726278d-53db-40f7-a9c6-12e18e389ac1", "comment": "Malware payload", "value": "4fe3cb40c5dfd91cb852dd8a4cafc7d7a8333a6ff729a33f99e1c9b1f80eefa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744415, "uuid": "7ce778fb-8f4a-462a-9878-c6b8a1178d46", "comment": "Malware payload", "value": "22f3f5651af44dacaca6a118943c8376dde7bfba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744415, "uuid": "3cb59c8f-a325-4e6c-95e4-f59ab7fb0300", "comment": "Malware payload", "value": "e688e4ad090e844548c584dec3288b68953d9698e4c4afbb8414a4d94d29c20fb56a2e6fe7160aecc4b5658505e23176", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744415, "uuid": "2f8cf6f9-10e7-466c-9599-d7569742acd9", "value": "T140D35B1176E5C036E07241365724E67246BFBC32AB3A8A9F7BDA4D4D07B46C1E728723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744415, "uuid": "9a786cc7-7ac2-47d0-bc72-bbcb48beb398", "value": "c8d7a10f1f370eb7c020278599a3af3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744415, "uuid": "576c1d81-122b-4fb7-a860-88f5f704ead0", "value": "1536:sqzqprDi7r+CqS8leS1GM+fvGrts7iIEWGGxIe7pPLsuPw5O/EfPjg5oFmJ33l:/zqew1Q3Qts7iIEpMz7pPHwBPjgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675744415, "uuid": "eb9254c6-d6e7-485e-8ab0-96b3dc3d87b5", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675744415, "uuid": "373c8ba7-9828-4f6e-a6fb-27e658d954e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744415, "uuid": "9d26f692-46a0-4816-a157-9a0ac2129e65", "value": "SecuriteInfo.com.Win32.InjectorX-gen.27246.24208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b109c025-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675789988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789988, "uuid": "d73c2e83-db27-440a-9618-f1e2e325102a", "comment": "Malware payload (Formbook)", "value": "c189964991dde81247ec9c506ba9d012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789988, "uuid": "d645530e-cd03-4a4f-86f7-c62399e73546", "comment": "Malware payload (Formbook)", "value": "5032142ba20b1c3203fb0b6c8c5f6d52c4546b233b3d11b885b4296e4887d6a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789988, "uuid": "e78cd820-d2ce-4682-80f9-2ff43f9289a9", "comment": "Malware payload (Formbook)", "value": "a7362cdea0f49dd256eea184b46ef78bd95b51a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789988, "uuid": "f8bc427d-2a14-4704-abbf-eb488bebb2f1", "comment": "Malware payload (Formbook)", "value": "a953a551c113c56195fefa58d2ceea8145a329e7b8b94a6e0432d2ee6e94180d83f1dcc0b612c5c8c5719ff4d8903a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789988, "uuid": "46fff449-9a77-4080-a50f-7d2739a80a3a", "value": "T1B205230D63392B20CD8C8339D4FA5AA05335AB2DF152F71E9DD9A4E94D33F914A82B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789988, "uuid": "d946d184-2b23-407a-8acc-826898edddce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789988, "uuid": "522a8960-4d75-418d-9eac-50ffbc04491b", "value": "12288:D/n05FNIh652tffbnCLTkcFkiDOx92F843YLsnrsu05SlRuCOrx7p58lCrd4gyQj:Dc1465ODidRD2AsL3rxN5IC54TWMxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789988, "uuid": "898390e3-59e8-4a7e-8945-2fd2557c3d93", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789988, "uuid": "a206198f-04b2-4972-973a-9446289faab1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789988, "uuid": "4eef119a-105e-46a0-ace7-e3174a49d33e", "value": "Payment Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20d5e580-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788887, "uuid": "e987d36b-3406-4e81-9efa-23c8284e9166", "comment": "Malware payload (SnakeKeylogger)", "value": "f66f341b23e8f136420daf6afb945749", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788887, "uuid": "f9d36221-9ec0-412a-8275-94bd5ac916bb", "comment": "Malware payload (SnakeKeylogger)", "value": "5082b3c06b1c05a23ac3074cc33ecd3a3396b50b4d6259685442d727179747bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788887, "uuid": "4bd0d8e0-8e94-468f-85fc-fd2a445681b8", "comment": "Malware payload (SnakeKeylogger)", "value": "d58bc7902251adef6630a51c3681d638373ad37d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788887, "uuid": "ad97880d-675a-4c78-92ae-05a3ae3bd54e", "comment": "Malware payload (SnakeKeylogger)", "value": "ea0718d555bb681b62f9e43529bd0d56a0ba9db65ebcea045e0726f94314b39800cf7caf116dccf39c64e5571ae5f356", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788887, "uuid": "2234f9f1-d629-4f53-8a01-15d593abc8dd", "value": "T1FCF4220D2FFAEF10C46E47B9A8B0591017BAA4227162E33D4EC762CF3E267518641F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788887, "uuid": "bfdf430f-4848-40d1-adbe-a1485b5ebc5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788887, "uuid": "048ef14b-1bf6-4ba3-ab8c-7ac8a02d4814", "value": "12288:fuawHRr/CB06KuLp2Jiyv5EqkniBI+yeufDYDIzeYcdRV6a/071/LD5FiHFbDDlG:fuawxO5d2oU6+yeQDZ6LV6a/051FOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788887, "uuid": "0c63aa99-5e05-4f50-b19a-feac957f6bb8", "value": 768512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788887, "uuid": "1cf98cc1-16da-4897-961e-f6a4b518cc55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788887, "uuid": "2f175aab-149a-49d2-a258-d362a0740925", "value": "2oPLnUHhM95XX7O.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74dacba2-a67a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675728039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728039, "uuid": "8588debd-ba4d-4abf-8554-d4ce8618af52", "comment": "Malware payload (Amadey)", "value": "f16568c78fea16f69102b78be297dcb1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728039, "uuid": "7f3877ae-3557-442b-8e01-d6850974c5d0", "comment": "Malware payload (Amadey)", "value": "509780fec6571467b334a7ff2ecc8338dd9214463d30899456276d8b6c098db6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728039, "uuid": "81604ce4-f2d7-4693-b85c-42ef61024d91", "comment": "Malware payload (Amadey)", "value": "d30f96c265d5f0c5e7670f5d3e05167259c2711f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728039, "uuid": "24634782-a50c-468e-b0af-eedbc2a460dd", "comment": "Malware payload (Amadey)", "value": "42f53c5e16a465fa171333612584497ba8df15eab00a68d58749b8eae66880d5fc4f9501b4b5973333e29a739dd67d36", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728039, "uuid": "bd97bb8c-5d64-4820-a897-c740cf0c3bd8", "value": "T108645B8393E1BE40E9268B72CE1FC6E87A4DF9418E7977653218AEDF15B107AC173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728039, "uuid": "c2552766-8d02-4272-8aab-f68ada8125e7", "value": "362b00b7c7bfeb7a79c15e736bbb9859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728039, "uuid": "5cf1f3d8-b514-4501-9883-a80eb92bd7df", "value": "3072:CMLpb6bvYLdWjwRGcYeve8K3A9Qfq8Bsw0vKYybk97DkuQjiMTE5O1Xa6j:C64YLdS3fevM3A0duK497DkuQj9bXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675728039, "uuid": "a61e4e74-02b8-4a3c-8459-d0482ceb7ef9", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675728039, "uuid": "54f72974-0f1b-42b2-962a-cdaaf2b1905e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728039, "uuid": "9a580617-c6e9-4f61-83d2-6c27aaa20c55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4b6032-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (PandaStealer)", "timestamp": 1675758408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758408, "uuid": "ae640abb-b63f-4e0c-9f4d-e006bf2d4b93", "comment": "Malware payload (PandaStealer)", "value": "dde995cfb07cbb9bc3f054783cb35461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758408, "uuid": "054c73ed-9a8d-44d6-b111-37cc3053b64a", "comment": "Malware payload (PandaStealer)", "value": "513b839cea18adfe5cc8f6307dbf2519ab07c6cca7c46508b778150acb88829a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758408, "uuid": "66a5b046-ee09-4215-a5dc-3a9c36d038ce", "comment": "Malware payload (PandaStealer)", "value": "62c8098fd796dbbb1ae38d4e8eaec2bacae64bea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758408, "uuid": "d64a3d77-e633-43e9-865c-79141b1ad6e8", "comment": "Malware payload (PandaStealer)", "value": "d89254ab1df26fba7bae206a1143329720d88346dfeafbafc5d1b672f5b7dfed5a0e5bd6575b31b3275168b20f289207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758408, "uuid": "3d74b48a-7f6a-4e91-a6d2-d0874d9383df", "value": "T120F4DF7C5F6A5072D6C53875EE2BE3B8D8B72AF20C7B490A7F67214513B024926E60DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758408, "uuid": "dcb438ca-7399-485f-90a2-3bd8ceabf409", "value": "fa196ffe3554a112ec3db8d999b31772", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758408, "uuid": "3a10db7f-d92a-4cb0-b1b5-f49b87a0bbb9", "value": "12288:s/lF1MbcEK5zByepp5uZpJwPHITFl76WeggtgWwdW1ZdhCEfg7Y1Mh6sP7P3e3:0aIhrpv8GPohoW9gtgDdo/hCEfgTTPu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758408, "uuid": "7e0ddc1c-8424-4c33-ba70-263f5dc00d32", "value": 759296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758408, "uuid": "b09ca32f-d550-4183-b7bd-64f4cbf5f8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758408, "uuid": "64d41170-ee44-4a9b-b8d1-b81de161c201", "value": "dde995cfb07cbb9bc3f054783cb35461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bf4b20-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732663, "uuid": "bc82141b-5152-4ed4-8105-dbf9c6b9fd8a", "comment": "Malware payload (Gafgyt)", "value": "29fcb2cbfe39394d660524594c5bcc37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732663, "uuid": "d5afcf2c-991a-4c0b-969f-5a919a9cf97d", "comment": "Malware payload (Gafgyt)", "value": "51de2aef5a4e9d20d27a2df2d885717160bcf25832bf1c597fed86fd36b77f3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732663, "uuid": "61b01073-c8c5-4a34-8899-4da15dd51079", "comment": "Malware payload (Gafgyt)", "value": "6b2b59426d8a2889bfca0a73963fcb13b87121a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732663, "uuid": "f9b4257c-db3b-43aa-84b2-9a3ab1c3bd13", "comment": "Malware payload (Gafgyt)", "value": "86d4a798c56b840c2ab6dff2c3b362668e08e98bcb71541b44af1a6305e5d4fc304d07f93b13bcd6d0192154ff92b559", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732663, "uuid": "c57d2d95-8ad1-483c-949d-954d6f553c03", "value": "T186B329377B270E23C0CA147112D70732AAB5C6D938FA5397B9E06DAC6F16A843916FD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732663, "uuid": "988486d2-2561-4d4f-96b0-ab438450dc49", "value": "1536:BXYQBTSNM5+ZtzOftEj5phmdddddTFOrJfIVmYj1EPZjDbfKasj:B7TSN8+DOfUphwQ6VmK1EPZHbfvsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732663, "uuid": "f6a39f5e-13ae-46c0-8ee6-eeb629584327", "value": 108147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732663, "uuid": "1132171c-5022-4806-802a-6dfaaed7708a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732663, "uuid": "befd360f-a8ba-4ba5-9905-8cf5f937d5fe", "value": "29fcb2cbfe39394d660524594c5bcc37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac360c02-a69e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675743594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743594, "uuid": "a3667fec-8908-49aa-a590-899ac6de10c1", "comment": "Malware payload", "value": "2024ed85143b1b3669d7c4f5b7344cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743594, "uuid": "769233fe-b1c6-4759-a570-da66d3342554", "comment": "Malware payload", "value": "5226eba0c91d9f68c0325cab7f85b127a389d84ed8b82873fb8d743cc541c7fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743594, "uuid": "af6b3ff3-3602-43c1-b612-c037dd23037f", "comment": "Malware payload", "value": "c78c9ea9b2d7d7aef6258ac6e95c6f7af4caa41a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743594, "uuid": "4ab197c4-cc87-48a2-a988-f6c5ff4c4e98", "comment": "Malware payload", "value": "f45e56016d921cb13d24cb6cd3964bf62cf73bd2d77e844205faf9c4a34fdfda093ef0f60dc132b8ed541d81518df510", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743594, "uuid": "b155c890-ba59-406b-809e-d409904aec65", "value": "T1927633453DE54DF1F76028F2888A3BEBE2A1E24502535093EBEA8019F7346F1C5DDB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743594, "uuid": "a373f91b-bb7b-4f72-9ed8-09f16a9c4072", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743594, "uuid": "bd6150e9-e487-4377-b512-7ab8813be3b4", "value": "196608:91O18IKRcc8efxejaXpMekrPmrUlEVxWyEWbANFIYk:3OiRcNAxe6MekrPz4WyEdID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675743594, "uuid": "6dc1d1ae-0fb8-44a1-9d6f-23f159907a62", "value": 7638393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675743594, "uuid": "b5c04578-3d66-4452-bccc-6185b9618d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743594, "uuid": "50ced029-d3e4-4b63-bd6a-d95d07a079bb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40fd7531-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732676, "uuid": "f3a19024-26e8-4808-a6ec-58b5e72de933", "comment": "Malware payload (Gafgyt)", "value": "753ee5aec784d0a1aa2b3c4505e65024", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732676, "uuid": "f30b86f8-285b-4233-9d74-04f511fa53f1", "comment": "Malware payload (Gafgyt)", "value": "52c8b87d599b1076bfa299b329d40a6792fdf8ffe239e2ddbf47ad59849ff737", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732676, "uuid": "ca4fd3a4-1385-4a82-b5c2-41506ece8d27", "comment": "Malware payload (Gafgyt)", "value": "dcba711a532aa2f79d55192667abd8e3666bbb3a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732676, "uuid": "1288bced-b6d9-41e4-b081-6519ee03047a", "comment": "Malware payload (Gafgyt)", "value": "3997185a4dd6f2791698b289e61e341442a4a1033c1608cbc75c27d3c11b6a2eb1da75f324f9f9ea128c698627ad8ab8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732676, "uuid": "9730ad75-0cdf-4933-9865-f08e505dccba", "value": "T186B31841EA448627C2D22B7AEB9F434D37326A54A3E737095538BFF43BC27D91E26211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732676, "uuid": "7e8d03c4-1f38-42d1-9ada-890dabbbe27c", "value": "3072:NgRVyZbF2t+2gWaYv04SnfuVCNwm7QnjcX/YN:N1KBgKvnSnfuVCNwm7QnjS/YN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732676, "uuid": "e10077d1-aac1-4237-a99c-f7a95396f0a6", "value": 111433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732676, "uuid": "91e311f8-1420-4924-bc8e-87d7a2987de2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732676, "uuid": "3afe60b3-e866-4edc-b802-376bed2fb046", "value": "753ee5aec784d0a1aa2b3c4505e65024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0398b37d-a684-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732144, "uuid": "67e4a983-8bbd-49a6-9fca-f04ec71990e7", "comment": "Malware payload (Gafgyt)", "value": "1ca05fe1185ad50e02a758f0f61a7057", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732144, "uuid": "24552369-5346-4088-9779-9aa9fb3f8711", "comment": "Malware payload (Gafgyt)", "value": "5324fccd100cff64b29e60de0b350aceffa6df38920ba4490d897da5fcb545aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732144, "uuid": "2c36522c-54d2-4697-8b99-da21f95b403b", "comment": "Malware payload (Gafgyt)", "value": "d1c8189c2e941a0b70c2e36ba8ee4b21c63270ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732144, "uuid": "a554bf2e-396f-456e-a9a3-45329500657f", "comment": "Malware payload (Gafgyt)", "value": "7fdbb45efb0d59c7c42b63c4316f239820646048b4e737c162aca5102600e12f1ee4290d2bda7a86d18895512f96d047", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732144, "uuid": "e4666344-f913-4bc8-8d46-0c58c052afd7", "value": "T120B30905F9404767C2D327B6F79F438D7B326AA457D733016A247EB02BC1B992E3A960", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732144, "uuid": "db4c6596-c7d5-4bb3-9c6e-d51d8bf62ba8", "value": "3072:w+/CzUt4JZyehU5hyjeEI4gxNiume3QQxXxzXToj:wnUt4iehU5hyjetNRme3QQxXxzXToj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732144, "uuid": "d1952c38-57d3-4d5d-ba6b-4f41f3408bf5", "value": 109594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732144, "uuid": "b6ce1526-4850-4144-8669-8140670380ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732144, "uuid": "16e6019a-ce4e-4a3b-b50b-75638c5e08cf", "value": "1ca05fe1185ad50e02a758f0f61a7057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "653513f9-a72e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675805322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805322, "uuid": "9ae9d005-bb7a-403e-864b-fcfd2aafe6ed", "comment": "Malware payload", "value": "d07eb11e2f72bde21377460c4eaebfa4", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805322, "uuid": "9e6e6524-0fd2-4bfa-8240-242dcd011752", "comment": "Malware payload", "value": "533ec2002e6dcf5cc585823bacd4647a1fb83758993ba716be76f24c0a2fa2ae", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805322, "uuid": "31b045e4-d0b8-4192-ac69-0d5e8b2e3503", "comment": "Malware payload", "value": "729b4f7d337e88ea40c0d417bd2808f275de733e", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805322, "uuid": "6c642872-d695-4766-813f-5db675e1f4d3", "comment": "Malware payload", "value": "08fdccd698989ded2042c504e5b049192af737a20ece72aaf4ee23193ceb9fece9696ad0204cc88ec7da7e3859bca3d8", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805322, "uuid": "b65842f6-aa9e-4847-884d-82fc7e92862d", "value": "T1D7228D2DC510FD36C323057DE01882F4F61820AAFB95BA1D1942F29E8AF06C347DA6F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805322, "uuid": "4aeefd78-296d-401b-8616-9aee5e0d496c", "value": "192:ScIMmtP5hG/b7XN+eO/xXkO+5+5F7Jar/YEChI3UqR:SPXRE7XtOJXk7wtar/YECOUe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675805322, "uuid": "e7287366-45fc-4dcf-9bba-170466975e89", "value": 10374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675805322, "uuid": "c4c93d86-a7e9-454f-a019-666861bf335f", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805322, "uuid": "7244e825-451c-405a-8f4e-a25b15e0acce", "value": "interflux 230101.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdad606-a726-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675801877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801877, "uuid": "b6874a28-511f-4b09-a235-2a4a3db0faa8", "comment": "Malware payload", "value": "05ae27ee9ffc2a40ff97b548513e57d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801877, "uuid": "8bc77aaf-bf0b-4c48-bdf2-8f74a94ca28a", "comment": "Malware payload", "value": "5388fe22307a6304c990a59596a87127f668ae62b05599df1ada23da512d4e47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801877, "uuid": "c1ac9451-f4ba-459e-8b25-20efdfb4cadc", "comment": "Malware payload", "value": "6d25620166b7cc6be53c11fd28cac25676c003fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801877, "uuid": "5165fd2c-086f-44d1-a458-009ec8a408e9", "comment": "Malware payload", "value": "108cbadfbbd5a81241900522696d2a1a866eb54c68e8f59495d0caae86589bc4be1661eae8d4387f245300a942af8145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801877, "uuid": "3d98ff3f-392b-4d7e-833b-fa54f7accaeb", "value": "T14614C0363A90C072C17B64705C64EA646BBDB93146B8C95B37A80BBEDF303D1573A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801877, "uuid": "abe198eb-0fc3-4ff2-a39a-83a4c85aaa00", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801877, "uuid": "f7215ea1-131d-49b7-abc6-419e1c0692cc", "value": "3072:ypyOVQFtet3LNZbWkE5NkDfIHeUz2kGbkff0mbsaiwSo3:ypyTQ3LTbhG+/yHxiwSo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675801877, "uuid": "ae434904-a7c6-4d5d-ad78-a7a9dccf05d1", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675801877, "uuid": "80318db1-051f-4878-bf17-fd5b07515d37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801877, "uuid": "4197f15e-8fde-423d-b431-68ad9ce54cd4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1414f2cf-a68b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675735178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735178, "uuid": "1b866c63-e844-4a38-b38d-5406b3855db1", "comment": "Malware payload (Tofsee)", "value": "04a4fa24bcb580aaa580052197e69c2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735178, "uuid": "861560a4-ae96-4e1a-a990-728a1aeacd51", "comment": "Malware payload (Tofsee)", "value": "543e37e50d79fd6ea207873f7fbef74be63556d437d8aa7ad19ab8216f805793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735178, "uuid": "a5f6f3a4-39b4-4f8a-b6b1-d585388c356e", "comment": "Malware payload (Tofsee)", "value": "9810676d6ec3a5ac4e4e89eee9dda78f4cb92345", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735178, "uuid": "3e6ffdae-6368-44c1-8876-fdcd6a079062", "comment": "Malware payload (Tofsee)", "value": "805c77de0b60b19f45efde10ffee851ae0a607fe9949e04ec9521a07eb11ee3ca44f808092bab1702e7480894b157e27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735178, "uuid": "141fa0ec-2445-43b6-bab4-2e6869050bce", "value": "T1F6644A4392E1BD84E9268B72DE1EC2E87B5EF5508EBD77653218AEDF10F1072C163690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735178, "uuid": "d55cfda1-6411-40b5-8e41-e132c830ef41", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735178, "uuid": "c6532c1f-8e98-475e-88a1-bbc2e2997c91", "value": "6144:iTI08LeS30u0iHpKibRwAVwJDuQj9dkfaL:isNawHpdbfwDljjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675735178, "uuid": "0b9ad442-1c3c-4367-b87a-41ed37551ef0", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675735178, "uuid": "6a07ee73-f19b-4931-9b97-c0a5af2d9d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735178, "uuid": "006bdd8d-f5ec-4ba7-bba0-4c371ab9a0a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d4928d-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756867, "uuid": "38c21f47-b19c-4c3d-826f-b43cbac8b7d6", "comment": "Malware payload (SnakeKeylogger)", "value": "98a5358665656e68a35345bf05e9e965", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756867, "uuid": "49a96aab-fb74-4c39-96b3-a0f624cf4305", "comment": "Malware payload (SnakeKeylogger)", "value": "547666ce0f98bbd093c5375eae900472c0faa12f25671d9438bcf2f25e49b00f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756867, "uuid": "01312bef-0cbd-4f3d-98a9-35a8cac6d8eb", "comment": "Malware payload (SnakeKeylogger)", "value": "f9bcc1508017b7778ca322bb997c00cced53deb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756867, "uuid": "037469dc-fb30-4a6e-9cc8-9aca11686984", "comment": "Malware payload (SnakeKeylogger)", "value": "e7a30790861f3e519fe2341ffb4b6e522c514bc116680f7dd84e7ac4061b465af83b8b126e84e12c482b4eaf92c95d3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756867, "uuid": "7ac31f56-4852-4048-914f-f0eef1fd0db3", "value": "T19A057EA337B195B2F78720B20424BB885BF17613BE16E2938BB737C06785DB77294152", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756867, "uuid": "fae69489-26d4-453b-b5df-d3364878a0b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756867, "uuid": "da1a52e8-7d7f-47cd-ab19-a1732784ec15", "value": "12288:z0hefaqG4yPaVToew7RQDX+gyW+k1H8Q6Fy2Mxzo3:zSeSqG4yPaV92RQCgy5YH8Q6F0xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756867, "uuid": "1b4eb7fc-b972-416a-91cc-ce8c90b1e67e", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756867, "uuid": "a2b3106a-9a8a-45b2-a35f-a286cb9af098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756867, "uuid": "50770d8e-f69b-4063-b97c-5729fe47c187", "value": "QrmkCyChrIFVWYg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b928e4-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756924, "uuid": "3c91b876-707f-4ff0-8ae6-fcccb5569bb0", "comment": "Malware payload (SnakeKeylogger)", "value": "0f602d8a0f87c4674c102afb300657db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756924, "uuid": "6b178cdf-10fc-4e4f-a66b-9b24d4852405", "comment": "Malware payload (SnakeKeylogger)", "value": "5578a126a1312ca70faceaf8a6c189bf1be33cb774958c0107a21a3e262d2e71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756924, "uuid": "98bfad5a-72ad-46dc-91ee-65abc29eec0a", "comment": "Malware payload (SnakeKeylogger)", "value": "7de7e3d769ab3ccf9ba73f1eeb7469ac8ea84843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756924, "uuid": "bd261f63-8158-423d-9c60-12c316d1cfd9", "comment": "Malware payload (SnakeKeylogger)", "value": "d2f690dd3606ce2aecff921be761e2a4e00ec5b185eab394e6d4d4bbf5c190c946d9319de3444429316745720dcf03bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756924, "uuid": "69b70ad6-efe7-4a9c-a7de-316639ed06e2", "value": "T1F5B402987068C48FD5AD1B719C92FA6A6620BC702C985D873F6A3F4E75B1342381D7F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756924, "uuid": "2a5f265e-ea28-42f1-a8ff-038685d5901d", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756924, "uuid": "01a209da-4bfc-47b7-872e-28ca01b097a4", "value": "12288:OYsMTy/BU/i8R7MhG8YEqQMRRmGH5msvpZ3JMg:OYdTysioMhG7EkRRmGHDxZ3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756924, "uuid": "86708738-880a-481f-be38-9b0246323cc7", "value": 501895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756924, "uuid": "06aed207-cb5f-43a9-a9a0-7596295f950f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756924, "uuid": "c364ddf8-a40f-4af2-8402-35eafd2d343d", "value": "CIMB-Transfer_Advice-2023020709400021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4189d231-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675789371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789371, "uuid": "f5165f8d-8c38-4b91-88e6-3b240aca8349", "comment": "Malware payload (SnakeKeylogger)", "value": "f995ee6cf1282fcd570b490a55b17355", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789371, "uuid": "73a9e3e4-d4f1-48c5-b77b-1868ae12c669", "comment": "Malware payload (SnakeKeylogger)", "value": "5589bcfad3eb74dac48659c6353f72b4a3aede02382d92f3180dc895181446d6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789371, "uuid": "60c309ef-bc30-4ee8-a6e0-b5346bd12125", "comment": "Malware payload (SnakeKeylogger)", "value": "e0d2ed2412eb4d09c9a2f05612c01ab93e75af03", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789371, "uuid": "fafccf73-ab9d-46ae-a393-34bbb11c4b5d", "comment": "Malware payload (SnakeKeylogger)", "value": "c178d977dc5e91522b5395ffee680f4d2c9816d9d9d680363b4116178987783cda5314325f36bbc27a833f28285211dd", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789371, "uuid": "98457e47-9196-4fa2-a9ba-90be856a4e8d", "value": "T1DCB47C9395738815F9A3CB7EAE7E49561302AC769F430E0AD410BB642DF3394063FE96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789371, "uuid": "fa7b4c89-bd48-4bdf-9a3a-5da06c855573", "value": "6144:C90rC6zzXaMANkizCBDEk2sG3figF8ESbuQq9c+DS+5T+Z+RwPONXoRjDhIcp0fy:CF935TH8Cuou3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789371, "uuid": "6b50675b-0dfb-44ce-840a-db54def682ea", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789371, "uuid": "86f13598-f837-48ae-8465-9666a5c95de5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789371, "uuid": "aa8c0f97-8d87-4f05-a854-89a73a37bea1", "value": "Swift 52,000USD.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2152cbc-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675761669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761669, "uuid": "d7de2e0b-7aaa-4cad-be14-425431083fb7", "comment": "Malware payload (RedLineStealer)", "value": "c781cb26771fd971e331037800432637", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761669, "uuid": "ed88d3a1-2609-491d-84b7-7ebac88766b6", "comment": "Malware payload (RedLineStealer)", "value": "55d930de42a7b77be3ce4fc6c7750f9554aeec874b883ea43e7a5dc6fd97e5b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761669, "uuid": "69b17d7d-b1f2-44c3-977e-3f1614808287", "comment": "Malware payload (RedLineStealer)", "value": "0e4dea1c49139f26d8fd2804b73f756cd5d4bef9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761669, "uuid": "8accbf8f-183c-44b5-81b9-a5fee32e0e39", "comment": "Malware payload (RedLineStealer)", "value": "1ce3e38c5116da4abf8be7910b7905f345aa27eb8165b402a233bf5e98649589fcfc09a39d4319fd1e8e9ebcbe6beb63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761669, "uuid": "1396ef65-0e91-4bd5-9bb9-680cd42c9dfa", "value": "T1306402223690D072CA6792347864DF956BAFB8311675851F77A803AECF707D0A63B34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761669, "uuid": "f5ea4f49-5f42-44e6-942e-5b98e63c56c9", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761669, "uuid": "e3e88dd7-d456-4b6c-8115-ed6bf0634044", "value": "6144:rHGMxTLH25c3coGh9MOqHmGb3liupxkPOG9A93nCv5y:rHGMxTD2Wcow97zGb11kPz9A9Xey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761669, "uuid": "bafaf4b9-3b87-44b5-97b1-aef6db0d39d2", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761669, "uuid": "2621792b-bd09-478b-923a-ba9389920c4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761669, "uuid": "3f086f21-bf0c-4779-9f1d-df6068e7e480", "value": "c781cb26771fd971e331037800432637", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8239f92-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675761626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761626, "uuid": "cd4f98cf-6105-4619-8e20-1be23468d90d", "comment": "Malware payload (AgentTesla)", "value": "ee38600435b398a0bb695455f97b1dd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761626, "uuid": "75fc7e62-98eb-4e6c-9ef6-6d158f0f6b0e", "comment": "Malware payload (AgentTesla)", "value": "565590afc98c5f16472d915cef468055bc365f76eb37e4aa6a18cd6b17775d08", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761626, "uuid": "d8a09c62-e0c1-44e6-b96a-56cc55dac3c4", "comment": "Malware payload (AgentTesla)", "value": "e5e513988d0148be264f093c575acb430b08e378", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761626, "uuid": "f153b70d-167b-4d8e-9ffb-ea4e7d31b35d", "comment": "Malware payload (AgentTesla)", "value": "6018346fea315db08c55293497afcfb28afce2457010f09f6a42f9ebff1353b7376b7c179c6a02e23b5b2d39d20b9cd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761626, "uuid": "f6a02484-d6c9-456a-9087-63b3275457bb", "value": "T199E4129AD325DDFEDB44027A22B44468AF3126EEF162EB49129F9324C88F31156713FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761626, "uuid": "c146d875-dfbd-40e3-9a68-d02566e6065a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761626, "uuid": "cffbfa30-9527-4ab7-a62e-96834cdabdbc", "value": "12288:+I6Cd1uczEXgAvRmSDYchys+dRdWeh3ih9H1A:19d1uTQKnEchWBYTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761626, "uuid": "15e290a6-031a-4630-827a-01bf9b07249f", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761626, "uuid": "9166a1d9-f56c-486d-8a25-2711723d7d36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761626, "uuid": "ae154379-72f4-4967-b2ef-d5a15cc5ef53", "value": "565590afc98c5f16472d915cef468055bc365f76eb37e4aa6a18cd6b17775d08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7808439e-a6e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675774430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774430, "uuid": "7eb9872b-c670-4c5b-9e85-ad4448f1d24a", "comment": "Malware payload (NanoCore)", "value": "60c8d91adfa30a60afa2f5437ce7d041", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774430, "uuid": "34eea0c4-cbc9-4f27-b326-a27f141ca20f", "comment": "Malware payload (NanoCore)", "value": "5707c702f70cc5bf864e10aaab48f9300e3be0a7892d8faa1810145f0af93d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774430, "uuid": "43c833c6-7908-4b34-ac75-82c70c29ea88", "comment": "Malware payload (NanoCore)", "value": "f8460389f343481d7420073ad1da2f90ddedc696", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774430, "uuid": "ea1f7b46-e811-4288-a2d9-4ebc8e53b5a4", "comment": "Malware payload (NanoCore)", "value": "7383fa339278e0d179ddc1e7348e66db4ce14c9eae56d727b597904e2e2564b7308f876928cd51bcae97959ce825895b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774430, "uuid": "98bc095b-27b0-40d5-a487-978941b718c6", "value": "T182159D5119AB43E6ECF98D7832B8E61826A28CD2476D9D3EBC863D7A8CF370F4451711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774430, "uuid": "db3f272f-826c-466f-9121-d3c0592ba612", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774430, "uuid": "b30d79a3-09eb-4e16-a473-337ea4e05a0e", "value": "12288:77S45nJrTmHkFrVoaqnS/pjpkH7PRNNiJTp/cuP1FRkkYy27YBp7HwcBVw:nS4PkkFr2QJ6HdaTp081L4y2Qasw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675774430, "uuid": "78ab7ca5-1622-483c-997f-d4bc63df4e6b", "value": 941568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675774430, "uuid": "01229f4d-3cfb-43ee-b33a-d9f3ae508705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774430, "uuid": "fa29b265-12ea-4d4d-9cff-180c884fe426", "value": "5707c702f70cc5bf864e10aaab48f9300e3be0a7892d8faa1810145f0af93d2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb7ecc4-a742-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675814141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814141, "uuid": "bedd3e22-7bfb-4092-a04d-348233d5fd05", "comment": "Malware payload", "value": "1dd1f6c343b95251ddee1e1d8481472f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814141, "uuid": "a328c176-d728-41c1-8491-b79c993b1f1e", "comment": "Malware payload", "value": "57101d6adbb7318e5362d0400d24eb666f7aa6457ad161751b22c0147fa22176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814141, "uuid": "3f70f2b0-7e23-47a8-bc5a-a363abc277ce", "comment": "Malware payload", "value": "cae5050c8b3fd8af6ffa0ff4ade0b48621db1020", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675814141, "uuid": "7dd4f10f-db28-49c8-b55b-a0eb27375fd8", "comment": "Malware payload", "value": "09cf71e9c4bd3bfcb1607e22778dda25f6f3f641cd726e6d1f5321d6b43f04181d52f799b5470c2bc0c3ca1e92ddc7bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814141, "uuid": "fb6c179a-a89d-41af-9ad3-717a32eb8d5f", "value": "T129B40217F6DC8432E8F557700CF602D30A367E621A38875B238F6C591D726A8A6357AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814141, "uuid": "f77bffc0-ba03-4abb-9b0f-dffba131ae5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814141, "uuid": "e3b0d69b-5585-4457-a66a-aeb038cdef9f", "value": "12288:YMrky90UGsQV1Pt33YXkTF2f/6T1+u5aRs58aegiwEtDNmy1e2n:cyVaVdt4XkTe/6TlIRsVegiwEXmy1eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675814141, "uuid": "e0f17dbc-3c1a-4487-94a9-1b47c190b729", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675814141, "uuid": "f37e59de-624d-403b-87d9-53f4eb0b693e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675814141, "uuid": "f7b67fa9-af29-44c1-a445-41216c1d3cd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7261d433-a710-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675792459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792459, "uuid": "819f1125-e681-4077-ab09-b8e7c7b9fc1b", "comment": "Malware payload", "value": "7dafeb7bcc8c715cacc78401b0dd82d5", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792459, "uuid": "29a57636-7047-41b7-944c-b736aed29fa8", "comment": "Malware payload", "value": "57541303816885b9f1332a243cd19a7daeecc132edd3c40bda352856b5dd90c3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792459, "uuid": "9c0c26cf-2cbf-4fe8-8d61-bb2df8d0a549", "comment": "Malware payload", "value": "2973d9559c80e4f952623b7a3d5dd39439059092", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792459, "uuid": "8ea41add-f832-45bc-95f9-ffc1c8eee940", "comment": "Malware payload", "value": "68c8261c924dbfa1c83a22bf21838abfb1c5b73549eaa7506494b29dd72aca17206cc9a6dcb3c0ed84256d1645b7981a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792459, "uuid": "f2355ef8-24bc-485f-9072-352054628b13", "value": "T16687335BB2913B45A912F83D55A274EF4A2B343C85142370E78CC2D1E9DF8BD37229DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792459, "uuid": "aa21a568-faff-43ed-a8bb-05094fc82b69", "value": "786432:MTfejjLbrV1n/YtRG86MNldkQn0FmmzZ3BsMh0kyXDYkHzwYXvSjhswCAatd0FRu:aWjjLbngPf6ud3n0MCRuTYk8YpwCp0fu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675792459, "uuid": "7e4fbcc2-32d6-42a6-962f-8c02975a6907", "value": 38963224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675792459, "uuid": "1d2775ce-0191-422a-8063-3b97e2e6426b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792459, "uuid": "ec55ad5c-64b7-423f-956a-5d64170e1c6d", "value": "Petrobras_Premmia_v3.3.19_www.9apps.com_.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefe5cbb-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675757396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757396, "uuid": "f14d3f42-810d-4d37-80f4-425cd5ae8105", "comment": "Malware payload (RedLineStealer)", "value": "ab50c54652b109548d84fe361bad8dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757396, "uuid": "82765a8b-e837-4abb-8c0f-b1c0a9f6ea38", "comment": "Malware payload (RedLineStealer)", "value": "57b5ae8759f3965f4a42268f53a27c1aaf15be3e29df9c18af552d74d4fd0f93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757396, "uuid": "51b4a54c-0f1d-46e7-8e10-beb19e6b1d79", "comment": "Malware payload (RedLineStealer)", "value": "464b27b09c76699b6c799e2d1514fa0605d440a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757396, "uuid": "a11f7bac-283d-4be6-b5c4-ec9a2881daa1", "comment": "Malware payload (RedLineStealer)", "value": "595e0183fbfa44111ec1658438f02d68d87155aec3074778d63e8b789d96af17efeb9cd59013a37c92eeccaea90d5b41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757396, "uuid": "3f882fd4-12cf-4587-bedc-c3c22f8955d5", "value": "T1A564F1223E88D4B1C4AB81345820DB666BBFB5317675D9577BA403AEDF303D15A3A30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757396, "uuid": "5fba6e37-e6e8-436f-9307-b7bf036c7189", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757396, "uuid": "9d8b6af4-c0f9-4979-86c5-1549bea6e98c", "value": "6144:FzqNRLDkri63Lh/mxvseEEobyiGj1YuHKkZ3:FzqNRnku67h2f19Sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757396, "uuid": "eb8274f9-480f-4966-bb8e-f53ce8aa40bf", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757396, "uuid": "5db77578-36d2-4933-aaac-38777836108c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757396, "uuid": "4f08996e-cec0-4a9f-810f-6e0b67c95c39", "value": "ab50c54652b109548d84fe361bad8dd5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b35869a0-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758638, "uuid": "c2eefe07-674b-4534-8a89-0599235a7f6b", "comment": "Malware payload (Gozi)", "value": "47da9676faa255b26d3366fb4680e072", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758638, "uuid": "33f0adbc-e29d-468d-9565-8c5d5ebd3dbc", "comment": "Malware payload (Gozi)", "value": "57dd70ca77b412abaddcf5c920982d0b084bb31830ac1b99c7a4a25b51c2f785", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758638, "uuid": "3e6ef254-5887-4f7d-893c-9ec24aaf0683", "comment": "Malware payload (Gozi)", "value": "9a6248bec95477314c5ef02d4314b43fd7775b60", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758638, "uuid": "48093f0c-7a42-438a-b201-b0ed5cc18ebf", "comment": "Malware payload (Gozi)", "value": "b56c63917ad6cb67c6d7f670711c0d09b361ebd923811380139c3206d0e84cbf35f2268f99706c2b88cb2a76d5cf1bb0", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758638, "uuid": "dac863f3-df01-4f57-9ca4-1596f5d40482", "value": "T15DB18D84CC8F51F34FF8980071A4F6ACA223969586E3D75F8BA943962D713AC4B825C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758638, "uuid": "6b9f82c4-5ffd-45f1-a14d-801ca54bbb64", "value": "96:0/oeLOVYykGiJpygdxWgvzlqi3r2ekId8FNbTtyFuOXys4wF75zYMvwNFnz:0/JO4Ldo6lT3r2ed+TiuOCs/F75cHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758638, "uuid": "18f10f3e-0ecd-4e8c-9bd0-cb645de76bb9", "value": 5090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758638, "uuid": "702d09a2-a29f-426a-8ccf-df1738944b65", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758638, "uuid": "39b4a1a0-7630-4e65-aee9-208e03db2dae", "value": "azienda_21.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d283e2-a705-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675787630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787630, "uuid": "69cda789-1530-472a-bb0c-d500536460ea", "comment": "Malware payload (Mirai)", "value": "def915195c2e507f8d26dd3e0ff8913d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787630, "uuid": "693c01dd-2bf5-4529-855d-29943a3f7485", "comment": "Malware payload (Mirai)", "value": "582f1d4857de6c3507b98f97b650523b72e032291f51aa10a1c5112bd2ccaf5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787630, "uuid": "240f1271-c22b-4908-b0cb-b144c499ac71", "comment": "Malware payload (Mirai)", "value": "ab7b5bb78de8381d50ec33a05a6a221ed18f320b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787630, "uuid": "ffe20125-e7fe-4b0f-b3b8-4ad4ab42feaa", "comment": "Malware payload (Mirai)", "value": "643740f46a982cc62d7edd62d8fa70f4738d7778ff83c8a0dd760e02e9df229d266bc3a306298312422d23dffb48881c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787630, "uuid": "da27c185-73a1-41f4-b513-c87f6b16e36d", "value": "T11A435BC4F643D8F5EC8705712077FB379B72E1E922A8D643D3B4DA32AC52651E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787630, "uuid": "6d126283-7ce6-42bd-aaf1-1819b17109ab", "value": "1536:JeESt/basV2rcZhG6+KN7Tqa9qpFzWOIaEjrqMZs:JeESt/basVTgW7Tqawp9tXESy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675787630, "uuid": "7b356edd-5066-4003-8015-05cdfecb5651", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675787630, "uuid": "8976cfc1-86e2-4dc3-b618-164cd14819eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787630, "uuid": "3e796504-0113-46ae-bd74-71e7263874dc", "value": "def915195c2e507f8d26dd3e0ff8913d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48497b75-a6ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675777786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675777786, "uuid": "faddecdd-d768-4aa3-b6ce-b31c990fba8b", "comment": "Malware payload (RemcosRAT)", "value": "84ad5293451e2219d11dd0e27bda0bf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675777786, "uuid": "e80d57bd-4164-4b71-af8d-9468d13bc0fa", "comment": "Malware payload (RemcosRAT)", "value": "58322bf1b559e8ff51bfc5c0215f4fbd4ddaf1046d5ba0fa5d01d82a96323bbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675777786, "uuid": "c731f699-5acd-41db-9f4a-b8e2bd7f673c", "comment": "Malware payload (RemcosRAT)", "value": "76c3fe9f4452e67c34a73bc82510454643c0d35d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675777786, "uuid": "bf1228bf-12af-415c-9b99-bc5927453727", "comment": "Malware payload (RemcosRAT)", "value": "833f8e7c8a4d4b6fd8f36a31bc11662e9b5598bc4ce70fda1f6e9bfbb5c2be5c5181d14c09e0e7c64ba6491a35666207", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675777786, "uuid": "e97dccd2-4780-41c4-8ee4-d25ada1125d6", "value": "T19D95C0710287BFD6E35B2E44A0092E405C6B5C876F38D6E4F9C9346F99F127CEA99930", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675777786, "uuid": "b23ebacd-67a8-404e-b119-2f816832db66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675777786, "uuid": "e9d380e0-abee-4dc8-8e8c-941ad4f0edd2", "value": "24576:RaCFzjMHjl2sE6Obc2d5kZ0Z72lCtV7TxGpn8mGBQK69U8O2Zj0f+6xtMoZzvAuD:Rje5EVbH5J30dUgj6438qo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675777786, "uuid": "04174323-e0bc-4815-b369-b75eddd84fb1", "value": 1936896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675777786, "uuid": "adc92b4e-5cba-475b-9f1d-0dbb78852167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675777786, "uuid": "39510d2b-d753-4e4d-bad2-ee939635b2f1", "value": "58322bf1b559e8ff51bfc5c0215f4fbd4ddaf1046d5ba0fa5d01d82a96323bbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34f2c1b-a67c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675728976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728976, "uuid": "bd026511-02a5-4086-bd51-d3ca224e5909", "comment": "Malware payload (Tofsee)", "value": "fe041a63df2b9558f2247cb6f07f97bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728976, "uuid": "ddb50315-7af3-49b0-8ec4-d3a2fd868c1f", "comment": "Malware payload (Tofsee)", "value": "585707b6537eb783c58cde2b84c84a7741eb129b885aba9ff7822c2345f39362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728976, "uuid": "8b34ac9b-98cc-48a1-a741-f7a9362e8a74", "comment": "Malware payload (Tofsee)", "value": "b772f20c7ea8d3655e64717bdc82cbd669d7ef65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728976, "uuid": "eade5cd2-8043-4d5d-b9ef-81757e6d52f0", "comment": "Malware payload (Tofsee)", "value": "5f9b7b268e995a3547cb27c074f46c6da203e9cfdaee3123026a95ca3c744506ba7e8da5fe2cf8fec7ac348531ff8620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728976, "uuid": "00ba77ac-d20a-4585-b95d-5d4ebeab0b7c", "value": "T158644B43B3E1BD44E9368B72DF1EC2E87A4EF9408E797765221A9F9F16B0072D563210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728976, "uuid": "0047c028-a563-41eb-a9cb-1d11fc1af86f", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728976, "uuid": "9594da1b-c7fe-4585-806f-74be97c5a3f6", "value": "3072:8Lb6bfTL45RmziYvPtd7Sj4yprPD0uQjiMTE59W2Hva5D:4QTL4+Oy7orIuQj9UHva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675728976, "uuid": "796f1939-3e15-4e72-b374-579f2103c475", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675728976, "uuid": "a3d725cf-ff98-424b-9ba1-e18921aafe0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728976, "uuid": "828e3242-c339-46f6-be29-34b5bcb23b91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a63d90-a6e7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675774720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774720, "uuid": "5614ece6-29b3-4356-9508-cacd6bd10e21", "comment": "Malware payload", "value": "b44d31bbea36fded086dc92b8aa8785e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774720, "uuid": "53180102-9026-4a31-a1e5-8bc61162027a", "comment": "Malware payload", "value": "59a73181177f550d27e3c2582c7942ea0f193311be0ab7b324334f0bc6de5835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774720, "uuid": "b0fe5b98-b178-4527-8b55-d3e6c5684cc8", "comment": "Malware payload", "value": "77ea346238b7fe2dd1337d26c0b2db1fde4d257f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774720, "uuid": "621694ac-a912-42e9-986d-cd04fac09d66", "comment": "Malware payload", "value": "899d20ef2859bbe6952406891f0c903fed32c70c8904f782116c1b8704f656b3c987fe45a3edbcb3dea96d3445c8e5af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774720, "uuid": "b644ad6f-9f5a-4c3b-8206-08ed8ea6ce20", "value": "T1F54302497A5E0DF3D6CF5638628FB39D5B489730C786E1146C14116DAF426E46F2B1D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774720, "uuid": "adce1fa9-628a-414a-b2db-37ac781e1566", "value": "95e71cff07f4a18cbb53b590195f742d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774720, "uuid": "89d3dc36-f66b-4487-bbf6-e5cc7435478d", "value": "1536:U9TGV2aFyfvoJfoFAZ9rWymWFkzBjHARUQe:U9TGQaFyn4oFAfOWFkzBlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675774720, "uuid": "a4932689-3864-4003-ba71-df8f34c81a6b", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675774720, "uuid": "7e7864c6-3c89-4fdf-8347-cd9053847ca1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774720, "uuid": "99e706c0-483d-490e-906c-b448d220d09f", "value": "59a73181177f550d27e3c2582c7942ea0f193311be0ab7b324334f0bc6de5835", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d210c30-a701-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675785954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785954, "uuid": "9f2d585a-dd92-4061-b497-be07d3d91426", "comment": "Malware payload (Quakbot)", "value": "46808efd5331489a931e51792623caca", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785954, "uuid": "8cc9f938-8f3a-47b9-bb1c-dbfb5b86cabd", "comment": "Malware payload (Quakbot)", "value": "59f42ecde152f78731e54ea27e761bba748c9309a6ad1c2fd17f0e8b90f8aed1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785954, "uuid": "3570ba59-f7f4-4d28-aede-c6f64d737a91", "comment": "Malware payload (Quakbot)", "value": "1e7e75bcee397e9c447edb7a7a20a5c81eee8a87", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785954, "uuid": "7d6242b6-dff8-4dd1-b536-d3b97517a8c8", "comment": "Malware payload (Quakbot)", "value": "91cdf67b56476a64ddae0eb89a8c66060345bdc71dbde91b7ed053c93fb8f928c2a20fcf683c2c52095681cf560354f6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785954, "uuid": "03d1c6f8-04af-4ce0-8605-7af02ac19ece", "value": "T10F35BE5173F5C845E0BB1F3879B987955932BC70A939CB0EB642BE4E1A30B80DE65723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785954, "uuid": "430eb6bc-7da0-4f07-95c0-2eb360ac7332", "value": "47b25cab4d220854dcb1268c5af427d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785954, "uuid": "32d74dc0-1cd1-4c3d-baa4-0573ed139bf5", "value": "24576:oYwf5ZRmacuzNSmFa10450twvOUqEB7PBd3X3m+r:WcCzNfveyUdPBdH3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675785954, "uuid": "352a47b2-27ea-4f3c-a08b-bf7d6f318811", "value": 1066136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675785954, "uuid": "3012071e-c0a1-430d-922c-152ace1387da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785954, "uuid": "c3eea970-adbe-411c-b3f1-a970439b102a", "value": "bb14.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa0d4a2-a703-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675786809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786809, "uuid": "6901066d-250c-49d0-bdf7-009490cc2c55", "comment": "Malware payload", "value": "c6ba1a7b2b90e18b6c25382453370169", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786809, "uuid": "779b9a68-a1fd-4e97-adab-90ccdaeaaf21", "comment": "Malware payload", "value": "5b2c5889d8004f48abd37cf66eec91153eaa3a84514ab4ffdf4ee99e456dbbf7", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786809, "uuid": "af9cb362-b6c4-49df-a918-86bae675c927", "comment": "Malware payload", "value": "598a0bb0ffe807ebdd38d4ef943d3d694f186a5a", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786809, "uuid": "3f6025a5-55e9-43ee-bb85-b2cea02c8282", "comment": "Malware payload", "value": "3792396836401c5e9e279764354c794fca65720343c31ac897c086fd9e8d33c7c2cabd84ef85b4493317699d7ad4ecdc", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786809, "uuid": "8aaacd38-ecb1-458c-b402-47c988dd4ae7", "value": "T1FC516A3D2211D99DA9B3AA3BFCA87F34505AAF63DDD06BC80435845B26E1571720839B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786809, "uuid": "fee39a8e-6200-491d-b3c5-081794ea5053", "value": "48:sahoFeaqqsfrZJA3uOKNnSgieUfkHySgdS33qI8OJN/ZGYKHutF7:saeeND39SZSFHUYKH8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675786809, "uuid": "0a43f00c-f859-4e14-a208-39c4b1c2b314", "value": 2458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675786809, "uuid": "38667134-ea24-431a-9d8d-882c02166885", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786809, "uuid": "8cb21ee4-7280-43d6-81de-d5fb7a0f63b0", "value": "Review.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77926f6-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1675790025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790025, "uuid": "67f110a5-d93c-4dc2-b53c-9cd70dcce90b", "comment": "Malware payload (Vjw0rm)", "value": "5f8b36eb5344031a80d596979dfa752c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790025, "uuid": "b0c76325-3622-4f93-886a-dd43da1c7f6d", "comment": "Malware payload (Vjw0rm)", "value": "5b7fea2fca7f3dfb0e55d4bd6c2c6bfaecdb27c02b2f4e17ddac4985278571d7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790025, "uuid": "8d2b8419-1a86-4917-99da-a4526bfe32d3", "comment": "Malware payload (Vjw0rm)", "value": "d9490cf67b33b741237efc63ff56e1b0d8ea36a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790025, "uuid": "905682d5-57c3-4e92-b90b-f3fff7cbba97", "comment": "Malware payload (Vjw0rm)", "value": "f0f78a9fb2edb03d691800192a95bf0e9c2001c314872b1cf9fb549b6356f51e24d6debdcd44552d55415470c362dc7b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790025, "uuid": "61ed9c94-d357-44bc-abe3-85c2a0c0358c", "value": "T1CE469BC91566B5126D0D77F0684C48F62C2F479B00908E71B86CDA7EBFEC22E89E46F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790025, "uuid": "1a88652c-33ed-4fa6-af14-26eb44368bc1", "value": "6144:K41FAmzRqqfadNrdpM66w8yZKTnDC/K3jKkAw41Ue/3tzs/BXACA+HxZjD3I/SVc:/dLyNrdaMvk46efBs5wCxBDTDVCg3vb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675790025, "uuid": "0d0f49a0-66dd-4082-908b-6f18cf633b7f", "value": 5816621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675790025, "uuid": "7c132eb2-ad07-4241-b125-e8572814ea68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790025, "uuid": "65a5e7aa-8036-4b41-abd2-6ebad7c6be7e", "value": "RFQ -F7 AIRCRAFT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa3b6ff-a6c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675761818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761818, "uuid": "5760c5cc-b575-45f8-9afe-bffa9716b8d3", "comment": "Malware payload (AgentTesla)", "value": "5fb780707e7d1d6add3049815f17d7d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761818, "uuid": "891882cb-d265-4324-803b-59e0656c3acb", "comment": "Malware payload (AgentTesla)", "value": "5c7b3fcb46d002d14473ea26d4a10f50a21afca36d0b6faaf01014da03105aaa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761818, "uuid": "ce58731e-2ddb-4fe9-a11a-c348086a2bd6", "comment": "Malware payload (AgentTesla)", "value": "5a9a13449bf8b0fd3f48b08b70f22778c1948926", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761818, "uuid": "0123553e-a4cd-4edb-96ff-8c8506bc9379", "comment": "Malware payload (AgentTesla)", "value": "0b95c425afad525498aefe2bc66b37969b47d0f4ed1ad3725233a680dbb89aea5f830fc7802f019984b5c8289e8644b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761818, "uuid": "f7cecdc4-9ba1-4fd1-9de8-d09d30d99091", "value": "T1EEF3292892955F12D72D40F4F4B0115807BEA2424617E7AE4EB0ACFE3E4A7D3F62F865", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761818, "uuid": "d01b92e7-bdfe-40ee-a742-6697e32dc73e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761818, "uuid": "f29e6146-9d74-4b45-af58-5d8d5c1cae4a", "value": "3072:oANX60/DvzyoBV7r60RE6b3qT+un8xgtLkEQ2k0JD:h6G/yaV7Gi1i5kgtL7QBQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761818, "uuid": "8a26a3af-b291-4460-aa46-9f86a78b6b42", "value": 168960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761818, "uuid": "d28f88fc-7c4d-4b9b-9fd6-b1090e5b44a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761818, "uuid": "e3d1b88b-d4c5-47b3-8cd4-eeb83cae1836", "value": "5c7b3fcb46d002d14473ea26d4a10f50a21afca36d0b6faaf01014da03105aaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ee0b30-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758698, "uuid": "b4ce524f-75c8-4e48-b422-e9487862bbdf", "comment": "Malware payload (Gozi)", "value": "3e85421f21e81cbf199121ef834b96d3", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758698, "uuid": "c4dc8256-9d9e-4ec4-962d-6bc2423f4378", "comment": "Malware payload (Gozi)", "value": "5ce22d2d30b4bc32e23c1cb5c45e71d248249d482e1e51621cc6b7638dfc5b48", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758698, "uuid": "03e6a4d1-4686-4e68-b0aa-aa5a0479a75a", "comment": "Malware payload (Gozi)", "value": "45bad1eded2d47a32c245dbc66213112cf7c3f05", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758698, "uuid": "c24127a5-b2b7-470f-9acc-1c135b97ca95", "comment": "Malware payload (Gozi)", "value": "a9a449c90104a9da4c33146192ec738c1f3dd81dec3b05ecfee120b338be6ef42fb8baccdfdcf4878fea14491c98a94b", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758698, "uuid": "ef1ed1a7-5640-48a1-85b6-3b83acb210bf", "value": "T1B6A18EC2F0E59612B6DCE0204D7F774538C9A67738BA517E99C8D020363286406DE7F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758698, "uuid": "22d42841-3924-488d-9979-8058002648c6", "value": "96:fg56hTzT2eCgFIfVYKX8Ub/s0F5lpXVSE1wwKOauLrILBPjka1aSlpe0HTxcK9h:ZL2eXIfWKX8Ub/tSE19KOauLYBTjySxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758698, "uuid": "70f1a96f-9ce6-46d5-95c2-d9303a5a8b2e", "value": 5076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758698, "uuid": "48096cbc-6c5d-4d66-b8a8-37d95710286f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758698, "uuid": "be0139bb-1ead-4d55-b548-eab77b1f5059", "value": "azienda_32.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc45a7d8-a6b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675753929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753929, "uuid": "0f66cfa8-831a-4f0b-a746-737026174c1c", "comment": "Malware payload (Amadey)", "value": "3b43ea908c71c8c626d43d6c8c89d1ac", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753929, "uuid": "dd7bf958-16ce-4281-a5f9-971df57e190c", "comment": "Malware payload (Amadey)", "value": "5d2a5f6f3863c72f5fc49a306e28a6f62de53247d503ed9338876937bf0ddf90", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753929, "uuid": "46217143-b91e-4f9b-b610-63f69b1398a7", "comment": "Malware payload (Amadey)", "value": "2e321f176461a7ea30630f9b1da2968ecc7e8c25", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753929, "uuid": "9b3b48d3-a31f-4f67-b967-7eb2ac7fdf50", "comment": "Malware payload (Amadey)", "value": "bd9968cf36496c25408392fbea1bab053175b5ec204b752432d62b30bd085c6a95d0356de5fb2494067ab2dc170cdf52", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753929, "uuid": "14d6c61d-4e8f-4a23-b9c6-a9dba3a00d4b", "value": "T141B4014BABF88176E9B15B3059F743D307367E616A74864B278FAC5A0C72270B630727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753929, "uuid": "c415d09a-22a0-4e97-a13e-2331a87a98a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753929, "uuid": "c644ca98-3b13-43f0-8b8a-76dbc1474e57", "value": "12288:mMriy90uE3+qaX96cvqAa7jAQqj74LhcG4f2lqKhFDr:oytERavvyvAQG4Of2lqgFH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675753929, "uuid": "753d232e-6145-48d8-8a2f-508871197c04", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675753929, "uuid": "406e6a3f-ecdc-48b8-a046-83f659ac7e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753929, "uuid": "3029a575-1fc4-41ba-8227-51a6ecf3ae74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ac6b84-a69d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1675743039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743039, "uuid": "0a218f24-f75e-4b52-b477-99d346386a3b", "comment": "Malware payload (Vjw0rm)", "value": "c7b0633dd0db084edd9264e1bece25f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743039, "uuid": "638e8b9b-6c5f-47b8-a406-e34c8c6b348f", "comment": "Malware payload (Vjw0rm)", "value": "5d85139835dee61ab951d98035d73d72a6e6f732b8974c261fa19c6642d47dd0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743039, "uuid": "4aad4269-3b5d-4504-819a-9f6907bb6491", "comment": "Malware payload (Vjw0rm)", "value": "acfbc379e088ff2e65f394cc8c861192abed8117", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743039, "uuid": "a44a4ee8-ad01-4beb-bf5c-20c503ee95a8", "comment": "Malware payload (Vjw0rm)", "value": "cf47dccca7a6d498520bf59928f26ddcd7a679a3de511a407c9ab3532ec6b6e2322971686d6928783bf907bb3751325d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743039, "uuid": "6fa365a6-7b9f-4173-8414-c8048a9958bf", "value": "T16F0692D8BB85D8036A8D9D836F56BEE5517AE2629FEC32C7D5A83FCC00A85C34451CD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743039, "uuid": "46f770cf-f1ef-414d-a7dd-e02c3d1dcc26", "value": "3072:qrYedmaAO8Or8YETkPjuYf/J4foavMLBjqybnW80/ng7sdiiQzs1ekLQzFCDUrWc:G6R1xQqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675743039, "uuid": "403b5054-7225-4838-85c7-1cf4359cbbb7", "value": 3958039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675743039, "uuid": "05110949-fa3f-49e4-8c69-3c7df3fd60f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743039, "uuid": "10784eb1-b89e-410e-898a-577afdf8ca9d", "value": "KENBAXTERCLIENTCOPY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "458b44aa-a6a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675744281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744281, "uuid": "2bab3627-3dd2-4f0a-a3de-4fff76e51894", "comment": "Malware payload (RedLineStealer)", "value": "f342435a8afd4f8f5e995b3ddda302d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744281, "uuid": "0ad0ded8-bb20-4916-843a-68ce1685c3d7", "comment": "Malware payload (RedLineStealer)", "value": "5ec9de28fba96485bf91582b0629f85a95fe77a5628bb598ac4137cf4b2319f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744281, "uuid": "525eab59-5d92-466a-9b7d-a72f545abfe9", "comment": "Malware payload (RedLineStealer)", "value": "033d12cf789b945584677303564773657a5d776c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744281, "uuid": "608bac74-1b87-4ffa-98f0-292165f8d782", "comment": "Malware payload (RedLineStealer)", "value": "f5eb72c652508f99997ef01dffb43defc9898a668891d5d51c23ef83ed1bec3a5e9b90474ecef82a68202b5d2b31992e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744281, "uuid": "00bb542f-518b-43dd-becb-4e6f32c8268c", "value": "T1CF848C4393A1BD44F9269B72DE1EC6E8761EF9408EBD67753218AE9F10B0072D273B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744281, "uuid": "47d0a39f-2e7a-40ff-b390-97b148a0362d", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744281, "uuid": "73ab9d70-7690-40e5-9009-ef42331971bb", "value": "6144:miSjLInS/WKYbxOg/eWzDYMwMjBix5yMVzu7gTpuQj9WgaL:7McpxOXaAM0x5yiRlj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675744281, "uuid": "3af7e3c7-6260-47f4-b896-70ad2dca2b85", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675744281, "uuid": "2a81859d-1395-429d-bb92-95c37ffe1291", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744281, "uuid": "69855a6e-7d3f-4aab-9fe9-de733c08d1de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caae721a-a6c3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675759536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675759536, "uuid": "ad58947b-6f75-4b0f-b14b-26b79027338d", "comment": "Malware payload (RedLineStealer)", "value": "16223b9c625a57d26bb5315d2b8af0f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675759536, "uuid": "6611c7a1-4c54-4a57-a864-2df385a0bce5", "comment": "Malware payload (RedLineStealer)", "value": "5f7e979a53d8b78267258ee24d9ce34952da71f19f83e2086fda274464bebb74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675759536, "uuid": "d0679b80-7f28-4aad-9cb9-c9d62d25f2c7", "comment": "Malware payload (RedLineStealer)", "value": "e324cd870b53d414785ef78a8d9d71eeb0d9948c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675759536, "uuid": "32ea1a83-d8ed-40a8-b90f-d57a6dba40b7", "comment": "Malware payload (RedLineStealer)", "value": "04de5650c84f14e2b72cae2982bfd570a80c440f18e433eb11e54f4dce50e839ee2b8c4e915f2371a09368b8d5385925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675759536, "uuid": "6e6a7ebd-26c2-4cc0-a937-988668bc6c45", "value": "T1846402223990C0B2C5A729705820DBB62BAEB4310675DA5B7B94177DAF302E15F3F34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675759536, "uuid": "832ba5c8-fe88-4f94-8ab5-f354584f7f60", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675759536, "uuid": "869c30f3-c1a6-4e7b-b7d7-e67736f8a9c9", "value": "6144:NjvyCQLR0CmpPX8qNrfV3KGnCAd0QOztpZaiyVsb:NjvyCQaC20qNx3KiG5ZaLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675759536, "uuid": "8139e4c8-302c-406e-bf2f-9d1a93e9d7dd", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675759536, "uuid": "bbfac90a-129e-4944-9567-99b09089fe8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675759536, "uuid": "f5ad6c84-b4a6-4bb2-bac5-82970aaf3f43", "value": "16223b9c625a57d26bb5315d2b8af0f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855f3a65-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675788196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788196, "uuid": "f575577f-9065-4067-9e40-e6ca9e531de9", "comment": "Malware payload (Vidar)", "value": "e1ff355c4fdc145734699be5bd6f672e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788196, "uuid": "ca39e9d1-7021-41ee-8434-ee3a1fd1ff94", "comment": "Malware payload (Vidar)", "value": "5fa0dbec65fd8fed68161fafee9abb7217a6ff17ff7dade962983d6fb97addb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788196, "uuid": "a69556da-76c6-4051-b836-b62bb2a7403c", "comment": "Malware payload (Vidar)", "value": "1b6ce24b30adba3beceb2abaf1f52260a47708cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788196, "uuid": "8446ebe5-ea02-482a-9583-b228f201a61d", "comment": "Malware payload (Vidar)", "value": "a31857c074dd8656dac11ff2d51ce861d4778d7bab1fca575537de568b7bc4351598ceed64e390d4680b9c2b5c2f3163", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788196, "uuid": "ca868d1f-c4ab-48a1-90fa-a0bb34e4316f", "value": "T10156122763655061D0E68839C53BBFB1B0F913376781A4B7B7FB2DF52A110D2A226E43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788196, "uuid": "0ec02930-395f-405b-b36c-8f7de96a6c10", "value": "dec71b085dc5a08706fa389ac5f0718d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788196, "uuid": "647cc562-daf1-4b4d-b86f-d65a74704e5d", "value": "98304:K4D3yR0GMXM9x2Gp2qVeoJAYyFClDOSAJBZO+os/ATYCVN/4AINYYh3yQdS:KAo0GdblrJAY55OnT6sNC/45Nxzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788196, "uuid": "7b4f74ae-80f3-428a-a7dd-1679217340c5", "value": 6144000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788196, "uuid": "ce3b5d12-d502-4d57-86d1-6481f2c5c713", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788196, "uuid": "4b378c16-fc17-475f-9cfe-7b21213b446c", "value": "5fa0dbec65fd8fed68161fafee9abb7217a6ff17ff7dade962983d6fb97addb9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ba5980-a70e-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675791822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791822, "uuid": "501f9ea4-b187-45e4-866b-5ad8b62ad7a0", "comment": "Malware payload (CoinMiner)", "value": "025f5fd230c30937378fb225020ec75a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791822, "uuid": "596aedd2-6d5a-4a40-95c1-201ede97f988", "comment": "Malware payload (CoinMiner)", "value": "5fabfec938887d35334e82b406980f9d344024bcf3f2bef0ecebfc118a983ea6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791822, "uuid": "0f88951b-c8e9-42c7-be02-38e078c0fab9", "comment": "Malware payload (CoinMiner)", "value": "574590e7d063a5d4001f8297eb2bd6e35a051146", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791822, "uuid": "f7af569e-17e4-4ba4-a2f4-2ed8097c17f2", "comment": "Malware payload (CoinMiner)", "value": "93a6356cd748478f8ae3655b9103125f02e05b3a9ad2f62286ac6b9f3a3152154537852784756e2f527ed9faa50910be", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791822, "uuid": "c4c2da70-b417-4bb6-a266-e3c93ab85811", "value": "T12EE55D0BB6E244FDC09AC830471FD553BE7578994221797B3684AB302B67F609B2DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791822, "uuid": "c5ef69e2-55ad-475d-9b9c-5dca0c455f6b", "value": "49152:z50wO3NhgU0zT66Hb2+0ccnLNoXToBHDZPElwvsZxftvroFycy/AX9j6zx7XBWTc:vO3Nt0zpHb2+0ccnLNoXToBHDZPE+1BK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675791822, "uuid": "9a601b74-2dc1-4ff0-9dde-7c60c27af95f", "value": 3088984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675791822, "uuid": "b7d7912c-2a68-4d09-ab3b-359b860b7ad4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791822, "uuid": "6ad67a11-f97c-4ddf-a827-08c23bbc9c4b", "value": "5fabfec938887d35334e82b406980f9d344024bcf3f2bef0ecebfc118a983ea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ed0680-a73e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675812167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812167, "uuid": "bdaeab22-afa8-4061-bdec-0c14dd27f428", "comment": "Malware payload", "value": "a1855f2ba0179e3f10fab3ecd4032cf6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812167, "uuid": "38608043-46b4-4e20-ba78-b3f2e7635e48", "comment": "Malware payload", "value": "5fb7f3fac0a9b9ab243ee642a0775500c524166ef075035c9510ccbab76ad633", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812167, "uuid": "bf92da63-1900-430b-b977-9a4f3f37ffdd", "comment": "Malware payload", "value": "7f680c032712170a75ff1a12f646dd94b318f627", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812167, "uuid": "86e0e38f-2f2d-46ff-8c10-a0a45a845b8e", "comment": "Malware payload", "value": "f607a3a1fd9d609d3aa921dc1636e1caf4dd89ec23446876ca82717e67b37fd90b4582ef9ac518cb3fee918880f2ef7d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "installer", "colour": "#FB677E", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812167, "uuid": "2a06d475-a424-410c-b92b-aa63d2f65e99", "value": "T186E39D83F9D1D6F1D47E2A79847A93500B3F2A109F16CCE7239912641F660D26F72B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812167, "uuid": "6b301363-33e2-402a-a976-1053d917048f", "value": "6652f1a4d5005cb50ad0e122c1bd7ba8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812167, "uuid": "412618eb-f414-472c-8341-0e9c9bfdf03a", "value": "3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675812167, "uuid": "a3b37742-5810-47f7-a77a-d5c6f61a25fe", "value": 151360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675812167, "uuid": "12fbbeaa-4584-468b-a943-1a6c57d1f178", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812167, "uuid": "9741cf06-1897-4c62-80e5-59fc69b05a35", "value": "big.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e71437-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675789274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789274, "uuid": "e555ee49-3513-4ffb-96f8-7493883e3ff7", "comment": "Malware payload", "value": "368215a43ab9d73ba350102662018645", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789274, "uuid": "92548018-46ee-464c-a36f-182d8716bd59", "comment": "Malware payload", "value": "5fefb2ee55c0c90204e33dbc06b98fb83c1269a8db289ec31f1acc2a87fa9b4e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789274, "uuid": "17cfc270-0ba2-4657-9148-a43e55e72626", "comment": "Malware payload", "value": "5f68ba6a009f47194f19958e162880f6a0d3bd8e", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789274, "uuid": "e68c058f-80c0-4751-8d95-cfff8d27b7e5", "comment": "Malware payload", "value": "5314346f35435e00c9c1332949811a443861f77d3d48ef5a9176d507de5d9b492d57d216a669d03ba18b84cb3d92633c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789274, "uuid": "c6c1d6c1-47c0-4d82-9f51-d65c6d514114", "value": "T17835E007F177ED2BED27C57CE84F648282029D7A9955CB4D2182B32F8632BF0193EA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789274, "uuid": "18ca1c55-3f7a-4a00-b224-171fc112307a", "value": "24576:JFe9ySuw7SeFe4x0FGYsaeU2iGUJj8raEvgl:beyPwO+30/sazJvJjfLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789274, "uuid": "f8c31b36-39d8-438a-9c69-95eb93ba3c7e", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789274, "uuid": "5ac77005-4970-4bac-9619-202a9bb82d8e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789274, "uuid": "65456bf3-ede7-4913-b233-3543f52f2555", "value": "New Purchase Order ORD-1268PS-IMP-253.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70cf3c57-a713-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kutaki)", "timestamp": 1675793745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793745, "uuid": "4487c825-6d0a-45bc-8f61-115395ba197c", "comment": "Malware payload (Kutaki)", "value": "48b4adffdbe0a5e704653fd7a6cf5a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793745, "uuid": "83fe95ad-0645-4483-8e63-f7c35b7bc1e2", "comment": "Malware payload (Kutaki)", "value": "600ed7173b9c1cc4a9d5c058d7079d742854b5a2a010403ca4e36aa5e8b457d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793745, "uuid": "5aced2b9-db75-45fc-af5e-312c6873ace0", "comment": "Malware payload (Kutaki)", "value": "ab735248496ead4be59f20eedc4e983b2edb8912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793745, "uuid": "859d64c4-b8ff-4f51-a10a-ba96ffca82ab", "comment": "Malware payload (Kutaki)", "value": "3e37f0074145b35c1cb9b0d31a0ab80d4a82b404d4f58d51bf54091d336be3f7e93d4d63efc53573996cce3968acface", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793745, "uuid": "99c30773-d98c-4d93-9580-98465e194d38", "value": "T12E358D33EAC0A406E66351B34CB653B914112D7581094D0BB3CAAF5969B3AD3EDF632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793745, "uuid": "15d68245-d8c6-4ec9-abcc-b6fd816bbf44", "value": "d05f235ab4361da42178be81d9f5db86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793745, "uuid": "b9948dbb-d97a-45ae-9686-af8dc70baaf4", "value": "24576:AvPS/SnugUM+4Zt5lWfmP/UDMS08Ckn3Y0:AvPEwug1cfmP/SA8No0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675793745, "uuid": "ed63e5bf-ee05-4746-bedc-ea6998d1aa98", "value": 1062098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675793745, "uuid": "4192ab8b-b0f7-4477-96d9-06732dcee2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793745, "uuid": "49c26a2b-62eb-4c5d-b363-fa4df459f5fe", "value": "Tax_Payment_Receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7516e6a-a690-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675737707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737707, "uuid": "31bbe3e1-19e7-4a47-9f3b-72581efb393b", "comment": "Malware payload (Tofsee)", "value": "f39c23e01b50e97b9be6b2eee432e696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737707, "uuid": "2d88316d-f413-4007-8e44-afde470782b3", "comment": "Malware payload (Tofsee)", "value": "60c32223f5aeff7391c5d42a614967742da61c2379b52c50934b03f91b35e897", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737707, "uuid": "b8f2a12c-6ee7-4533-871c-f126fe322410", "comment": "Malware payload (Tofsee)", "value": "0bf245d40e951083f47298a57ae5f6ff1a8c917f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737707, "uuid": "b6461658-e071-4643-8b64-29b178917211", "comment": "Malware payload (Tofsee)", "value": "f8992dda08df478a2c25d9a1a92984ab6cdb0a1151603537b1a33e95fcf4154ef0c8e7d1eaef3f2f2f243bbb69cec401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737707, "uuid": "55a707d2-416b-4dc1-a0bb-13f2e928501b", "value": "T13F645C4393E5BD80EA278B72DE1EC6E87A4DF9408E7E7765221CAE9F11B0472D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737707, "uuid": "16baf2d7-8d1a-47c8-a7e5-5ca543cd0958", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737707, "uuid": "1a4648bb-1b7a-43d3-92f0-b989521b0746", "value": "3072:/Pb6b6BLo5nRmQ+3wM2ABSuq6Y6eiiDRbgvisCSnWuQjiMTE58NfRa5D:HpBLo5UQAwMLLnDmRbgviPuQj9HRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675737707, "uuid": "fc1d5955-cd78-4e05-8e0b-da954622d5ba", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675737707, "uuid": "99f33190-018d-481c-bc27-534565d37838", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737707, "uuid": "ad2814a1-c49a-478b-9fd1-363eb193adc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f9693c-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675794202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794202, "uuid": "1a3b016a-4821-4735-a32c-8efb76c22f53", "comment": "Malware payload (RedLineStealer)", "value": "291671ad5ac2ae405dc79b1f5fd367dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794202, "uuid": "1f910218-5027-457e-8ff8-8a36bfb9c277", "comment": "Malware payload (RedLineStealer)", "value": "6185e2bf6538d94b71a527a57d16b4f4576e1b2bfefa852258e73ff97068525a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794202, "uuid": "fbb95101-76da-440e-ae8f-ac6d32e645df", "comment": "Malware payload (RedLineStealer)", "value": "952a10c03ace9211b2d128fd21fc012aeb495772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794202, "uuid": "a5a95e4b-770a-4b3c-8234-738735723eb3", "comment": "Malware payload (RedLineStealer)", "value": "488b57d9315bdb9c404aae017721957063b972e458e02043ccf16ab8a4b3bef59babb65b339a024aedcd99fca600e2e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794202, "uuid": "a466e2f1-8400-4c95-adef-c6f47b50e893", "value": "T19364F12377E1F3B2C06A41715C21DAA9AAEEB03445798A4B7B680BAD4F313D0D777346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794202, "uuid": "154e5273-fbe6-4a4a-b0f1-eee2f3a7656a", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794202, "uuid": "89ff8bdc-291f-460c-84b0-2cd9f433097f", "value": "6144:brXKo+LBXaK3Lf8soA9Ul5F7lr7FA0w1Ic024mq4+Fxf1g:brXKo+NXaK39oUsF7hF7c0KqzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794202, "uuid": "3caa8745-953b-4c02-8239-3e0a28c59a45", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794202, "uuid": "a0d8bd0a-d74f-4283-bb97-2069c5c69cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794202, "uuid": "35adbcc3-eb3f-46da-9f74-8aba391b2ad0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "325c6374-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788916, "uuid": "4f44c271-98bf-4c80-9cd7-00c279f24671", "comment": "Malware payload (SnakeKeylogger)", "value": "c0e5d62ad11e700fd5251be62539a5c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788916, "uuid": "fb6e891a-0dc9-4d74-8b77-51548c9f19e6", "comment": "Malware payload (SnakeKeylogger)", "value": "61c4f2646a200a57f063517c527d7336e77caaa27e83f382b66be014cdedb7f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788916, "uuid": "0dfcb279-f6ed-41d5-ace6-633d720a016f", "comment": "Malware payload (SnakeKeylogger)", "value": "6cd753c625475c6184af4ec562b8a8240bd36fc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788916, "uuid": "42a6215f-46a2-4c55-a814-e0dbe204c76e", "comment": "Malware payload (SnakeKeylogger)", "value": "63a9fcc3a8f5ea3ecc4f96ffe6ae95dc7716d32b9f99a99ea3f442241380d8979e7cbbe56a5d5804fd14e3f07bef2482", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788916, "uuid": "4bc5bac2-945f-4f40-9bd1-8a0ca8463461", "value": "T18105E19B358485ECCF6E55F6A25784407394CCBFC508E61A6B843397AED6FE20C2271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788916, "uuid": "d63cdd9f-7167-4cb4-b841-94e6e2e9de54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788916, "uuid": "be477c3a-1d29-46e2-9dfe-32860668c84a", "value": "12288:JFimar5VFDutOc6duxKLo3qfJbHhmuBAqwMiaeZaK1HeDFT9N0i9C9lsAn3GI2qk:0lAAi9VHet9vC9lsA3GI2qN6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788916, "uuid": "483eef13-f952-4a74-953b-a095f2b822fa", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788916, "uuid": "903e6684-a0f6-42cb-93c0-517cd58c1230", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788916, "uuid": "459fe601-8d62-4641-b816-ce412d66c596", "value": "Contract sponsorizare Lancetti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96325a12-a717-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675795526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795526, "uuid": "cf885607-5bbc-4d6b-a201-34b68ef263a9", "comment": "Malware payload (RedLineStealer)", "value": "fa90a0d3eda74437273dd23d8e9ca8e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795526, "uuid": "557e330c-32df-49d5-92c5-21b44d703151", "comment": "Malware payload (RedLineStealer)", "value": "621606f23b6d2a7e300cc4785f35fe8235b60604fb2c988470bf8971b57360e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795526, "uuid": "f234a115-caf3-4bc6-a255-ea4215bb6688", "comment": "Malware payload (RedLineStealer)", "value": "6fcf6cfb3ce6daed7c13e9af899640c17b2e6b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795526, "uuid": "99374005-0fbe-4995-b077-8cf2d4e0726b", "comment": "Malware payload (RedLineStealer)", "value": "939a844f6f451282ff852da4fce5b8282c1d3f3d595f64e6c16f60771f644a0dc420ee932e4d2498f6754fe606ff4990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795526, "uuid": "e442de1c-666e-4be3-98c8-b0db994287c0", "value": "T1AB64023335A0C0B2C4256974D920DA99AB3FF4F0667989A77BA407AF5FB02C1567B307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795526, "uuid": "ed358719-ce04-4e39-9e6a-6c04ce620845", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795526, "uuid": "54079dfa-e4bb-4f30-9e4d-ef40c9bc7c8f", "value": "6144:WryLl/t7LnStnj7AZYKoyjhrsu/bLwL6wvxlNlDrwTHlygs:WryhF7zSt3WoyjiuzLwL6GxlH3gHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795526, "uuid": "7c42648a-a116-43fa-87c2-bb1e620cfbc2", "value": 311296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795526, "uuid": "890255a2-8802-4b35-a1b5-59a5f436a209", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795526, "uuid": "737ba941-3d15-455e-ad73-0146de5b4f84", "value": "fa90a0d3eda74437273dd23d8e9ca8e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d2ea97d-a6a5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675746441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746441, "uuid": "bdaf4bde-fc79-41bc-b2c7-3c8e89c3f972", "comment": "Malware payload", "value": "a61bd931b12da7b065ef579825a4be43", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746441, "uuid": "a5c1af69-cb4e-45ce-9e6d-628bb4a059f5", "comment": "Malware payload", "value": "623426c94fa5e371c968315f1db57b83e3b9fe60ba27f9b2caec297bdeb2c691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746441, "uuid": "fc597952-4346-417c-960e-d888b1228a7a", "comment": "Malware payload", "value": "26b414a8ea0b159ed7fe848f1b5906d60f118c07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746441, "uuid": "cf06f24c-ab53-4f84-bf80-15e0baa6dccd", "comment": "Malware payload", "value": "2351d417aafe16606581cf6b71853eb025a23073658c6b001aab2f05d14e1e3cce7d519bb7183b8f47cec799fd15151d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746441, "uuid": "a79a0ff9-b8d9-470d-981b-725c98bcfce7", "value": "T17E763365B8DBC9B5C6E568736F453C9839ECE22C0D3B861B73580A6F3B9CE905121E07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746441, "uuid": "88023d85-c2fc-4c97-be70-ab48fb3f8232", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746441, "uuid": "7bbbe0a1-27da-4e6d-b41d-368eb828b482", "value": "196608:91O50YuLHAmqYNCb6upn8pveV2NKIwDuR9aBDnISu77UsVNxJ59:3O50YuLHApOCbJpgecNKHo9aSvpNJ59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675746441, "uuid": "6b296bd5-6c37-4b4e-9881-9accc1929d42", "value": 7606473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675746441, "uuid": "6838efc7-090a-4a49-8d5e-de6307c69ba9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746441, "uuid": "1511e2d1-43be-4dfe-a79b-5a7e55434628", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581e8a09-a6d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675766216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766216, "uuid": "65ffa216-5af5-4c69-b10c-47b3e1410dfe", "comment": "Malware payload (AgentTesla)", "value": "b6eb7b4e594a56b4863355c9a7f86b53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766216, "uuid": "134c0de4-8ae2-4bc5-88a8-e57f1fcbd5da", "comment": "Malware payload (AgentTesla)", "value": "6293bc321e0d935cb697ff2d091446f6ff17b604c8720fe525f0ef3c38de8dbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766216, "uuid": "a87c345f-daee-4822-b5de-9db2f2b57c11", "comment": "Malware payload (AgentTesla)", "value": "117f098e05ef647da17ea4182b77f99efd7b1b94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766216, "uuid": "1759702e-c7ed-4582-820b-d9039d388b58", "comment": "Malware payload (AgentTesla)", "value": "ff17c597d5c233998d15db5b5cfe0f731c27305fc6e39a415c28e97b99a9457b2426eb25c7aca1c1ab15e1f28961e0bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766216, "uuid": "47e1c7ee-c306-4f18-8f29-ab85b2fa3452", "value": "T107539027DC6C42EAFA2D46BC405652442FF735E7F636CF4A5BB56C88CC423120926E9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766216, "uuid": "bc42613f-84e6-4c55-b23a-171388748d58", "value": "768:0AOAg9DjP3i6zmz4e2XX/40LO6dusn04ep:ZON9DjP3iC+Ja/40ymuL3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675766216, "uuid": "9d531685-368c-446a-bd4c-8d39948629d0", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675766216, "uuid": "049a7901-4db8-4f94-853e-922502ed972e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766216, "uuid": "7a16a1b1-0edb-4b59-aa3a-546f36988890", "value": "Arrival Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de7a515-a721-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675799780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799780, "uuid": "1dbcc39b-1d79-4248-8d33-7d3679de623f", "comment": "Malware payload", "value": "3fb28683c066b99263c0fb6de9268939", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799780, "uuid": "82de6953-d891-4b72-9438-f5eaad3d0a27", "comment": "Malware payload", "value": "62962636c23f02776d63a8cb7d422f1d161679c32a365093c5a5a546cde4d03c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799780, "uuid": "58580625-1e21-4195-aa96-895db058a400", "comment": "Malware payload", "value": "2b5ceae16eb349611c8a057fd090bfe766e4c0e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799780, "uuid": "e9b372a8-43f3-4f73-980f-304033d19a54", "comment": "Malware payload", "value": "54c337b0c1e682444f23c6a38ef4943433df298ec9e13faba3925d7e0cde68c0b0241f38b84bcd4c0b54943d7dd66a92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799780, "uuid": "ad8a0952-d94c-4923-96dc-28e8b46c6b13", "value": "T1BCB6336F79E1FAFFE591017058D8853DACFB600C801D8C3ED874906A2696BD7026E6F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799780, "uuid": "cc7a89cc-ebe8-426e-9ac3-a56161ab1f9c", "value": "196608:muJHGbszcH24xALq0DVW6vVSitrdoYvq8z+byKpVcGJ/daQbhcyJpHqebEM6:hJHAPfA7VSSoYS8zBKpSGJlaKJFzbEM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675799780, "uuid": "fbb2bb92-4846-4e7d-9f31-52ed68f76b69", "value": 10878665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675799780, "uuid": "24a4c25f-d44e-496d-940f-2a06410a947d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799780, "uuid": "062abdb7-d0dd-4b64-b082-9dc1291f0579", "value": "62962636c23f02776d63a8cb7d422f1d161679c32a365093c5a5a546cde4d03c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea4a03d-a720-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675799432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799432, "uuid": "58d1c896-0e3a-4123-be5d-f0a7d910973b", "comment": "Malware payload (Amadey)", "value": "0d1881a9805f8312cfca192feb54ca87", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799432, "uuid": "70576135-a14c-4b8f-87f3-769fe10dbc97", "comment": "Malware payload (Amadey)", "value": "629ee2e8086e7422522a76b1b03bb0d90247d4426af8ade30669b147baf73b03", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799432, "uuid": "a4f59277-f317-4113-a5ce-469679617a55", "comment": "Malware payload (Amadey)", "value": "c8571c9b249f5da65f8a2b022718b209f88b22ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799432, "uuid": "5e6d8b6c-05ed-4767-83b5-6e3818fdad41", "comment": "Malware payload (Amadey)", "value": "423dad78e8f03d3bf9ce07984b5c9a44e8c47ef5b40f37c823b696a2f61bc9024d2e179a6ef404af155de0c6edbfae15", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799432, "uuid": "b86a19f4-994d-4da2-9ecc-f13fd34a61c3", "value": "T1ACB4020BE7ED8523E9B5677049F703C30A367EA1AA34839B228B6C491D73564E235737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799432, "uuid": "efd2d0a9-5b23-41e8-aa20-a711cb53ca57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799432, "uuid": "0d9876a0-c7ec-4b18-88bd-d124108c4314", "value": "12288:9MrUy90kb4aJHsu6vBWGY0TdEFtuDlgky+V84Qvw:5yfb4kHsrvBWGbEFMDlVy+GdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675799432, "uuid": "143af54f-ba8c-4c77-9e8a-1c9d7a44b93b", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675799432, "uuid": "6c8354ba-db97-4e66-969e-266ba385e436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799432, "uuid": "5d4e3960-8b60-446b-a136-5196e92f7601", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8117ad88-a72d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675804939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804939, "uuid": "872918a9-1c16-4640-815d-2d8aaa89f456", "comment": "Malware payload", "value": "ab2b6eee54afb98aa369555876da8643", "object_relation": "md5", "Tag": [ { "name": "1675755007", "colour": "#67AD32", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804939, "uuid": "e3ec3354-7d06-4d33-9adf-67b8159abb0f", "comment": "Malware payload", "value": "62a0750ae87bd6445ebc202e442b0820c859507be37487e012b910660050929a", "object_relation": "sha256", "Tag": [ { "name": "1675755007", "colour": "#67AD32", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804939, "uuid": "80d87665-dfe1-4c1c-b7ac-38d3a67fc32e", "comment": "Malware payload", "value": "b1722c2312888b6467f9c4f2962eb4666ebf0bea", "object_relation": "sha1", "Tag": [ { "name": "1675755007", "colour": "#67AD32", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804939, "uuid": "13c567a2-b65c-46bf-a71f-278fe1bf0da3", "comment": "Malware payload", "value": "2052fc59bb5ae0b35a30803472fcb1bfa341aa1c48227da61b38b3f13074728c136aa07bd21531d21a1fad16fabc9960", "object_relation": "sha3-384", "Tag": [ { "name": "1675755007", "colour": "#67AD32", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804939, "uuid": "77977a45-5d05-442c-8008-68e2d723e69f", "value": "T15FF3C025B191865ADB29827A0AE77F74B373BE029591531FDFB72A1C4DF0248CC9068F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804939, "uuid": "3352ba4f-7c95-4c66-95e5-86ea26fae19c", "value": "3072:ggS2EJbyYeMYkKkyX3DWvLLATiRMS2jFuRgbLU:ZhjZrHDgtSjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675804939, "uuid": "f56eb48b-c237-4a57-9d7a-7c715d17270a", "value": 159152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675804939, "uuid": "c158f094-f33c-4a1a-a6a1-6fe4bf01d0fd", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804939, "uuid": "2691e35d-1559-4590-a49c-9232d34aa449", "value": "cancellation.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55f4edb0-a6a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675744308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744308, "uuid": "73878db5-6131-41a3-b48d-5c8e6730c5ef", "comment": "Malware payload (Smoke Loader)", "value": "b0c85396bd605ee72398773f1bca2015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744308, "uuid": "b3348521-883a-4b8d-8529-e2bb6bb4adc5", "comment": "Malware payload (Smoke Loader)", "value": "62d622e4c6581c0dd50e5623a3328cf60ffa7e87dea131c294883a2b610f80f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744308, "uuid": "7dab2049-0a96-49cb-a3c6-8987b743358e", "comment": "Malware payload (Smoke Loader)", "value": "6d09ae234c43abe8666ac87d7426eb9cccca10ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744308, "uuid": "5ab50f92-e325-43fc-9205-1139a0442ba1", "comment": "Malware payload (Smoke Loader)", "value": "e4965dae8768fc047c24ad4269e0a035b0564fb10950925a53f085e0afcb052480b41713079772413eb28281f22f67a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744308, "uuid": "9f195803-4428-433f-9c4a-dbd75b88efed", "value": "T158545D43A3E1BD42ED268B72DE1FC6E8764EF9408E7D77652218AF9F10B1076E163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744308, "uuid": "333bb199-9b2b-4047-9994-8af8e5d162db", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744308, "uuid": "a91391ea-6400-4d6e-a086-250fa7a77f2d", "value": "3072:G2b6bx+9XL/cRmOSJ5Cn+Zh2I4L8WY9P2kPduQjiMTE5xsa5hN:D6WXL/DX5C+LhrduQj9laL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675744308, "uuid": "c272295e-94c1-405e-a4d9-ca297776c7a5", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675744308, "uuid": "144dd4e7-de6d-4058-8ddf-5c26fc31ff15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744308, "uuid": "4a6124d3-6b0e-46d1-a094-c07e38022331", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f2d6ad-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789853, "uuid": "0bd86709-c383-4c53-88a0-3bbe62bc89f5", "comment": "Malware payload (AgentTesla)", "value": "569c9ae0ebbf4af9cf52a893c8268bc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789853, "uuid": "7d9ec1d2-412b-41e2-a55b-148556d4a903", "comment": "Malware payload (AgentTesla)", "value": "62fbe96794ff9a92954bd4c4dd34dc6cc687a2322dd8fd953b3560c5dcfd6dfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789853, "uuid": "452515e9-f716-43dd-af00-a26a38e01b3e", "comment": "Malware payload (AgentTesla)", "value": "2463233aced60d9cdbe5aae9181832539b38494a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789853, "uuid": "88c2f30b-714c-4523-b9f5-fdcc33ce8b22", "comment": "Malware payload (AgentTesla)", "value": "2a25cb04eb74c9909a42c7bfeaef4b2bfc3f47b1dfad6e81fd3a286268336ae0d7cf6bef7e27f2dce55a055b2f6ee0c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789853, "uuid": "d446eebb-b2d0-4259-826f-b837f0da8f7c", "value": "T11C256C013AF6C863F05A0E7460283DCC3A3CE4479BDD419FA972A96853A6776F9D8D31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789853, "uuid": "29e51d35-9f03-435f-9684-14094835cc73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789853, "uuid": "63b5abbb-fa80-4bf1-9137-bc40f9ec6fc5", "value": "24576:3p1IYGDkjwJsoGlWzYgEi2XfURi0pHubJB0roBblIQhPjJgi3:3pSY5UsoGlSYgE/XgisuX1DdV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789853, "uuid": "6e9f1923-b866-43ae-a2ce-9b7e54d6d1fd", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789853, "uuid": "c153533b-0cb3-419d-be4a-744f8570f3b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789853, "uuid": "ecc9ec46-63d8-43a9-b35b-76aea9f68e39", "value": "HSBC-SwiftDebit Advice - 299T402172050006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5b133e-a6f8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675781984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781984, "uuid": "e33053c4-3540-49f3-865f-2c33e0e40406", "comment": "Malware payload", "value": "eeb3cf875081bb8f876af43ec2ef53ab", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781984, "uuid": "258b18a0-f9a4-41ac-b210-b7029f45203b", "comment": "Malware payload", "value": "6300b64fdca744479a94b0f7176130959d70920e8a22adb8233ca4888cdec611", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781984, "uuid": "9e3366d5-0ee3-437c-ad38-f987ceff1126", "comment": "Malware payload", "value": "0ea8f0e415e7d2d28823d02a587555e801ec314c", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781984, "uuid": "5c14bfda-6d79-4b1a-8d88-3ba8a54b19d8", "comment": "Malware payload", "value": "47ffe638bb812f0d7b44eac3da8dac2aa4272237cef0ffee2d96730c2347a5c53c8cb94bcf44bfde838158f1a224cfe2", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781984, "uuid": "269446c8-1f13-4f5e-ba14-dac66722366a", "value": "T1B88456A1AAC4F25FCB508BB7ABCC4C7656337E8A54C9510B68447F6910B36B7CF22532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781984, "uuid": "87dc1041-621c-429c-9177-d8f23fcd155d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781984, "uuid": "3050b397-f2d3-4b7d-b787-1c59cf12e964", "value": "3072:bJbwnK1E+8Z8xLSLUGLzNgFYnK1E+8Z2xLSXUGLzNgy:bJbwKMNUVYKMjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675781984, "uuid": "1b6584a3-4eb1-45ee-9683-1831b70fc7f6", "value": 372736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675781984, "uuid": "d817f26c-a891-448d-899b-6b3bb01e8a73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781984, "uuid": "a909034b-d740-4300-b051-86d27fda0a4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19174c6f-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758379, "uuid": "23651eb9-509c-4585-b20d-84db4fc65776", "comment": "Malware payload (Gozi)", "value": "324999e6b4ba3e94655455942527bcef", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758379, "uuid": "0d21a542-2925-40d8-b6d5-80af0ae8b10d", "comment": "Malware payload (Gozi)", "value": "6335b61185585aabc34532592df59d84415b8d4d588802820c5f9708f918b99d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758379, "uuid": "c8bbd884-a5c6-4865-8831-2fda7d3d1a45", "comment": "Malware payload (Gozi)", "value": "74111538a99a6e2c41f5fba688d06f083a2bf1c9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758379, "uuid": "76b7fb3a-5666-44e9-a233-0191bea79d7d", "comment": "Malware payload (Gozi)", "value": "5f399a0f741a86b71aa54ce601a07420704a41165727d5fa30df3c6ee6b8b7f9ead34f19450825a31631cf5955389570", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758379, "uuid": "62e739d4-387f-4736-9f2f-48c89d58484f", "value": "T1CBE15C4FDEDBA41B675181DFF2732C11FB5029BBD9292204B5E6E30E2A92767004165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758379, "uuid": "a7f85b29-6a22-412a-b4ba-dc80b3152a38", "value": "96:wRRBz3WLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dRUZ:DU77rIKdn863jMM0OD9+VVF4bUx/Ce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758379, "uuid": "02dffbcf-9224-409a-a343-08dadbb81cec", "value": 6974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758379, "uuid": "79ea22fe-8231-4fb2-8220-be00b7c81f03", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758379, "uuid": "828b80d5-e464-4d0d-b901-1f533490ffa0", "value": "azienda_20.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4509b7ec-a6a2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675745139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675745139, "uuid": "90f630c3-0b4b-4dc6-8f6b-ef347bcde26b", "comment": "Malware payload (Smoke Loader)", "value": "9de1afef1ac0edd866f7c9539b241dfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675745139, "uuid": "4063d3dd-ff18-4069-babb-794dafb33a83", "comment": "Malware payload (Smoke Loader)", "value": "636ae2cc0c1c90eb2ff61591915bc82eb38f20e55dc9899e1cf5d236552a8358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675745139, "uuid": "50da4169-8939-468b-9acd-138372587df3", "comment": "Malware payload (Smoke Loader)", "value": "bf0654172c36914856958353ab2259962e445753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675745139, "uuid": "aedb8760-d96a-48bb-99c9-a84158aa5782", "comment": "Malware payload (Smoke Loader)", "value": "63f23ec5fd98505de64ded756091b962ce5d92f1ef85107b7a37ea0625c530b635aeccc272038a3fd03064a94fd0b113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675745139, "uuid": "610c415f-d194-4b54-8c0f-4b14019364ea", "value": "T1B3645B43A3E1BE40EB268B72DE1EC6E87A4DF9508E7D77752218AEDF10B0476D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675745139, "uuid": "2d5053c2-e082-4734-b6e4-1f0985ef2dae", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675745139, "uuid": "1688c048-f4dd-4127-9970-623652d26e3a", "value": "3072:D/b6bcgELrrRmXVOldgPia+No8siLrh/auQjiMTE5IXra5D:TTHLrYSiPiaGMuQj91a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675745139, "uuid": "9528b5c1-d8f8-4c9b-bf4f-1fc6fe376ac2", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675745139, "uuid": "aa625ac3-fdd2-4e81-b28c-eab5e3144d33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675745139, "uuid": "873f0bfc-0265-48e8-8d0e-99ac02fb15c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b437f41-a73f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675812634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812634, "uuid": "b54f5911-b2c4-49e5-8dcc-0e116c1d52dc", "comment": "Malware payload", "value": "ab799e62d3827019ce3fe43f09273801", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812634, "uuid": "982ef5ed-3959-4558-853a-b1539040182d", "comment": "Malware payload", "value": "64568be8c5faad0c1c2a7c6b54e3db76dd95809cff558b132abc84915b53b627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812634, "uuid": "48af34f8-d253-4d28-a0d9-b97a94ff451b", "comment": "Malware payload", "value": "494f24b36bcf152ea3ddca396a55d326801911ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812634, "uuid": "114c0653-3fbb-4223-9aee-8fcd3c7882cb", "comment": "Malware payload", "value": "667dbbe7c6439f89127bf1e22e4e7b7568444163d812ac3801213718e4a8d94a7a3aae4fcd6159524a6289e45f98c9cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812634, "uuid": "dccba640-3227-4844-a9d8-ea696f449aed", "value": "T1BD14D0363690C0B3C56B55305FA1DB642ABEF83045758B9B77A807AD9F306C0763A39A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812634, "uuid": "35a8553e-724d-4715-b534-94c2015da471", "value": "ae0d5a157fa4c5b2c2783d24fb5ee840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812634, "uuid": "46bcf4ce-9b22-4040-bbeb-2eea84a57a0e", "value": "3072:8daOkZYrYx+nLB0UW6a5yTezS75ZGnI2Sfd:8daqA+nL+U/JTsS75ZGPSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675812634, "uuid": "288153d5-a974-410e-8623-007383dea6c0", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675812634, "uuid": "347b7e2b-b73d-4a7c-86d8-8295bb5d28f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812634, "uuid": "6fa0c555-4f71-40c6-abbf-b1de7e9a7619", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9872c82f-a6cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Arechclient2)", "timestamp": 1675764606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675764606, "uuid": "ea47bfca-6a01-44e8-abff-9eac2d4a9a32", "comment": "Malware payload (Arechclient2)", "value": "3e2c3e5f1519583f450f2c658720de0f", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675764606, "uuid": "b47eb89f-cc40-403e-833f-192544c8216e", "comment": "Malware payload (Arechclient2)", "value": "6503af884f87235c82c36b47fd40fc0cc61dc82aa479c0f3196c3a0b97209886", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675764606, "uuid": "1de5a0d3-2074-4a72-9e36-850e532df454", "comment": "Malware payload (Arechclient2)", "value": "5a85dc4aad7894eb1d2e522c17ec6cf489b36dec", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675764606, "uuid": "ccbb84e1-5195-4756-80f2-3045fc1ae4d5", "comment": "Malware payload (Arechclient2)", "value": "91cc856924eaccfbb30a83d22664f404db665bb8bec4827d72e67fbc8d46f3b18f14b30da38312c1fe7bc2136c7856f3", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675764606, "uuid": "017a4e52-d235-481a-a858-b2afc645fe21", "value": "T13FD6BE1182E31955F0F0867891BEE0B09AEB5D63CD878D1935DC3D9B3B390DA98BDA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675764606, "uuid": "0a237e9e-531e-4616-a579-5afd36ec71f6", "value": "c7c88a9f12777d4c1f156ccc8f276fa1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675764606, "uuid": "39396f63-ebbd-4288-8904-ed043e112fe7", "value": "393216:yLF7hgdtdOT0y62yqgJDt1gn/2CuuegmdBXpEXjGD6ApgMyx708OK:yZF+tnDKght8x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675764606, "uuid": "f046cfc1-b2b0-4b0f-9e12-d698c113c90e", "value": 13036984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675764606, "uuid": "3a76baa1-7f56-4550-8a7d-60fdc21c41ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675764606, "uuid": "542d9160-4622-4191-a50d-c47bf9088588", "value": "3e2c3e5f1519583f450f2c658720de0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b012fec8-a680-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675730715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730715, "uuid": "e9d15bea-60f3-4b3f-8bdc-259be1c4fd84", "comment": "Malware payload (GCleaner)", "value": "521fb0474c3ea4c603cb7ca4bb2ffdf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730715, "uuid": "09a4432e-a732-4cbe-989f-b0aedef2111e", "comment": "Malware payload (GCleaner)", "value": "661709c4e8532eb14135354c24694d479041812c6a885bd7b5ff21a8c6da3c42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730715, "uuid": "d92ee95c-1cc9-4787-9a8e-b25325315d02", "comment": "Malware payload (GCleaner)", "value": "c0e644eba0f3e418c7788d1553ec7e9f8c06e33b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730715, "uuid": "4c03af47-158d-4b6e-af42-8417d567c38b", "comment": "Malware payload (GCleaner)", "value": "2b3a1d4d0020ac8048a0041ecaa6b3c41458a410cd622b0adbc1e6c4c127d6ed5f076db934bb9a275b4445a1757bf789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730715, "uuid": "bf4d0044-dde7-470c-ab01-4abc8d046e0e", "value": "T1EDA523066214E4F2C7A2CF75DC1E8AF52473BD04E8E1662B75187F0DBFB229C502E666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730715, "uuid": "39830479-aa70-440f-be73-08bd66fe9f96", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730715, "uuid": "9bbe4f5d-a7e3-4a0b-b608-ca4c460fc7ab", "value": "49152:nZF9mOF4nF2o2r1+VHSXCTWZJhT6USiaCGtjhgVmum1U2l32J20IgyLCgv2MR:ZXxFt5xs4CTWzKbjhgVOUT40Igav2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675730715, "uuid": "a842da50-9864-473d-9497-04262fea6754", "value": 2083182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675730715, "uuid": "a87fd184-9ee8-4d3f-b3ea-ded7d53fd24d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730715, "uuid": "83e44031-1148-43aa-bf4c-c4de5bd96dd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834f7845-a6b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675754263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754263, "uuid": "dcde6e74-21f8-448b-b7e4-1c8e32d29c71", "comment": "Malware payload (RemcosRAT)", "value": "adad8504703d6f9292fce74d9810782b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754263, "uuid": "3e1a2349-ecfd-4560-a5ac-008a622ae2af", "comment": "Malware payload (RemcosRAT)", "value": "66846bd67a3ce9a5b8965be996c6f7484f9c5bf8205bb3e22f9120a615449e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754263, "uuid": "e8379867-e675-4c54-a0a1-102f279f440a", "comment": "Malware payload (RemcosRAT)", "value": "0cf67d5a23213509f61aaa2ba3f0086d4787d6b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754263, "uuid": "96b65f3c-6023-4f85-af52-1f97d82fc9f2", "comment": "Malware payload (RemcosRAT)", "value": "42a5da2bfc3327ba4077d2a0c3c4bccc0f8f7f99fd9c1294aad077f2cf995ea6d85acbb88a6d88dc043c315814905ee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754263, "uuid": "45da0a76-8fc4-496c-80c9-e3da004921de", "value": "T11203EA9821AC8B33FEAE1BFE14B9659BA7F665376010FE892CCDA1D435957804700B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754263, "uuid": "f87c7b41-5160-4731-a61c-6b49fb3abd96", "value": "768:qevENw901TxGi+ZPc0XIg/PFt+yVTqt5RYVMUfA2liO4v:2Nwe1T4i+ZPbXzH3+UqtfYJI2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675754263, "uuid": "f6f9aa15-d61f-4a59-990a-fd78c0d6b2b1", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675754263, "uuid": "202d0761-78be-4d76-b081-3f1ba602bd27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754263, "uuid": "0b7009c0-14d3-4728-b102-9489dbf0a6ad", "value": "ReminderStatement - 20230138.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997eac27-a6b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675752582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752582, "uuid": "ad6c9e95-0750-43bb-85f8-9d4f2495c989", "comment": "Malware payload (Tofsee)", "value": "0a8ed791644a87e421f98f9e0bc41c78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752582, "uuid": "ecaab3c3-6756-4acc-83ec-e8adff5567d9", "comment": "Malware payload (Tofsee)", "value": "66af2f2679c734c4494f1321ca7c7f7d3d04e1f245c928f37b307b4474c7a055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752582, "uuid": "e1afc51e-076a-4da8-a8a7-93b8fda2bb46", "comment": "Malware payload (Tofsee)", "value": "e0d33f1b47ad612750141d9f05242d43dc99686a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752582, "uuid": "c5608060-ab95-46a2-9ef6-2f661d30c09f", "comment": "Malware payload (Tofsee)", "value": "b1b3ec5fe07012403bf54e1775c967dec57e64b5e980b9fda143bcb51cb927d85678a5035449d4ca6d38f25ab17934ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752582, "uuid": "0392e8c2-c6c3-4f51-8742-218995becf9e", "value": "T1E414E02236D0C072C1BBA5305970EBA51FAFB8327679895B77A4137E1F306D16A36347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752582, "uuid": "125a0e34-acbf-4a52-a797-7662e98f2ecb", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752582, "uuid": "9dc02636-1f03-4371-8140-711c144fc66e", "value": "3072:nIqOtotpwMhLVMBWjpR5LKxDdJSgzNUfh8kXOFk7NwyJZ:nIqBQaLeBy4DegzNU588OFkZwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752582, "uuid": "284ab702-3479-4dc7-848d-ebd6702a7fd8", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752582, "uuid": "d5d5bab3-acfa-4f7e-9c93-0866811682d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752582, "uuid": "139aca11-7461-4910-b16a-1950df0d7927", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdec5c6-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675732856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732856, "uuid": "ea8f1038-0ebb-4db4-9049-f2be06894fe5", "comment": "Malware payload", "value": "c22c640d7cca1caccf110721b60d632b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732856, "uuid": "d40d135f-48c5-47af-b143-d40f73093ce3", "comment": "Malware payload", "value": "66e056f25a5bcaec1e722787abb857db3a61e780eb113a20cfc42c4760b17e0f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732856, "uuid": "859727fa-7e7c-4fb4-8252-73fdb013acf8", "comment": "Malware payload", "value": "6c675bb888e47981affe88cf352ead72cef7af51", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732856, "uuid": "99c05197-07ab-483f-940d-e66aec963ec2", "comment": "Malware payload", "value": "2138cc293a9edf22820e7d56aaa9dd18bb5808bca576c53946dba0ff44549737303dfef10124687d7721a4da5786567f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732856, "uuid": "50ed0523-7869-4b1a-9985-9a5303b57daf", "value": "T12F17338CE4CF9B3931FB17B7CA016258D992FC6C79510371A987A1FDE04B6A16A06CC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732856, "uuid": "7a38bdf3-6c18-4e45-83de-0f73e7cdb4ee", "value": "393216:Um7y3ewMgFjfgtkAG+hhjaGy6BPG4h4+w7Oa8zvyW0Kgs/L4Dli:2ewMWgtbXjaGyo+8bwS3zt1gI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732856, "uuid": "096e2240-0e95-466f-856e-3c484bb8e90b", "value": 19395746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732856, "uuid": "013ca615-eb33-4e68-b7ab-10c73b7703a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732856, "uuid": "d5f1c58f-c453-47f1-95c5-f6f506bf4e25", "value": "correioseletronico1675729215.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1998977-a702-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675786660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786660, "uuid": "78f55548-85f3-485a-80dc-9a46ae8eceee", "comment": "Malware payload (AgentTesla)", "value": "80e6c2c8d8f19b864ee0891a5303653f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786660, "uuid": "2826813a-02c3-47b5-927d-bf30a4a634b4", "comment": "Malware payload (AgentTesla)", "value": "66fb896b0a7fdad4255d5947e5417799369b17f20ff4744a555497c1b478606a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786660, "uuid": "55b82d58-23f4-4132-9f34-cf54614bc320", "comment": "Malware payload (AgentTesla)", "value": "efa7b09c350bda5d75ca3d8215f4a5a42d89a929", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786660, "uuid": "3c216d6e-c41f-49d0-be6b-bd2412efe1c7", "comment": "Malware payload (AgentTesla)", "value": "1b7bd5f88f74a135c6f348c5edddc27d13e81248eddb00f2d5ad386523b65d246259244f699081b47b90e2c3cadfa445", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786660, "uuid": "12485f3f-3825-44fd-8acc-025f55e6a512", "value": "T12084AFFC75047DE6666E176BDA96ADDD03B527728ACBA8CC80A477C305A3371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786660, "uuid": "65a8ef79-2eb1-4dbf-8b30-7beb0d1141c5", "value": "6144:uxW6Ey1pkz2Hk/V7dsEBIU6RZwerg3ufnCkNraWcE3j79LDnCBW:uxWWU6yVFqXRZnrg3uPtaWN3vdzC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675786660, "uuid": "fd3bcf12-9d56-4618-8eda-6d64e650aa83", "value": 383343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675786660, "uuid": "f1b38f7b-e8f9-4b7f-a639-b4eeafc194ac", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786660, "uuid": "7b69224e-68b5-4678-886c-8143e6f9d072", "value": "PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b529648-a6f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675778730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778730, "uuid": "ed5e2899-f65f-4771-8d60-81455fa2a3ce", "comment": "Malware payload (RedLineStealer)", "value": "58579b788dbda123284f1d2981dd817b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778730, "uuid": "2728bfd4-72c4-42b7-94aa-dd66fbf87137", "comment": "Malware payload (RedLineStealer)", "value": "670ebc347dd7d79c1736cec1f2e8e517dfab7227f14dabbecbd7eda139642175", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778730, "uuid": "0a2143dd-a0f4-4fb6-8375-a92af326bb3e", "comment": "Malware payload (RedLineStealer)", "value": "91fec1837c9d2d9b0b7b3b343ec77458516b032d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778730, "uuid": "f6f14b8f-3125-497b-a712-a3b415336097", "comment": "Malware payload (RedLineStealer)", "value": "0c4b0cbd4f49f98721e2b7fe81d3fbe6c5e4f56cdf572552057815efb88c2b978a7374cb5f579fa6780dbbd3471e3594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778730, "uuid": "05efb18e-a0dd-4428-a187-b7ed49063d46", "value": "T19164F02736D0C0F2F9A620345820D7746AAEB03156B5C96B7764176F8F706D1AB3A31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778730, "uuid": "86f5884f-8161-49e9-92b4-c841e10198d4", "value": "af0a92fe52cf161a7b179d1f32aa9186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778730, "uuid": "cc80b0e4-b72f-4161-bbb8-9dea16bc6551", "value": "6144:1UJIYLW5oKfp2qm6YHtC7eE8Y/8pmrYh/0gwVrUErEaltd:1UJHyoKfpks7eEF8GeuxUE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778730, "uuid": "adfbd3f7-f66d-4167-aac1-0b7ddc18dd73", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778730, "uuid": "ec59f0de-5771-493d-adf5-3fea0be10414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778730, "uuid": "fd1da92b-cab6-402a-b679-9e4bd93e3904", "value": "58579b788dbda123284f1d2981dd817b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4454e035-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732682, "uuid": "5066df69-e470-452b-b6b4-ad5984b42121", "comment": "Malware payload (Gafgyt)", "value": "25eceeb5a74cc4bea468272cb6210a64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732682, "uuid": "4b0a580f-624f-4983-8026-52bb6292e796", "comment": "Malware payload (Gafgyt)", "value": "67140c880ae63baa0d59b0a72298c870349fdbd78991458467bb037cb9a4d310", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732682, "uuid": "b79b2ebd-034e-443e-b49c-0623d1d0b816", "comment": "Malware payload (Gafgyt)", "value": "b205a19a95dc64c749438b3ee185a95de001f3e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732682, "uuid": "27387cc4-d6fb-43a9-8a7e-1d84d1ae0e0c", "comment": "Malware payload (Gafgyt)", "value": "a742c3a3378554426566b20b277647fd1733981b88a8e6c6b53af4f97b5e914d01e1674257ed99d257fa6fad5277d56a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732682, "uuid": "ed95cf7f-4828-488f-9f8d-1b89a283cf79", "value": "T1E9D3E61BABA15EBBD80FCE3301E6452210CEE49612D96B2FB274CA5CF74B94E49D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732682, "uuid": "c6cf2bb2-5148-4a20-934b-9fae551435ca", "value": "3072:oX0xGeoXc/JCv2FWsbMh6iVcEGmtBcEYj0u:ID9sbUjZGmtBcrj0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732682, "uuid": "a09750d0-2093-43d9-8dd4-7b5a672c4390", "value": 139827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732682, "uuid": "28262a4f-9a7b-4f6f-a9ce-2f2c12078f32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732682, "uuid": "938b0eba-9b35-4d86-997d-b1e0069c0eb6", "value": "25eceeb5a74cc4bea468272cb6210a64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91b9c58b-a722-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675800243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800243, "uuid": "fe26d8b0-48e1-4b1d-a30f-723a250293d3", "comment": "Malware payload (Smoke Loader)", "value": "31d0c61ee5023f7e855db0ece9b1862f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800243, "uuid": "5e3ee6e3-66f0-4da4-9b8e-0aed2a4834c1", "comment": "Malware payload (Smoke Loader)", "value": "677108f2e8aaf90e920af4db5e5fed7d7e103b99c2dd174abfbb570f4d9d734c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800243, "uuid": "2da78cc5-0cae-4264-a03b-53e72a95910e", "comment": "Malware payload (Smoke Loader)", "value": "5bfa6151c3880033f507e61687315e5a5ef8be48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800243, "uuid": "03640156-6d02-4dab-a160-07d4bb93e4b6", "comment": "Malware payload (Smoke Loader)", "value": "7c4c3c00b24f5edf19390925a18c64a7dcd88df0cf0015cbf59d3a0216d66bee49fbe9777d10afcfacf718cca464cf56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800243, "uuid": "5645896a-49dd-4884-a31f-0365966a1211", "value": "T1F114D0323690C072C52B65305830DBA5ABBEB9315679899B7FA80BAD4F303E15736F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800243, "uuid": "754fdcfe-c8ce-4a63-a51e-45ffb3d25b6f", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800243, "uuid": "a716aeb2-ee59-49da-9424-7dfeb4bf868c", "value": "3072:QJsOQagNdCILTkhWF5h1JxyxX96WmySKhto6sb3IBnCLk:QJsjyILwhURyNe6sTIqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675800243, "uuid": "7b7463b1-0bb6-4812-ab9b-aedb83fdec3e", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675800243, "uuid": "967f2be8-79bb-42b7-91e6-e086ca03bd52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800243, "uuid": "c3f7383b-be80-4954-8c69-6c5f15e44cd7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106728dc-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675788000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788000, "uuid": "ec99899d-26a5-45f6-813d-71f0a5312970", "comment": "Malware payload", "value": "63471d1fcdd0c2a026e701b70df1bd01", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788000, "uuid": "dd4357dd-9ea8-4cc2-adbf-46f5b2b6ae23", "comment": "Malware payload", "value": "68ed66b62e1e6adf5a5e0baab0c1bbef63dc5d52c514ba7d8ff5b6295a498cb6", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788000, "uuid": "53c39266-eb4d-4463-9ee8-2be1d5417eb7", "comment": "Malware payload", "value": "e8872ab5f536d7a07f6790c9f8472e6c008c87e6", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788000, "uuid": "327e4930-630e-4fde-b138-5da301be9583", "comment": "Malware payload", "value": "4ce58bc0136584b2b63ec22edaa15ad42e43f49e5c20df29a56747b3aea3da81779a16d6bde56e774a3fb99c6f4ec13f", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788000, "uuid": "141ca2f7-66fc-4db8-8a52-3e093c1a398a", "value": "T1EED481152AE0075BEBBF873BDBF66C52A271AA42A521CB1F8286014D4DD0341D7F693F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788000, "uuid": "7b132a85-9f89-402a-9b47-f26869ec3c24", "value": "6144:bH1HyGGZKAspiHNAqzM1p3JcjUFQ5uB3c0U9lQcUgBT90nGWOFX0YdXb91YzjH3S:ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788000, "uuid": "21c16f16-79f0-4e82-aa12-937063dfc02c", "value": 654832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788000, "uuid": "3468e118-fb16-4587-9350-9085a9bcf8ac", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788000, "uuid": "c6af2c4c-e664-4861-a058-3998caab3d66", "value": "Legal Notice.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ee8377-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675789992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789992, "uuid": "0cb08269-5457-4f83-9f15-64d236ff0c14", "comment": "Malware payload (Formbook)", "value": "b2a1b891f389df9f952d527232370467", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789992, "uuid": "35e7ced0-4f27-49d8-a456-361522ddf5bc", "comment": "Malware payload (Formbook)", "value": "692b9ef8836f8905044fa6c82848c977c2c8d39e60bfff0ef87c6cbeb5aa14e3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789992, "uuid": "e6784dc7-0827-4606-ae84-97ee15af721f", "comment": "Malware payload (Formbook)", "value": "b8bfa74c714b9d2c5ae6f096e9de8c76e5079dac", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789992, "uuid": "d49bc1d0-9203-454d-8dbd-289d1035205e", "comment": "Malware payload (Formbook)", "value": "91343f360a3a8bdc7ca366c85ed573590f723f95267f6c37056619716f3a9759671edc06bb54acd80560f7a77b9e92ca", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789992, "uuid": "cd76b248-ed2e-4858-b526-7ce22e286ecc", "value": "T17C955C3CEDE8A8A1C3F15AF970727348CD27587845E6D19B4290F0F476943EB7A66A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789992, "uuid": "95bf82e8-b87a-465f-af0d-f4b831a998eb", "value": "7a7a9ac40cd670433b285ea5ed2b1d4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789992, "uuid": "d034cdf2-4a81-403f-b070-2f0bc279a657", "value": "49152:lbfq36Dm0Agq2mUAZi79NXwDmjwriPb7h3FC:pfxNAgXQDmsGPh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789992, "uuid": "017feb40-2e11-4886-a7e7-2f9ce10b27db", "value": 1889336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789992, "uuid": "68cd2aac-9f6e-40f4-8090-659e7ee4457f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789992, "uuid": "8a3b0d54-c1b6-4dcd-b763-dc6f9430cdae", "value": "DHL ORIGINAL DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743916e5-a6a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675746506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746506, "uuid": "e5bf8cce-56fc-4bf0-ad75-5e66db8e1d1b", "comment": "Malware payload (RedLineStealer)", "value": "c1c43012aff2576fe55079a8c4571e0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746506, "uuid": "fde17df6-fef1-48db-869f-26a394de2e2a", "comment": "Malware payload (RedLineStealer)", "value": "69e92aca5216819f5ae97a6461c3e8d125421af08fab8b68acb69755a715fe8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746506, "uuid": "089bda67-5111-4dd6-8de9-b28aec10dd1b", "comment": "Malware payload (RedLineStealer)", "value": "26ba36a18e7614a057bbc0e537afa4e17900c651", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746506, "uuid": "fd2e34e9-6df7-4c87-b496-0dd2c01f76ec", "comment": "Malware payload (RedLineStealer)", "value": "1aa3e6f04fc83f60790679f1538c62837b2b9a87be3452569d5e62831b7042fc70eab90be4c9983f0abd0bcc3b3aaa89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746506, "uuid": "6728c41f-5ef2-4cdc-9260-9f3c74efb2a1", "value": "T1781519153BEA9E23C25C3B3294D9CAA13768DD2C9692F66B75961F93F813306CC03563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746506, "uuid": "e6929669-9b62-409a-8daa-0d4af132d313", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746506, "uuid": "9a8e44f6-703f-4b02-a700-52ecf85db9e9", "value": "12288:EF72qiXznLfjX7PTHOhLsNPJ7lGvfE/zBWDH9kLuimal6jW3c8Si1RdxLuSYsHZ:EFHSNPJ0vfJyX5l6jW3cHi1jxLuSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675746506, "uuid": "4d8715e4-8166-43f4-b382-ffc2ca047014", "value": 919040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675746506, "uuid": "814371f1-d287-4a22-b957-434cb5f8221c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746506, "uuid": "ea71a331-7b54-40ff-b8e3-8631a43c28aa", "value": "c1c43012aff2576fe55079a8c4571e0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c810d991-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675794321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794321, "uuid": "5c4bd694-5d05-478c-b033-e86553f8a6f2", "comment": "Malware payload (Quakbot)", "value": "19b3a84dc2fd71aadbe47458cbd0e4cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794321, "uuid": "0f2068e8-33d0-4ca5-b9f5-187059b958b0", "comment": "Malware payload (Quakbot)", "value": "69fc127cf404c0a8126d1489b099d67bef28852d47c0854d85d0df1ea9d7e903", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794321, "uuid": "521b6ba0-3f46-4665-a0ef-3221ce518eb5", "comment": "Malware payload (Quakbot)", "value": "5e544d53f740b283acde982ab5af4a76718ef48e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794321, "uuid": "b22f915b-9d62-45f3-b125-2db413ff90f2", "comment": "Malware payload (Quakbot)", "value": "686a72ddf91a44d96489f43d4ff016eea562528007f79b83dcb510ba61824854a5cc715f049c2c37840f478135e39752", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794321, "uuid": "ee5d95d8-98b6-46db-9c7a-ea56d35837e7", "value": "T19D940805B792873AFEC7E0BF0346829A9A74627BA433501E6514BD75FB303B1716E932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794321, "uuid": "eb25fe49-3b73-4226-81ed-3210a71c91dd", "value": "ed7b82ba2c3d48fc4ed65dff68081358", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794321, "uuid": "0672df44-a672-4dd2-8b53-b40e2d412002", "value": "6144:Iubpx1ymed01f3UBRxFoNgKIlp6Ydc2Zo5QLxZ8Ex6kmh08PfJO8L:XN8d0dkfxFoNgKIlbdc2WQLy28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794321, "uuid": "d2cbf392-2b6a-4172-864e-495dc400d4a8", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794321, "uuid": "ded66777-5094-4dc1-8570-08c095618d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794321, "uuid": "fb68820d-05ba-4398-bc19-6712d8668c10", "value": "60852.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ff48ced-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675789959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789959, "uuid": "4bbddf3b-bb9f-4e28-8464-06182dc30b94", "comment": "Malware payload (Rhadamanthys)", "value": "fa10fa3a71059cdc50ce89b53c2df731", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789959, "uuid": "4a82abdd-dc80-44ca-b850-940ba06528ac", "comment": "Malware payload (Rhadamanthys)", "value": "6a7afb8f7f2a67c98cd75d271fa90b7466adcfd86012fc62e88d5f345d8433d6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789959, "uuid": "d27734ec-38f4-49e7-9c73-e896f2f9f98c", "comment": "Malware payload (Rhadamanthys)", "value": "a16c3b58b47d6adb4fd1ea3df65cdf81d0470688", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789959, "uuid": "353c9798-8f39-47a0-b7de-c2fca607159d", "comment": "Malware payload (Rhadamanthys)", "value": "83d192cd11c94154348b737e12ec4276084abd657f740c21ceca7c106d07fcd797b654758d0afc740d363841a0b0c986", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789959, "uuid": "393ec945-ded3-4173-a87e-2d470b860d4e", "value": "T18C757B835A99A357C3E6C6F3591301F07EB17999F94EC08313BA5E3D2C956830AB271E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789959, "uuid": "21230fc4-6900-42db-bac3-1f40dd3e31dd", "value": "61ad665502ca1c66fbbbb4bc3ca6cb32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789959, "uuid": "f5b2108e-1ff2-4bcb-a2bb-0b3879308598", "value": "24576:8Hx7en6674l9yg6t4KYMtT98FfjO2nnLGxgb0dttuHJYlyPhdiIWuq:SXNl9jYYLO2nnLGx0OncmlWhdYuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789959, "uuid": "7989c6fe-e178-4970-bdfb-cf8544db81fa", "value": 1676432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789959, "uuid": "f81fe9e0-cb4d-4e78-a32e-fef59728691f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789959, "uuid": "ed96889c-fdd2-40f5-b4bd-84374337ffd8", "value": "DHL Original Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c17a507-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675796207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796207, "uuid": "79b84bda-065e-4a6b-b323-5400c7ea7081", "comment": "Malware payload (Formbook)", "value": "213c726e8c807214f78e31856da4c4f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796207, "uuid": "5c8c4b9b-0d22-4600-8656-539185168a02", "comment": "Malware payload (Formbook)", "value": "6aae46140819f63ba6d8021f344c1e45fe751050aa6fa5d47e87711f4beb0e90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796207, "uuid": "b7b5b114-19b4-418c-b152-537f81fb9415", "comment": "Malware payload (Formbook)", "value": "547c329961b00cde647830a48573696dc86d722d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796207, "uuid": "5b37ee3a-d48d-42f3-bb14-ec57e63ed014", "comment": "Malware payload (Formbook)", "value": "d5f93f45473af57be5ba2fba6bde2ae3d009622356dc1a79e315780fe7652da22f52f7e70c599c83e36bd49fe1d35b2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796207, "uuid": "b2b85aed-3db6-4fb3-83ef-896e3674657e", "value": "T1D605220D2BFC8F21C6A91BBD68B40170477AA41A7556F32E0EE632DE3D76B640901F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796207, "uuid": "e12de0b9-23eb-4cd3-a84b-60e022a63d85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796207, "uuid": "4bc10258-141d-4786-b740-5c3d149f77f1", "value": "24576:tCrpqUsq/8sWo1e/vKihpcJ7OcAtxjNQrGawxO5d4Z:asC8V/vTpVKrGTsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796207, "uuid": "dd2969f3-1a72-4991-b2a9-4e4ebac60f36", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796207, "uuid": "1675d8fc-5ac6-4866-ba0e-bdc4893bce13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796207, "uuid": "a63f7550-4158-40dd-9558-d920c4d6697a", "value": "213c726e8c807214f78e31856da4c4f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "638d9090-a68b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675735311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735311, "uuid": "d79be37f-2cf3-4561-88db-d4589e275cc8", "comment": "Malware payload (Amadey)", "value": "f4d862c63f3bbb007c3cf4de6905b946", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735311, "uuid": "c6ecdf75-b708-4a12-8da4-d2ece98d745f", "comment": "Malware payload (Amadey)", "value": "6af3b99aab7b9ecba87debb6ec0429b279dac188c608d41a9b4df6a43ecff36f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735311, "uuid": "1431aff5-9e3f-4e49-a4b0-4fcee1f870c8", "comment": "Malware payload (Amadey)", "value": "354aff5be6299cc35388b69433ddd1eb7cdd899a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735311, "uuid": "73905e1b-e125-427b-9f35-789b1d79ac1c", "comment": "Malware payload (Amadey)", "value": "78a45321b0c664be79efbcaf13313d8c4e471854ff10cbbe38544baeb4b7525f689f6a4b1be715cdaa13b490a85525fa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735311, "uuid": "a61a0e01-7787-4f98-8d8f-112e4eb8292d", "value": "T130644B43B3E1BE40E9278B72DE1EC6E87A8EF5418EBD776522189EDF14B1076C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735311, "uuid": "2dfbdf8f-74b7-4a3e-bfcd-2e61d5d256d0", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735311, "uuid": "6ffc7b4b-4576-42de-a52b-018c226d27e6", "value": "6144:tO2+LmUhW7Hnng7pHCSvCVemTuQj9YF8aL:UdiF7HqpicCVFljb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675735311, "uuid": "a1781a40-ed3e-4cd9-b6bc-bd69536fabfa", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675735311, "uuid": "915efb37-5746-45c6-b45f-5ecdf4404fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735311, "uuid": "c26caba5-5e6b-48bf-97f0-ce5759e5acfe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88da4063-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (Glupteba)", "timestamp": 1675788202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788202, "uuid": "1e8efa4c-3518-4b80-bdfe-cfa54b9dd5f1", "comment": "Malware payload (Glupteba)", "value": "e0c71816a1c59f04f32c78d6114f6fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788202, "uuid": "097de098-b8dd-4012-82ff-a282a4b90e5d", "comment": "Malware payload (Glupteba)", "value": "6b23195ae6f7219126fb7344a50effd49a93ecb29c580ba8470280f48818e34a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788202, "uuid": "c8c088da-48bc-44a9-a7d0-67146222ff2a", "comment": "Malware payload (Glupteba)", "value": "83d7baa28a29e1edda7203a8b485cb56eecb1fd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788202, "uuid": "46c1da99-5f97-4a75-a541-d6ee807e2820", "comment": "Malware payload (Glupteba)", "value": "74b67035e7262eec83bca7e8f2bce7e6c2a92ff72e09adbf435dcbee9e7beabc0800183cfc3fb4b64c06eba06c8c34fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788202, "uuid": "c7524bc2-55ca-49e1-9222-ff2078e890b0", "value": "T176163342F7A0D1F7C7AC20B06741377D02A8D22B23ABE97E35602D2F55A55CA48F7369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788202, "uuid": "c7106289-6b1d-40b0-a0bd-7368ce0abb62", "value": "ab6f9c627ad0c79047c9942afaa32bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788202, "uuid": "3a1a027b-9408-4af9-b477-d0ca8cc9e3a4", "value": "49152:9MNvexabSZTToojLB7UbO6dnx+03A71JWahrq2wQubFruTaBlQqbwxBHOn/4Zc6s:2Nv/SMoQO6JE03A71JNJ2DBR0xhH38br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788202, "uuid": "0adf01db-97b2-4230-96bc-076a99de16ec", "value": 4237864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788202, "uuid": "d0dfb024-602a-42ba-bba2-0746f44fb40e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788202, "uuid": "0e394508-5090-4bd0-b315-c02f58835d37", "value": "6b23195ae6f7219126fb7344a50effd49a93ecb29c580ba8470280f48818e34aexeexe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7eb1e7-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675788180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788180, "uuid": "173451a6-f150-4736-b161-6ec911367aec", "comment": "Malware payload", "value": "0770b122545119afb2c4e87a2b6732ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788180, "uuid": "3b6f4c88-d5fa-4c27-8848-09c8522ef5e4", "comment": "Malware payload", "value": "6b2b4ba436ffb3f5cb5872a1c590c8504a26a2d003cb872313fc722222ea6cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788180, "uuid": "df82555b-0d1a-4168-837b-e2090ce8b37d", "comment": "Malware payload", "value": "d644fb9b8fead525dae31c75ad58afff3d90e33d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788180, "uuid": "9a8d6bdb-3b6d-4790-ae08-48aa8f7898ed", "comment": "Malware payload", "value": "d2d91af86d26d4ae9e377d4a74f718436fdd1c6bfb8074ca27becb3becc33f4bae07bb9abcb4e3939f218db4ae56a06f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788180, "uuid": "b951a287-b653-493d-bd0c-3f9e19ba7e3d", "value": "T1217623146EC90C7BE8BC5DBF95134236B5F9C49EF22BA3E70011B6690F5B0A2DF42265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788180, "uuid": "c8ccc41b-78a7-4fce-ba58-93dbbe6cd786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788180, "uuid": "9e24558d-e1d0-4537-8d5c-fcb614c49257", "value": "196608:TwH8E5+Itu+2TzWI1CSfMqvCQoQvySRBJ:TwcQ+egoWv9vySRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788180, "uuid": "ad530fc9-d655-4c1d-ad85-b556cee83554", "value": 7397888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788180, "uuid": "4f30d008-d235-45e8-9ce1-6a51fa35eecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788180, "uuid": "a0fe4894-eccd-4ffb-9397-bb6420f67013", "value": "0x000600000001ace8-206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46a97e0-a6c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Sodinokibi)", "timestamp": 1675761190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761190, "uuid": "a44aa564-14cb-4934-9355-c0885dbe2fe8", "comment": "Malware payload (Sodinokibi)", "value": "3d20213a55eba582103888a64db1e900", "object_relation": "md5", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761190, "uuid": "8464d838-668a-4e7f-9e41-235a519536b6", "comment": "Malware payload (Sodinokibi)", "value": "6bfd4fd81e590d1aee9451d5fde3cf5d22706a85e71583a4cce1683d50b89df0", "object_relation": "sha256", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761190, "uuid": "e2c1db44-05ed-43bf-a8f2-52a6fdbda3cc", "comment": "Malware payload (Sodinokibi)", "value": "5c56fc6e2f6ed5837c8197b5e0d9b930414359ad", "object_relation": "sha1", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761190, "uuid": "70a96ef0-1310-49ec-beeb-7ab706edba55", "comment": "Malware payload (Sodinokibi)", "value": "c398ece85dcb4eebfa3d559ad4c98548ce76d9218d74e244b6ea07eebd405bcbb02637e8915c86244b733a8241df0c89", "object_relation": "sha3-384", "Tag": [ { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761190, "uuid": "0e12944c-b18e-4226-9f81-37d058c7ef46", "value": "T1E2A4C67E76CDE03DC40A5EF5DC1B2B64A1B3D8E49799D613698C60AB0CFA07CC91EA41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761190, "uuid": "3cfd6396-6c57-42f3-bb0e-44a8bbb0d966", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761190, "uuid": "d71c3b69-1490-4ef9-be2c-e483089f1d4d", "value": "3072:sr85Ce8F63VETed7/kBazzFbULpC15RM4ENKQ4JTBg0hDWjZtQt/dR3PyWHqvC42:k9eS63VE6F/M4qE15NENn4FNDqWJ4PXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761190, "uuid": "bc3ad3bc-5b52-4f4d-bb63-72a5d6edebca", "value": 463401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761190, "uuid": "b828fbfa-2601-4a91-8ee8-6f7fe503a480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761190, "uuid": "25c90e13-0b4e-42fa-b077-741c9654b1e2", "value": "2023-02-06_3d20213a55eba582103888a64db1e900_neshta_revil_sodinokibi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e7edca5-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675758576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758576, "uuid": "a5750237-ec72-4839-9e70-7dbb76daafac", "comment": "Malware payload", "value": "492d9f36071a7249c5b82ba93356eda0", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758576, "uuid": "0548d648-8510-478b-a1e4-2e1f14425856", "comment": "Malware payload", "value": "6c01721c4512a1df4945773cce7cf307df51ef073bda52aa3600983e9227bd9b", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758576, "uuid": "94f1acb0-46ee-4c25-b172-deb7d1cdf1dd", "comment": "Malware payload", "value": "7c97b06934014541554341c240fc5aed01a82925", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758576, "uuid": "ad7fa276-252d-4bd6-921f-8d5eaf6483bc", "comment": "Malware payload", "value": "6cb7120c5abec9c16db896d90375bb7196d7edc3c0e3bb64bef912b482763cd59ea76d9a7cbb7cfd5e90bb26c3910f85", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758576, "uuid": "d0b4d7d6-98bd-45b2-ac1a-f55ad8264522", "value": "T11494394BFA008B36F0198E7259E74B443612ED159BE215672224F21DFEF32E05BB5DE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758576, "uuid": "b3d91bae-4108-4ecb-926d-ee6c9f6d1eee", "value": "6144:taFJkKXiDU7wBB4A7y/BeZ+RwPONXoRjDhIcp0fDlavx+W26nAj90w5eSbEjIu4S:taFiKXK+BDewuje51Ij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758576, "uuid": "1d7167e4-5903-4703-b305-cff3f436ea61", "value": 426496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758576, "uuid": "c9bee95a-35e1-4e3e-9fbf-aedcd2250070", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758576, "uuid": "7219c14c-cc7a-441b-aeeb-bf2056de9b7d", "value": "Purchase Order-PO013199.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6617780b-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675794157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794157, "uuid": "81ec21dd-f6ff-4b92-afaa-cc1bd0c9d68f", "comment": "Malware payload (RedLineStealer)", "value": "4efdf3a4c19a94b2e58f5212124cb161", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794157, "uuid": "abf61817-258d-4f45-8b71-df87845b1cc9", "comment": "Malware payload (RedLineStealer)", "value": "6c188098c474ab5e86923f93dd49426d17d4d356832b5da9f79db95e476820b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794157, "uuid": "92000cf7-a145-4969-a6ce-19aa9a6cd1a4", "comment": "Malware payload (RedLineStealer)", "value": "e6e18040cf9552dbebee940602baa8994c83a474", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794157, "uuid": "27e72fda-7fb7-4d2d-99c6-f1eb20b618e8", "comment": "Malware payload (RedLineStealer)", "value": "d9244ab14920514145d5f30715d2a9ffd86de0ac70c473112941409a163a36ee43189d3f08e1d579dcd80d14a43b9d21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794157, "uuid": "0c45e27a-a8af-4c29-9b80-2fcb933435e3", "value": "T1C6A52303B6C2D5B2E6221A324625A762597C7F201F148FAFF7CC9F2DD6351906624BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794157, "uuid": "7f4dc64a-b07c-4693-ae35-79532106976d", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794157, "uuid": "5147503d-2018-48ab-9df1-1cf0ac7b993d", "value": "49152:V5Oku3Fk+/Ek++gTQwYuvVMyRfNbhCm5r2a1GrI0kh8oo:V5k/C+9wYuNMytNbj1E8z6oo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794157, "uuid": "cd0580ce-4e38-4211-84f2-73e761ed5713", "value": 2182849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794157, "uuid": "78a3302b-c445-466f-99c0-d388fb9c04fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794157, "uuid": "b44077f3-edd7-4770-a795-015342c729bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc863d4e-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675790007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790007, "uuid": "b5d78b56-7370-406a-9fb5-852be5874784", "comment": "Malware payload (AgentTesla)", "value": "fb8cfd46abcb35810fb8410c72360d38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790007, "uuid": "16c8d6c0-6ceb-40e9-891d-ec2de9dcdfb3", "comment": "Malware payload (AgentTesla)", "value": "6c7ebdd3eb38b4f3c3f20c41be71434add09a2bdd31c1fc79fe9312de1820e13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790007, "uuid": "8af7ae35-1a09-451a-b0a7-d4ce16b4737a", "comment": "Malware payload (AgentTesla)", "value": "14f6849cc9b3af8ce07aa7b661daeaa364aae10f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790007, "uuid": "e58b750a-e781-4f07-ae59-02a079ac2c4d", "comment": "Malware payload (AgentTesla)", "value": "bb90071072b5ba62218ad7220f05858f9525a7d99da7b52f3d0fcc74be2b9aee427b6cb99abd2335aeb148735393c1a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790007, "uuid": "6fbd8cc8-a7f2-4dce-a1f7-2464a40ab1e1", "value": "T14F85BF42D5736635F4BD7C3B2C9723C20674CCACEA0B784B11C8B2EEDC5A1786591BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790007, "uuid": "1f89e723-ad1f-4def-9823-0ea1961992a0", "value": "7a7a9ac40cd670433b285ea5ed2b1d4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790007, "uuid": "dc377f24-f529-4155-8a8b-f393e79973fa", "value": "24576:AMpI9OMfKK+XsXMMa6ZA2KErQyd/OlBXObr3ZWgaVUL9+kEEMtWLxIDetHCAg:rQPI1Ma0A2R9OlBe33csLFzMzesAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675790007, "uuid": "31b434cc-3ef5-4116-80d7-e4739e051d41", "value": 1778720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675790007, "uuid": "81eaebd4-2668-4937-a7df-f77f2a280b64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790007, "uuid": "4f32eba1-9208-4fe1-a748-ba950ffa5a2c", "value": "DHL ORIGINAL DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd31b15-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675796213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796213, "uuid": "cf3f5183-32e3-41bf-a19f-b850e11055fd", "comment": "Malware payload", "value": "641a933e19a1256c18f8130488915511", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796213, "uuid": "78b72e18-2465-46b7-8cc6-56674773f188", "comment": "Malware payload", "value": "6cbcfadd3b515a9fe3a7c612d2a2045d848df608a4e10a96ef37aeaabc8e6339", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796213, "uuid": "317f377c-57bb-43cc-9f70-863b3b89093e", "comment": "Malware payload", "value": "b11524acd10b1fff115bc40292a199f54cb66a5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796213, "uuid": "ed9b08ad-a519-4b2b-8055-e0b3adf14790", "comment": "Malware payload", "value": "89254685746a86ed6d7bb31e71cad04c0ec15113d89c06c5653c866ea09b7a3579d697982d8b12655fd2536f6b86fa34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796213, "uuid": "fe2fd0aa-c90f-4211-a70c-c98f5be1e91c", "value": "T1B4E53301BF801F99D641A5F4DC3E079DEB24CB5AFA83DBD3298058107DE37E6252298B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796213, "uuid": "e4266247-fb84-445c-b2c6-fe5789b85f1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796213, "uuid": "c4708c3d-2767-4426-bf36-59cb7fdf8e9b", "value": "98304:Kp/skP+Rjfw5y7qXI5MCVpvtBaUp4dFw:u0kP+1o5NXImUBaXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796213, "uuid": "92286d32-e17b-4a35-bbd9-6fd1c47208e8", "value": 3237376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796213, "uuid": "8a47508f-8b99-4477-a277-79331f1e3ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796213, "uuid": "83ed8aaf-8c0d-415b-8cbb-de43bca6dc47", "value": "641a933e19a1256c18f8130488915511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c5b75b-a687-11ed-88f6-42010a9c006e", "comment": "Malware payload (Casbaneiro)", "timestamp": 1675733710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733710, "uuid": "c25a0ae3-4e19-4c5b-abc4-26303e88f0d9", "comment": "Malware payload (Casbaneiro)", "value": "c2766d4a4f4d3f129c452838abef4f33", "object_relation": "md5", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733710, "uuid": "4dd10768-ef25-47b7-b7c6-a670bf8abce6", "comment": "Malware payload (Casbaneiro)", "value": "6d5562256840a1856dd4e60b20f2d0a0edf8a0c18dbd779ffb501c209385ba9d", "object_relation": "sha256", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733710, "uuid": "cc4f427c-0b62-474a-a993-dda8c4abbd20", "comment": "Malware payload (Casbaneiro)", "value": "878ee830651510030b68208340cc1c98774041e9", "object_relation": "sha1", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733710, "uuid": "f2150ec7-2b1e-412d-b32f-0f6032bcec0e", "comment": "Malware payload (Casbaneiro)", "value": "c41b516f2b595798856a78e59c17b8f4fe36cc3a53df52805d4b7495c63f2ea8368c67ab7da4a3535ca5934e14fe1e5a", "object_relation": "sha3-384", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733710, "uuid": "695cc05d-ac64-4b34-b328-29c782d08468", "value": "T1156733488AE79FCCF38FC37E40ED0BE4A6804613566A7AE493D1A8557E33837D549887", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733710, "uuid": "a654f5e2-32a8-4709-bd31-8c72b0643321", "value": "786432:ZDwpcw8mLTUPe6WOwGeCjn+di0wK/+QC2g:dwpcVAoPBtwGTqdxwKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733710, "uuid": "a0d98033-054f-4afa-a7ca-fa02213b1281", "value": 30304049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733710, "uuid": "2b92d730-d37b-4534-a697-eb3a2e4569e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733710, "uuid": "08a87b8e-7b94-4302-a669-d749a24e3be5", "value": "notificacao.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f077b3-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675761587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761587, "uuid": "8ff693a1-69a8-455c-ae54-26667eefae20", "comment": "Malware payload (Loki)", "value": "8efa190958c4354b129ccf93f40657d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761587, "uuid": "f3f8177e-efd2-481d-8dc1-301081ddbdb5", "comment": "Malware payload (Loki)", "value": "6d73e767959ba770dc38fa6cfc31459903cefb11c08058c03c378fe79b409982", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761587, "uuid": "dfa4bbcd-b17c-42b5-a6dd-9f7330e18f2e", "comment": "Malware payload (Loki)", "value": "da71db0345ef44e36b14bf36ca5fbc1b3c110296", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761587, "uuid": "0abe3ff7-a6d9-468f-a719-f2e55db330f7", "comment": "Malware payload (Loki)", "value": "4eb81cf2c7a75fea66f108699aff4b7840bd9d842fdc30eb83285d898577ef0b90fba92e9728782b7c2f55475b685831", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761587, "uuid": "7b503758-a30f-46fc-a7de-cc86936591d3", "value": "T15DE4225E733C9A22C94E4A7DD4E5562103B3AA2CF192F32CAFC921FD5D52B944F82643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761587, "uuid": "fb7ae66b-2e00-4f20-a4df-edd3264e06a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761587, "uuid": "225a1aa3-327e-4caa-8cb9-8c0be93d12c8", "value": "12288:Sm+0O5z4dNQ8YX2x+xA8RoeuynF5KH0vDXlk6eEOrx7p58lCrd4gyQapWMs0PA:y0jRYX2x+GMxuGvKgD1/yrxN5IC54TWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761587, "uuid": "f3fcd9ac-faa2-4d8c-8741-70b0fd1a2a22", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761587, "uuid": "73815318-8e03-4644-a81a-18ead2f6f13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761587, "uuid": "5bed45e9-227b-448f-9082-eaa37e6b850d", "value": "8efa190958c4354b129ccf93f40657d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1b73e0-a6fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675784636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675784636, "uuid": "659c3cd7-bebc-4986-98ba-114196c4c0d0", "comment": "Malware payload (AgentTesla)", "value": "b435125e4066987b4469ff7d7ed61d15", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675784636, "uuid": "2b1bebc0-d14c-4da3-9757-582bfc8cfa54", "comment": "Malware payload (AgentTesla)", "value": "6dcb88d4431e0ea3673e741ac379ea47c01665f39c751f02344bc09767d9e1bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675784636, "uuid": "455c1ac8-e98d-41eb-b78e-cba2dc86e811", "comment": "Malware payload (AgentTesla)", "value": "9480420c4d8ed6ace9cfafdad1add5888de82795", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675784636, "uuid": "cfe220c6-0dc3-40a5-ae60-561fa322f406", "comment": "Malware payload (AgentTesla)", "value": "a4ec83c13bbda176a17f4fb6351e7aa9988e97f0581dc06f439df68ecd70ccca6d1e9b29b131c0dc2d1915b2ea04ac0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675784636, "uuid": "08c0e55d-62bb-42bb-b932-c72977685559", "value": "T1D26413742FA0C193D8B114731EF75A4BEFF1D11164B8978A2B224B0ABE207D7CA1E765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675784636, "uuid": "027d486c-7d67-4329-bddf-366f4acf91b3", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675784636, "uuid": "0dc94358-6f70-44eb-8a17-64bda00eae3e", "value": "6144:vYa6diS9VuCUkLxlEaVgjBJwjx/kiUuJvDu0Yy60aejy3bLy9zK:vY/iS9VB/9lEaYBJwlkpuNDu0X6sEbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675784636, "uuid": "5efa6bdf-844b-4378-972d-7f090053af85", "value": 326070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675784636, "uuid": "4822cfd0-b813-42fb-beaf-d5242db97e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675784636, "uuid": "ad8dd6a2-dd36-4767-b67a-0e7b6e05373b", "value": "PO_72302991PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f10f28-a716-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675794888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794888, "uuid": "b4edf9fc-1b44-4bd7-a5a4-0d9cc32dc071", "comment": "Malware payload (Quakbot)", "value": "e72a2c94e84a6457842987623b38505f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794888, "uuid": "dfc2c36c-c539-45d5-a863-0bbdbd3394a2", "comment": "Malware payload (Quakbot)", "value": "6decda40aeeccbcb423bcf2b34cf19840e127ebfeb9d79022a891b1f2e1518c3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794888, "uuid": "33b78f82-de65-4909-80e2-9eca7d650fef", "comment": "Malware payload (Quakbot)", "value": "697d305ac202375be260c81612a72adf4da73dc4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794888, "uuid": "4ab9f416-9785-4de8-93a9-b03abc22a9a1", "comment": "Malware payload (Quakbot)", "value": "844f4036ecea55a468708623c63285cfe9ab1700f5027c1887df8fb48080062f0a45b6571eaa10b790decdc4ac64b416", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama237", "colour": "#03BEB5", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794888, "uuid": "2973394e-83ea-403e-811a-229d36e28b2f", "value": "T1F7940805B792873AFEC7E0BF0346829A9A74627BA433501E6514BD75FB303B1716E932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794888, "uuid": "ec0b4835-20cd-465e-92e6-3abf39a70cbd", "value": "ed7b82ba2c3d48fc4ed65dff68081358", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794888, "uuid": "dadd850f-10be-42cd-9567-e9995699c54f", "value": "6144:Iubpx1ymed01f3UBRxFoNgKIlp6Ydc2Zo5QLxZ8Ex6kmh08PfJO8L:XN8d0dkfxFoNgKIlbdc2WQLy28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794888, "uuid": "49b1b74c-4ab8-4bd0-9f10-ade58d5dea80", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794888, "uuid": "4a930275-6a2e-468a-9bec-3fc045fd3fab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794888, "uuid": "83a0d53b-7fdf-4511-b03d-b523a7fa7f32", "value": "60852.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4655c812-a6c9-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675761891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761891, "uuid": "6acbe797-342b-4564-874c-d124486b6bd6", "comment": "Malware payload (Formbook)", "value": "5af999fe6d9b7d0031283b55ec7e3b9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761891, "uuid": "bcd25cf9-ce8b-4d66-a3b1-76e8fe935a6f", "comment": "Malware payload (Formbook)", "value": "6e3586d3d73247e903966db351c66e4ea78da6a3607116129aa79eac3c1b2d70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761891, "uuid": "940f6e8b-af62-4848-93c8-69bcc05f237f", "comment": "Malware payload (Formbook)", "value": "492fb1126536ddcf687cf6ab527c4fbfaef5dbdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761891, "uuid": "39ff066a-921e-4e91-8437-9092f5224cb8", "comment": "Malware payload (Formbook)", "value": "05680826e675646dc3e904df4d04c20036556f140db6365f3972791498367b5d1afab17b74744d2575a364a79e57927f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761891, "uuid": "976f7d8b-f45f-4af0-a53e-8a790501ba69", "value": "T1640423114BD144BAE476F83F690F58BA6F2F4E66A12A20625B5DDC19BD043F434B3D07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761891, "uuid": "bfed6221-768e-4475-b22d-c82206d09a7a", "value": "3072:6PWoAenxbOre3VWiID4UuokpT1p7HcYAwqflupCRWYze7x0kPNqv:fSQiUiokfp7pAwqNuPYy7ykFqv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761891, "uuid": "fe2be797-1b72-463a-8c23-4b58ffc8db9a", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761891, "uuid": "8a3b3576-96e7-4668-87e0-2a6852963557", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761891, "uuid": "ce9d5e6f-4caf-4a1e-9f6d-1c0bf691e398", "value": "6e3586d3d73247e903966db351c66e4ea78da6a3607116129aa79eac3c1b2d70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c06cc6c-a6ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1675778114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778114, "uuid": "190cc8a8-e40e-454b-a6af-60fa5e48e84b", "comment": "Malware payload (VectorStealer)", "value": "a1c496c6f57e369cc592fce0ea75bd8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778114, "uuid": "c5286ead-0e70-4fec-a19c-9bafc93d9945", "comment": "Malware payload (VectorStealer)", "value": "6e6362d1a6101b847c0fcd3dfcb43f4bc08ea0960d54e03b2223f3bb28f9a329", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778114, "uuid": "5ff578ef-f983-4982-aab0-00f8febddcc0", "comment": "Malware payload (VectorStealer)", "value": "1291e6ffa41e3fd0d202b736f927a1ce8a41383c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778114, "uuid": "443fdb81-7065-4f15-b90c-4c53e0138b78", "comment": "Malware payload (VectorStealer)", "value": "b65c5f2b585b56f866ed34e8938744ba69b2dbc25e4a21469a968c9f60fc2a633fd36b622f545e1cea1d3a5f9f12f6a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778114, "uuid": "519f5121-9330-46dc-af21-bfd5f3095a1e", "value": "T12245ADD8988AC042CA3D0D79CF99CBC22343A912001F397A6DFC6655567DDA7E5CA3CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778114, "uuid": "1e5958bf-6322-4129-a698-f7d08db361e1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778114, "uuid": "d35a7218-4b9d-40d7-951a-3a65c4ce4ac0", "value": "24576:IYswpS+i/oZPaBdOXgqy1VYK+ydwbodXq83DgXnLYxLbQGm:ZBpS/oZPaBdtx1V7+C/w8unL40x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778114, "uuid": "4f27e4b8-9d3e-4270-90a2-93a44aa65cab", "value": 1164337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778114, "uuid": "2ca9e051-ad20-4d76-828f-76d6181ad086", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778114, "uuid": "ed67b95f-a046-492b-86c1-0bf6afe78e0b", "value": "svc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8323877f-a6d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675766718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766718, "uuid": "c3f57aa0-5458-4e79-8ad6-e4e12e716ab1", "comment": "Malware payload (Formbook)", "value": "7cfc7221a9dce25d158e79c10e229c18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766718, "uuid": "69159c7d-c036-4f7c-9f06-6619a1218f48", "comment": "Malware payload (Formbook)", "value": "6e684555c5cc0b3e36348e9bf1c5c23cf8ae19790741344295ca741233c9b846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766718, "uuid": "0234945b-cf59-4116-9e01-9160eab14f88", "comment": "Malware payload (Formbook)", "value": "5c6b78b91a9ffd33ace0d2926f19e0e4fb4ec2f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766718, "uuid": "a4c34997-877a-4acb-b871-3cdcec7f17d3", "comment": "Malware payload (Formbook)", "value": "65a7a8c08a3256a0b8bfb2814e77fcd159299c5144865d333df3741b4caed0d448e5bbd62a75500c14868311bd311352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766718, "uuid": "0675dbf1-e892-4c3c-b33b-452172cec1be", "value": "T1F6052211B5A8C760CA7EA9F5AAF862C01338A7153921D76C1DF923CFDB52B5BCA10713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766718, "uuid": "8ea9ae39-4c19-4126-a628-df17f34e085c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766718, "uuid": "19c6625e-221a-4219-be24-869ddc14752f", "value": "12288:ZpkuPA+cXnyXx6q16ahRZ5GxprNMeFkBC6h2sdJEEEofQXUZgrYe2jjiVM45qoIU:XA+1NMS5G7NM4dl2QknjWV2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675766718, "uuid": "b54671d7-82c6-4567-8607-713eae4536a2", "value": 813056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675766718, "uuid": "671f170c-d8d4-41eb-bba0-f2147d62b2d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766718, "uuid": "8934d75e-2cf7-4628-9390-7d20e7bba299", "value": "OFFER_LIST_REF00447565757758858.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a7887a-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758582, "uuid": "25bd5cec-b58a-411b-a683-9fec73e4d3b8", "comment": "Malware payload (Gozi)", "value": "a525656b8ecfeac77d363b7bb3b38364", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758582, "uuid": "470005ce-0f67-4d13-b190-84cf8fe0af1e", "comment": "Malware payload (Gozi)", "value": "6eac01ee3addb4f2cf2bbc77026096b41c21980598c23c8d5cf24c0a471c679b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758582, "uuid": "c533158c-fa10-4133-97b0-968cdaf817af", "comment": "Malware payload (Gozi)", "value": "aa95f7751f3fd8a7ecc2b25e217ea5f984bd1168", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758582, "uuid": "9a54604b-b79e-4b9b-9677-876cb0a2fdd3", "comment": "Malware payload (Gozi)", "value": "083aa3e51a0f8bcc314d99e68c37de8e30e70af4aaf43a818d071ccf7cf5ac0d17ef3fd447b01921e3095c05a5e0b093", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758582, "uuid": "7428a624-0069-45da-8e0a-9468556207f4", "value": "T1C9A19FB1BA9B840979C3A7868C8670BC17EC3DAF225F0B919357744132585B174F961A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758582, "uuid": "d32777cc-5668-4da8-8f67-65bcdcd06594", "value": "96:5BlKAn77hvTyPHZB9fD7JDxI359/FxYSLKp1fH2089XUnIH7ww6J:t7s5B1DkmSup408JOIMwy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758582, "uuid": "80862782-9817-4122-a9c1-6d5b7ed1650c", "value": 5086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758582, "uuid": "e7ca74e9-ccf8-4447-a0ab-cdc00107ee25", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758582, "uuid": "6c450438-6a87-4f0c-98f2-ea86908c41c2", "value": "azienda_11.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05fa3ed2-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675783258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783258, "uuid": "af8f6f71-17cf-46d9-bc37-574a3cc20065", "comment": "Malware payload", "value": "52f60ab2fda69c21df8f2a01a1d5c47e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783258, "uuid": "4e31f924-c1bb-498f-82a0-65865e57596b", "comment": "Malware payload", "value": "6f094760da0a80236c2d2d7100ac5c5744d4cf56c517f848adf5c4e06e84c493", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783258, "uuid": "fab6127f-f4f4-43db-86d0-6b80bf3411be", "comment": "Malware payload", "value": "eebeb9df0d94727a974da89e0a61b8886451cec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783258, "uuid": "65a82492-6e27-4625-8e23-c06092e80981", "comment": "Malware payload", "value": "f474c9244d4c082f7bc3ed2c83ae913d3c697c5849a021576a6f4b7a875c5bb57c84fdb98aff066f3079fbceec63cb8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783258, "uuid": "3b9bb8af-2379-4230-8c30-2ce5c9a78e95", "value": "T11AC1A501E3994237FD914F719E72A3C107BCBB1368479B2ECEC0201A7C1A7894A21FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783258, "uuid": "432e76b2-db9f-48db-82f6-bf03d2dc70bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783258, "uuid": "ef4b8461-f7b7-4a51-92f7-ec1a89ba9ea5", "value": "96:A0yksV06Y4wAoeHDI5brRbYJfgrkDQJSFnU:ABJV5wAKPRbYZgAOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783258, "uuid": "990c2076-8e51-4c73-a3f1-a09346f02d7f", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783258, "uuid": "5370c176-2472-4ac9-b0d1-7d2137593b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783258, "uuid": "ef3afafe-426a-49f7-86a4-df5f9fec263b", "value": "210909836-042205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f5a526-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758671, "uuid": "7bf06459-287a-442f-af09-e659027c94fd", "comment": "Malware payload (Gozi)", "value": "990d3946d8c441bf91e24cc1751053c0", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758671, "uuid": "5909c982-c35e-4df8-ada1-b1b5a732e1f8", "comment": "Malware payload (Gozi)", "value": "6f143bb989d9bce92a11794329b2aae0bd593cff17cd532b830babbf1972e3aa", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758671, "uuid": "4486bc1c-0da4-4221-b7c7-42fd957d28a8", "comment": "Malware payload (Gozi)", "value": "b9fdd85c88cb9ce59cc8bf1f98ffcfb70f31f7b6", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758671, "uuid": "ff9adb67-a7be-4551-b312-b58d41188776", "comment": "Malware payload (Gozi)", "value": "2a44230ad3c75f39f0538ec95933d10e4e9c32f9017a0f6a9efd29b9d7eafe006c249c1de240012713de5ccc2ac9abec", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758671, "uuid": "74ac6498-a54c-40ee-8671-394fbd5cf343", "value": "T13AA19F108CD1604BFECCA9C1489C143D78C47CEE87731B529464320B7CC97CBD99E985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758671, "uuid": "73ab682d-c73e-410b-8c7f-a54111e9c4ce", "value": "96:0dbZs8gQN8O7owltGgTVVjFUse5cjCGe2BOEFfs1rNaGQYQBtdjFMd0:MbZuQN3JIgTjasKh120EFUx2tFFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758671, "uuid": "cbf76426-0851-485a-a8df-75c6e920291e", "value": 5056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758671, "uuid": "083e9df1-efe4-4bd7-8e1f-49d9e2bb5447", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758671, "uuid": "9b289ac3-77b6-478c-8eea-1732605208cf", "value": "azienda_27.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a00afe-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675796458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796458, "uuid": "248ae333-0a83-466b-9a88-d6c1b9d6d719", "comment": "Malware payload (Amadey)", "value": "22d6c96f8fa3e489bb4be34ddfba7aa7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796458, "uuid": "685e5e96-2d68-4525-a20d-4f1edf130894", "comment": "Malware payload (Amadey)", "value": "6fd27e935dafd61c410cd2f1f5aca2d961719729f9319755fd9660e383c1e5a8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796458, "uuid": "0e8bb399-873f-4375-ada0-00aa6351e338", "comment": "Malware payload (Amadey)", "value": "c8a830ce325d98f46fa211ab804e801cb1a4acc5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796458, "uuid": "2043c3aa-78e0-4c97-83d3-be85be91422b", "comment": "Malware payload (Amadey)", "value": "a65f1542a0a21f6486f683144a5a65f2a9343770d7c1c1e5391c0717141a072a5a1f48e7e43961129fa12a7dcf47dba3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796458, "uuid": "3c7516f4-d2bc-436e-ba38-56a85cedcc9e", "value": "T112B41247E2D89026E8B157B04DFB03C315363EA0AA74439B274BAC990D736B4B67177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796458, "uuid": "3f0b446b-f7e4-4883-846f-1edb05818781", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796458, "uuid": "37e90d05-e259-4fbc-91df-8cedde01b208", "value": "6144:Kwy+bnr+yp0yN90QENUY3ydzFLlVbPZ+9M4qMIfDY26EeYzPmSNVzAwtR7KUhtUl:UMr2y90PDAzP2MsIb2YJVtZKUhWOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796458, "uuid": "4235ed22-0971-46a7-bd52-efaa89d2494e", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796458, "uuid": "c61d6294-cf72-4a62-92da-aabcf1bd8a68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796458, "uuid": "57fc40d2-ca7f-4aba-bde2-50d391a9463b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7e1b01-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758415, "uuid": "e6a24b97-ea26-41e5-99c6-3c81818027ef", "comment": "Malware payload (Gozi)", "value": "4b3c3ccf3533e5630a188a66894254f7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758415, "uuid": "228f4426-2c94-49d6-af87-ade59c8386ca", "comment": "Malware payload (Gozi)", "value": "703aea4f47823f7333325dc489e45434e22e5a8c1e9d135ce37295e52e861ed6", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758415, "uuid": "1b6bd9c6-2c79-4159-8181-dd3171ef592a", "comment": "Malware payload (Gozi)", "value": "c7badf8d1fc2f584364ee8dc7efaecf03b278a30", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758415, "uuid": "0c707d41-b3df-4479-a4dc-f0da2f08e5ec", "comment": "Malware payload (Gozi)", "value": "f6604eecbe73896bde6d10f6ae0c8b8769d2a4116224be30c9b1738d9c904c7d4568e809acbed719a1648dd4f55c7df7", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758415, "uuid": "fcce3dd1-a629-45d3-b491-9b45f7943ab3", "value": "T1A0E18E8EDDDB641BA74081EFF2773C10FBA0157ED8293204B4E6E70E6B62B27014166C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758415, "uuid": "7caf3cd4-cdd0-4ea9-b42a-206e34b80b3a", "value": "96:w3BTFLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dl96r2:ifU77rIKdn863jMM0OD9+VVF4vx4kuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758415, "uuid": "f153f654-68e4-40cc-bda2-d64ca56d4100", "value": 6997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758415, "uuid": "4c0ce358-08fa-417f-b0e6-0bf03530e911", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758415, "uuid": "6239ae82-d6cb-444b-817f-44880165f561", "value": "azienda_27.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3244861-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758611, "uuid": "f65470cb-5d42-49c0-b1e1-ce6c5f06e2a7", "comment": "Malware payload (Gozi)", "value": "18470e64cb58fcd2f2db529b0aa59184", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758611, "uuid": "b2d20d38-81c0-499f-9c0a-61410453dece", "comment": "Malware payload (Gozi)", "value": "7110021ffab517619ba8d0af153423a65058a420b8142b5e3243bd56379ec497", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758611, "uuid": "eaa170a2-2777-49e8-b28a-1fd8341585d4", "comment": "Malware payload (Gozi)", "value": "56ec62caa05c6e8582f42ddf8bfa0125bd741c3e", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758611, "uuid": "39b60f8e-6fbb-4334-9025-a8dc3300d014", "comment": "Malware payload (Gozi)", "value": "b2d8b025fdf4f61bfba73d4103428ec70f088585e3167674f41de06ac3ca23d1c3c9cd70ff47dd1b9f49e632aebf4c77", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758611, "uuid": "19d9b050-b221-4d7b-9b39-e3f04c6eee5a", "value": "T1A7A17E11E6CE23678BC128507AD1B3F35DB7DCDCA4E8544CFBD29566061D247B1CB060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758611, "uuid": "6431884f-c072-4dd9-ba4a-795933200101", "value": "96:q2QRakoF/+jyIoUx9z0kdTbGVAjYvXS7cbLBgS2rizpg+V1CqDD6snx:jQcrG5oO3dFYvC76LWEg+bDWsnx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758611, "uuid": "4a9923b0-5ca0-4e70-8320-d364f2a401ff", "value": 5085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758611, "uuid": "c8079da3-38d5-4def-84b5-7c803c2597c4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758611, "uuid": "d825ff6d-0bdc-4948-8c49-767ba6f8e379", "value": "azienda_16.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ed672e-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757376, "uuid": "e82a7244-5f93-49ce-9f97-32ef84c91319", "comment": "Malware payload (Gozi)", "value": "d9b99afe071446581e7878af95a90706", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757376, "uuid": "5835b1fe-2d4b-4787-b035-3959f1d1b23f", "comment": "Malware payload (Gozi)", "value": "7128ab66b0ccce2d742c747b82b52a7ef25fab82301fa04995aa05798ae82e31", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757376, "uuid": "ecabb3a5-7381-4623-85aa-bb345e23acc3", "comment": "Malware payload (Gozi)", "value": "56e7f3f09a68d37a110ec41a4739592310294ca7", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757376, "uuid": "d629d1b8-0c99-4519-bea9-ce6d90b8c2c2", "comment": "Malware payload (Gozi)", "value": "cad39b08dfda6338f88dcda49dba7d9e4a3f15e91fa9d04702f18c56ad40d2a30c97120021dbf3c9315eaecbb81c30f8", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757376, "uuid": "543c5ae2-c116-4a85-84fd-5960b2b67bff", "value": "T169E18D8E9DDB641BA78081EFF6332D10FFA0697FD9292204B5E5E70E2B67727004125C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757376, "uuid": "5209cb4d-f1c5-4347-b066-4f9a4393e38e", "value": "192:qgXQU77rIKdn863jMM0OD9+VVF4GxikuL:bH7EOM7/F4MuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757376, "uuid": "77fe62ab-593e-4be4-b82e-7473d4eb7b19", "value": 6981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757376, "uuid": "14b094bb-d4e9-46ed-974b-42b0ed5c18f4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757376, "uuid": "a9285153-d9c9-41ef-afc4-bc1ce25c7847", "value": "azienda_15.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5eb3ae-a69b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675742359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742359, "uuid": "3357f160-0e88-405d-bf3e-9171cca675ae", "comment": "Malware payload (Quakbot)", "value": "eee61c02f9ea05a0ad6a43d513a37a1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742359, "uuid": "6177cfcd-72bf-4285-b5df-483d8a490d93", "comment": "Malware payload (Quakbot)", "value": "713207d9d9875ec88d2f3a53377bf8c2d620147a4199eb183c13a7e957056432", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742359, "uuid": "c1022521-c9cf-4e6f-a69b-91954f773c05", "comment": "Malware payload (Quakbot)", "value": "775aade0dcb211dbcdb896e42fa8ce95752b9081", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742359, "uuid": "24631cd3-a04d-42b0-b7e5-9ce8013e8b91", "comment": "Malware payload (Quakbot)", "value": "fa01b08eb59144c080c4ac3e40a98fb9fe6f4c6e86c6a8d7dd29d93c76ec63380d6e5b2016e009399d673ea2274d8cbe", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama236", "colour": "#DA0789", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742359, "uuid": "9eb20fb0-e9aa-4b9e-973f-4e696ba4a293", "value": "T1F885AD1242CC129AF14D3B78243C1F7FD3BBB7A87B19634E9654B8A9AFAB7D34115600", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742359, "uuid": "2eb4e59d-58b9-4746-9b89-e554341e6505", "value": "a3432b773266dde6a100dba767517009", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742359, "uuid": "4b729798-f696-4fe7-a785-908e7ce08004", "value": "24576:zrw3nPW3ednWPiT8VTBqcATV8KIyydLXGcq8z+0uaEYmgEJ/tc1:g3nCeCiT8aHxyM18z+XatEJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675742359, "uuid": "1a8caa6c-1b2f-4d50-8f3a-7ee395f6df5b", "value": 1761280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675742359, "uuid": "0fae8ee2-5f61-4162-bee2-49d376fbc88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742359, "uuid": "a600d545-ba35-4323-92c1-bff3cd8caa73", "value": "86607.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73dc7f7d-a67f-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675730185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730185, "uuid": "83005e95-7771-41c7-a4e4-a4e32bc08ef1", "comment": "Malware payload (CoinMiner)", "value": "1f374aa76e90385b3697d554fb113906", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730185, "uuid": "170df64a-05ba-4843-9a95-4c36d1aaabef", "comment": "Malware payload (CoinMiner)", "value": "71864f13775192cf8a30f8a9318b224818f6edc52eda6db27b38e549fde0d413", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730185, "uuid": "438f8048-d48e-4988-83b2-f5b52c449731", "comment": "Malware payload (CoinMiner)", "value": "7c70071eee00e510fdeb851df9fe1bd6aafed42e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730185, "uuid": "15656574-09c1-469b-a3c0-8e9ce90dc18e", "comment": "Malware payload (CoinMiner)", "value": "692db713e70342166eaa1a9ce8b2ae74c15a1776ffe7dababe76e669a1a62eb5b6439f7ef3e8540a4909a99e3ecbf2ca", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730185, "uuid": "fba6fc98-03d1-465a-afbc-a46c89c5896a", "value": "T1AE644C4393E1BD80E9268F72DE1EC6E8768DFA508E7977652238DE9F10B10F6D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730185, "uuid": "2e8e3698-040b-4242-9e5c-c3c244f595b0", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730185, "uuid": "d3625b5b-2f5a-46a5-9363-4e09dfd8d6dc", "value": "3072:Hfb6b8akULxbdRmbNPv2i3ClwyKy9gfACW4HluQjiMTE5HyNa5D:/zMLFyJRS4y0AC5FuQj9FNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675730185, "uuid": "0757c608-020c-4878-973c-7bc7f50e19c4", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675730185, "uuid": "d103c8c9-3438-4f41-96dc-91e85efc1b18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730185, "uuid": "f8a35c16-f437-4120-8ba4-7842af52ced6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8330341-a6f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675779772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779772, "uuid": "43bed5ce-e462-4c00-a9de-d2b1ff92de0f", "comment": "Malware payload (AgentTesla)", "value": "b78b511a1b6fcd24bd7fa2110616f470", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779772, "uuid": "600cae24-d015-4c28-b652-6bc819c54bea", "comment": "Malware payload (AgentTesla)", "value": "7329530a28c60633cb144dbf8b44268b2695438c22595d11a600e25019c042e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779772, "uuid": "32e696f5-b0ab-4dd1-8222-48fd55481ad5", "comment": "Malware payload (AgentTesla)", "value": "40b11a9ccda200d1df55ea14f0ec1d22c77d503e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779772, "uuid": "ee7eef98-2c4a-4729-9a96-5e5ba44043f2", "comment": "Malware payload (AgentTesla)", "value": "692b8357ac92a39f7037333ec49e62f62628e4514715e2a68e09196ed589f63f193b0a8a3249918715f0686b661c6424", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779772, "uuid": "2a0e84da-b45f-475b-8292-e9b6c1c40fd5", "value": "T1E605131D1FFEEB21D5685BB994302860077AAC26B223F31D1ED571E73E377209902A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779772, "uuid": "cea9924e-5070-4762-b198-b761a8381120", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779772, "uuid": "856942fd-55ec-42f4-b782-d537b6d0583e", "value": "12288:W/+qk2KkOT4AraoeB2YIuyimus2I/0yIHjKA3hEiwiPN57awHRr/CB06KuLp4bDw:WRk2KcArWBXK2I/0hHa9657awxO5d4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675779772, "uuid": "ae35a8be-c638-432e-a09b-ff7d704e65cb", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675779772, "uuid": "1a4f62ad-918e-477e-8d56-20612c393d45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779772, "uuid": "74a3ee10-507b-4c8d-8d31-e4023ce22986", "value": "Request for Quotation PKLMNL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61dd0157-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675789855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789855, "uuid": "1c90668c-83e3-48f8-a70d-bbfc0620b75e", "comment": "Malware payload (Quakbot)", "value": "ab28ce01947066084d4af6583a6d3b54", "object_relation": "md5", "Tag": [ { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789855, "uuid": "b96b8c63-42ee-4f5a-ab2b-49cbfc57ce28", "comment": "Malware payload (Quakbot)", "value": "73c6b431eb5a92719ba406a765d011aa709234af3675e9de4eff9c5f9edd3fe3", "object_relation": "sha256", "Tag": [ { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789855, "uuid": "d55ce4b0-60ff-4f17-954d-522b11fb6603", "comment": "Malware payload (Quakbot)", "value": "b1d69acda90232d836bc69ea3cbd9465ce3afdd3", "object_relation": "sha1", "Tag": [ { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789855, "uuid": "f95f95e5-1699-4444-80ce-786e3bf9e200", "comment": "Malware payload (Quakbot)", "value": "76b4c2f6554b2921c649211ec8dedd8398c1ec6e1c113da424eb047e8b7eac793bcf353c11bd5107e29b37a1e3d13291", "object_relation": "sha3-384", "Tag": [ { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789855, "uuid": "c6897837-8d40-465c-86b2-85700f6a326b", "value": "T1A9941905B792873AFEC7E0BF0346C29A9A74627AA433501E65107E75FB303B1756E932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789855, "uuid": "e41c95db-7ab8-47f6-bbde-b633d7ab02e7", "value": "ed7b82ba2c3d48fc4ed65dff68081358", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789855, "uuid": "f49efcff-caa5-459a-a7d3-cdb61cbb66e3", "value": "6144:+1bpx1ymed01f3UBRxFoNgKIlp6Ydc2ZiKm5baKrE7eh7PilAFNZzdnLf:sN8d0dkfxFoNgKIlbdc2IOaGlAFnBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789855, "uuid": "0fe96ff2-7394-46fa-a120-685d1a36a565", "value": 428777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789855, "uuid": "e9d2b7b7-1793-4378-97a2-5087ff2f80f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789855, "uuid": "ae44dd9b-2a01-4fd5-87da-98d0e3a1c4df", "value": "01.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e1f3b0-a6f4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675780491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780491, "uuid": "ac6a33e1-f37f-48b7-986a-1216d631fa64", "comment": "Malware payload", "value": "8202a39025a499a0575c65fd811ba0da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780491, "uuid": "1f667849-fef4-4ac1-a0f5-76f859b8247e", "comment": "Malware payload", "value": "73e4fea561cfb5cfcf94edda5a055e4983c29210b26913d54c2c1a3a5f8067c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780491, "uuid": "4e51622f-e2cd-468b-a764-1912aaa435bc", "comment": "Malware payload", "value": "c9b90b7cd5bcd81b610ac87d5385775b66c6f652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780491, "uuid": "d5e78fab-fa92-4073-8388-6e0023c7ce0e", "comment": "Malware payload", "value": "d677726e4bf459143bb1e5d883743413e5dd6bd2744c21c9a0a99c817c60f136b15f3249e8badc351a887271f6786719", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780491, "uuid": "07b4e6d6-3090-4796-bd23-2fa830ee6771", "value": "T12C93C4E47AD58CDAEA14823C42E6D232753DB9D096139B176630B7321F13ED13ED722A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780491, "uuid": "802029d6-03d3-4df2-92d6-1c9525160f7e", "value": "42d3fa2749acc322199b54e67c777a71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780491, "uuid": "aa6eceb0-1c86-45a1-8068-ca4ec056ebda", "value": "1536:oqS9j/dHMC4/mDmXEqTIm4gKN2PFs5ZWAL:mDRtwTKNcs50AL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780491, "uuid": "7626978a-1c9e-4e10-99c8-2792e69e6fcb", "value": 89189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780491, "uuid": "535de94d-a55e-48e7-b8f9-db61c4935cc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780491, "uuid": "5241fbc4-3de8-4557-9bd5-c0291dccab2d", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7161e51b-a6bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675755950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755950, "uuid": "2f9f4a88-f56a-4786-babd-650665580c3d", "comment": "Malware payload (Mirai)", "value": "ce2d20ed3304248f332f21a4b5b3a285", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755950, "uuid": "f9076902-47ac-40d5-845a-c5c1c379c70a", "comment": "Malware payload (Mirai)", "value": "741df6fc4d256c6656f9094752ac02a3092f38536e6df61da0910554f928a0ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755950, "uuid": "6dc02024-fea5-4c2d-a619-a0d7fe8c263c", "comment": "Malware payload (Mirai)", "value": "c4e59d1dfa1ca8e23137efb0e7e2e12f33339427", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755950, "uuid": "447dbc91-dee5-4d15-96e9-6bcdb92df0a0", "comment": "Malware payload (Mirai)", "value": "bb2cf90370681657afb332deed9d9a8daf81102073d3d8a183b53ebba08caab054ad14fa0acfded638b090264db42f71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755950, "uuid": "343b0c76-52bb-4b1d-b907-5a9dfce5fc45", "value": "T1EFD3C617BB518EB7C84FCE37069A4601249DE19642D97FABB2B4C96CE70794F08E3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755950, "uuid": "8ac66ebd-8093-4c93-81b5-3fa573ba41bb", "value": "1536:sjeTlrGEfePhMMBIZTfGiw5mYKNwtTCnFDq7Clmm7hmvjeq+TCftG2j:sgroMp2mXNVD+2m2hmvjeq+TstG2j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675755950, "uuid": "22b95a3f-a1af-4460-8d4c-3d261d1dc7e1", "value": 135301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675755950, "uuid": "5444968b-642f-4846-a301-80a780e12bfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755950, "uuid": "6cee8af6-ce4a-4c59-a01a-bbe94a42db21", "value": "ce2d20ed3304248f332f21a4b5b3a285", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4101db2d-a67d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675729241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729241, "uuid": "33628396-e0dd-4013-aacf-8e596aa57f60", "comment": "Malware payload (Gafgyt)", "value": "7fd4e1f077fd998e43cfd70643060172", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729241, "uuid": "18c6bc5a-73f1-4bb1-a6e6-5839e627aa9a", "comment": "Malware payload (Gafgyt)", "value": "745d38913eb9097542eb409aa94ac83ec549ea0c0780fd971dad984051f6acfe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729241, "uuid": "6490cd52-deaf-4c6e-9684-912a4c15b0f4", "comment": "Malware payload (Gafgyt)", "value": "d5d72ce06358d525205c816667a4925071cb27dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729241, "uuid": "81c44350-4251-4bc2-b958-d6220bb86be9", "comment": "Malware payload (Gafgyt)", "value": "b55262d4022cc9e54963261e78f994cee20390153a73214c35fc10924dd99488a7c9d3c24ddd29b536123b9ea518eda8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729241, "uuid": "7f6e9ea1-cd98-41f1-9afb-7b6d4981a607", "value": "T129A33903C6A0D87FC08B537A1BDFC6265163B8B91732630B6394BEA51F069D9DE59343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729241, "uuid": "a7c4523a-a797-4350-af3a-f55c201c09e2", "value": "1536:cfBpPmNNkfr+cKimXJM9wW8G67TRwgYmoMr3Qms5TS0MHT1K:cvmz6rzP0U6HYmoMrAmITS/HT1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675729241, "uuid": "ac44e667-a881-43a1-8431-bb3f4fd54261", "value": 102312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675729241, "uuid": "3fc42dd2-b299-4e58-8f5b-6a1b03a3aac2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729241, "uuid": "0892d90c-c9d0-4e28-b439-68479ab0e440", "value": "allahx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a12d211-a700-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675785493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785493, "uuid": "acc033ec-e0a1-42ff-8a99-457ffce8ae1b", "comment": "Malware payload (Formbook)", "value": "f05ff7fe84068566d56eed9508c8328c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785493, "uuid": "dd3f5204-4473-478e-93f7-be1b92227d40", "comment": "Malware payload (Formbook)", "value": "74869f0f14717c02088edbcc8fb77365263d3af14b3f52f9577ab2bb883203fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785493, "uuid": "a036833f-f632-429d-885d-012f315a3cae", "comment": "Malware payload (Formbook)", "value": "14c2d28060098c96d96622b9cf01d2bd6a64a87a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785493, "uuid": "a98437d3-403e-4530-b433-6bc7b21820ef", "comment": "Malware payload (Formbook)", "value": "84c687f73259332e63b9067558e5889fed406beeb63a9de8e39351de2f06c99e14c17897c89741a9a6211559662284b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785493, "uuid": "c3e72a5c-2df3-4c1b-9284-6338cb66ec49", "value": "T128D42301EDBCC86BCD9295B1187B6262ABF6F5273E50030E1B51570836BA6F2786DB43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785493, "uuid": "d4a058e5-81d4-4ede-8c70-69fba800d85c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785493, "uuid": "239ca2e0-02ff-41f6-9e48-391e2a370517", "value": "12288:vYzc4ueL3B1AWmFzQrwoPPvTpUX4h0UDVngafasq2Jv60eq1cBKfz6QZ9Y:vYzcjeLDAvSPjp8UtgUaBKv6XpCtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675785493, "uuid": "c6a693d1-9857-48c7-a650-4ee999d84c7e", "value": 641192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675785493, "uuid": "0340adcb-6979-4ea7-9e0a-3cbcdad4e23a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785493, "uuid": "5bbf812d-89fd-42b3-9618-c5339bf72f3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b57e8e-a73f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675812752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812752, "uuid": "3cb14a63-dc90-4109-81c4-b511d5b6cc32", "comment": "Malware payload", "value": "39b9af1e4cde31b253c7bb716dfc324d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812752, "uuid": "39d91be0-5bef-494d-a867-8a8b3aa02bde", "comment": "Malware payload", "value": "74ad435abc6dc430258e6e0fecea532339e6759656b24772e58934951e720acd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812752, "uuid": "2d40b8c9-d384-46c8-8b25-55558aeb97f6", "comment": "Malware payload", "value": "53f6688280595a3865741fdd13371c8e1fa637e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812752, "uuid": "5c7645e0-2b4b-4fcc-9ba7-093adb487bcc", "comment": "Malware payload", "value": "b0c78cff0825ccc8cf629544a102ccaf8152589b549f156e1badf73d3cee8afd5230616a94140aaea326c81d39b7bcb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812752, "uuid": "1bf35a57-1a1e-42ba-9784-d6d499ce286d", "value": "T17164F1327580C073C16F69315820DBA46A7DB93046B9D93B3FA917AE9F302D16B7634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812752, "uuid": "eea44f99-ff19-4901-a52c-86cb4e738ab5", "value": "ae0d5a157fa4c5b2c2783d24fb5ee840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812752, "uuid": "f9e4140a-b41f-4856-b080-2193c728361e", "value": "6144:HWeFLG2L2zrQ+c+IrQFdEFt/01pqdu2Xq9Me7neM:HWexG2azM+cb8EF101pqduHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675812752, "uuid": "a18e2b75-0078-47d5-9440-742f75839288", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675812752, "uuid": "e2aae1ad-9620-4dd4-878e-63d68f1b42cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812752, "uuid": "7ce44b26-5158-4c9a-9c8b-73046dd5ea21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7417de35-a71c-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675797616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797616, "uuid": "42626151-c569-4e3e-b49f-2703c5f7fc6d", "comment": "Malware payload (SnakeKeylogger)", "value": "add2863f5ba67c49deffe3a4942d3243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797616, "uuid": "7353d4b6-aa2a-465a-b82c-9081d86c06a7", "comment": "Malware payload (SnakeKeylogger)", "value": "74d9700de7120df22592b8ab8d30b97df9e53cf2309b5d282610f03a314c0220", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797616, "uuid": "9119000f-79e9-4ae2-94ee-93f5e6ca539e", "comment": "Malware payload (SnakeKeylogger)", "value": "b370a6c5631f3a0453a24c4e0224136b00124657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797616, "uuid": "495560ce-8838-4ffa-8b59-2de0c57e5a2d", "comment": "Malware payload (SnakeKeylogger)", "value": "cc2aaac4bf8342f8c87dde7dc6da86eb6b541bd9fb7760f792992be451f01ea2e71de95b82c4db3af1b298ab12105234", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797616, "uuid": "39032b11-1ff6-4728-a6c0-219caad08881", "value": "T186A49E97384485ECCE7E55F2A256854033A5DCBFC508E60A6BC533A75EE6FE20C2271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797616, "uuid": "c010fdeb-d1bc-4c01-9114-3f996f504c39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797616, "uuid": "175aea7b-9f85-4525-9eb4-bfd9dc59a99a", "value": "12288:qFimar5eFDutOc6duxKLo6SRi4UBZJEUqq+qv6nnjqKoe:2xBZJEtq/6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675797616, "uuid": "ada449ac-a893-4656-ac4e-79dc0542be5d", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675797616, "uuid": "c96c89a0-7a75-4b76-884b-0a76f6316e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797616, "uuid": "a0f2ec3f-e65a-42d2-b0a0-f2b2f38c432b", "value": "_Contract sponsorizare Lancetti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306616a7-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675789772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789772, "uuid": "0ddab86d-248d-4165-aba7-81b3e52f0327", "comment": "Malware payload (GuLoader)", "value": "15bd082a1239672f89da95a8e64c222c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789772, "uuid": "5f598611-b9bf-4ba9-95c8-82931427439c", "comment": "Malware payload (GuLoader)", "value": "773560e65eee3974ead74c4f73859a9f094794610469e71566cbed3d04015e2c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789772, "uuid": "39455445-1898-4f64-a52a-b6887f9fca4c", "comment": "Malware payload (GuLoader)", "value": "03e403be543416771fbf7aafeed8023257619bdc", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789772, "uuid": "f9978436-ed50-435f-9733-78a8a4fd4995", "comment": "Malware payload (GuLoader)", "value": "1c2cea1a50e6840e135335f026d5344d84429c4c36f96c19630345cd558f0dda70c77d71af1b79aa4479ecedfb726b8a", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789772, "uuid": "099a7777-0761-48c1-b88a-5eb1068b341b", "value": "T14E834A609E6606D94BCA1E4DEB411988C43A4C24141EDD697DB6078E3F36FCFC26B2ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789772, "uuid": "75ea1dca-c642-4f6f-b3d1-417fcd4954d6", "value": "1536:MApmpA5OR/mZrFWHVzt6XZT6/Wxfi0PS6aW12HpsA4i:7piy+/cgHF4JT6+xfi0PS6H2JCi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789772, "uuid": "72397f47-3008-40e0-b6d5-9ec5aeb4afd9", "value": 88395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789772, "uuid": "27e2b61b-4ed8-400f-9656-f3a241104331", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789772, "uuid": "79625057-63a7-4a5d-9562-1fdfeeca8c7f", "value": "justificante de transferencia.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dce44cb-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788935, "uuid": "27088e22-4587-4c31-a98c-996ac93f4470", "comment": "Malware payload (SnakeKeylogger)", "value": "d92663659acec15e0167ee7500634e59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788935, "uuid": "3a169016-b695-4117-b6a7-dd79d35e1e12", "comment": "Malware payload (SnakeKeylogger)", "value": "77dab247203f103e2c7e5139d3d67cc41c2d375bdfb56b9fa902c53a4079a489", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788935, "uuid": "d23f7d3d-4698-4edb-9364-518a4bf30652", "comment": "Malware payload (SnakeKeylogger)", "value": "965657d95f52be3a91f7f784503ec287dace934c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788935, "uuid": "7ab5b30f-b3d0-4773-ad21-4aef6361f6c5", "comment": "Malware payload (SnakeKeylogger)", "value": "11dd046109aaf834568a6998c46efdea2e6f4e31d6d487650c1ea4f7c5d57ad04ac3bf2bdd82eb334bc3cda37acbfb3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788935, "uuid": "64b142f4-25fd-4faf-931c-28ce28bc1663", "value": "T1B464D05895B4932BE0B629F602C7BEE40BF0432F5923F13E449136854EF69F29DA1D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788935, "uuid": "713b8050-f885-4145-ac8d-84a77f840cfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788935, "uuid": "53e9e141-32d0-498b-aae0-fd730d707985", "value": "6144:Ie92FDutOc6duxKLo8TNLLepQZnNh/b6DTlT1CGRcuOiG5MFoCDCHA:sFDutOc6duxKLoeNWpQZnNh/b6PCGhDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788935, "uuid": "0fe1b3d7-f0a3-470b-8411-10a546bf1259", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788935, "uuid": "267ab923-df68-4c6a-ac50-7db576ad9fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788935, "uuid": "5e062c47-0e8b-4f51-beb7-a72752df899c", "value": "Statement of account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cf4d75-a6d3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675766432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766432, "uuid": "7e09a2f6-eeed-424b-855a-525ff10c9c99", "comment": "Malware payload (RedLineStealer)", "value": "38b211ff7cd3b3e0e7ea2b9e6b6f8512", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766432, "uuid": "e282d85d-9427-400c-9516-bc14e4a7592b", "comment": "Malware payload (RedLineStealer)", "value": "77f19ea2e98aa20589c1196037c0ec3bcb2936b4c1e53fd89c1a22697c8d31c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766432, "uuid": "9efeadb6-afff-4475-b7a8-421e819ff441", "comment": "Malware payload (RedLineStealer)", "value": "4c366f52966c94c022266b70833e4f4cd4de1c62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766432, "uuid": "6439ca6c-aa64-49be-9a00-efe1dfc625df", "comment": "Malware payload (RedLineStealer)", "value": "04ef9e20217b6251dcff46fb9c95b1b151cba1fe50ae56cabc2dc82ef03768b909c08afc563e8109e4f6506d5d945ce8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766432, "uuid": "9704b30b-b1f5-4d3c-b187-6a9fa7712004", "value": "T15764F1323790C032D9AB25309D24E6A11BAEB5312675FA4B7BD417BE9F302D19A36347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766432, "uuid": "290fd92b-410f-4d94-a675-33fa4d7d5f76", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766432, "uuid": "be8bf061-f613-4d97-b28e-8a4b8836cfc8", "value": "6144:hjuLncOLUU1LXOigBWkMJNzsInZBVKw01+us:hjujcO4UVdKWZNpkw01L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675766432, "uuid": "38a20378-0626-4de3-991b-bef53e8f0a77", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675766432, "uuid": "e0a5b15f-2528-46fa-a94a-ce591b3a3518", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766432, "uuid": "be6932ab-e742-4ba3-a9d8-aa711ce82953", "value": "38b211ff7cd3b3e0e7ea2b9e6b6f8512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6e8411-a717-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675795511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795511, "uuid": "ba4543d9-1df3-4223-b119-6f4c1dae1cfb", "comment": "Malware payload (GCleaner)", "value": "d1200f2ceb58bf7b674b4b258e2c9b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795511, "uuid": "d0533cb2-3fdd-4b9f-9809-1881a27fa8e7", "comment": "Malware payload (GCleaner)", "value": "7876d7350209c3c5363181621d8e15068e9a7be0e336313f20394e54e114b6c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795511, "uuid": "4b170e1a-f662-4a95-a8d6-fe11f8931a09", "comment": "Malware payload (GCleaner)", "value": "75ad864afca970feb793afb7c0d1c851ee57a0ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795511, "uuid": "4ad5fcab-07aa-4cc7-bf62-e3f04055bfd4", "comment": "Malware payload (GCleaner)", "value": "82e841e299aa97272f82463cdd706ed02dc145c579778f67521c8830497c782d5019fca9a985172ce876e12a79d4da41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795511, "uuid": "437495ab-11ab-4a34-856b-5ff6b82a4c26", "value": "T122D5E01A1D94D097D2618F70C8CB2DFA8C11DE6FE8BA019713143FFBB632649A94AD74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795511, "uuid": "38efd811-780b-4f9b-b0b8-658dcf2bab49", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795511, "uuid": "042d0167-864d-40f4-90ab-b156bee469de", "value": "49152:wDqThi7lmIemYcY+DYJG1BOaETEeiB1fCq67R+oExLWsH9N4AC1LCgv2MR:+yTpmYjzgjOaETW1fCqaR+ma9Rmv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795511, "uuid": "de5f59f0-1f91-41ae-9f0b-dbeb68634ba1", "value": 2745097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795511, "uuid": "331c797b-5fdb-4af2-b1eb-00dd8a1782c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795511, "uuid": "2256a4e3-60cc-408d-a599-8da014f9dbd9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36b827a7-a73a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675810398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810398, "uuid": "4148f5f7-b204-4eb9-b0bd-191ebfd2f0a4", "comment": "Malware payload", "value": "9a3b9ee2a1f4fc57af56d8caaeffaf7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810398, "uuid": "e1be2c40-5665-47a5-b3df-11cbcae16943", "comment": "Malware payload", "value": "78b29f9d2294b2b7d8392aba5996c6580ce671d68e95faac8066a2ed3f2d70d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810398, "uuid": "89ad2ce6-63b7-463a-830f-7865af595c65", "comment": "Malware payload", "value": "d5f792255601c88314d7c3702d09884d6bcab8b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810398, "uuid": "40c2712e-dee2-4d94-a204-f8deac94db55", "comment": "Malware payload", "value": "3acb9e7558866fa618f72e819cc0d1e88eb66c57d55608b2e633640681933a4b9b26fcc10a9689b5ea49f6237b3cb941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810398, "uuid": "6c100083-98d8-4352-b3f9-5b455364409f", "value": "T167B40207FBFC8467E471537019F747C31A36BEA09A38839B228E6D5D18B26B46631727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810398, "uuid": "f34242bd-6b68-4c03-8eb6-0c42d634fe03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810398, "uuid": "b7e89c91-1e6c-46bc-b43a-34526af88db5", "value": "12288:XMrdy90ePHkpEVbbGG5DDQFuo4AwGLpF2fSjGYA:OyfHvVT5DDQNjSf2Gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675810398, "uuid": "c90559c9-31ae-4403-8896-dff7b1d9b3d1", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675810398, "uuid": "0342a9be-644b-458c-93fe-5bd457cbecf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810398, "uuid": "7e3da7fc-eb5e-4090-9c07-1e69a3b5fed9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e6bc3d-a70d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675791392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791392, "uuid": "8474133d-57c9-4399-acdc-7c0831bfff78", "comment": "Malware payload (SnakeKeylogger)", "value": "1f14a1e2ec6f85377b3f967fdde22191", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791392, "uuid": "f922480d-82ae-43d0-b8a0-98d0ce14dede", "comment": "Malware payload (SnakeKeylogger)", "value": "7903de968980a6f2a5e771980f3bbd8bba813d380cef505c819172084c0b761a", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791392, "uuid": "573784fd-40ba-4bad-af9b-302b23b2e60b", "comment": "Malware payload (SnakeKeylogger)", "value": "c35f30dffe7fbd3669c7c2d5c836e933f54c45f2", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791392, "uuid": "bda3f581-64dd-46b1-8563-c605848070a5", "comment": "Malware payload (SnakeKeylogger)", "value": "ab23e1ca5b867046ce5d14baac1de223ea74124e77899953ee19b95cd9973bd934f878ad793f6dfb32a2e98b68019027", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791392, "uuid": "6c0137af-30ca-4f7a-ba4d-2e33156da657", "value": "T1F5846F4172E95418B0F36B679EABF1B45777F8D168358D2821CC1A0A1FEE60886B37F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791392, "uuid": "3c44e461-7eee-46eb-8d83-478e209b1197", "value": "1536:2WkF6cGJXeDAeJBuApR9oeNt46dQkBcT6KJ/Uxrs+rrU:n6xU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675791392, "uuid": "74ee1dd7-eebb-4a37-b63a-de2479e424e8", "value": 401954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675791392, "uuid": "647123ce-62f4-4422-ba17-48990150be72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791392, "uuid": "7a099757-3380-4d52-9535-6db9b095833b", "value": "Orden de compra.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d352ebae-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675756974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756974, "uuid": "195d0f92-882d-40e2-b8c9-a8abbe2e9925", "comment": "Malware payload (Mirai)", "value": "58adaf13bb8969eb53ccdf2e93404925", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756974, "uuid": "7d74309a-e887-4b90-92f7-57fa66758cea", "comment": "Malware payload (Mirai)", "value": "79e7976d095453db21347d90d304efc42f7b77e7af2c4f7497d615d3fbdf981f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756974, "uuid": "dbe8cea1-23be-4dad-bd65-dcba929d7402", "comment": "Malware payload (Mirai)", "value": "5bc4fe3413ef5c7c54c75050141951f1e944fc6e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756974, "uuid": "11f1ab81-95d9-48df-b381-441021ead2c6", "comment": "Malware payload (Mirai)", "value": "521b81ecbde499e6ecb9357fa1af9046c740182cbab3f9e4ee3b1b0a0b246816bc91329baf372bba2c0324b031e51b43", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756974, "uuid": "0a45924e-68b1-4ea0-b868-4d604e4b04aa", "value": "T1C3A35B23A662C6B7C08746B523CFA5919433B57D0B73326773E83DA42F119D92D1AF82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756974, "uuid": "ba064c69-e528-4a29-9cca-555b2d3f3085", "value": "3072:MgiB39CozuVW7qgKm0b0GUtdG/GSymnQVrpiFZxHj:67zz7qXHw7znmnQVrpiFZxHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756974, "uuid": "c1a5187e-a194-4d3b-86e6-11a5211a791a", "value": 105937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756974, "uuid": "9fd0c452-8b1a-4899-947a-3ec3b89eb3a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756974, "uuid": "5da2b8fa-b37e-40d9-aa1b-1f6c6c800a2a", "value": "58adaf13bb8969eb53ccdf2e93404925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "421cd599-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675796244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796244, "uuid": "e37fbd62-7296-4d42-88ce-8f84f5fe158a", "comment": "Malware payload (Formbook)", "value": "3b669808616c3307da8c91b91a43db35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796244, "uuid": "5abd45c4-d025-411a-9c68-62c73e41ec83", "comment": "Malware payload (Formbook)", "value": "7a4cbe6918c174321d777bd64c6cd6d8c6a3ba69c07a43ca357a691f0ef6a480", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796244, "uuid": "3dfc93e2-cb55-4b67-adf4-7c1ed1876e95", "comment": "Malware payload (Formbook)", "value": "337fbe2865cb604dc8cacdd3d5c7ca1e5ba6311c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796244, "uuid": "ff904de9-aae2-4b45-a0c2-43ff145ce703", "comment": "Malware payload (Formbook)", "value": "5693e3b847c0defec00e3f6a3e1009a5fac8bb23ce7afe875d17d762b6e59c7c3e933ad33c544f6ca12d52ce44b1ddbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796244, "uuid": "2b3632ab-905d-4c6f-b21e-bf9fe0fb944f", "value": "T1C6052340629AC360D67D9ABAEAF874D5237912027921F9AC0DFC32CBDD20FC2D564B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796244, "uuid": "f26fcbfd-22a0-419c-a090-b97e27a2a2fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796244, "uuid": "e2a46d1a-a424-48da-a162-5831576685d1", "value": "12288:opkCPAXcXnyXx6q1lPBos9QX/tvzNXl6I9/nLfkIHv8QArlIZAZrSF+d49ahRZ5G:GAX1NzFQX//rLf3v8KZaeMd49S5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796244, "uuid": "dddc6d10-86df-4cc4-b3a1-6c3ed36dd96b", "value": 814592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796244, "uuid": "84e3c534-1ca1-45d7-b494-6075ab52ca47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796244, "uuid": "da205651-5ae1-4dda-b12a-81e5e95cc760", "value": "3b669808616c3307da8c91b91a43db35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88be05f8-a6f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675782189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782189, "uuid": "de3b5d0d-b291-49b6-bbba-380fc9673e8f", "comment": "Malware payload (Quakbot)", "value": "ef744014e574f16dcf821ed9e118137f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782189, "uuid": "a7ce6efa-eab9-4278-aa9e-9db6d332c905", "comment": "Malware payload (Quakbot)", "value": "7a8860f6975853e167c121a6c28b3f60c011e8aa93130856f73d9df688ec589f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782189, "uuid": "3c1de206-8e02-4042-b33a-bca22e473324", "comment": "Malware payload (Quakbot)", "value": "248888a5e4dd518a6c689d2899927621d375f933", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782189, "uuid": "7f9f2f14-ea2a-4d3a-9760-1cf8207b31b3", "comment": "Malware payload (Quakbot)", "value": "1de5b18415a4e3f01792e56b20770482e7e2fe49e462aec9a970680353737a77b9cffa3495bb3b36b8f803c035c2a383", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782189, "uuid": "7e91e0e7-9b0b-4661-afe2-09a0f66afe99", "value": "T129941905B792873AFEC7E0BF0346C29A9A74627AA433501E65107E75FB303B1756E932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782189, "uuid": "1804f6cb-b1a9-4546-b7e1-0b1d47079364", "value": "ed7b82ba2c3d48fc4ed65dff68081358", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782189, "uuid": "aea25d78-290f-4587-aa20-f8475d9e67e3", "value": "6144:+1bpx1ymed01f3UBRxFoNgKIlp6Ydc2ZiKm5baKrE7eh7PilAFNZzdnLf:sN8d0dkfxFoNgKIlbdc2IOaGlAFnBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675782189, "uuid": "3d942b3e-de1e-4b1a-bdc5-61b8ee40496d", "value": 439586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675782189, "uuid": "2aecdf6e-14af-442c-8e2a-ac85c646e014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782189, "uuid": "bd170607-89eb-4ae6-a38f-428880c1b318", "value": "01.gif.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012b14cf-a733-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675807302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807302, "uuid": "4c3bc830-8efe-46e7-9010-9fa5ab7b9641", "comment": "Malware payload", "value": "22a6485703241c73261db3dd51a0e136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807302, "uuid": "44de9c31-bfc9-4cc2-a17b-8ff006dcd62a", "comment": "Malware payload", "value": "7ae7644763c5a4cf9d13fe94e40750a2ce1b706e34e913b714973409da9761b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807302, "uuid": "620cbe5a-1693-4237-a572-9ae4764687db", "comment": "Malware payload", "value": "4735378631e7349cce22b11196aa3eebafc0669d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675807302, "uuid": "151afc12-85bf-40ba-a80d-719c87e9bd47", "comment": "Malware payload", "value": "c95e19115177068bc8a07002989ea80a2607d14d815df08d6f937db92932f04ec802398f999e027f883bdf136a799d01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807302, "uuid": "c6044412-7a50-44ed-b5f4-c7b22b601881", "value": "T189C5E00A1D94D097D2608F70D9D76DF68C22EE6FE9BA409313047FFAB631206E85AD35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807302, "uuid": "0f836443-7814-4568-8d09-be09b6771479", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807302, "uuid": "4dd408c1-559c-4c41-8775-3cfb02ec74ec", "value": "49152:wDCdSvWxAt86xQpLqRQenYQiJbRGSIrOJ/coYuQNtKqiGLCgv2MR:+CdYWxAKVAQe/iWSIaEXFNv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675807302, "uuid": "4b387b96-baf6-4c42-a3ec-b3ea845c0d2c", "value": 2735397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675807302, "uuid": "aa88f0cc-2c4c-4237-8d8d-873ea7ceba91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675807302, "uuid": "7b5fec5d-97c3-4806-a9ee-4f9cb799f27d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d326a92-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758601, "uuid": "e6c627cb-dc0e-48cb-9a16-76b91ba4d5c6", "comment": "Malware payload (Gozi)", "value": "9d51e47d75870d1ef1938bb9846bc9d2", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758601, "uuid": "2fca5497-238d-4c9f-a090-5e0017af4f9e", "comment": "Malware payload (Gozi)", "value": "7b1dac7ad14356f6ab1ab79815d5af7d21e3b3354a2a221108a402632fe8473d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758601, "uuid": "508a9f66-079e-4290-8c30-3f4f93acda1b", "comment": "Malware payload (Gozi)", "value": "0137210d172414832cdda86e02c701863b034c5d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758601, "uuid": "bc8c21b8-1cae-4312-bb98-d47c4fd4ee92", "comment": "Malware payload (Gozi)", "value": "15faade008708e147660a9abb9c5d62dfb6471102692da67838f0a26af894bccf5c2478adb0f4b2b2a76d83f710c6870", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758601, "uuid": "9b7d4292-ea6b-4dc6-aab5-15cc4a6fda35", "value": "T12AA17E41125F110C267CA904F69AF3E0721A0C5EEEBD4B93DA31BE897D7072C966E146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758601, "uuid": "3442e3fa-3a52-496e-b6bd-c0bce36295cc", "value": "96:Ij7lpxw+fVIfiS4U6DCz1WokGxtm+iQCTLjK+8N73apLhVTogMl3pcWeNPMW:Wxp3IficWCz1WokGxtoTLjK70Ml5RetT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758601, "uuid": "1d14f4b0-2438-4c7c-9027-985b75c2f5d0", "value": 5042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758601, "uuid": "dd67b9f6-65cb-443e-b382-d5df856dc819", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758601, "uuid": "c139f864-72e8-47e8-bb7b-99d42dd25cd5", "value": "azienda_15.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9d3403-a6f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675780529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780529, "uuid": "3b1ddc8b-3065-480a-b4ea-cbb2043f918e", "comment": "Malware payload (RedLineStealer)", "value": "4263e83eb1b47e804c857038690a0053", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780529, "uuid": "266dc14a-74c9-41ef-9caa-c9b585455967", "comment": "Malware payload (RedLineStealer)", "value": "7b4ae35ac3c70bcf6f9a7367e92b448a8e4f76368c9eb4ffebc53891d77c20a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780529, "uuid": "4b09ba36-a7bd-477d-bbd8-7f4698891526", "comment": "Malware payload (RedLineStealer)", "value": "7f76d2480539fb481ff8a0e59b7d97e8d3158e1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780529, "uuid": "517bdeb7-b335-49ca-9cd5-e17ba7179803", "comment": "Malware payload (RedLineStealer)", "value": "75b0846ca5c9ed20c20f36d9f853d72cd26d4f8b1401cac32ebc5819ffc6453fff45c197d15d8e7ef0105607fbcc1272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780529, "uuid": "d1578849-e66c-4b67-b612-bfd80be34f2a", "value": "T105640130F680C073C267153469F4D6A66EBEB431677989577BA413AE5F202E09B3A34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780529, "uuid": "48db7dc9-d3f4-40be-a14f-9784973c6696", "value": "cdb2dd381be56018fc9552ac3271a401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780529, "uuid": "0bdc3893-da3d-4018-b315-16c213cf394a", "value": "6144:Ueupyk3eLVv35jYM/0PDCXxeNgjsVHRfiZ9eMPTqzkuG:UeuQk3exvJsM/0PDG0NgAVHRfiZ9ekJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780529, "uuid": "6add9b85-e13f-427a-a162-49bb259bf1b5", "value": 312832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780529, "uuid": "59ac02c2-4ecf-4c38-9cbb-acff8b2c41f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780529, "uuid": "8dcd6de4-d31a-49ef-9151-81eb7e6323bd", "value": "4263e83eb1b47e804c857038690a0053.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757418e5-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732764, "uuid": "a62fe124-9fcc-480c-ace3-9b36e42d5a02", "comment": "Malware payload (Gafgyt)", "value": "1509a4dae2cae1c13ea3956734044c0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732764, "uuid": "5ac7e484-1bc4-4cf5-873c-2ee5129eed3c", "comment": "Malware payload (Gafgyt)", "value": "7b4fcb8f45213d8373efdd023350794c88f15daf5dde3d5549f3a2e9eedbb0ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732764, "uuid": "86d5e074-fe75-43dc-9b94-69700f543d01", "comment": "Malware payload (Gafgyt)", "value": "8ebc7de0a1a6aebd6c0f8278bb9f35c6ce5c5059", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732764, "uuid": "d9bd0341-dbdc-4c5b-bb57-43e520faf675", "comment": "Malware payload (Gafgyt)", "value": "59e4ebb9fb02b1d679b6a4d63e53180a7697ade04e5dbf09da11b1491bd14cdae80a3ad703fb96b827d9a2bc0adff6e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732764, "uuid": "0ec87023-3808-40df-a6c6-0f128db508fc", "value": "T160A33B03B71D0B43C85B59B029BB27F1CB5EB6E216E261C1A11DEED05773AB02522FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732764, "uuid": "887a2316-c258-438b-9de7-65b1c31cd51e", "value": "1536:GM7o276l6AL1jDo4mYAe0z+q4t5vfsiH5h1dddddbKwHq6mYj10PZjgVf3Nj:GgYDsUAe0z+qe15hPnK6mK10PZkVf3Nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732764, "uuid": "6572c7ac-3f8c-4359-a89f-c38abb816d2e", "value": 98046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732764, "uuid": "32ebe35c-e945-444f-9393-1bf6e4e64e9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732764, "uuid": "6db4f2d0-139f-408e-aca5-a34dcc0b9caf", "value": "1509a4dae2cae1c13ea3956734044c0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4da8f7bc-a718-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675795834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795834, "uuid": "301ccf64-1a24-48c4-a28c-68408132eddc", "comment": "Malware payload (RecordBreaker)", "value": "04a988e37b8ea5facd28a7d42764f597", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795834, "uuid": "58b64373-6935-4980-81fb-4e754550380e", "comment": "Malware payload (RecordBreaker)", "value": "7b734abb20157ca48892547a61f80013138e9659b0942895991a9ab49fdadf79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795834, "uuid": "3d4c312b-0d20-4860-978d-6427f4fc924d", "comment": "Malware payload (RecordBreaker)", "value": "1182f9d0de33e9363c7777f3f76d26c179a856e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795834, "uuid": "1bf82f73-dea5-4e65-9831-b8ca1c49c0a1", "comment": "Malware payload (RecordBreaker)", "value": "86110a08f62f42850f6d71496006d1c7c6e3dc2f2afdff55f3fe9dc004a33c22277aab870b20f471cdc35905280c01f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795834, "uuid": "519f010c-1a33-43e5-aa26-19cf16678ddf", "value": "T1DF14C0223980F372C06B25705874DBA53FFEB5309175895B7BA917AE4F302D2663A387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795834, "uuid": "851e2b9f-142c-43e7-8e10-16bce23ac763", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795834, "uuid": "d348a4b2-b64b-4b91-9e86-0adc03baaee5", "value": "3072:BJoObqrFdq4LsfErWQ5vk/HqHA0KK1HYRkqPSM3Fa59NhVwgy:BJoDa4LXrxk/cA0/FYeSLFU9Ncg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795834, "uuid": "117ae25a-5bdf-4e56-826d-927479ec26db", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795834, "uuid": "6502a4aa-9ec3-474c-a4de-83d7c6432bd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795834, "uuid": "060566a3-6ae8-4553-a1d5-91721254eb6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e483e8-a716-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675795203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795203, "uuid": "371596bd-0650-4592-ad6a-53416d15b491", "comment": "Malware payload", "value": "bd13975abc6ac3e5a97706a45f48f7df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795203, "uuid": "4c5419e3-6064-4c0e-8aa7-7ad74d175447", "comment": "Malware payload", "value": "7bda9944d4b4a62a86088d56ad964c0a4b98516c93f6467cd89a8f8f655a0029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795203, "uuid": "d8f31ab8-6707-42fb-a12f-b1a9308924ed", "comment": "Malware payload", "value": "154e70c5150815308e17bbb74cae4ee79948e438", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795203, "uuid": "fad9593f-9aa0-45be-9544-60c9cdd9311d", "comment": "Malware payload", "value": "cd8ae006a61d2d32122198d102baa6e3e9679ce0815c47d8ed7c4b6c215f18a61a2c1fb423fe8bb434596fba3fcce12f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795203, "uuid": "2b2f52b2-84e7-42a8-bca7-c1b04f332c64", "value": "T1EB046C316842A495F0E3E8F3C9EBD47DBB0977A0030224F761CC065AA7625FA763E553", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795203, "uuid": "899260f2-88be-47d6-a77f-e2b57d992514", "value": "3072:jCY64XFREi9URWKznfMvJ/zl6HvK2KkAtZodTzHHNaTrOT:tTORmLyJdvH4TrOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795203, "uuid": "74d00290-cb82-4ba1-8edb-57bbfc33ff26", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795203, "uuid": "801f3520-b832-4431-a691-327977745b0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795203, "uuid": "0737d1e2-8be7-4193-9979-fd4982a53206", "value": "SecuriteInfo.com.Trojan.TR.Crypt.XPACK.Gen.23862.23788", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7642ce97-a727-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675802344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802344, "uuid": "ce992417-b308-4c80-88ab-221893120796", "comment": "Malware payload", "value": "e72aeec50de2d174bc430511f5286cfe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802344, "uuid": "44dfd699-bbd9-4e57-ab6d-0ccb65e7e315", "comment": "Malware payload", "value": "7befddf4f9454571ae0d23d6921e5fd527d765d24fbdfea78fbfb3c97bf8be30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802344, "uuid": "1b61035a-233a-4813-8048-ca27f1e5fff4", "comment": "Malware payload", "value": "63b7deae6d5db2e7fbb4d4cf28d264ac24fd6763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802344, "uuid": "82bf2a8d-23bf-49dc-80a8-0ce791a33c6e", "comment": "Malware payload", "value": "acb78a5f07d4fa888a51a9af487fe5879e7e02e5dca0395c99658a0c617fbb8ac999e6dee029cc8fb8625b283a35395c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802344, "uuid": "b516874a-23fa-431d-a82e-bcb5452aa83b", "value": "T17FB4020BE6FC5032D6F56B3059F612C32A363D525B34836B638B695A08727B0B53637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802344, "uuid": "79a7cb06-f648-484b-b872-d350b0159839", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802344, "uuid": "4d284dc1-f564-4c13-a831-1573cddddd4a", "value": "12288:ZMr8y90XTBEUVfgiT+AtKgEQf1Q7neAo+iS:Vyu/VoI/Qjr7c+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675802344, "uuid": "f5e669c5-ff75-4edf-a6f2-b53031660546", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675802344, "uuid": "7b447eda-3ce6-4c91-b242-7cd163683ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802344, "uuid": "6797b6e4-0a67-4ebf-ab60-c2e1ef34ff6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a9280c-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675761538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761538, "uuid": "b65eeba7-16b1-413f-a574-51f37ff011d5", "comment": "Malware payload (Formbook)", "value": "c085e256f5143fd4c6406e70adfecf02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761538, "uuid": "8cb52fe8-173e-45a6-9132-fd26a4076528", "comment": "Malware payload (Formbook)", "value": "7bf6863ca040ff44fef29dab94fd94341cbd0b67cc52f60c398a6cf6dd69090a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761538, "uuid": "7ce3bb7b-194f-42d1-9e76-ff55ec4e5d9a", "comment": "Malware payload (Formbook)", "value": "a20323282856a000e1de8a347946d4307b581616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761538, "uuid": "ac49a057-14b9-4b1a-ada9-bbc47f5a02a5", "comment": "Malware payload (Formbook)", "value": "957af56a6087a171b42a424dea4a89f46da309d30cad6de323296b3da59e9eb73377e0682b321d591f830b4b4680f1b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761538, "uuid": "650b0ff0-5d5c-4f0c-810a-2348bcf7f1d4", "value": "T19FE412D68318CFFEC745033F22F45848AF3125EAF5A6D74902DFA619C49B3015AB16DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761538, "uuid": "ffd35fa6-042b-48df-87b5-d0fd37e434e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761538, "uuid": "3265161a-39fb-4fb7-ac82-b3547e0d8910", "value": "12288:/Sz9JJR++qL/1ikbXxSmtoPPe4DvGRfqTWeh3ih9H1A:/I5Q+qB1XxSmKPPeivMcBYTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761538, "uuid": "f8cb7413-994d-4b1c-8307-24a6aaedb251", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761538, "uuid": "06945d9f-b6bf-4fea-b437-1bc3fe5619da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761538, "uuid": "cab773d5-8383-43ee-bac8-f41a29f3461b", "value": "7bf6863ca040ff44fef29dab94fd94341cbd0b67cc52f60c398a6cf6dd69090a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "484bea93-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758459, "uuid": "1f73a49b-9ff7-4025-aeaf-3b86d9b95fec", "comment": "Malware payload (Gozi)", "value": "6627612314308237e214d6101125bb42", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758459, "uuid": "e94a565c-937b-418b-9554-4fb921082d4d", "comment": "Malware payload (Gozi)", "value": "7cefc61d74c269fe571515a9be34a76b239abed349335a79e60fc923aa619030", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758459, "uuid": "a7863f7d-9128-4a72-ae9d-79bd79a40811", "comment": "Malware payload (Gozi)", "value": "5639b5fd391f0a7a7ea15fffca349f340c352cfe", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758459, "uuid": "76cf79b9-ac4a-49ec-bbe4-da1aaafe468f", "comment": "Malware payload (Gozi)", "value": "53fa33f32b4e0d522e7f26f28ba88ec27288ac7a922f7d104084e9f66e90d7ffb6775d8f52df53d51f88c0658fd07bbc", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758459, "uuid": "be1eb21b-93d0-40eb-b1e5-950e6dcb0fd7", "value": "T15EE19E8E9DDB641BA78181EFF2333D10FB60197FD9292204B4F1F30E2AA6727008161C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758459, "uuid": "bf6949cd-7c21-4e24-afd4-ec45de0ac2e9", "value": "96:wDBFi3MLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4d292:K/U77rIKdn863jMM0OD9+VVF44xikuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758459, "uuid": "3f435d23-430c-41ec-90e2-9b6ca1219306", "value": 6992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758459, "uuid": "06d37e40-57bc-487c-990b-35a30fbb223c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758459, "uuid": "d9a1f204-c296-495c-a0d7-813c420349e7", "value": "azienda_35.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da6cbe7-a686-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675733235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733235, "uuid": "68399c9c-7da5-409f-81fc-b6633bacf3f9", "comment": "Malware payload (Gafgyt)", "value": "f139a2fe43f6ca2a27a35ae2df42e4f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733235, "uuid": "b8e995c9-aa04-41a0-9eaa-2eb6463ebd79", "comment": "Malware payload (Gafgyt)", "value": "7d281a42e7f68db991844932a035175b295894228ece8649730271d591ed72fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733235, "uuid": "bdf02b28-be0b-4391-9c90-6836cf735209", "comment": "Malware payload (Gafgyt)", "value": "29d652ce79d899c8b1b760ce206f1e009b8386b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733235, "uuid": "a94f2ba1-9238-4a34-b6f1-0661265f57f7", "comment": "Malware payload (Gafgyt)", "value": "83d59e4d87092b49ba6330af232913c343e4f267a64a8f230cb75e09d8f217bb9ab2235d6bc525653566e873790859ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733235, "uuid": "3c459e11-de8b-4b16-9b63-31e53efd9bbd", "value": "T194C32901E5508767C1D2177AB79F864D37232BA897DB33129A346FB42FC279E1E39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733235, "uuid": "40c9d40a-93c0-419b-8a7e-a311f28bb662", "value": "3072:0NJf9avjj1UxcYAEaY5h9s6tlgqmEQ92tX8Q8:49avjjSaY5h9s6gqmEQ92x8Q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733235, "uuid": "b66cb9c7-d0a0-4067-ad96-061e4a0af99a", "value": 124474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733235, "uuid": "20d2b3db-5bc9-47f0-b0fd-8a1073463b14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733235, "uuid": "a8193170-3638-4f70-971f-ad7202f428cc", "value": "f139a2fe43f6ca2a27a35ae2df42e4f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332d36aa-a6b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675752410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752410, "uuid": "5eb98968-50a6-4149-80d5-5041e5e31937", "comment": "Malware payload (GCleaner)", "value": "632601e05689fd4e3fe34783644c76d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752410, "uuid": "781a4611-f931-4320-946e-ceed1f856a94", "comment": "Malware payload (GCleaner)", "value": "7d69916c51f270e126a4a676342b013fc40acaa3900e6081bcc07288d3e11a0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752410, "uuid": "424634f7-a70c-4649-a5da-9dc92f3a6462", "comment": "Malware payload (GCleaner)", "value": "9613f999262671bff70bc1b374d00e9d26d17258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752410, "uuid": "c758ebca-19ec-4e3b-9344-9e101f730f51", "comment": "Malware payload (GCleaner)", "value": "4ad52e1912917313e79b87d8c1fd887f50e1748741f3972cdfde8b6829500cfbd9cf7a64bb5d0bd9eb9c575f05e3c94e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752410, "uuid": "60fe04ec-7b15-46d8-81bb-5c0d18a306c5", "value": "T105C5E00A5C94D067D2618F71C9C76DFA8C12EE6FE8BA009713103FFAB671219E94AD35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752410, "uuid": "34bbb6f3-49a1-41ca-a56a-dbbc400b2558", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752410, "uuid": "80952a79-a07a-4429-ad72-05be02195297", "value": "49152:wDOn2s9Wb2rzqcvCDmcTviZOBNCaTX6aIPnPTDZuXcsmHKDLCgv2MR:+mHWb2RCD9TKZOBNzD6F3xuXcmHv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752410, "uuid": "f85544fe-5a3f-4cd6-af81-00e030e32e94", "value": 2734057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752410, "uuid": "62dc7d58-d8a5-43a7-a37f-1a1093b905a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752410, "uuid": "51e85e2d-67ec-4289-96a7-7a365a144fce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1429ae2d-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675796167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796167, "uuid": "37e2988b-80a0-4b54-992f-69882e1ba6d7", "comment": "Malware payload (SnakeKeylogger)", "value": "37eb31593888857c5d801000ab3fef9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796167, "uuid": "f3a6cf85-2c40-41a9-bf2a-6b4efc7d1d2b", "comment": "Malware payload (SnakeKeylogger)", "value": "7dae4dd284890c7d471e62b8e9d18f60ef6d24aaa28e31dcd7805d55723b3844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796167, "uuid": "51469d41-bc11-4c68-85dd-f17f4c8ea0e4", "comment": "Malware payload (SnakeKeylogger)", "value": "c910593fd58a0753275510a77be5302323307a83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796167, "uuid": "b76b24a6-9c5d-4a58-8e6b-d457062b2e85", "comment": "Malware payload (SnakeKeylogger)", "value": "abd8ef58d9909aa7a05ab4c4147420b45cd7eba6d0a2246c256dec2f72ffbdda3b01dfbe37dbfab083f6c28d20865fab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796167, "uuid": "ebff6aac-7919-4e9d-83ec-ff2025d245f2", "value": "T12FF4230E532C9B21DE89D6BAD4E969940376B71CF552E71C9FD118EE5FA3F000E81A83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796167, "uuid": "f77696a9-6fca-4b51-9cd9-90ce54364cca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796167, "uuid": "62665e52-3bea-420a-a08e-8b7f4be9eca3", "value": "12288:Ghwrhy9Oog7AIsdiJ9KKD3DDf1hcl7KSaMzeCv7VRy6M5Orx7p58lCrd4gyQapWf:GhwrqOogkMrKE39hS7yMzvblMsrxN5IO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796167, "uuid": "82d3149e-2503-4443-8350-74b911e14fa6", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796167, "uuid": "a0a49a0a-99b4-43fd-9277-fd4e5ec3a870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796167, "uuid": "2161b43d-ee21-4927-9903-35ac0449485f", "value": "37eb31593888857c5d801000ab3fef9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23c6afd-a696-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675740195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740195, "uuid": "084d9a16-3d0b-4bb6-8a4f-e4db00fa19d5", "comment": "Malware payload (Tofsee)", "value": "ed2a1ece21904ae9bf41ba78f9df354f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740195, "uuid": "3b43773e-9e27-4d8d-bc85-9d5b10cf81ce", "comment": "Malware payload (Tofsee)", "value": "7e567a80f5f6fec9c99f31580a703d0cefd43439431bc38b4def65a3f4eed3c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740195, "uuid": "c5085d24-a128-4361-8ae4-d40ecaa65619", "comment": "Malware payload (Tofsee)", "value": "8614b28792e059c561c69698459fb589c73db9db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740195, "uuid": "7dece1a3-3287-4683-b46f-931d2fb67a67", "comment": "Malware payload (Tofsee)", "value": "c67a619831e82a543dfc73ad7f704d6a7777c590ce3aab483183b0c0ba1139106a7010b7846b155fb3b8719147eb78f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740195, "uuid": "e6740e57-903b-4ee8-aff6-507986936f28", "value": "T1A5545C8393E1BE84E9278B72CE1EC6E8765DF9418E797765321CAEDF12B0072D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740195, "uuid": "79dadc9c-a1e9-4ba2-8afc-dee759036eeb", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740195, "uuid": "8aa4536c-6e6b-481c-8397-9ed184161a3a", "value": "3072:Vpb6beYKLM9RmvG2QbRpHPPqk/c4XVpypbizVK6fWuQjiMTE5UouTa5D:79YKLMS+VqL4XogWuQj9zo+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675740195, "uuid": "0f62d17e-7c1d-4fc2-b5b0-0a57e452ce95", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675740195, "uuid": "e83c227b-bcc9-4151-af85-02ba87d161c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740195, "uuid": "68442c90-fccb-42ce-9a0a-918906d5aca0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8274350d-a6cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (DBatLoader)", "timestamp": 1675762851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762851, "uuid": "c871b200-81f3-4c40-a3d2-8afd21abd59c", "comment": "Malware payload (DBatLoader)", "value": "d6aca3d22ac46801fb0f146baaed6abc", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762851, "uuid": "466ca8f1-1b25-4345-9291-2a2bb7b2d436", "comment": "Malware payload (DBatLoader)", "value": "7e82cf496170e81178aa01bb117531aaf096b2ee9797e5d82e6e141ad550c0ef", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762851, "uuid": "08ef56f5-38d5-4b17-8377-5c0fa8cfc4ef", "comment": "Malware payload (DBatLoader)", "value": "6bec8e4bead72dbcd8b5f0b0a3bbadb1251dd458", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762851, "uuid": "d52beae7-a621-4a67-9132-fb61aeb45eb5", "comment": "Malware payload (DBatLoader)", "value": "6735debdddee080e872c8cb7d61c58d3d253dc20eef7ea73ac350e7ebe73d57d8510fa19e3499a3cdac2dbfbc2da56e9", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762851, "uuid": "f522847d-a52c-4d05-97dc-ef31d93ef559", "value": "T1E825AE62F6D14833D5336AB89D0F6390EC297E213D6859873BF51E8C5F3A68138352A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762851, "uuid": "792a805a-844b-42e9-ac41-6516ef2108aa", "value": "6c3620595af3d09c3e1478621557659a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762851, "uuid": "be6e21f5-3399-48ae-b208-907242848d3f", "value": "24576:87Je3RHKC7+5fxxViZhPYpnSZqAEuoLI9:8sqvCASkAEuoLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675762851, "uuid": "ebe8ede7-48fa-4ae9-83de-38fa31307e68", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675762851, "uuid": "919963a3-28b4-4a29-a01a-63efb8629837", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762851, "uuid": "f2b771d7-d3f1-4bf4-89f5-b68e51086c9a", "value": "Shipment_document_february_pdf_63554.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877663e2-a726-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675801944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801944, "uuid": "a20074a2-50f8-4ec1-a192-822318c628a4", "comment": "Malware payload", "value": "4a5fef7904702f9a225c6e4d60ab754a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801944, "uuid": "0833a019-cb20-40e8-91ae-64894f8c313f", "comment": "Malware payload", "value": "7eabc0f25261566f175ae74301f80e3da52ca90aa172ce2f8634bba9d9c8793f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801944, "uuid": "a5f59b8b-f3e7-441f-ab96-0ca1fcb12758", "comment": "Malware payload", "value": "a20f8852dd2889be82e384f47adcfacdc7572fbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801944, "uuid": "a419a668-315e-43f6-ab29-212f36b1516a", "comment": "Malware payload", "value": "2fbb5cdbab09730bd4a8df20f4e001e880bd8d12d252a9c94bebdea9528a044bf615f8efb79f6a988a3a8731f8c0bc83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801944, "uuid": "01c6095c-c0ec-4ebe-ae33-6a969d244d48", "value": "T150C5E00A5C94D097D1608F70C9DB6DF68C12DE6FE8BA009713047FFBB632249A85AD79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801944, "uuid": "2a9f754d-2ea6-49b3-8d03-512976a5197b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801944, "uuid": "39eeeaf0-cf14-42b4-ba33-b1b00e709597", "value": "49152:wDqVs3waG+6VHxzpRs9DLFAL/fQ7cZAGHHHoV3G2gZuhLCgv2MR:+q66VHZs90YKAGnIV3WuNv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675801944, "uuid": "28f635e2-6815-4424-b686-a6929e785c9d", "value": 2739463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675801944, "uuid": "a045bb75-adff-4792-a793-997be82eb227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801944, "uuid": "3ad91164-f4a8-4f39-a106-6af0d2348e68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e24a840-a6a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675747838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747838, "uuid": "bc0a6f99-0fcc-4f73-9827-9180353c3542", "comment": "Malware payload (RedLineStealer)", "value": "ad05ec1c7aa07aa5be888851f7781e21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747838, "uuid": "d740734d-c82f-43c6-9f68-860f71d28f80", "comment": "Malware payload (RedLineStealer)", "value": "7f16d75ab9194daccc8d30d9fe3e86a0e9fe7c74a177954825f2d60d5adbe0cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747838, "uuid": "bfa58408-68e6-4fce-b9c6-06bad17508fb", "comment": "Malware payload (RedLineStealer)", "value": "a3a0ecbe47bfbe4deb399ec0ff6e48faf4788e71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747838, "uuid": "f0103fe2-3d51-416e-9a64-441c70ccd26e", "comment": "Malware payload (RedLineStealer)", "value": "d3830b9594ff1fbe8900b63ff536fb6cc07da8b3cb31b68d4c5dce23c537494830ddea92e5539233422c3e2139db9e13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747838, "uuid": "c465e117-1b0a-4bab-adc9-9875fe65452e", "value": "T1706401233680C432D5A715386C25DAA56FAFF93126758A1BB7AC13BE1F303C1967631B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747838, "uuid": "b7f2444a-9fd6-4c29-9d65-162ee438a51d", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747838, "uuid": "57bcf5c4-6542-4723-9feb-ab88c31d46a6", "value": "6144:NIrHCEL8v+KHn2HWvYPKzAPbHKQX7FZI9H:NIrHCEgvL22CbfZ+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675747838, "uuid": "4083538c-d253-4088-b06f-5342bac2079e", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675747838, "uuid": "2baf4308-2c87-4f09-b099-2239e54887ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747838, "uuid": "da092c3e-9729-4ba9-8034-5a3a154af261", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14df21f1-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675783283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783283, "uuid": "1111d9ea-a60d-455a-99b0-a854f186d4ca", "comment": "Malware payload (AgentTesla)", "value": "bb7da07b2fe227dabe3bca346b7150b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783283, "uuid": "e240bce9-4e1d-462d-a831-e9cf8fd52d4b", "comment": "Malware payload (AgentTesla)", "value": "7f490d0ca36f65c1a3e08dbfb095c6b9bf26b7db071c624675635013a5c34cde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783283, "uuid": "db772348-e332-4f28-8ac4-01dbe6753568", "comment": "Malware payload (AgentTesla)", "value": "356bf616666407fd318db616382722e45259538d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783283, "uuid": "e63ed614-e1f1-4862-8420-65420d419af2", "comment": "Malware payload (AgentTesla)", "value": "730771b0aeeff7774a58a5067427c3149eb8510e2551492e5ae1f8e99972093481c2f956e7a2b87cf501ed1ef0819078", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783283, "uuid": "c870b4cc-6eae-48af-8932-f19f15495d67", "value": "T19EF4221C233CDB20DB968A75D4EC4A5503B6961DF251F71D9FC86EDB6C33B908A82293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783283, "uuid": "e47b54c8-0bac-4947-8ff3-6cb29656ffd5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783283, "uuid": "b7c934af-5187-4f8d-9147-d1fbfc4bae26", "value": "12288:tOrx7p58lCrd4gyQapWMsR21lyllKG8rQeTS8Q7Rmb0jRtHjqvb9Cpg9dPA:YrxN5IC54TWMwzz8rQASF1mb+HOZV9pA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783283, "uuid": "fa7ed00e-3a64-4056-83a7-b15b3bedad64", "value": 780800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783283, "uuid": "c07fc215-9640-4568-9da4-7f10d945fcf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783283, "uuid": "052da37e-28ce-4406-ae3c-e3bc4f4ec6de", "value": "Quote_2200001635.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad80b238-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789982, "uuid": "3387b5ea-6d3f-4d1c-af29-3fde1286d01d", "comment": "Malware payload (AgentTesla)", "value": "c029f02f6e9aae04b640c9e37be1af7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789982, "uuid": "fc192e09-9975-4dcb-b98b-0570d67ed09d", "comment": "Malware payload (AgentTesla)", "value": "7fcc32a04925ec34da54246c7f22e29e3a5c55609499d28662bdd9baccd84b17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789982, "uuid": "173a8f77-0a1b-4c0f-b62c-357abff24f24", "comment": "Malware payload (AgentTesla)", "value": "4c4626c3621687ac8f47edd9af4a23315c6d73c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789982, "uuid": "b3e039d9-bede-4b62-95f1-89ced6c0c568", "comment": "Malware payload (AgentTesla)", "value": "de0c71ecf0eb6fd7a25de8bda96407ef705d6c27c6709d67469affa7d3e5e479dc27003ca4d69847e5d6ed0498d1249f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789982, "uuid": "d4c13ed8-ab9a-448f-87e3-adee95ad4b7b", "value": "T1F305221D2BFDBB21C86E1BF9687018209376A0256561F72F4EE670EB1EB77108600F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789982, "uuid": "19c1407a-9344-493d-b06d-47f98aabfd41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789982, "uuid": "02c33de4-4307-4c96-955d-40cb3f2d2222", "value": "12288:dgawHRr/CB06KuLp/qod9uR2G79vXm3D+uGFscfKwA8Z6fCPjd1eR8BgCMRHQbDw:dgawxO5dC/7hWb238mdY8BdMiZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789982, "uuid": "6be8326c-9158-48ca-8314-348fb3207673", "value": 809984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789982, "uuid": "e5fe4c15-023f-43fb-9a03-9b75dfa75bd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789982, "uuid": "df43fd33-207e-45d0-b0ed-4f67eed33ef7", "value": "DHL 1 x 20' LY 0736449574 Shipment 0106245448.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b346b58-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675732586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732586, "uuid": "54e79cb2-aa1f-46aa-bcaa-8744a13925b4", "comment": "Malware payload (CoinMiner)", "value": "1c5c5fcbb9411738d3e6945a538522c9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732586, "uuid": "7bd6cba2-29cb-4b98-ad5c-e4a62ace3b99", "comment": "Malware payload (CoinMiner)", "value": "8009c5bc8df7fb418791fe8ec56e58ee257ef1dcddbe47a8dfe180b6fee3b390", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732586, "uuid": "abf0c44a-2073-4863-9c0b-c8aec76b50f5", "comment": "Malware payload (CoinMiner)", "value": "e9f3e00bb4f5a3035481d05d7429c825bd16ab7b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732586, "uuid": "54c454be-d191-498d-931a-df2afbeb22ec", "comment": "Malware payload (CoinMiner)", "value": "6a3491b4f0d0ea61aba2c19bee9612b28e08254b445debf4f5bc36abbe1c28c5c2e2e4614b6fdc9ea19b8802df0ab063", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732586, "uuid": "ddf0a9ff-94e3-463b-a77e-2009cd58c822", "value": "T1C0545B4393E1BE41E9268B72DE1EE6F87A4DF9408E7977652218AEDF14B00F2D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732586, "uuid": "2809ecb7-2fcf-4a2e-82e4-238190715225", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732586, "uuid": "5a6b4d69-5574-499c-98c2-2f8449a64a61", "value": "3072:3zb6bLKLLCeRmSULtjK0h13Di9+6QtXxp+q0rsL4spqIuQjiMTE5JOPa5H:j0KLLCdSuR1zis6QtXxYTN+qIuQj9ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732586, "uuid": "4639e285-9054-4652-8001-fdd3fa7ab0c7", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732586, "uuid": "5c2a97eb-dc50-43c6-8f8a-d1121727c429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732586, "uuid": "4aab776e-e18b-4292-8631-42b5375904a7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b2d5df-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756922, "uuid": "2c327d61-d651-4dcb-bdd3-8d6b9b25e882", "comment": "Malware payload (SnakeKeylogger)", "value": "c3c191a3d821681be6f849c84b71fd92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756922, "uuid": "e8458441-28e9-4cd2-9233-946b04caeecf", "comment": "Malware payload (SnakeKeylogger)", "value": "8050e8b876abe28d529d09660615dbef045d25037307db84c645c7ed515df089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756922, "uuid": "e28a077b-6153-46c6-a057-360375939975", "comment": "Malware payload (SnakeKeylogger)", "value": "80d25dc39f7ba89110e00b3e53450cc9a645ef34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756922, "uuid": "c1b55730-cc3e-42ed-8d99-fdd460af75a6", "comment": "Malware payload (SnakeKeylogger)", "value": "974ea955c1d534ebf6ca6e45eb096d3ee1266c2bbf5b4111b7b660638c44557a5e75a6e263972c5ee045cf51a0661373", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756922, "uuid": "23d71730-b847-48fa-9364-d1f5c906a386", "value": "T16065E43D68AE523B9AB5EB66CBD4541BF590AD2335039C2DE0D3338246369437DC623E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756922, "uuid": "4541adcc-855e-488e-8936-79138bbfb6a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756922, "uuid": "677e88ec-33b4-455d-9823-0d0d6e5ec91f", "value": "6144:xhFMDOHmoKSBZaJw05QtnbqlAnGH/RYNS/WVqB0:JHmoKSfaJw0qtnbqlAcuRW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756922, "uuid": "48ecefe5-9a29-48e6-bbab-63c49bac872f", "value": 1477120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756922, "uuid": "8a72f32b-56fc-40e2-b504-a57c97936563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756922, "uuid": "d604bdc8-48aa-407b-b56e-054f180daa40", "value": "9876543234567086543456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b7b7920-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789871, "uuid": "25b690c1-ca20-4d62-872d-9ea8f2ba3cfd", "comment": "Malware payload (AgentTesla)", "value": "218566f78183c63526d589250c454405", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789871, "uuid": "d2fad2d3-7342-4cc0-8805-091d9f45f97a", "comment": "Malware payload (AgentTesla)", "value": "8089619c8dba1d0d3a52b272d619fd6658adc82fd4f44df48582b0d6505f673d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789871, "uuid": "3fa5eca3-645d-436e-84ed-0fccafbad518", "comment": "Malware payload (AgentTesla)", "value": "61f8d6f962b30df274bf64821709a10816fb9f15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789871, "uuid": "5c0a1aa7-16ff-4069-add6-c6f4fc6a6beb", "comment": "Malware payload (AgentTesla)", "value": "a7b16ca2434bc8bb0eb9bb56468c86ff9e79d8452c622e0e76ae5e9059215a9ccf868cfd44bf897b9a462a4c5e286be3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789871, "uuid": "326706e6-1218-4d54-822a-5c02bc741b83", "value": "T1F215014A22ECDAD2D55C4AB99CD4F36C63357D298052CE19BDC0FB8E5A32A4204F357E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789871, "uuid": "e16130cc-37a6-439f-b74a-76f1a0b7d976", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789871, "uuid": "f8b7a4e4-f606-4440-a498-85f249dcc73a", "value": "24576:tbnBFmcWUoN8GEcNEV3A4rxN5IC54TWMxA:tbnBMRzSG6Ntgi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789871, "uuid": "438902e1-b319-4d41-a93f-f1d0132c5d55", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789871, "uuid": "51d0a7d7-11d4-496d-a970-0c441536eeee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789871, "uuid": "c5494a80-b404-4b1a-aeae-03727f9422bb", "value": "HSBC Bank Payment Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47efea9c-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675796254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796254, "uuid": "9f3a1617-20ef-4fa2-9f6c-7238193d5635", "comment": "Malware payload (Vidar)", "value": "b24eb3042b2149b2dd07946f337ba3ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796254, "uuid": "a8bfbc61-7871-4679-bf77-dacbe5428708", "comment": "Malware payload (Vidar)", "value": "8154ade13ec5b3bae9b89980e639004d7feb4be0b7f54c3678a83d603d83fea8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796254, "uuid": "25fbfd66-1489-49b3-9ae7-428cca94c005", "comment": "Malware payload (Vidar)", "value": "274cf7303a0972754d13c4fe70620a599a3e2c08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796254, "uuid": "09fa2805-c565-41eb-8176-fd6ba039b1c0", "comment": "Malware payload (Vidar)", "value": "97f747d7abc274547c996cc1c802a309be1ec2cd791212950d67588a25a7f9607b41bc7c4aff5fa3a5c974192f95e598", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796254, "uuid": "bcf4e03f-3000-4104-899b-6faf4db1e043", "value": "T1B5660151F8D754B2E902253209A7E2FF27206D055F358AC7DA44BF6EFC76AE00E32265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796254, "uuid": "f8298b70-8086-49b8-9871-e435ac23c405", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796254, "uuid": "17511c08-5b7a-4dc2-b786-793367b2c0d4", "value": "98304:I9ESrC9NP7MPc1XCB/PEmDEhUXG6ETc9wDQh/Ttlv8L:mEW4lMP4XsAhUXG6ET5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796254, "uuid": "0d69432b-2a68-49a3-9048-7c80b24518fd", "value": 6500976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796254, "uuid": "9432fedc-1f5b-4d75-9af8-47a730a06f8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796254, "uuid": "eaaeff60-f4a1-4581-ac85-e1d2d882d60f", "value": "b24eb3042b2149b2dd07946f337ba3ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe18ee3-a6e5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675774222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774222, "uuid": "0daa4b73-ee44-4ae0-a13f-7280d7e23cf8", "comment": "Malware payload", "value": "eeaf9edd636b474f2d5a0a77fbd49e7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774222, "uuid": "087f38b9-fe4c-4b8a-bc59-bee1fed49042", "comment": "Malware payload", "value": "81bf5d26d5248f9e2a964d44fae67545d32f6fc94d4587028364f63037ea3c5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774222, "uuid": "46b5010c-8c3d-4b64-b5c4-3fa51b70cdcc", "comment": "Malware payload", "value": "0abf36549ae78c564be67af67492d7042e94495c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774222, "uuid": "cb25c98d-466c-43e6-a1a8-2ba5fc19637c", "comment": "Malware payload", "value": "1c22a6dfd3d8b7a8fc574445caca67465f2ba2a038d07a34f1bbd0bc2dc4775ee7c522d22900bc46fc696b0018ebf2ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774222, "uuid": "d25dcfd3-d18e-42d2-8709-7f2f0b42626e", "value": "T18C53B516E29370FDC9B7D17187AFA137F537F8891A742B090B34CB192B51E60267EA48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774222, "uuid": "14956259-e969-4591-8ef5-f5aaebb3c4bb", "value": "768:DLnev9JsjYpFCfFbN624XtifcJd+ELNs6oVhA0Q4VBcrgoGo9Lcqzo8DOQCvZXa9:DLeVJtr6jAZSAozBcrgoGo9dOPRw3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675774222, "uuid": "94470446-9c9f-469e-be26-3b0a8ba3a982", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675774222, "uuid": "7779bcfa-f17e-47d4-97c1-a861a852c5c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774222, "uuid": "e2f4854d-b983-4de1-b5a8-b3705478f0d4", "value": "81bf5d26d5248f9e2a964d44fae67545d32f6fc94d4587028364f63037ea3c5b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4505f217-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675796249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796249, "uuid": "ad6701d5-e084-4df8-bce6-4b25a452435a", "comment": "Malware payload (Rhadamanthys)", "value": "367382cd5f338fd5d36f27e9b91d806f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796249, "uuid": "91bfd0b7-a4fa-422e-b055-cec664b9f123", "comment": "Malware payload (Rhadamanthys)", "value": "81ec316a2df6429425c8686cac4cccf3e96835ad4f3b4454fd9d96ee0765e6b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796249, "uuid": "32da0669-a0bc-4fd5-9e6a-ca84f0518a61", "comment": "Malware payload (Rhadamanthys)", "value": "f3acd3a8bb6b58a49a890782f7182a4d367ef883", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796249, "uuid": "11f5f947-36b3-41d8-9ef2-85cdf441d1c9", "comment": "Malware payload (Rhadamanthys)", "value": "780a792def93e1795955949c8930d505ce7d56e31651e88ac19fe1d340cefb4fb53b897196a85d726ecbb389dc55c309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796249, "uuid": "fecc3384-5517-45cf-b5af-57eb25c21664", "value": "T17B749E03EBF27C63E53287729E1EC7E4768DF5509E58E7691218CE1F14702B2D6A3628", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796249, "uuid": "fc6f5177-6f24-449c-80f8-17f2dd31625e", "value": "13dc564127b9f6b618808536c7e12f68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796249, "uuid": "57fa99cb-a176-4714-9671-cb8df3993bcd", "value": "6144:OP5L40ax+8hU7Ur8EeQ9WTtXmsJfsRudZuk6og:OBBC1hlQEeRTt2KjjrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796249, "uuid": "4ad6e9d9-95e3-4cbf-bc0a-c93c1d07f30e", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796249, "uuid": "3c4bd81a-9819-4bb1-8240-8cf1a65b4920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796249, "uuid": "35ae8e6b-8ea0-4b9c-9edd-50ba608cb214", "value": "367382cd5f338fd5d36f27e9b91d806f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810aea9d-a720-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675799356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799356, "uuid": "037d0b56-a9a1-4efb-9896-d323c07e183f", "comment": "Malware payload", "value": "9c09eeffe2f425af3658e7596efa753e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799356, "uuid": "d6ba9d47-8b4c-445a-a3e9-8a0a2f6c856f", "comment": "Malware payload", "value": "827c4997002fad614d23a5c16f9547005862ce2a8d5758e986f7a9ad67266184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799356, "uuid": "2c6bb745-f5a8-45a6-b6be-b30f44dec7c6", "comment": "Malware payload", "value": "bfd360c1be479ec1495bfb3b9fee0a5de2577d55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799356, "uuid": "56f6bbbf-db32-4e8d-9d18-80b25a75781e", "comment": "Malware payload", "value": "853821156c3e5bc2ba3351ac7e273516ea16b5e9aff785448e07870152c198784d96217e2ea553d523e5be22c84bcb00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799356, "uuid": "76d5ce4c-d445-44b1-ae4b-3b925ed6395c", "value": "T12B6633A77744CC39F2D6DCB0A5766E44C8066C2A879AF0E1B0BF7A7D623F56494A3103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799356, "uuid": "7c2f3096-341c-4435-910b-3d6a80a6f9cb", "value": "496fff7f26eb25a135e9d530fa8ef62e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799356, "uuid": "e48093fd-2401-4375-a8b4-c40917eff544", "value": "196608:g++s55CXIftXiqzb2oRBIKM2cZlZAAsU5H6qMENA2:lHJz6aIycKRCHecZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675799356, "uuid": "173ed349-b0a3-4c4f-a18a-af6fd1dd07ba", "value": 6648832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675799356, "uuid": "fa64e2ad-6224-4bf6-85a8-e1191f6687c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799356, "uuid": "2f0b48b8-cd6b-4738-82cc-016ec48ab216", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695b2b14-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (LaplasClipper)", "timestamp": 1675796310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796310, "uuid": "4e5def45-e8b9-4221-9cc1-1c0accce786b", "comment": "Malware payload (LaplasClipper)", "value": "fe7fa48a440e259f9ff0da8d725246a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796310, "uuid": "8270b074-1ca6-47f5-91b2-47ca7a27e1eb", "comment": "Malware payload (LaplasClipper)", "value": "82cc7bab13ae210019e28cad84b6a18a337621872951daddd3916f2526cf223c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796310, "uuid": "0a247df7-415d-4816-8bb0-da031ae5aaad", "comment": "Malware payload (LaplasClipper)", "value": "9ca747fd60f6d1c986e7638d3bf63986bdd5325d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796310, "uuid": "8ee5971a-4d42-476b-8732-26f564f1291e", "comment": "Malware payload (LaplasClipper)", "value": "19dacd89376276fd6105f2968fdcf0a9af2933a5110f4c991b338d86cfacb87a513296b797e7314a8760d37558072dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796310, "uuid": "8c74d105-ccac-4ea1-9369-c981e25324b3", "value": "T14C8523223710D0F3CDAA8A754A1467F4E87AF470A0E99017B75D0BBD2E702D5AB3D35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796310, "uuid": "6dc18d2d-fb6f-43c6-9085-a4be8e284fd7", "value": "d76496b570328542e143db87692dabe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796310, "uuid": "131a9d2a-5111-4d58-a0a1-47c375b235cb", "value": "49152:vrNB4pzWoMv9jHpR0eC4NHc7kSHZB4cOSbx9ps:DwzWo8jvSHZ6cOSbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796310, "uuid": "3d8b23fc-f58a-48b4-8405-65b30b45abda", "value": 1870848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796310, "uuid": "c595df57-a8e1-4fae-b4fa-2cb51d44f88a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796310, "uuid": "ba962ffa-2e9b-437f-91fe-10f9ba344920", "value": "fe7fa48a440e259f9ff0da8d725246a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41a90d4a-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758447, "uuid": "d2fbdcd2-5d14-4ae8-9bf3-2afdc5957a8e", "comment": "Malware payload (Gozi)", "value": "452e7b912470606f77ca4d9b36b3f4f7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758447, "uuid": "1576238f-177e-455b-9b0b-a5c9ab3938cb", "comment": "Malware payload (Gozi)", "value": "82fffa53f44c6e9cbedbf437d08258885f3e23b1f3da800b45c498d4f2775ccc", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758447, "uuid": "31581ec5-c758-4898-8213-6654c9e37a35", "comment": "Malware payload (Gozi)", "value": "18e5a66902f23f47fc06b107406aae988b3e0f75", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758447, "uuid": "7d0f73ce-9e23-40dc-84e4-e8e183149de3", "comment": "Malware payload (Gozi)", "value": "2fd93421e788df8a763bf17d1a9222362d1e3e1a4094c6fbf5bc4d2b579046c2dc9c357348b77f235c3c4fe15918632c", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758447, "uuid": "7e2a9f3f-17ab-4747-b2b1-d59e10f33a05", "value": "T16EE18C8E9DEB641BE78142EFF6333D10FB60187AD9292204B4E2E30E6A6672B014125C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758447, "uuid": "229166e3-de83-4203-b0b0-75bbe1cd0b53", "value": "192:DxCGXU77rIKdn863jMM0OD9+VVF44xikuj:xa7EOM7/F4Ouj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758447, "uuid": "1d07e501-23fc-4a4f-985e-1c8cb95b5bfa", "value": 6981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758447, "uuid": "523ddc5c-3d85-4135-9ce6-49c92f4874f8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758447, "uuid": "b2d58aa2-7d3b-4b3a-b381-d56a3079ee7e", "value": "azienda_33.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4184a13-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675790019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790019, "uuid": "4a405de5-6f73-4881-b65f-165d15bc1dbd", "comment": "Malware payload (njrat)", "value": "a97d1ed486e42aacfd886ca2f730b2b3", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790019, "uuid": "ca47cffa-c6d4-461e-b0c2-e2a0fe66db57", "comment": "Malware payload (njrat)", "value": "83034bb9f37774d1699872906765d44f1e244ee02c6544b931d61c301eba7991", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790019, "uuid": "d0b0b65e-2bf3-41f4-8bdc-cbea0a37ebb1", "comment": "Malware payload (njrat)", "value": "ffc71bef70305895fe4d85e6143f4b6e6795d996", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790019, "uuid": "5fb019f8-e94b-4bcf-b5ac-962be10609d5", "comment": "Malware payload (njrat)", "value": "d5953e3e84c4c2c3377fa194db477d2f86402df02e652fddd3151b2b7f83ecb6c3931a6f0134f861c23fa7d8f1c94e03", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790019, "uuid": "9b7829f5-edab-4566-9f73-9490318507c8", "value": "T122F18D4EFAD9E609CBB0493C53A1DC56F804D2E68068E2C255A2BB0CAABD489534D8DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790019, "uuid": "18f14ff9-a726-4602-be87-114809573ccf", "value": "192:xrXP/RYUVJQ1uq2/S4cS2Ow5f/5/YRWhcEy5:dXPJRq2/S4cS2OwRpjcEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675790019, "uuid": "9b17b211-8169-401a-b62e-d9456f50bf6b", "value": 8003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675790019, "uuid": "042986e7-908f-4e31-98d0-2cad95267ef9", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790019, "uuid": "6d11be6a-f140-4541-a4ff-be24e918133b", "value": "RESERVA.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f949111-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675796159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796159, "uuid": "3f157246-25cf-4624-a2ff-5d43ff88138c", "comment": "Malware payload", "value": "d09f5caa5c4c7029b74685e9deb50ab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796159, "uuid": "953e1e04-f24b-4e8f-8668-aa46d7a13798", "comment": "Malware payload", "value": "8316a57a9d9234ab3bd9e9626c0eebb5c7a708e2800aecb0713ac452e22c9ec1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796159, "uuid": "8158b173-c24b-4735-818d-3648f52f9882", "comment": "Malware payload", "value": "c6ec5b0f9d8f2774d00b71ccf117de2ca1512a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796159, "uuid": "afb07a10-4dae-4749-8681-23d8d2425caa", "comment": "Malware payload", "value": "c67abacd6c51312732b1f17601dd2460d9f6f5798cf279593d50b17a7b28a28bc475d3288759d2f487f6ba9c71faa171", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796159, "uuid": "60bf5cff-1d03-45c9-baf7-fa2ae3ca4249", "value": "T14706E05481C430BFCDC4DAF746F5AF4F217634731642AA0FE48EF2958A2AAF8AC07565", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796159, "uuid": "c08ca1f7-65e2-4616-ad8f-b29d803dc1be", "value": "49152:Q0vYGL/PdGnWYzlXaDSvcDNPZSUO59aukb57R2v2brVZM18s2916dBK7SkBYHMqf:Pvb/PW3lWI4pjy9aTR42b7iA5aMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796159, "uuid": "83606087-f575-449d-a24c-9c2dcb58ad96", "value": 3731724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796159, "uuid": "c465ed53-1dd9-424f-bbc8-861a2db25a8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796159, "uuid": "4999ab17-ebf4-4615-8b39-14c90f61b247", "value": "d09f5caa5c4c7029b74685e9deb50ab7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35150bb2-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758426, "uuid": "87e1bf4f-91aa-4cc4-bc39-05d27fd4c84d", "comment": "Malware payload (Gozi)", "value": "239656f8c1aed28be6206662b3864211", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758426, "uuid": "edc5a204-9356-4222-b4a3-e2cb65124144", "comment": "Malware payload (Gozi)", "value": "83ddc3a0e23f7614c94bfbc2cbd98a87980c082ec48bb9b5bed1376d65ba2fe3", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758426, "uuid": "20a9385f-554d-4a63-981f-381e8d94e595", "comment": "Malware payload (Gozi)", "value": "d8c729f70db90f02b7f28da7dd16913093aee321", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758426, "uuid": "dc54e763-bcaf-4fbc-b605-c6762f55ca3b", "comment": "Malware payload (Gozi)", "value": "e3f3be639b03b28d4c5b24c434efa15d556f3172f802b62a8c69c3c1f27ec466d8a012dc343ff485609d347b8055dcb3", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758426, "uuid": "96ec6b30-590c-42bd-bd4c-b5eab43ddb96", "value": "T136E18D4EDEDB641BA79182EFF2333C10FBA0597ED9296204B5E1F30E6B62B27014161C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758426, "uuid": "6bedcafc-d8e6-4b8a-b39b-ebffa6ecb404", "value": "96:w1KwkLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dl96r2:59U77rIKdn863jMM0OD9+VVF4vx4kuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758426, "uuid": "cfac61c8-f9fd-45df-ba63-6fc977913257", "value": 7025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758426, "uuid": "4d2d5b7a-e2f0-494e-a3db-62dfa4553d98", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758426, "uuid": "33ebb621-8724-4c4f-9d85-686b9fd138df", "value": "azienda_29.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d86e24c-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675796209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796209, "uuid": "cab3d3b4-277e-4527-8e9a-9dbbd780c3e3", "comment": "Malware payload (CoinMiner)", "value": "2c64042dc4d129cd682fa733421b7081", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796209, "uuid": "43f0140a-cc7f-4bf9-adb3-92210d8e97c7", "comment": "Malware payload (CoinMiner)", "value": "843a3b5990b6c1f9b26d211ce03f6cd08b7363d3b2c1614a90a6ca842ffe5073", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796209, "uuid": "f8249896-9f7c-43b9-b150-d75ddf73d424", "comment": "Malware payload (CoinMiner)", "value": "6c22ea3217226e1b8f5207349ade626890c409a7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796209, "uuid": "335b7699-2610-456b-a3b0-83fb4856ca92", "comment": "Malware payload (CoinMiner)", "value": "97166169f9c511d5a463734d081f1dbf757573aeabab1e4a6a03808c110a33ee21686c90eb95acc1a5559a2a4d9e9830", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796209, "uuid": "7fc4e15e-ff7f-46c1-a5aa-7bf1f0912201", "value": "T15695AD04B27ED455F294AA34FB657FEC3810BD1979190A8F27C8B2CB97F6771490BA20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796209, "uuid": "9e81e4c3-f28d-4483-8acd-13f37cc5a4a0", "value": "fb1ae5abecaeca36783c993b4b11b360", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796209, "uuid": "11047718-023e-47cf-9aee-a5a469ac3a4d", "value": "24576:vB7sEEQ1VkUWWBkjaYoQyeHnSEViHDc/4VdOT6JmkZreEf6wf6lr9o+w:vBrgUB9YNykSgiHnOTpsrFf6Pxw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796209, "uuid": "4320e5ae-ece1-48fd-8900-ad22e9fe7a11", "value": 2053920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796209, "uuid": "2000b7f3-a745-424f-b2be-f9748f3901d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796209, "uuid": "17f73014-faec-44aa-9494-cd58ef617038", "value": "2c64042dc4d129cd682fa733421b7081.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c82f886-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758519, "uuid": "244d6cc1-18ce-4d05-8c26-5956dccbc9e9", "comment": "Malware payload (Gozi)", "value": "2e0e64aacf6b0c1c7daeba6f296b0658", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758519, "uuid": "7454f4f3-bef4-42f5-978f-8c0bc34fbef9", "comment": "Malware payload (Gozi)", "value": "8447b4292c7bfadab77b3b847c9dffce3c038a8af760eb638081657c5dc3750f", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758519, "uuid": "3df97df7-97da-4a3d-9af5-3293cf04763b", "comment": "Malware payload (Gozi)", "value": "117ecfa15c7e82f3f812f143606e926809ae1791", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758519, "uuid": "850c7730-5a6d-4ba1-a69f-3ef734cb869e", "comment": "Malware payload (Gozi)", "value": "665d7733742ed1dbeebc7708046f993bd495982a0192e22284b80e742d188e8c3e6ee147706ac487b42501c8bbc7b8b7", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758519, "uuid": "e0634daf-2f7e-475a-b512-10e5b48dec31", "value": "T16BA17D15EC822103745FEE92A3D1B4C0688B3CAC51798A349F47D2E3B2D97F1E9710A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758519, "uuid": "180124fe-5cae-488a-9e23-71a9e8ee21b0", "value": "96:h9duB3nTWOosZ/9oQolWlDc2cnTWfryjbckFA1B/3KYA5sbDVZ1IJh9uOa:h9AB3nxb1cWlD/uEyjGt3y5sbmJh9uOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758519, "uuid": "4143b277-3142-4925-83e3-531c1144d9cb", "value": 5071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758519, "uuid": "633669d9-6347-4a8e-b02c-c25a722f1d26", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758519, "uuid": "798f82f1-9e94-4284-949b-92913d0b4b86", "value": "azienda_01.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da56f21d-a71f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675799076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799076, "uuid": "5f02b296-064d-478d-b574-ec48b69b6b2b", "comment": "Malware payload (Amadey)", "value": "3a9592fdef575c048d0ddfbefe6fe7e7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799076, "uuid": "37c4e86d-6879-4db8-8e29-33ba45619b85", "comment": "Malware payload (Amadey)", "value": "845908e30110887ee222bc5acfe7bdf0395dc5bd0e8458570f3ec775b54ee181", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799076, "uuid": "52ccc225-0b31-457f-a001-083b956b2150", "comment": "Malware payload (Amadey)", "value": "72be4d6294fefc4af469ac4c4eee2f25ded8baa5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799076, "uuid": "0a9d5cff-7a97-4c3f-b835-574a617afd89", "comment": "Malware payload (Amadey)", "value": "df5e32edd7132770e4568b91961f3888c6325c64198aa8966cb306eed9fc5907003ae76a89974bdcb7f8b4904dbd66c0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799076, "uuid": "9f1b11e0-e007-49fc-aa9f-6993f5dd3a39", "value": "T14DB40207B5EC8122E9B5673055FB03C31A367DA15A388396368FBC5D08B2268F53577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799076, "uuid": "af533f92-0495-4183-8143-a738de2a7bc0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799076, "uuid": "dfc55e70-b7c2-44aa-b038-1ce35b8370b1", "value": "12288:NMrsy90r2kp1FC1mPmwOfeXgrddEeMuD8GIqZX+Ajoar:ZyWp1gcKxrLEerD8GIkX+AcU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675799076, "uuid": "363ac58d-a116-430c-b6de-6b89152ac555", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675799076, "uuid": "7d1350e4-e9ad-4b03-a741-b77daab5ec8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799076, "uuid": "4c37cad3-c639-401f-b8dc-cbf4ffafd838", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bdcc0b-a6ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675778394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778394, "uuid": "faaba181-11a0-4797-a0db-8824123f27ea", "comment": "Malware payload (AgentTesla)", "value": "6b036c7623d3100e8deb9b8851326abc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778394, "uuid": "47aef457-5735-4a0a-8dc3-0edc164fffb3", "comment": "Malware payload (AgentTesla)", "value": "8471fcbd72382b544bf61c72954cd414af72316ecabff24485617a0fc800a9dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778394, "uuid": "136c565c-f8b5-46e1-bfd4-54c0f14e97c7", "comment": "Malware payload (AgentTesla)", "value": "47a2606f4830bb935f3baf46bfcefee973ead6fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778394, "uuid": "188d4c2b-f061-4b0b-8aaf-e96dd00ce39d", "comment": "Malware payload (AgentTesla)", "value": "098cbdee7a19452c49586225b66497400678038073b9b26ae6924cfc048e28f7383becf6ddbce21161aec68c35d9f741", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778394, "uuid": "1812df18-609d-4538-8b1e-32eb27abaa50", "value": "T124D4C53E697B56E2C578F93986E18420B5AD83933303C998DDDA2BC0CF016867DCE65D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778394, "uuid": "f5837dfd-f94a-4b01-b5a2-cb8ca5b8a1dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778394, "uuid": "43e96b8a-4676-4d7c-ac07-43b44e9787e2", "value": "12288:WYdNAeScK9Dne7f4WYMTyPdLX2tuCAe/ZXP7DyNmDP6XzAFLZE43G5p9OwRIkGY/:R4Tp7MTyPdLX2tuCAe/ZX/yNc6y1E43d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778394, "uuid": "d9d09fbd-18d6-473d-a265-10ac935da8cc", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778394, "uuid": "07570c9e-0df1-459f-ba0f-566266d6a677", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778394, "uuid": "aa589f39-7e2d-4ca2-9c1a-cd333658469e", "value": "Dewell HBL DRAFT -HBL#SBKKS0007377-MBL#COSU8029379970 -6 FAB 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a3dfb3f-a683-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675731726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731726, "uuid": "786acdae-baf4-4613-a714-b1aa9fd90c63", "comment": "Malware payload (RedLineStealer)", "value": "7552458435bbdecbc398defe4ab28fd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731726, "uuid": "02e713aa-f542-4113-bd3f-4997f47e4904", "comment": "Malware payload (RedLineStealer)", "value": "84808ad5835a69ced89441cdf92c4e5570fffe6d5936aa2b34c7b41d7a25601b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731726, "uuid": "7475f230-d6b0-46be-9b17-8078e6b2ae09", "comment": "Malware payload (RedLineStealer)", "value": "046e2e4619826d7c62f547b520094b59394d53f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731726, "uuid": "cb6ff744-74b6-4d27-a24b-8b643ec11591", "comment": "Malware payload (RedLineStealer)", "value": "831bf8d496cf46f9d462469daf4a6364af61bbf4575fb6fc4ae95c707fe620602a91609e4d88e7ada200b87d651de528", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731726, "uuid": "81bbb085-a9a0-4bea-ae98-20b5b727a3f0", "value": "T113849D4393E1BE44E9268B72CE1EC6E87A4DF9518EBD77256219AF9F10B0172D1E3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731726, "uuid": "1f35e074-b748-4657-8447-786bfca4adee", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731726, "uuid": "036de7da-ed11-4844-82df-7e2032e6080f", "value": "6144:uNKLJ96IZxIjnHPXfTChUY7ZMwyTvSuQj9XWDa:YKVAFLHvfT6UcZM8ljs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675731726, "uuid": "b5490f91-7c69-4b3f-b33b-a2f81042d7e3", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675731726, "uuid": "f01559f6-38b0-45dd-adf7-43f519650845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731726, "uuid": "748ecc59-2eaf-4fe6-b631-9a1bc49db5a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee64094-a6f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675780132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780132, "uuid": "fca93ea7-5f44-4a72-b773-138e49345712", "comment": "Malware payload (RemcosRAT)", "value": "668ab80274e478146789a6e13930cae8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780132, "uuid": "9f59359a-4539-4088-bbe9-6de480b8de75", "comment": "Malware payload (RemcosRAT)", "value": "85072c1047d2354b40e07b8ad6628f86208fb392a56cd868b9d166f7f6b462c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780132, "uuid": "ea43afe5-2844-4b10-994c-c9972ce83d4f", "comment": "Malware payload (RemcosRAT)", "value": "313422ac19b51cd0f0827414a6d743639ae8d892", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780132, "uuid": "bec2b56f-7cb1-4f65-b95a-98a03fcaae3c", "comment": "Malware payload (RemcosRAT)", "value": "79d48d7147a118376e0130834ae6a369a72072fe32ff9947d33659494f4baa623a0398a260e5b7f0c1d3b0991dc88648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780132, "uuid": "3b4fb5ef-6410-4826-81b1-43e0fef3d386", "value": "T134B42310BA4E99B7C0B686710EB99376D8E6A948013147AB6354FD8C76F3052CB9E33C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780132, "uuid": "999adb3d-aa18-4f2a-a764-2e6710e62600", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780132, "uuid": "8e501127-d9ab-4b90-830e-be63f5c66590", "value": "12288:/YNggj0rkQK1tX11pfh8hK5W747mAShDh8Ho1DwccpXo6B6Wdu+xoqw0c:/YNgiGKXzpfh8hKfmAStoU0VBwUlwb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780132, "uuid": "a4b3fa36-00b4-4fd5-abee-7e9752d230ad", "value": 535851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780132, "uuid": "91575fbd-0bc2-4858-8e76-302f1d3ba4c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780132, "uuid": "066ff986-322d-4f52-a5aa-ba8a07e9e490", "value": "PRE ALERT DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff014716-a702-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675786682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786682, "uuid": "4b6f9a28-c223-4af4-bafc-f7a44e0077fc", "comment": "Malware payload (Mirai)", "value": "593aecd29474c38b17f3648ed9bdb1a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786682, "uuid": "ea869c39-daaa-4c84-bc83-73e7e611a314", "comment": "Malware payload (Mirai)", "value": "856c4ee8019b692ec7a1a02e233a16af5e9d3055f0eb257dae9395f6c2146e88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786682, "uuid": "ad267e23-1371-4f00-8cc6-bdc7cd3e86b9", "comment": "Malware payload (Mirai)", "value": "a7f4a5530402e5f8656e8fe9c588e5a5a82f79fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786682, "uuid": "5c16a764-ec99-400d-bd55-0461fa38fbe4", "comment": "Malware payload (Mirai)", "value": "02a900d384539b3a430c000288b1b48470cc24f36820c5829de3c5c6d657f8a820bd8651a712dedc9d06640b9d45e1d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786682, "uuid": "18a480c0-2f49-40db-b1f9-7b830452e752", "value": "T13D132AC8F453DDF4EC5506B4313BEB369FB6F13A6129E9A7C39996336C81901E20629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786682, "uuid": "925cb1a3-fc72-4e29-b837-424bae3de4a6", "value": "768:w2T5Sb8x07IvnJ9Xy0h2chGtGrDDMnLBnyAZm9IOgPuDlycake+E0nhVvuvn:Hx070nJVy0fhG8rD4Nyo0gAlvaRh0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675786682, "uuid": "e9fc88e4-9cd0-4029-9636-e57601787fbb", "value": 41744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675786682, "uuid": "aab5fd38-cfbd-462e-87bf-5d0a96e93615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786682, "uuid": "c3969ebe-160e-4815-8a68-95f1e2474fe7", "value": "libcurlnew", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eea7f96-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675758496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758496, "uuid": "84203335-aab1-4b51-b31e-1a24f6f84557", "comment": "Malware payload (Formbook)", "value": "9ad88e8dbef2a3504695ab12bf86688c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758496, "uuid": "dbdfc347-aca4-4e72-856f-9f6d253e793b", "comment": "Malware payload (Formbook)", "value": "859a92b3928c1ebd7d9eb16fcf622493f4d0ba1c776bf86f62ce9734bde090c8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758496, "uuid": "f9ce826b-09df-432d-930a-a80bcf136ecb", "comment": "Malware payload (Formbook)", "value": "732df4a147ae98f0f4fcfea84af2dcd6224a80d5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758496, "uuid": "f450cd25-b165-4eef-b51c-58b717b6a885", "comment": "Malware payload (Formbook)", "value": "40aec6509ec0b70f9b6cc2889b6043ee50ef07bb4d74e9fadf41c0be4e7c2cd7f6c6db8fa3f78c69f397a4da82af3edf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758496, "uuid": "197ed3a8-8997-496e-93a4-91bd378328b5", "value": "T1A1F2095AE79F02A4CF511277171A0E899ABDB33EB3505571386C837433EDC2E0666ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758496, "uuid": "fb114b6e-1789-4034-a948-691d44752ece", "value": "768:sFx0XaIsnPRIa4fwJMMyZ9Uze4/TSUxvo8Wz/37HxlfCPEFA:sf0Xvx3EMMyZ9Uze4uUxNWL3LxrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758496, "uuid": "31bf8312-856e-4b63-80f4-1c4063db50be", "value": 35843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758496, "uuid": "9fce7484-feb3-412f-a178-ac96594b8e7e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758496, "uuid": "5f4c897d-28de-436e-b050-81441491e25f", "value": "MensajeSwift__20230206_115140_1.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e400dc24-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758720, "uuid": "4cf59d94-8f26-45f8-be04-ead251ea18f2", "comment": "Malware payload (Gozi)", "value": "cfbcf59eb803e4e6b3215840a57dd2bd", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758720, "uuid": "9915f071-ab90-438b-b3a1-fa7340090a03", "comment": "Malware payload (Gozi)", "value": "862722c090a65cbf3455d9b6603aed944ffbb85289e973ade36b2d3744d0f560", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758720, "uuid": "48aa7cba-65e5-4700-b777-6628d5784184", "comment": "Malware payload (Gozi)", "value": "ef5c53552c57e7698862a00c0c228c9e963c4784", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758720, "uuid": "49c149f9-30aa-4ec3-93d0-6f20e364d78f", "comment": "Malware payload (Gozi)", "value": "04de1d3d54ebdf0e8e7d6a361408a3cd341fdea11ad704d5dbd73061412717bd0054e446b38c4bc5c6a549552c6f7497", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758720, "uuid": "f2dba0ef-97e3-460b-bac5-f1492969d64c", "value": "T134A16DFA15ADFC2A50B872E5D7261153E10F6D1AD928C2142BF6FD35348433939D4513", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758720, "uuid": "24dd3eb4-c89d-4687-a36c-de43a6fbfe4e", "value": "96:Sdcex16rguQcub6QFtCjnOnuqmEHxz3kGpRTm9OGKz98v:Sd/arTQX6ACjOnu6HxzpRuOViv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758720, "uuid": "906a8c63-86ef-4695-90a1-5e6f72a60396", "value": 5052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758720, "uuid": "a713489a-6ead-4d0c-bf1b-c7a0cfd1316e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758720, "uuid": "7daa1b9c-2a39-40a7-96ab-f4656b9baa90", "value": "azienda_37.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752d19e9-a67c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675728899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728899, "uuid": "6070bbe3-e315-411e-809e-1b9e9954a897", "comment": "Malware payload", "value": "844193282a04274a17123208cf71c174", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728899, "uuid": "0ea18140-63bd-47b5-abea-2c0d32412f3b", "comment": "Malware payload", "value": "865762f1b72d9e112da99dc517808ebcf42a4b0ddd39063fa2b1e6c0fb82d0a2", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728899, "uuid": "06f8d27b-9318-4e92-a627-acb4db3a4130", "comment": "Malware payload", "value": "631d1c8af8f89a1506b5acbdd61eb325777bbc76", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728899, "uuid": "4f7e95a5-8e2b-46e1-b1eb-85244ab6c465", "comment": "Malware payload", "value": "6c7f33f7b2ee5cf68b7afde3eeedd39f2894bee7a116e549cf81bacface52e6ce585527cbcdbdd65ba37a6b0fd6376ae", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728899, "uuid": "5e914dad-f2f9-4dc2-b4e0-8e54e951dcdd", "value": "T16011CE347FB8C11DE13735B896A3506A7B2A2A5C4A4C8A0B462871DC5C35B814FC2AEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728899, "uuid": "c859b9f0-7c55-4095-a827-6b0e59612f7f", "value": "12:5j5GJjnq19P94vxrTdHGugj46ISrLAzoQtqckRilxbGaEx2u+5dUT:95GtqSTdvgj4f9PPjxbGfxAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675728899, "uuid": "bf3d2148-1d97-4119-862d-6daf454b61af", "value": 935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675728899, "uuid": "c858a57d-73b2-4c5a-83bc-8c4c457e7337", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728899, "uuid": "01a533d9-a23b-4a16-b88e-7bd1235e95f6", "value": "Xploit.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22264dc2-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758395, "uuid": "8c0ced8e-4ee6-47db-8f11-7ba6d8de16ab", "comment": "Malware payload (Gozi)", "value": "cc68d37ff80c37464b46d0b10cf0ae52", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758395, "uuid": "df8184c0-dcf6-4e95-9373-e08d34528fa4", "comment": "Malware payload (Gozi)", "value": "865ea3480a44c5d699de77f6405952bcd7fe3af106f815a517a5ee8379f20cc4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758395, "uuid": "594da886-ea3d-40de-a97c-94ad871bae91", "comment": "Malware payload (Gozi)", "value": "a33459edb846deb10cb1b74341ad2113efa2284b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758395, "uuid": "b76164b3-1e8f-4507-ac6d-2124953f5e37", "comment": "Malware payload (Gozi)", "value": "d869c2c2449e805cb99a7a97718fff6419b5dc172508fce00c216a094d2325da88715c84ae51b51d5b484e5ba3f68f83", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758395, "uuid": "cfd5f3a0-2b6c-4ab3-bf4d-0487518996b4", "value": "T17CE18E8E9DDB641BA74081EFF2733C20FB60557EC9293204B5E1F70E1A52727018165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758395, "uuid": "e94611a7-3b29-4efc-8765-fd4e71070b48", "value": "96:wX7aLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dV96rKL:LU77rIKdn863jMM0OD9+VVF43xYkuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758395, "uuid": "d0847575-371d-4fe1-8106-39fc43df4931", "value": 7038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758395, "uuid": "3e7323ae-5670-4e56-bc0a-b0398bfb2b99", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758395, "uuid": "5fd41043-f044-49b4-a4d9-283825c4238c", "value": "azienda_23.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf8a15e-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788853, "uuid": "cc6dc364-1d61-4afe-9c88-2e3921f1be8e", "comment": "Malware payload (SnakeKeylogger)", "value": "d3332c181da602270cd02ae209b09379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788853, "uuid": "527bdb46-8224-4825-941f-63020e57b417", "comment": "Malware payload (SnakeKeylogger)", "value": "86e4b776aec50acdd93a30a8c0ff8435c10ba8bfe5172cf6e0defd32e26b3e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788853, "uuid": "20389f5a-c513-4803-9832-a3bda042cba1", "comment": "Malware payload (SnakeKeylogger)", "value": "c92d960b33ff3d97994fb53b9b61019206774b4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788853, "uuid": "d013ec3a-7078-4114-a8d8-19d052973a5d", "comment": "Malware payload (SnakeKeylogger)", "value": "0d36b5c783e581cf862111d95637daee19826387b70bedfb5219996d2e11146ff227caac046bb6462c91e38f19ede5bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788853, "uuid": "8c16ff90-e7f6-49f0-9fd4-6473aa70652a", "value": "T191B59D3ED86C5177CEA8C37DE590841EF2E4A6733921BD3ED8C3138419AB582788656F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788853, "uuid": "246d08d9-aff0-40fe-bca2-66ee1fcfbeb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788853, "uuid": "f0c941fe-a5f4-4751-8f42-2e39aef80500", "value": "6144:8SAXst2KbcfBZ/Ksk/1+nriEgt6A6LnjZRBLp7UCJeO+5YBAGk2BDQAIwePzocHI:8zXs/bwodXCdtp+O+K6GTQ/Jsco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788853, "uuid": "60ba2cac-1690-454e-b5f2-2d9eef0204fe", "value": 2342912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788853, "uuid": "ea90b1fb-0d41-4a31-8a23-dbc7b7ae8181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788853, "uuid": "6ffb8552-5c03-4ff7-92b1-829f5bac1b2d", "value": "000289202 - 02802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb42d71-a6c6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kutaki)", "timestamp": 1675760779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760779, "uuid": "58f9865f-f49b-4d05-9917-3c6c97962bdb", "comment": "Malware payload (Kutaki)", "value": "3983e3e2ea37719a50665ac70316a53d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760779, "uuid": "885ac6e4-bb19-43cb-9ba6-e804ef698a99", "comment": "Malware payload (Kutaki)", "value": "86fc1f2dabb60a5c5a30d63d8508240074809554e0630f1d6bed457e3f02e80a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760779, "uuid": "38fcbdf2-9ee6-4ee0-ad56-d6e01670fae7", "comment": "Malware payload (Kutaki)", "value": "029aaed996072a601fae913597f20c976bc2a452", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760779, "uuid": "44114915-f28e-4142-bf56-ce21342c2823", "comment": "Malware payload (Kutaki)", "value": "64b51fc1e31d3c8b2ba2f0995da7864ae9560b1e1e165ec2dc141ee9524dc080620bbea1d8ab02cca6c3cae96debdcf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760779, "uuid": "96edb3f1-3f30-459d-bcd9-4285a7c62e00", "value": "T163358D33EAC0A406E66351B34CB653B914112D7581094D0BB3CAAF5969B3AD3EDF632F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760779, "uuid": "d35d22ba-5286-450e-9eed-e212a21014b8", "value": "d05f235ab4361da42178be81d9f5db86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760779, "uuid": "238d4853-9397-4f76-9fd9-6bc19461f415", "value": "24576:XvPS/SnugUM+4Zt5l1fmP/UDMS08Ckn31E:XvPEwug1jfmP/SA8NlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675760779, "uuid": "504c856c-589f-4901-94a9-de1ad3723e08", "value": 1062098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675760779, "uuid": "15d2355c-a007-436c-b18c-47eb1e58aca7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760779, "uuid": "5f1b96b4-519d-4f76-a0c1-c839bdeb14c7", "value": "INCOMETAX_RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6202d93-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758616, "uuid": "1ca6f510-ef24-429e-82cd-914a54e81591", "comment": "Malware payload (Gozi)", "value": "49e0b7b12f4d227234d86c8c9b13946b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758616, "uuid": "1e3622b3-9561-4ca2-92b8-db98da856682", "comment": "Malware payload (Gozi)", "value": "8738184ee9efdf4cd0617c360bdd43359c9d51b1ac37d5ccbb4d88d7e7140138", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758616, "uuid": "2d09cbd2-3c7a-4513-a512-db8095c712b5", "comment": "Malware payload (Gozi)", "value": "f72acb903a2a0023f441415c2fa1cc965a16b455", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758616, "uuid": "a325d31f-dbd9-4c38-93d2-e21efd2852fb", "comment": "Malware payload (Gozi)", "value": "00657060fb16a768bd2854b95fd873f6933bd9fe946742820e3361c866d3464a554ae4c15c2b00c9a059fcbc6c9790c9", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758616, "uuid": "2f48b7d2-ed2f-4498-8b6c-962ca3e71a55", "value": "T14EA17E2CFE7B455665F346E1066FF6CDB65935E2B121065477C920F38CBC4B22DD900A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758616, "uuid": "180fddc2-8dbd-4a18-99ef-c6ea652dfe7e", "value": "96:Kd2uhiQtUBCWndyujTidHzjWRkAUB4lgMa9v/pESS3jAhF:ePtU80cHDADlgdRR8jkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758616, "uuid": "cdc07ec2-7b6e-40d4-b2e9-38f4358c7251", "value": 5077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758616, "uuid": "652ca6ba-5447-4511-ab44-b1ea6e393480", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758616, "uuid": "5dae3ec4-01c3-4018-b44d-b2359956c26f", "value": "azienda_17.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df777373-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675761719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761719, "uuid": "48cbba73-eaed-46e0-afde-01c3318e3388", "comment": "Malware payload (Formbook)", "value": "207fdcecc4c844004d064f7f7d25fb0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761719, "uuid": "99ca866e-d9e3-4f4a-8acb-64fd3e4f5da1", "comment": "Malware payload (Formbook)", "value": "878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761719, "uuid": "6e36db53-7213-4935-aa27-bcad1f36d626", "comment": "Malware payload (Formbook)", "value": "4a1b05f7cd8b3ba7c82f48ca8aeb10b264369c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761719, "uuid": "2ad567f3-2b84-4d76-a33a-852373c801ea", "comment": "Malware payload (Formbook)", "value": "9349023ff5da356e101bc95e2e90614c8c82f69822735195dc140e9adfbb0b2e479afd5aa674d1b7db10698ebe8f2578", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761719, "uuid": "329b2536-0cc0-4f05-ad19-78e429206f4b", "value": "T1A433171476EC8677EABF47FE0830204917B1B6376017E7891ECB28DA91A1B904718BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761719, "uuid": "86fcc042-d0c2-4873-8b82-df9f30169f35", "value": "768:EyH64NqpyLvO3klekO2Pco2YQ78QTEB6SrZdP545gkRUnqkAmZbI:w5pyLvLy2awvsSVBqukeqxEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761719, "uuid": "2dc5588b-1eec-40e2-8ece-33214e916445", "value": 53248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761719, "uuid": "a8481cfc-9be9-45bb-831a-b8778fd18647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761719, "uuid": "89dc5215-59be-4aef-a70c-3800093b5e84", "value": "878b17fea5a31ad0ce61021cacba5be79f2130fa08165b768196a87eae4e6be9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd02703a-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758654, "uuid": "e9b5eb34-2d63-46df-83f0-17a8af278f89", "comment": "Malware payload (Gozi)", "value": "8de3d714d922883ae7367153cd967ac5", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758654, "uuid": "bedaea3b-b615-4dd1-8112-8f3a99d423d5", "comment": "Malware payload (Gozi)", "value": "87e22839f6c8564bd76add8b66d3bcd0336fd26c133b157f918a7be5869443f4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758654, "uuid": "a1c7d1b6-11c8-4cbf-86fa-29663755da7d", "comment": "Malware payload (Gozi)", "value": "cdce0dea2dfbb9b4d042ba4712cfea27d07ca940", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758654, "uuid": "f5e04b2b-0697-4c69-a28f-8c352ef68599", "comment": "Malware payload (Gozi)", "value": "584777329f0c56ede20f4b093acbb55e24c19f15d158d946607b62a4f88dfe2b8becb88971e2d5d45fb1bcbe3b22ab12", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758654, "uuid": "d01bf15a-416f-47f7-b409-f1f50e86bf61", "value": "T1D9A1AF4C0202C809E52A85A73C8973442957FDC58F447A2C16C6FB2C0D947284FB71B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758654, "uuid": "d8aaab2f-9661-4f60-98a0-2649ac06b71e", "value": "96:eKLZZWplCL6O9qUd94YhERCOFbMa4phONfM+nTS41:eKLZZW/CL/pxhEwO6hOBM++41", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758654, "uuid": "88df21a3-ad1b-4346-9b53-16992f3a89a7", "value": 5078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758654, "uuid": "63048bac-68e7-4d7d-9c66-9f74bdf7c257", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758654, "uuid": "fc4fb961-8ce3-4ad6-b607-9cc337311f34", "value": "azienda_24.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6427a7e4-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732735, "uuid": "e6f03065-3535-46f7-a4e3-f0aca8920bdd", "comment": "Malware payload (Gafgyt)", "value": "ee48282c801cc3682cb9e12778b5eb22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732735, "uuid": "715413ae-b01e-4ac6-8930-8de1b5e57970", "comment": "Malware payload (Gafgyt)", "value": "88066f02eb8483e744534b410dd18cb4b6697f0d4cab64ead6577297524de17c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732735, "uuid": "cce60e51-bf85-4283-a936-debcbf115296", "comment": "Malware payload (Gafgyt)", "value": "33547dc664ca0678d71ebe672cdb7f2e65a9085b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732735, "uuid": "ea68ddf7-de14-48fe-ab00-175c97314144", "comment": "Malware payload (Gafgyt)", "value": "a361c46ecaf3be207b7e8cc8f8cdc216c2b069ad838522aa959b211a2b3251cf9c28a3fb090e9dec5b255f31825d43c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732735, "uuid": "62d0b9ec-51fc-478d-91b8-48ff0379b491", "value": "T14CD3C52E3A22ABBEE16DC6314BF75F7083A525D227A09341F26CD7181E3129D5C9F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732735, "uuid": "f6d7c3b8-7279-4b29-9d64-34207031e616", "value": "1536:2HfNlkiEauf9usD72rKgMWg9WzLaNUIXT3Srujbz0wePQ4El5DsXJoKkBFRymQKC:yF1eUIXTCrK0wHxs5oWmtBcEYj0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732735, "uuid": "d2a0cdd0-6412-4ef8-a482-5ae9dedbdf00", "value": 139827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732735, "uuid": "11895ab1-7c6c-4983-b25d-753b78cccab6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732735, "uuid": "997e900b-3390-4765-9500-0510b4c29a33", "value": "ee48282c801cc3682cb9e12778b5eb22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07a4785-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758714, "uuid": "c7228814-5b69-4715-8cb7-0cc65bf06eb4", "comment": "Malware payload (Gozi)", "value": "9547a542f51d896b1ea9dd4f63cebab9", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758714, "uuid": "739b2087-4052-459a-9c08-ce08c32f25ad", "comment": "Malware payload (Gozi)", "value": "880ebf5a3d74cf9781321ae84c77dd49cb27603bfc85a133e3bf940cb1744ac2", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758714, "uuid": "faa3fdf3-e1a2-4497-b4f4-38c978c4119e", "comment": "Malware payload (Gozi)", "value": "d2bd80190c9b9543b6716dd8111cdcb72dd5117b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758714, "uuid": "f67d60c7-db20-445d-a196-b3f20c8b2e63", "comment": "Malware payload (Gozi)", "value": "6bead46ea971caa80fa9de2dd7de7e2aa214cb4d67da15b8ef2f292525479e6ad8cf4721acf4d952eba08dc32651b12f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758714, "uuid": "03d523b5-80ec-4bbe-ba59-8f5cb4b08c4b", "value": "T16AA19DD819A22D3DB4B82B39BC1714BB9913EDACB5E20F06159FD49728C936315B3921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758714, "uuid": "dad1ea05-a2d2-4685-8768-6700af787123", "value": "96:tbGmW4P46auEPwQCFxXYuRy6ojK5/LInSDUkLVWCUxibJFZzJb5ng:zI6qwQVu0rjGLInwVcxibXZlNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758714, "uuid": "92690bcf-dffe-41c7-b456-1a6664c5f4fc", "value": 5047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758714, "uuid": "d563bad2-1f44-4691-a0f1-2c944d576d5d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758714, "uuid": "7ed3eca3-fdf2-4cb3-b133-3fe9bfe06fb8", "value": "azienda_35.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc7c4b7-a69e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675743650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743650, "uuid": "54919ebf-75aa-4a0d-8afc-59e58773d835", "comment": "Malware payload (RedLineStealer)", "value": "225b09305d502023997d03098fe6dde8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743650, "uuid": "661b6e91-f390-40df-a2a9-c01c8490243b", "comment": "Malware payload (RedLineStealer)", "value": "8817c5e16f243310c07089fc170c08b523be6b39493d2d69f7c1508c16fd9199", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743650, "uuid": "cf3a256f-cd99-4829-a350-3feabbaac709", "comment": "Malware payload (RedLineStealer)", "value": "8dc92c13e3d1e77e7cd9c2a060417242dc8fed0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743650, "uuid": "26bfcd37-43eb-428f-9a48-508e11192976", "comment": "Malware payload (RedLineStealer)", "value": "82d30b8bb847570316e7af29dbf857a67582026ae7036bdc9b63994092521a1ff9c102572359b086514083eeaff5a8be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743650, "uuid": "e54a39de-90ca-4503-9c5a-65927168b860", "value": "T1A4C40107FBEC9033E4B1477019F603D31A39BD929778839A268E6D5A1873271673972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743650, "uuid": "6fdc37e5-8354-4c86-b3d6-8ddfd8f57d81", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743650, "uuid": "e0fa317f-b007-443c-844c-1b9e42c0e96b", "value": "12288:bMrZy90NFA+XHV9Ek/VPFNbQEhSgeR3oK6EeTNM7Ka2g:Wyl+3V9zlFNbJhhio7Tij2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675743650, "uuid": "c16a753d-2263-46d6-b81f-9aaa4eda97ff", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675743650, "uuid": "8f7dadcf-3285-41d8-a557-697c48e82315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743650, "uuid": "19a409ef-305d-465b-9ffa-3c6fdd8210ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a23c29-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675789408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789408, "uuid": "a0743e95-fa83-46af-a5e0-f96d674ba0cd", "comment": "Malware payload", "value": "be9018dc026975bb13411667e15e3765", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789408, "uuid": "f3182789-3de2-4676-855c-ea9b45f522d0", "comment": "Malware payload", "value": "881b7822da80cffa41cc1c6211f554a42ee4ea92340cbdd1d51df9d20a193b03", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789408, "uuid": "9b0a3f6f-f05f-4529-9569-b2a2fda0f05a", "comment": "Malware payload", "value": "16bad851fe2abc58fc3e559ed07109653f546a1a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789408, "uuid": "863d7c07-4454-4aba-b0dc-7904ae85f39a", "comment": "Malware payload", "value": "80c8cd3ad798af690be79ccfd6cb56efd1b9df84a9df13a48584e7acc2b2e910439f12fd47266011c1dd153b1fe2f4fb", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789408, "uuid": "3a50c5f1-ac95-41ef-96b8-b69f33d9344c", "value": "T15F47D320D3737CD9EA2762BFF0AC5FC58110F5E1A118E66B737C3BA58AD064661B6903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789408, "uuid": "efae06e9-e446-4e43-87bf-4dc9777c3d25", "value": "393216:4F+EEVZJtucWZQ1e3hhpOBJnsKn409u4EIZWSim0BR422pysbX1ADcKADxeQ:1ucWZS8UznxnuiyBLWyiX1ADcKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789408, "uuid": "56effdc2-c6ee-40a2-b6fd-cd4ea1cb42b8", "value": 24596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789408, "uuid": "215f094c-5142-4f13-9495-d6715088a5e8", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789408, "uuid": "efea3329-6ced-4035-b4d2-2790f76ae719", "value": "autorizacaoBUWFZCZN.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0d45191-a6e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1675772780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772780, "uuid": "974e675e-7b9d-4cea-ad81-6ea7c5761692", "comment": "Malware payload (VectorStealer)", "value": "316d79c519a1d7b808eb0a96f5f76963", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772780, "uuid": "2fa8cf69-a57b-4531-90da-49e6700ee160", "comment": "Malware payload (VectorStealer)", "value": "890ecebc5af05ee670b164616c531fc710affebffbf4c7f6643c8aa12f8cae87", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772780, "uuid": "2a4e89bf-32ff-4191-9df7-5c5e9298e83d", "comment": "Malware payload (VectorStealer)", "value": "b37ed6ed7f8d3eab1bd5b719f2185d746910d23a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772780, "uuid": "7df6304a-268b-49db-a74d-d4bfd6322505", "comment": "Malware payload (VectorStealer)", "value": "84fc7eedd54032811edfc1a02f5598576a2d2acbb2cef20fadaea6fe5fb15a8f78ae0a69d6ccbb4df4c47b97a2eb53cd", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772780, "uuid": "f855a0c1-352e-46dd-9a48-0f02b4c8e18b", "value": "T1D7112D202EF20724F3B29A39ACBBA30294767915EE12E39E025556081832230D5B5FBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772780, "uuid": "eb22ac10-c45b-4121-a275-d06ba9cb455c", "value": "12:8ewqO/3+508LGkNJ3o3k5sY8J4BnFWlU2/2+UNvsdVfd+qsa94FDTiSDpbdpYrnp:8ewj/erlZygbDhlG2+svcfOBDOSDVdda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772780, "uuid": "7bfad268-5c5b-4cd8-8629-40fa54290ff3", "value": 966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772780, "uuid": "93d36118-bd28-4dd1-a523-4ee8b513e05d", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772780, "uuid": "ff13556a-40a4-4d90-a441-aa9bae989201", "value": "QT21.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e18ca4-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789465, "uuid": "eab39364-6139-40b4-90f4-9eaa24034e59", "comment": "Malware payload (AgentTesla)", "value": "79c8439333d4b7ec239eae4f2c3355cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789465, "uuid": "365ba485-ee88-4d16-8f5c-1eb2ca5c77ce", "comment": "Malware payload (AgentTesla)", "value": "8a7f6f9e80b0a2858d5b636b37064b17631f9a53c168a931a91b8f5b18b76ed4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789465, "uuid": "c2fe9a23-36dc-45c9-99d6-0f8af7afb8f4", "comment": "Malware payload (AgentTesla)", "value": "a3df33b6d219fa2ff3f67d82e1a551c4b6979550", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789465, "uuid": "3a61e4b7-9ac2-415e-9769-aa72355c655a", "comment": "Malware payload (AgentTesla)", "value": "1c7c3b81c6fc6ea5aeb700374734681089c9ffb26fa3fef542fdadaf5cda2a5c11de6ba75d9e04f75a3c50a0ee63df98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789465, "uuid": "5db74dbc-591d-4107-b399-6bc0961d2df9", "value": "T1A5E423147B831314D6458874D2E3202133B5BF9F61B7DBAE6E80079F8F861D2AB64E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789465, "uuid": "49d7a137-0184-4f63-bc2b-06a6c3b3168c", "value": "12288:V3lNSlePDgyRjEvyc8g5wcW6UaqFiPQdbIwrQigR50PRxopzQpvHF3:VCePDgo68J9aqFWQd7KR5YISvHF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789465, "uuid": "04f5f2c6-15a6-4e36-880a-b46f205acd2e", "value": 692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789465, "uuid": "86ad925e-b20a-400d-8139-61cfdbe7f66a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789465, "uuid": "b4090d47-862d-4ac0-b7c5-0a74d2e25a0b", "value": "e-dekont-20230207-.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05214ba4-a71b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675797001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797001, "uuid": "0b8e8f65-704f-4e9c-9587-6f78ec033309", "comment": "Malware payload (Amadey)", "value": "a3bdbbac72b2e816cabe5dc24d1419bc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797001, "uuid": "47a956f7-2617-4ea6-9f80-c893fc18ce00", "comment": "Malware payload (Amadey)", "value": "8ad852b79334402884749331b306f8e9c7a337a04f11e17b240f4dee0062124f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797001, "uuid": "d6e6b6fa-128b-4b7d-a93c-f170555f22e2", "comment": "Malware payload (Amadey)", "value": "50af4f2f6075addc5645d3a541c48ddde089cd44", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797001, "uuid": "8fa181dd-7bc6-4e1c-a941-1acca98daecd", "comment": "Malware payload (Amadey)", "value": "9ce70cfad1d0ea2bf22d910e071f3cdd2819a4b8ae0d65498949318f92503967cd4cb5779990aada1c09378cdf5efe5e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797001, "uuid": "9e1b55a6-9d1e-4504-a954-0924ac6e6171", "value": "T1D2B4020BB6ED8036D8B567700CF713C30A367EB09A394397274A9C5A1872B60A63177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797001, "uuid": "d0e30a9a-0993-487d-8f1f-320a7aa48e00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797001, "uuid": "e5b009cc-d677-48a9-b6b7-6eb4998218d0", "value": "6144:Kay+bnr+Hp0yN90QE6D1OsvOJZeV7Q90xph5KYq7IfDYn6EeYWPmSNVzAwtFJvjV:6Mrry90AD1vvOIhg7IbZYaVtjBtDs+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675797001, "uuid": "f71177ea-61a9-4d1c-bdcd-b5f7037a2cf3", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675797001, "uuid": "d35a6658-6cb7-4b33-8772-27cba276d5a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797001, "uuid": "adbe5b21-183a-4e4b-850e-f1b0dcab641d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98231fa2-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675794241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794241, "uuid": "6fb92f32-fa33-4361-ad21-ac8f6ab25185", "comment": "Malware payload (CoinMiner)", "value": "d480abc3df41f71d5969b0cd8a2d52cf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794241, "uuid": "1cd18478-077e-4a0b-a856-10f473c2446a", "comment": "Malware payload (CoinMiner)", "value": "8adeeaeeafccc9b6925583224e784a89ef4f0e2d6a57305af1a8a49e12c5f598", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794241, "uuid": "3e482994-d2b7-4577-972b-3d9f366614d8", "comment": "Malware payload (CoinMiner)", "value": "79400094536a67e91eb2bb1c8fed9710f8644e5b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794241, "uuid": "5bc83636-6441-4e74-9ffc-cbb5e865429e", "comment": "Malware payload (CoinMiner)", "value": "575acfead7448856a80db43c6712de0f5b95a3c2996ac9d862374b18a9b92926d9f6ccb121bb5531996589fb36f55c24", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794241, "uuid": "14c197bc-5311-4d5c-a99a-11bfc291b8a1", "value": "T1DA14D0323AD0C072C56A65309830DB647BBFB8319575CA4B7BA417AE5F303D1663A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794241, "uuid": "f76cbaab-6928-4898-8f69-23440aa339b9", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794241, "uuid": "a85f8ed5-c987-414d-a529-64b045765b5e", "value": "3072:t9rLOJ8JwLdrEjLVGqWl35aNRc5gSFLAQi90bVShQG9rz4d:nrLlO2jLwq3RcKSFLAQbbUhQ4z4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794241, "uuid": "9e05fd3c-1be2-4e25-8756-7736b3b55342", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794241, "uuid": "e3049bb2-0fae-45dc-b484-859bdc97cf91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794241, "uuid": "84b3ecc6-6d54-440d-aa5c-534f4e03136a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb59c388-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675757390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757390, "uuid": "6a52d772-2b6e-4daa-b7f7-6cec4408a960", "comment": "Malware payload (SnakeKeylogger)", "value": "fedc11ee17f2bcd6018162ff85c1930c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757390, "uuid": "dc8bf0f9-ee87-4a17-ae34-4bcf322c1a1d", "comment": "Malware payload (SnakeKeylogger)", "value": "8b084a5b70a6572aa23ed19deb7007a91ea8ea740a36b801b6c98fccd7a2b3ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757390, "uuid": "861bcfea-3b77-4f8d-9cfa-c92a97dd33a3", "comment": "Malware payload (SnakeKeylogger)", "value": "d341ec42360dccbf21d1a3172256c69287679f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757390, "uuid": "83ee967a-f9ae-43fe-8fbf-b8e3a0b42ab1", "comment": "Malware payload (SnakeKeylogger)", "value": "2a3816fa0f5fee077c656de1b04d8c89be0c99659ff22abbd7ed5c601cf1c9a82909b249a69ab5d3d4a91f03257af1ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757390, "uuid": "97533e9a-8324-45b1-9851-8a6a197add48", "value": "T116F4235D1778CF30DD8D9AB8E8E45D1803B7AA9EF042D31C9DD914E97E62B5086C2683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757390, "uuid": "21fe508b-cf31-4fe9-89c5-40df4bdfe3e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757390, "uuid": "a4cedee4-ae44-4734-b9a1-c1a2cc2af2ff", "value": "12288:LOrx7p58lCrd4gyQapWMsCAhrPLJuuC+V51xUNp+jh2i7Ds+/bD0J5puPjPA:qrxN5IC54TWMQDuiV5up+Vt7M5puPrA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757390, "uuid": "bd75950b-d921-4ae4-a620-769fbc235e6c", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757390, "uuid": "b62e805c-4b99-418f-ad55-2fb176717696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757390, "uuid": "c28c8505-4017-421e-a311-6e71889499c0", "value": "fedc11ee17f2bcd6018162ff85c1930c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08449445-a727-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675802160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802160, "uuid": "91d4866f-1f44-422c-b38c-a835e9de292b", "comment": "Malware payload", "value": "32b44acf9a21b3b5285203b2e3192c3c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802160, "uuid": "06263d5a-b819-4c67-8dfd-bf90125d76c9", "comment": "Malware payload", "value": "8b28334b395c6c347274fd2d1204690bfc30fc44455183643ca50897647b602f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802160, "uuid": "b498e9a1-49b9-4c8b-b85a-c83d208cd15f", "comment": "Malware payload", "value": "6f6512f7551dee97ae152155aef58b73796b20b2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802160, "uuid": "84053995-1116-4ec6-87fa-43a38aee0f57", "comment": "Malware payload", "value": "e2091463a0e25aa9242fa7a9969d5f5ee2ebf380d270f3a6d855e16c5ffcc77b8acdefe8009276d9748a2071d2c5c437", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802160, "uuid": "d461f5cd-96a3-4516-b28e-0d28a7f9b9bd", "value": "T1FE462373626A1085D1E5CD3E563BBDE931F7025E8A02EC78A69AB8C03D634F5B523D43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802160, "uuid": "d20f6be6-644a-4082-b99b-e119df8b1414", "value": "48b9df712cf33dde7188572239569ffe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802160, "uuid": "bc5562fe-3ed5-4150-9dca-683e0aaa5c15", "value": "98304:gouFnCqBce0KfZRfGhWtvbnefugagdvQS8Pu2wqdigNUPvzaC1ut1mVxKrAYF:4w0HwhWtreB4F22wqEgNFC1yU+AYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675802160, "uuid": "a31b4913-250f-4a68-8f58-0669aa4bdb22", "value": 5513728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675802160, "uuid": "4208f707-e5b1-4a8c-a84a-7f328befe402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802160, "uuid": "94343440-e3dc-4854-b492-7823cfd4dbb5", "value": "8b28334b395c6c347274fd2d1204690bfc30fc44455183643ca50897647b602f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9157d926-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675732811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732811, "uuid": "170f4c74-a813-4264-ab04-2e3ca49f2258", "comment": "Malware payload", "value": "d735e2cab36cd4bc400ad6ff6828d3f0", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732811, "uuid": "cd6e47d2-7319-43f3-8845-6904efecba5d", "comment": "Malware payload", "value": "8b9f8b204723142c4381a9b6937b46073488115d3c745e98421a6dae62fc3ea6", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732811, "uuid": "fce0bca1-b293-49b9-a07a-2d7e684a087f", "comment": "Malware payload", "value": "f16a430b07f8f7e2bf061d39d3d82231ddf86807", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732811, "uuid": "2086edf5-c01d-44ff-afed-12a8a1e50efc", "comment": "Malware payload", "value": "77a040566560b4c82ccfa349057f47f923e21fa58fab02ca74ed7b8025f533b8f182cf636a186d7a22597e078c9d0c46", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732811, "uuid": "308153e4-0fb6-4949-a971-a30786ee66f4", "value": "T12E07337B7C52CFFC97A902FE8D3059C88C729A75F9A26CEAE6C5C0D8D50295608F06C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732811, "uuid": "ba094cc5-3ac8-4a5a-9045-80a3c9d4db03", "value": "393216:R64ZlPxDlz0Y7pdjOUC6n7aeUU3DzB/bHQGZZ9XvIRxS:NppZFYUC6RF3DFsjRxS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732811, "uuid": "aaa7f63d-9fed-4dfc-a2ee-2ea61f6db73b", "value": 17660901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732811, "uuid": "64d2ce7e-c808-4702-8287-d092255aa25d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732811, "uuid": "4c729d00-1c9a-41f5-8182-07dc82e92dd4", "value": "Contribuyente1675731496.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782d9fb4-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758539, "uuid": "64f8df02-ef18-4c12-b934-07b71482a175", "comment": "Malware payload (Gozi)", "value": "6d33f881705250bfb9202a2928163a80", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758539, "uuid": "59588bf6-29d6-4e61-9882-945f054bc4b3", "comment": "Malware payload (Gozi)", "value": "8bf4c4fac6785e89cd4c3d1a24083fd1f3f1439375caa4acc1ccee72af2fa7bf", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758539, "uuid": "ca84b176-9330-45fd-b7b7-ac5c0e655c93", "comment": "Malware payload (Gozi)", "value": "6002f33f0848072fb6753ec2e03128b9e1255fdf", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758539, "uuid": "37f21ca8-b6e8-4aca-bb49-789addac27d7", "comment": "Malware payload (Gozi)", "value": "3cffbfaee6a3e0dd2575f3f20041e936f1d4e42c16cba8d3e4870ff8a1a1ee54c9ccc159f68781392bffa2454dad129b", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758539, "uuid": "5503bdce-7a51-41f4-bf3e-ef60328d9f9f", "value": "T174A18E1ABD72552C39C1FF35852F3D8032B57BE6CCB447BA00649B51E940395E41A2F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758539, "uuid": "a8d38e02-4313-4f82-bbb6-2cc3f265fa65", "value": "96:Lgs1IhwTvKQgGjNxvZujMKwXmKUcMn9V7bjwwfq66Ftf47+L:8s1IivKQgGrZGMKOjdM9tjhCI+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758539, "uuid": "df1685ae-93fa-48a1-8f3a-60fa07ac3ff6", "value": 5065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758539, "uuid": "0a04fd5c-b000-4445-8554-88041dde021d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758539, "uuid": "8ad4418e-3b70-4728-a28f-7fac0e96a6b8", "value": "azienda_05.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d681b186-a730-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675806371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806371, "uuid": "5b9e86ec-08e9-4bc7-ac21-2c2672c646f2", "comment": "Malware payload", "value": "0de6f1d98b72c2b6dd14f1de17212162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806371, "uuid": "9685c10d-5514-40f3-b6a6-645e5ebc5f65", "comment": "Malware payload", "value": "8c1f6cb3d4124612705c2b607a07de101ac025a9a969fe4f8076361d63ddd0d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806371, "uuid": "0ed20874-9079-4ce9-8e5c-ae589a4916c7", "comment": "Malware payload", "value": "496a24d09fba3bc5414365e4ac32c04a2b9391e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806371, "uuid": "5f887d75-c479-48d8-9041-4201134ba514", "comment": "Malware payload", "value": "412fd04b6a83487eb2385226aa711997a8473eaa56617393202737d3cd133c560b54940b8034845557acee913f7dce53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806371, "uuid": "c98f4ce6-ca77-4ec7-86c2-d8e8ad9fb83e", "value": "T19485BE81FD5FC837DC792ABA05BD23982C5C5ED01B2E50D7F3E071C925A899B58602EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806371, "uuid": "a099bf91-ba49-4c76-a7c9-de479040bc76", "value": "b2ab5d36f7dd4a87126c1487665c85da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806371, "uuid": "a5406a30-88fc-46b3-b539-5d0dbbec5c23", "value": "24576:I9AmP6qNqlGVRFqeMxY400MAuZo7Lnm1todLMtKSHZynPtYy4IN71lyg+Fwzr:Ib6qNqlGExY38AN/Zyl53l1lyxqzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675806371, "uuid": "85c298f0-b3c3-4ced-bc48-efcc559dc235", "value": 1725088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675806371, "uuid": "2182dc09-18e7-4ae8-afdd-17cfac600331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806371, "uuid": "31eabe02-2d6a-4873-bcea-10575bdab264", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b77e3f2-a6f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675782032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782032, "uuid": "f4392e76-8ff3-4cf5-8948-2f2f880de67a", "comment": "Malware payload (RemcosRAT)", "value": "f4f7f68925dbf3c6275191b4c70ef62a", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782032, "uuid": "ca8fae07-d2db-4249-a3ea-a2a8525b1ca4", "comment": "Malware payload (RemcosRAT)", "value": "8c857434bca142d39c6ee27bf4c0b21ddc866b8296d2b837c7e859630574fb20", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782032, "uuid": "a3216913-ea46-4e37-8157-aee1bd64472e", "comment": "Malware payload (RemcosRAT)", "value": "77becd98a814bd40f4b569f9d3912155cba0dc73", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782032, "uuid": "4d914daf-2fb1-4d4c-907d-44d4fef7fbeb", "comment": "Malware payload (RemcosRAT)", "value": "22c246d7e81b06442618b4dd351ddbabbb69c6f6abff6d33e453b1d697e81dea8d87b893322d195430d36364ade0760a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782032, "uuid": "46def21e-fe8e-4a2c-b687-90d1aca55ad9", "value": "T1D7F423846642C2EDEBCD82BFE59116B19DB8499CE74C04CE877430787BA93173F226D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782032, "uuid": "f87160fa-1a8c-4b85-ab9a-7e71dcec13d3", "value": "12288:IxkolZTdYdymTliKrzZKxvmdj2TgSZvzYl0fq3lxIv/RKxRhYQbiuxoh1BrDP961:IzldS4gFKYdj5flFSp6hYCit1+x/VmU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675782032, "uuid": "95ec2dd9-f546-4078-ac6b-ec2a7dc93c33", "value": 732465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675782032, "uuid": "317bcbba-8222-4956-b0b8-6dee5cbfbf5c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782032, "uuid": "2363b0d2-28bc-47ac-9a9b-f66182616e64", "value": "Compiled.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8444034c-a6f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675780463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780463, "uuid": "15af6b8d-0542-425b-85e8-eb25b80b3d36", "comment": "Malware payload (njrat)", "value": "2474289da6da3415ae596a23edb5ee45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780463, "uuid": "6852eb56-c962-40c8-96c7-d51e81c625a3", "comment": "Malware payload (njrat)", "value": "8d8d4d1b2278e6e3a4b358c430dd631249a72a7965e6516110128f8d667804a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780463, "uuid": "dfcada06-83cf-4707-9b1a-0ff5bb7e73ca", "comment": "Malware payload (njrat)", "value": "fbd6c8f95233b29bb2397a934458e5035604f2ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780463, "uuid": "f2912730-931e-4b00-ab14-a4e07ce06e6a", "comment": "Malware payload (njrat)", "value": "09b8110d7b54e3aa937c814e36b8e79f1a400673e76eb9f63b0467c911df6b5f18393a53fbfad7c0a3d597ed3564433b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780463, "uuid": "243353d3-185f-4f7a-a010-67e6c68d8c93", "value": "T17CF3E86B76888F15EA542D71C4EFA83003D2AAC71B33F3493F5917A91E423E26D4A7C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780463, "uuid": "c4f966a5-02eb-43b8-8b8e-808afae3a48b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780463, "uuid": "4c56fde5-b3f3-4982-a723-a022392fd718", "value": "3072:0j4Oc/YRSoTQni1vaBjgTuZLvLr1mVAPKNKN3:toMiJa2TkLlmVUye3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780463, "uuid": "41b3f73d-357c-4041-941d-037fcf775ff3", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780463, "uuid": "8d2cea1a-693a-442a-ad4b-a0a217a2172b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780463, "uuid": "45892bf4-e7c4-49e3-b0b5-b6ead225bbbb", "value": "8d8d4d1b2278e6e3a4b358c430dd631249a72a7965e6516110128f8d667804a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7edb4c72-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757262, "uuid": "c7ba9a07-dfd9-4444-aa3b-80c2c638e731", "comment": "Malware payload (Gozi)", "value": "5c13d66828fff24146f9f42b990c05da", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757262, "uuid": "508f481b-8a9a-46de-a233-2f660e2e12a7", "comment": "Malware payload (Gozi)", "value": "8da9c49b00cce2bb97d6e77199c90c0d2d60b387f6ff51a06367ded85621f13f", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757262, "uuid": "2a233806-4271-4589-a322-2556e9ed20b2", "comment": "Malware payload (Gozi)", "value": "e9f0ae44ef634b4701127c84ce607e4536cfc677", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757262, "uuid": "b8745ae2-b587-4e54-8d8d-c8c094856b49", "comment": "Malware payload (Gozi)", "value": "b6903eea468c9b3b1e11e3e7699b52fec433e87e98b9501e076125ff80f3d8988b622de11e3ce2827989bcada10e8bda", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757262, "uuid": "0b4ab4a4-d2c7-4e8f-9777-10fe14d6a3de", "value": "T1F9E17C8E9DDB541BB78181EFF2773C10FBA0597AD9293204B5E2E30E6BB2B27014121C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757262, "uuid": "902c70fd-44d3-476a-bb06-1055bad2bfe7", "value": "96:wjVBxgLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dh96A:AsU77rIKdn863jMM0OD9+VVF4nx4kuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757262, "uuid": "4cccc348-dba5-42f0-817b-3e2d2509a904", "value": 7034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757262, "uuid": "2efc1114-d24b-4a18-9ebf-ea8b338b4a47", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757262, "uuid": "69d8410f-f572-4f8b-8d1b-3c0f47e04eee", "value": "azienda_07.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce15efdf-a690-11ed-88f6-42010a9c006e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1675737638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737638, "uuid": "c4a534eb-9588-44fe-b4bc-e442ef1309ef", "comment": "Malware payload (QuasarRAT)", "value": "bba593275329200ef119caf58cf4bd69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737638, "uuid": "a7f588cc-99a4-464a-8c41-5a5d625f023e", "comment": "Malware payload (QuasarRAT)", "value": "8db036965b0e4d578b254b3e4cb0ae877e2d22da1479c07e69f7208994d922cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737638, "uuid": "8517b26d-2130-4f0f-b90b-3477486a5221", "comment": "Malware payload (QuasarRAT)", "value": "85217519d6d7122745c88877da930c7e5a507a13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737638, "uuid": "839a07d8-8826-4503-a619-08ff35f80c58", "comment": "Malware payload (QuasarRAT)", "value": "363a76f22ef7683d980f10520a269dbed746c797d71594ca8beed32475659f5dc915bab20a5809af2e5cac59a289de0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737638, "uuid": "2a0624af-853f-4a81-b763-657d94680ff2", "value": "T156342380156721E2E1DE3A7561BB73183FB779722EB4C9D79E4483AF487126874C3CA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737638, "uuid": "2659b29d-65e2-4994-a771-8d0531107bc3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737638, "uuid": "21f5a17b-eefe-44eb-88c5-9568b218a537", "value": "6144:sb3yT+v4frHPJ1RCbXgAxHRbFxAMBnIn84W2fINpBsygZ2DFBI9a:5TeCrR1RCbXBbFxg84XgBsygiF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675737638, "uuid": "8830d05f-48b0-461c-a060-34782c5a00f9", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675737638, "uuid": "96be09a7-aa04-4497-9522-5cf036108042", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737638, "uuid": "a26c5c94-7d00-4a4e-b909-2f993c34c8b3", "value": "bba593275329200ef119caf58cf4bd69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7666f42b-a6bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675755959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755959, "uuid": "3387b799-1de9-44bf-8e28-fd3141216964", "comment": "Malware payload (Mirai)", "value": "3b84e7701c3d3c36aa418c2afb30e645", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755959, "uuid": "4518086f-f933-425f-b7bd-eae00aab064a", "comment": "Malware payload (Mirai)", "value": "8dccf0dba55e00588d6ddc8480d74a9a9cfafc51f33362b0f1fd06e1748587a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755959, "uuid": "97120d28-d30d-4694-8e2b-9e95be177776", "comment": "Malware payload (Mirai)", "value": "ca6e7cb676e51d0b2116f9a5727dfb2fadcea79a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755959, "uuid": "2170e936-bf8d-42cb-9b91-7b627dcc4995", "comment": "Malware payload (Mirai)", "value": "e39af32d63b5b5066a1079f9c38753a7bc4d0738c1aa12e784965e9e0cecb18c0aa20731d3fb3bab0f8417653fd33484", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755959, "uuid": "fce2620e-189f-4caf-b951-643699a4dcc8", "value": "T170D32902F4504753C2D2177AB79F521D37236BB987DB33129A346EB42FC179A1E3A9A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755959, "uuid": "44ef7989-3e2a-4e32-bd3f-6094f2416803", "value": "3072:PdM+laz7dgtKJpDAHRickKYD/WqxrY0AucjmWQ9AKXNY8:FM+latgt7kKYD/NWXjmWQ9A8NY8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675755959, "uuid": "88641c5c-3376-40fb-bad2-8eafc9dc453a", "value": 133080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675755959, "uuid": "92353cb7-8130-4a31-a4ed-f66752b8a8f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755959, "uuid": "1ee914ce-76b3-4f3f-a14b-184d29e2bafa", "value": "3b84e7701c3d3c36aa418c2afb30e645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0faaf341-a69e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675743331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743331, "uuid": "a1700723-edef-418a-b4cf-e6a4c6f792c7", "comment": "Malware payload (GCleaner)", "value": "dea0b138e83213cc23eb97c2917e75a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743331, "uuid": "d47ea5df-6ead-498c-8cb6-fba6904b86e9", "comment": "Malware payload (GCleaner)", "value": "8e194b828d07deadd8d13f0c813854c22dacb2aff5806ea10b1dcc44bdcb542f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743331, "uuid": "a4640abe-1eca-45d9-8285-967cdf4dedb9", "comment": "Malware payload (GCleaner)", "value": "5e7f37bd8bb04914d979091ec7141de0c6e96fb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675743331, "uuid": "5a50e3ba-a972-4029-973b-a45f599867b7", "comment": "Malware payload (GCleaner)", "value": "a27ec842d5bd2ca58d220f5228b6643a414ef93159cb18e6f903d09e8b8ce28241cae49de6f7ae489e7254a063f385f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743331, "uuid": "149b5cdb-1c68-494f-bf5b-464db8d9c9f8", "value": "T170D5E00A5D94D097D2618F70D9C72DFA9C12EE6FE8BA109313047FFBB671206A84AD35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743331, "uuid": "49af066a-876e-4c0b-85c0-c34918561c31", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743331, "uuid": "f01e9898-72bc-41fc-8f20-19185c16263a", "value": "49152:QwOzuEoSiQx4tkjWs5ikPEaRCMtCrw55RXLCgv2MR:lIBoD2QEXfsUblv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675743331, "uuid": "eb7dacf0-1f88-4528-b1d9-bba97f61cd5a", "value": 2757056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675743331, "uuid": "eb3455e2-c475-4e2d-83b7-ac5467845637", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675743331, "uuid": "98aa53e4-92f7-4a50-85a8-9a4b60fe86ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943d4919-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675794234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794234, "uuid": "99773a3e-3f1d-4cb6-aa67-cbc37073ea67", "comment": "Malware payload (RecordBreaker)", "value": "25507903a17e4b039380ef65f89e03de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794234, "uuid": "674e0586-2d81-497f-a1ea-f15d4bf563b1", "comment": "Malware payload (RecordBreaker)", "value": "8ea6cf0692c8e92395243ab0d52866580d13d537efd32dfc869e0976c2ad6413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794234, "uuid": "4cbdc12e-d1d9-45e7-84db-cf80cded2b46", "comment": "Malware payload (RecordBreaker)", "value": "034007995129e7bef268cb692d63e8275092902f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794234, "uuid": "15cd4e2c-18a0-4536-943d-ac08274ef872", "comment": "Malware payload (RecordBreaker)", "value": "c0c1fc23b8626cbb34b4ca78e58cb97d815752170dd2b0adfdbab0d6cdea9e9ffb1bdb0cc831cee2e553128f19a705d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794234, "uuid": "9e47d59e-6ae6-49b1-907c-a01fbf04876b", "value": "T19814D032F5D0C0B2C92A14305CF0DAD57BBEB97052B5899B7BA807AD5F701E0673A25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794234, "uuid": "9d43142d-605a-489a-98dc-c69d101ed715", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794234, "uuid": "7e7d7175-6682-4d3a-b46a-9489c2f8c38b", "value": "3072:3SvOUrT7X1LLNduOWU5D+qaMcwQ9UAThRvaRaGWdyo30h8isQIYaa:3SvvxLLKOUq5obT6Ra/dZ0GHQj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794234, "uuid": "7bbeb9f9-bf3a-4e60-9d99-c7f05ac1cd15", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794234, "uuid": "df00a37f-87c2-47d1-823a-5a8c2e8122da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794234, "uuid": "d78c6d38-0474-4839-a597-3cd7d89ca372", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b70af7c-a6b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675752156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752156, "uuid": "33c16ad1-cc61-4218-89eb-89cdc933b56f", "comment": "Malware payload (Loki)", "value": "1e758bfd9c8b1833a0d39d3e875ebf3e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752156, "uuid": "7d4c0568-759d-4fb4-833a-70e00e735754", "comment": "Malware payload (Loki)", "value": "8edab3d9b5bc81b5ef374f427a2dac801ada0d6fbd0b913b6908ece1ce7768ac", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752156, "uuid": "6cda1dce-93df-4144-a674-f075ac9934b8", "comment": "Malware payload (Loki)", "value": "197adb9cb3dfb4c11e12116a1dba5f20609d552d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752156, "uuid": "5157a935-fd01-4a50-be5d-c0ea45dcf963", "comment": "Malware payload (Loki)", "value": "a3d3a3c27662455ee2ecf4c3e7a0d069f173a809c0ff6a662bb9d1d5b0f11015534aeddac5a468bac641e2e3d2895593", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752156, "uuid": "1c9f8fb2-86bc-43b6-a2c0-19ae0a2ec07d", "value": "T19B44236B46F37221F2DA346E5824AF0D07EBE68CB687A5040F92612CDCDB257E98C55C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752156, "uuid": "85d8d692-493d-4a41-99e9-525463c50523", "value": "6144:3QWuEr4yF8VOfMYq8SCwjaQeDjCiNFI+ndUNoASNq:AWuEkR3sra9Cnp5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752156, "uuid": "361a6986-5ff5-41fd-884a-3dce0ac9ddd2", "value": 265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752156, "uuid": "1f117730-19fe-4c1b-8efb-1310af25ea38", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752156, "uuid": "4739b826-f201-4128-993b-62ab8b88fc34", "value": "Shippment Swift Copy_PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14042a08-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675783282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783282, "uuid": "111c4469-17cf-44a0-83f0-e2453e5da5dc", "comment": "Malware payload", "value": "8db5b9ff05fc565772066267f3d7ebb8", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783282, "uuid": "37df0462-f46b-41dd-b8cd-9971f45b1868", "comment": "Malware payload", "value": "8effb289d9291d7d06179ea83bb18d53723279f0cd5fd9a11f00309f066e9f58", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783282, "uuid": "8448e1a2-7d13-49a5-b604-af5cea7c03d9", "comment": "Malware payload", "value": "61baceec32f9b4a8cabf76dee5e337e7f181f8a3", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783282, "uuid": "4edacaef-1ab0-488d-820d-f0a51777543d", "comment": "Malware payload", "value": "51850226133124bb3e0848446b0a8d1f35edb58fb8ef83f4757d6a56cd3ec1cbe7e323d35aaf1721fbac2e9be56ba599", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783282, "uuid": "81474307-2e20-4c8b-96ee-7c0f8f1fd88e", "value": "T17555121C1338CB20DB968A75D4EC4A5143B59619F261F71DBECC6EDB5F33B908A82293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783282, "uuid": "13555fb1-7ef7-4b94-95fc-da1040f21d8a", "value": "24576:SrxN5IC54TWMwzz8rQASF1mb+HOZV9pA:StgiJorQAO1mEOZfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783282, "uuid": "17f16334-f1ca-44c8-a15b-f087a55a05ab", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783282, "uuid": "b99c38ff-a53f-4ac3-9189-e5189034c2d5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783282, "uuid": "7e6f6164-d397-42f4-84bd-ec6fef1ecaac", "value": "Quote_2200001635_1.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f83983d-a69a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675741828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741828, "uuid": "a69db739-25b3-4bcc-a9da-ea7256e87f66", "comment": "Malware payload (RedLineStealer)", "value": "297205dbdb7f40b8179a8f7b564eba00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741828, "uuid": "d2573638-32a5-4447-ac03-08590db3822c", "comment": "Malware payload (RedLineStealer)", "value": "8f8d5b37923b19878cfee3e5249a319ebd2248a1c2fdd8add845731e5e7af9a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741828, "uuid": "615663b1-2871-412f-915f-11f1434be909", "comment": "Malware payload (RedLineStealer)", "value": "455c537a7ce7f4fb4bd5c6db79a08fc1b3cfcce5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741828, "uuid": "64319417-c698-48b0-ad2a-c53d0d7b4997", "comment": "Malware payload (RedLineStealer)", "value": "85d9357ddc639235ec308027a245b9a0c05dae0deb8ff2689a8aebd6a8e0900e8256e4e1d56a63818248d87fa2a63a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741828, "uuid": "8d9724ca-e428-4ffd-b456-2c7162bba4d4", "value": "T1AD16CF12BB41C071E5C202B5647EEBBA197DAA204739C4D3E7D42D6AC8311D37B3B79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741828, "uuid": "9c35f485-dde7-4bdb-afb8-c41653618583", "value": "0f6f8f223199c2587baccb0bb1b26ca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741828, "uuid": "d325aecc-7602-4ed7-bd1b-9aec8aab7442", "value": "98304:Nx6c4p/ckPXHfG5+ZaS/G7++GFja1S0D4ghlxC0:nOpF/HTZn/O8Ahlo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675741828, "uuid": "1810e0db-e954-4686-9a0d-dccd1ebe2d90", "value": 4028776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675741828, "uuid": "b401b482-6000-41f3-9d03-6a159eb4789c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741828, "uuid": "bd332774-a9f3-45d8-839d-4251fa64034c", "value": "8f8d5b37923b19878cfee3e5249a319ebd2248a1c2fdd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8c38da-a6f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675781977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781977, "uuid": "0c4461c2-a654-4af5-8116-94f99f1d7833", "comment": "Malware payload (RedLineStealer)", "value": "405776050e77d76379252a33556d941e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781977, "uuid": "37fd34ea-5637-4ffe-957a-06d9a26d047a", "comment": "Malware payload (RedLineStealer)", "value": "8faf2d0e248c0775f91d534325ad36c730f45e3e2717752d12fc5eb99dff6110", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781977, "uuid": "097ef8aa-c127-4d95-b76e-ef62debaa1bd", "comment": "Malware payload (RedLineStealer)", "value": "8eef815b977652b012614afe2e2526e9331fa065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781977, "uuid": "90024c49-bbe0-4531-9b4c-d57199679f04", "comment": "Malware payload (RedLineStealer)", "value": "a346450f3037ea935b54bbcec198d70b441aced1ee5871ccc055426c4a5826561890f9549a4663369ef1bfd2057f6f1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781977, "uuid": "54f32136-c413-4155-a7c0-5a322d332b46", "value": "T16F6402213690F0B2C66A65745560DB6AB7BFB03025798D4BBFE407AD0F702D1AB3B346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781977, "uuid": "29df7cf0-4283-44cb-8ba3-97cb0ccb410b", "value": "cdb2dd381be56018fc9552ac3271a401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781977, "uuid": "3aa3b6ea-8961-40b9-9d8d-95423ef4e854", "value": "6144:/GWrlGaLZOisLGTJQsztGhx1DZENIBh5ZZtTyPt2T68WFGiwdvT5IL4bR:/GWxGa9OiOsJ9zcx1DZ9BzB8YOTF5SSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675781977, "uuid": "402273e2-42d9-46e0-8d3c-850617fa4d32", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675781977, "uuid": "31c8d2b7-946f-4369-b28c-dbfc946f987f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781977, "uuid": "dbe34e44-4d90-46cf-9c54-8d51451f390b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d3d84a-a73e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675812229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812229, "uuid": "b53fab2d-af00-45e3-8152-070237016ca0", "comment": "Malware payload", "value": "9ec23afddcf2f8321e119ad78ff884e7", "object_relation": "md5", "Tag": [ { "name": ".one", "colour": "#AD4A93", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812229, "uuid": "2ed872e3-ab53-4fd8-adb5-053b94f7ddfe", "comment": "Malware payload", "value": "9019a31723e8dde778639cf5c1eb599bf250d7b6a3a92ba0e3c85b0043644d93", "object_relation": "sha256", "Tag": [ { "name": ".one", "colour": "#AD4A93", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812229, "uuid": "ed6e6312-e097-4b91-a531-276b682bfe01", "comment": "Malware payload", "value": "dca4d2d56ccddc8d6651d5e292b5564cf27dcaa1", "object_relation": "sha1", "Tag": [ { "name": ".one", "colour": "#AD4A93", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812229, "uuid": "e27eba4d-e969-41a0-954c-20ab48ed78da", "comment": "Malware payload", "value": "2fdab5ad74a1d8c2e4a6276a9f53b48c669711b2f682c6713f12aa1d97575fe1939d72c26efc6d9d86e58fca3f533a63", "object_relation": "sha3-384", "Tag": [ { "name": ".one", "colour": "#AD4A93", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812229, "uuid": "55e1ab34-9acc-4f46-9ce2-1b4b7105f110", "value": "T181B3D026B191864ADB29413A09E77FB4B373BE029591571FDFB62E1C4DF0284CCA468F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812229, "uuid": "5d229ed9-7116-406d-a80d-7dcf6e3d3239", "value": "3072:RgS2EJbyYeMYkKkyX3DWvLLATir569RgSwfH:QhjZrHDgQkFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675812229, "uuid": "a93cbf5f-13fc-466f-b28e-899245f70c65", "value": 116904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675812229, "uuid": "56bccfcb-79c9-41e4-89b2-509c1c5450c4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812229, "uuid": "7a619387-3359-470d-a4f8-86362a13825c", "value": "Item.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1257c676-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675783279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783279, "uuid": "ed20307b-bca5-42ef-9ace-f9663f9275cc", "comment": "Malware payload (Formbook)", "value": "5d42bf0152a7a61d6dc5c714cb8fdb4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783279, "uuid": "50bb5f23-5b50-493d-be47-0ea6cac0f7e6", "comment": "Malware payload (Formbook)", "value": "914a3be3ab33d2a5438ebdcf47c77788382b47f24ed7352bc4c9e43e1aeabd98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783279, "uuid": "9ac90571-0aa7-48b0-b2d3-7d864110b6a8", "comment": "Malware payload (Formbook)", "value": "32c65e06476dceb50b45a7cd50524e0aeb2dc391", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783279, "uuid": "7b8966ff-035b-4652-b85d-e1537268b60c", "comment": "Malware payload (Formbook)", "value": "70d457c33c8793593101940a5ed27a4a88f4cb0fb188a1219e0453eee065e577ea37e84e39bab71e5dee062dbf2257c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783279, "uuid": "4435c827-eebe-4c63-b44e-8f30a54e658a", "value": "T13305221D937CC721DC899A70E4DA46240379B939B362E32EDFC975DD2D62F608A43643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783279, "uuid": "c46645e8-0453-4d74-aaec-4a77b6125826", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783279, "uuid": "6fb60ba3-091a-4dbd-8374-5770771fab8a", "value": "24576:+xWXIYXIEA/PJDrj94p3k+jacFrxN5IC54TWM3A:vLXIEKr5OrTVtgin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783279, "uuid": "27bc8183-f75e-437b-8ac9-7ebb830255dd", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783279, "uuid": "db9ae089-3fb9-4a46-9283-99bbfac27f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783279, "uuid": "6514ac18-fd34-462c-a404-41b863dcc725", "value": "PRICE ENQUIRY ENQ REF_PDF_____________________________.........exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfd78f2-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789469, "uuid": "7691f73f-737f-4131-8d6b-c302b80ab63a", "comment": "Malware payload (AgentTesla)", "value": "2fbaa4d917cce04617f24f87309286d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789469, "uuid": "c607ab36-3716-4367-a2a3-6e38af48cb76", "comment": "Malware payload (AgentTesla)", "value": "91eb17a8906ebbe9c50ef6a509e80133fd3322aec9b84e04cc5925992235c17e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789469, "uuid": "301a2a1d-563c-435b-971c-2b162ed50e24", "comment": "Malware payload (AgentTesla)", "value": "7480ce7aebd7f59da7d6bd4f9eb7bba0efe05f97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789469, "uuid": "c3fabe0c-9ff2-404f-8927-498f3ac7fcb5", "comment": "Malware payload (AgentTesla)", "value": "49e1ce607517a783a5547138fd166cd664f371f96fb749dc26a725581c3ff60ec3ab6f6c1d10624204639f0ffad49c7b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789469, "uuid": "e8e5862e-9b98-4b1a-8949-b9c5429b9494", "value": "T176E42212724F57BBE6296071C8FB087B13B57305A533D8A9BF1C12886F84B5B6E99F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789469, "uuid": "e791f1e5-6b20-43f1-a227-91020769c5d6", "value": "12288:OEc+106G5pJptT7f98u1548XTTtSXIK4798qdGxd3rb5Oi4W21q1ni/:O1+1pG5znHz151ntSM9zEd3rb58H1Wg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789469, "uuid": "227b9613-866d-4446-b1c9-0d7192a28a1d", "value": 688128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789469, "uuid": "289945c3-4177-47cb-9206-4f2c14d68e5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789469, "uuid": "5bcb5551-b894-4988-b847-2392bec61614", "value": "e-dekont-20230207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42fda1e2-a6f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675779924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779924, "uuid": "62cb6f64-17cc-483c-99d5-8c2ddc9b7ee3", "comment": "Malware payload (AgentTesla)", "value": "1305354ddbe08c9051a5c8b15255cb6f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779924, "uuid": "d74fe435-4ce9-45ad-91a0-aed5fc70815f", "comment": "Malware payload (AgentTesla)", "value": "9205a59f5c11c1e77ca151d15e2c24bceb70bf15afd6a0d1351de8baa48016f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779924, "uuid": "7579fba0-8f32-4786-bdf5-4797d9036774", "comment": "Malware payload (AgentTesla)", "value": "905187852ffb9e789dc1aa803c29104e855cbfaa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779924, "uuid": "bea39bc8-b4ab-4161-9b73-87bec8299374", "comment": "Malware payload (AgentTesla)", "value": "d3ce9dd4edd108e75a92a354ce8df9c5ee7542f49a123d69831ac9755c3467e392264f46433f9adeabd8006bd2b670a4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779924, "uuid": "1e22d8a1-bb97-423b-a838-4d3e58371746", "value": "T1E464121C7ED0D1F7D0E31E304EB67A7E69E6BB1124A99E2743A41D4E34216A14D4F32B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779924, "uuid": "c84c42fa-0a58-461e-afb3-0e61c3de09ae", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779924, "uuid": "635db21e-051e-4447-b243-1110ce06374b", "value": "6144:/Ya6GGKc6kzfK11fflfuUNEkTWzKIXQNKTRkvFXjoBpwDKnL9X8o+gN:/YQDcFK11ffljNnTWiuRkaBpVmo+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675779924, "uuid": "953f0166-bc1c-46c1-a329-d7c98980fa69", "value": 327463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675779924, "uuid": "3474d7e9-6d25-455a-aaae-ba41dc8f9472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779924, "uuid": "b8cd8289-36f5-472a-8486-f8b738b1858b", "value": "RFQ-N-12192.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce903b35-a697-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675740645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740645, "uuid": "f8750da0-0cb7-4b3e-b838-9efc36fa8ef0", "comment": "Malware payload (GCleaner)", "value": "eee5a5c093e858ea14812768a31a15b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740645, "uuid": "dd6f9a87-19e4-4de5-b708-89df1443f5e4", "comment": "Malware payload (GCleaner)", "value": "924a338ad202e45bb34285545034fa3025f8adf58e1b729646884be61963c108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740645, "uuid": "9c5d0140-b633-490c-a8b2-97b2e907185d", "comment": "Malware payload (GCleaner)", "value": "fe5a25f34f9dde52e01135530f630f1d694cea7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740645, "uuid": "3e46fc6a-2cef-433d-9ce1-da13eed6c71e", "comment": "Malware payload (GCleaner)", "value": "cf6ce2678f01365803ae3e4d8238320a575248605c050b8ed13ea68eeb8e79fc8acc5f2120030677bd83f748aa307e82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740645, "uuid": "0c5fc7e5-50b8-4123-82a6-a955f43dff16", "value": "T1A1C5E0065D94D0A7D1618F70D8D72DFA8C16EE6FE8BA009323143FFAB631246E94AD35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740645, "uuid": "c7f5edd3-e7c1-49e2-96c8-c9b1d5e2c957", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740645, "uuid": "86c0f5e6-cb19-46d4-b888-313dbedad9f6", "value": "49152:QwWo9phgkBqIRV94x6F1DiOOqbrnoRu7RS/5+DkhWdpLCgv2MR:lWozm9IR8x6nDj1XnoRuy5+DkhWjv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675740645, "uuid": "7905f41b-acb5-46c5-8cbb-44d48095ce79", "value": 2737409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675740645, "uuid": "30a25327-273b-4111-946d-db0c28380258", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740645, "uuid": "9a19f320-4b3d-42a1-8518-df8a3d5984e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81284d0c-a6f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675779599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779599, "uuid": "2fe835fd-6ab5-40d7-ac69-8ff5790be5e9", "comment": "Malware payload (Quakbot)", "value": "caf17ec8d6d574f29693b3dc2ac4f6cd", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779599, "uuid": "79e2e69b-23b8-481d-8a39-6203e57fa0cb", "comment": "Malware payload (Quakbot)", "value": "92574c2ed2980a0095f5e0844e1b537ac2f422489fee79e068f91a0cebe2f83e", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779599, "uuid": "46908819-1e54-4111-a154-4c4d71645365", "comment": "Malware payload (Quakbot)", "value": "711671a746a7004353a4aa4defcee09ca6b68915", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779599, "uuid": "73b032e6-6e45-4e2d-ad8c-57c34d6c68e9", "comment": "Malware payload (Quakbot)", "value": "4585d69b0e15f5b82dfbb62d537a2053f2192776dc1ab71d66c586dc5b195bd5b34be7deb0f9ec1b74d26978e241a2b1", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779599, "uuid": "e11f8146-e09b-437e-a3ee-e7c0c3cc59d9", "value": "T13EE0F104070647507BCC309102C49CC6B322016E719854EEB3C39F8EC9C62E0A4BD52D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779599, "uuid": "51335be3-db32-461d-b506-ad83bb5ba081", "value": "12:snEHLgyaI4HPKC2E4OL9b/ydAEq2QFI+x1N18f:iEHLCHPKC2EB9bIrNix4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675779599, "uuid": "15a2d6a6-eb18-4ed9-a99e-e8f72ca8af62", "value": 400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675779599, "uuid": "16e3a685-0949-49c2-b43b-5e770e26a230", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779599, "uuid": "e499bc36-cdf4-4a9f-beb0-21bb9f3785cd", "value": "Open.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df32c57-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732779, "uuid": "d5b0ba90-2470-4e1d-b055-79090eb649db", "comment": "Malware payload (Gafgyt)", "value": "7ab59c73193e4d6f44797660fde4d619", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732779, "uuid": "3b22f031-b135-422b-baff-cc99110d59d6", "comment": "Malware payload (Gafgyt)", "value": "9279bdefbefcff04d849a1f7df2356067bc35919d2101e3be7c512f52990f21d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732779, "uuid": "f6603a19-a765-40da-85bd-b514ba4d9de8", "comment": "Malware payload (Gafgyt)", "value": "9c1736f706b69ee5c4eb43f4a599675bb12ceadb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732779, "uuid": "15df9c59-b959-4bfe-a754-49d1369abf37", "comment": "Malware payload (Gafgyt)", "value": "e7e42f554dc4859e163894cd436211dcd56439fc4684c9d16c79296faf2b2732e66849de852688ff5c871c11868cfb5c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732779, "uuid": "6ebe1670-f2dc-481a-a82c-9b520d7f5354", "value": "T17FE34A05DB408B57C1E2277AE7DF424933339B54A3E733099A28ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732779, "uuid": "552b1536-99d2-4e54-a1b8-ba6f44d1af96", "value": "3072:bjjMM7NwA7VWxbZaXmpvh7q07YWpxVl0sgURKXmQwfHcQrAN:bPMM7NZ7QZZawp+07YWpxV+XmQwfHzrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732779, "uuid": "9445e584-fc60-4f93-a79f-14d9dccc1e6a", "value": 150481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732779, "uuid": "1413b436-9b8f-4239-961b-86ad4574c528", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732779, "uuid": "b23b1277-a7f9-4e43-80a1-eb28a6e27656", "value": "7ab59c73193e4d6f44797660fde4d619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd14ee9a-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675796450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796450, "uuid": "8aec01cb-e97a-4a49-a2a0-983a4015820c", "comment": "Malware payload (TeamBot)", "value": "7d3bb4f4331c27036a8faaa7d1e5ca00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796450, "uuid": "789ecdc6-42d0-437e-8a82-f7a63d1222ce", "comment": "Malware payload (TeamBot)", "value": "92c2bc9043a362d7b6f25f09c67adab90f099410ece2359c4eed960536542a5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796450, "uuid": "db08c2c3-0b70-44ed-95bc-73105a1bf370", "comment": "Malware payload (TeamBot)", "value": "d2cf719e2759d23a62b94cdf0ce592af434afa71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796450, "uuid": "3cb47261-ee01-4e54-a3f6-6dff7b6854a5", "comment": "Malware payload (TeamBot)", "value": "c98327e9166c0eee0d97be6fd770764db915545378254f441e8faa46d13c068c46e4c3cec1a01fdf53bd50476db1c8b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796450, "uuid": "4bd02cad-2d2f-4792-bd58-2410299fec80", "value": "T17314DF323590C072C56F513C9870EAA57B7EA830D6B4C99B7BA807BD0F316E1677A346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796450, "uuid": "e37f604d-7c31-437d-99cd-e9fb08ad0d40", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796450, "uuid": "ace4265b-bf94-4802-8a30-a6a5f5fc4db1", "value": "3072:TJQOMfw7U+gL7duuWn5IaXX5Tc48NPwhkxLOD3ogWRXl5cUgwj:TJQgLgLEuSnm48ihQLOLo9XDcUgwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796450, "uuid": "44c7b8e2-9498-4521-9ab2-4d5722460e4d", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796450, "uuid": "a3e829ad-340f-4c3e-a16f-012e3b648252", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796450, "uuid": "c17f1353-6c16-4139-81d5-3d2c4c9b105c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90051055-a6a7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675747412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747412, "uuid": "d79db4e7-4dff-4765-9f49-ec771d156cc2", "comment": "Malware payload", "value": "27b5398d583d24513a5a4816c0153ecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747412, "uuid": "81fd3935-2739-430b-ae0c-296debf927a6", "comment": "Malware payload", "value": "92ccd1ed10cc76a418d4585a782a0edb69ad311ff7a8f7b6d51c8daf1f481470", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747412, "uuid": "898f87cb-a032-4fd3-9240-794b7f4ea8e2", "comment": "Malware payload", "value": "5e05f19cda77ac16627c1345083d56c10fb1b7bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747412, "uuid": "5e63d3b1-fba9-4289-b93c-84f0b26f2a80", "comment": "Malware payload", "value": "d1e0e7544662e14df21e7a3f6dc49f8e3a69c04f1befa1ce3dbd0c64a8bf6da9b3a9274db30032a2e27a9c28cb12b969", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747412, "uuid": "10f89c8d-34a5-4716-92bb-99aa6c0a7e9b", "value": "T112F6339147684CF9F96BE53B4DC2C038A7D16DCD47E4815A038EB2592877280A9FF93E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747412, "uuid": "a7db36c4-b2fd-488c-8c9a-05c6a7aeb639", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747412, "uuid": "44dfdfac-1a79-4d8b-99f1-480cf1cd6ed0", "value": "393216:zML/JypdQuslN/m3pqq9AJ4ZoWOv+9HnuPV4ay72HI3LsjA:zMLRypdQu4KhS4ZorvSHo87QI3Ls0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675747412, "uuid": "27144170-9765-4e11-b41b-74d4041b8414", "value": 16048713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675747412, "uuid": "b6d9320c-b16b-4593-9c78-2b0612a226ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747412, "uuid": "28f335ef-09bb-4cbd-a3e0-0672cfb2403c", "value": "92ccd1ed10cc76a418d4585a782a0edb69ad311ff7a8f7b6d51c8daf1f481470", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e6ad7b-a6bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675755936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755936, "uuid": "687d0324-24c1-45e2-be1f-a0e10b987799", "comment": "Malware payload (Mirai)", "value": "8619fbf4c3d26d4db5c4d0fd091ea339", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755936, "uuid": "f6d2484d-efb0-45b1-b5c7-2bcdeb3024f4", "comment": "Malware payload (Mirai)", "value": "9303ee53951f150fd8673bb858a0281f2bd16f2ee565d9079096b0bd5bed422b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755936, "uuid": "17c650e5-f446-4054-9ad8-692bd51d6cd2", "comment": "Malware payload (Mirai)", "value": "0edd7a9ef455c0243cf591bd8ee306a812367b3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675755936, "uuid": "4fbde402-697a-403d-ae6d-001c44ffa8af", "comment": "Malware payload (Mirai)", "value": "30d0a32e95613971eea5ff9aeb7e7de5c8ba41bc2028a0b25321c86b9376cd9019e00a36295faf4202e81fc56faec84a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755936, "uuid": "e7d4d661-f605-467d-aa20-0f1e605fb83e", "value": "T1B7932A4BBB40C9B3D14309B2229FAB150533F6BB0A5B6E46F36D2CB09F115957226FE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755936, "uuid": "2f3add02-0401-49cd-a6e5-8ccf3ac74610", "value": "1536:gFff7U5UPSj/6Vbq1Nh27AA8ov820mKTOy/m1vmKHo0rIjNVfzksd:WfjU5UPS76VGjhKx8Qby/m1vmeo0rIhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675755936, "uuid": "405102e4-622e-4e3b-863f-361b5957e9b6", "value": 90142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675755936, "uuid": "1628c06d-f781-46c9-99bf-3a2358290f78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675755936, "uuid": "9255e57d-b4c0-42bc-8e7f-40fdeb6e8270", "value": "8619fbf4c3d26d4db5c4d0fd091ea339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253493f3-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675796195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796195, "uuid": "7dd246f8-64e4-4e16-b82d-8b0738b3d003", "comment": "Malware payload", "value": "2352457d71d6e16e5b87ead193c2e8d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796195, "uuid": "bdc06e93-b946-4163-82e7-c02b5d8edc0a", "comment": "Malware payload", "value": "945227de309cb138de2bdaae085aebfd574a3e4d81af76bd8e0ce620a58d5a64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796195, "uuid": "653313a3-e5b8-4af8-abe2-43f2ed5f0edf", "comment": "Malware payload", "value": "6dd0b78c3fc4bf9e532c3e1ec9bfb5dd661ff268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796195, "uuid": "0b03398a-2dcc-4ec6-9f48-d0d7cd42c83b", "comment": "Malware payload", "value": "1873376f2023dec092ec5f7a9f1185fc0917b9de269b13c86eb3551cf400f39d44d1359b88e5a6fa7b69136168140f58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796195, "uuid": "1ac37955-a8e6-4bd4-8167-464b78e6c13f", "value": "T1F6252347559B66BAF0269AB04C78D0190C27BE2BA83D101635EC5F2D4F73951B22DFE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796195, "uuid": "46bfe6c3-2e0d-4f1d-a636-5b77816a8261", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796195, "uuid": "f910f5d0-a330-4740-9a6d-447247966e82", "value": "24576:pQisB9ZCc/BZYSmImYo3OqFJp5AUP0e3DDu/5Ssf+Z:p98H1ZdmLYopFBhTi/5b2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796195, "uuid": "a89a1697-a41c-4381-8fa2-c432a8a73146", "value": 965184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796195, "uuid": "1e76c70b-8241-4824-922e-7ab376cff331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796195, "uuid": "35c3b727-35cb-49aa-aaa8-aad395b90649", "value": "2352457d71d6e16e5b87ead193c2e8d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd429b9-a6a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675747542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747542, "uuid": "40abd9eb-db41-4ff8-b580-f59064dfdbf2", "comment": "Malware payload (Tofsee)", "value": "b17d10f94b1122c2024d2d351c82dd9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747542, "uuid": "e7cadd05-55b7-465b-a833-766d31b54879", "comment": "Malware payload (Tofsee)", "value": "948b3f47df991c93af3b13dcf6ad0ce272973e8c04c765e3433851931f0881a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747542, "uuid": "7934eed4-f020-4f40-977d-5ce8863815b1", "comment": "Malware payload (Tofsee)", "value": "9edfe333543895531e99d7f14a61edeb079409c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747542, "uuid": "503af0c0-de27-48d8-a9b7-cde6f544ec66", "comment": "Malware payload (Tofsee)", "value": "34c899982dbc19903d2dad3ede0f8776cbf2afbcf95f3b192416127ece6a9c8b0686c1dc85625742b06141d02df36eb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747542, "uuid": "ac2b29d4-fb9c-42cf-95a4-23b83554daf5", "value": "T1C514D0233A90C473C6AB14305C24EBB67BBEB83156B8895B77A8137D5F302D06A76357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747542, "uuid": "9242a7f8-ffde-4b31-b601-aee8b91db272", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747542, "uuid": "a097acc5-6c81-4f0f-be44-611aa06ee535", "value": "3072:BI7OjEvcPvXLPObWo8S5qGq3YPa1V+Hjd5T1TgRPIs94miOlcF:BI7/KvLWbyF1V+HjbT18X94miV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675747542, "uuid": "6d8b959d-2169-4aef-b03c-1b7c2ae815b3", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675747542, "uuid": "77ebdef8-0907-4481-9425-66b5a0857f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747542, "uuid": "7ca60a75-1022-4084-b989-07fe0f036f08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9be3081-a6ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675762487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762487, "uuid": "f9416227-0d63-4689-bac8-1759071025a9", "comment": "Malware payload (Smoke Loader)", "value": "7c2b7f94b57d15b6f5f4ed31a96cc0ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762487, "uuid": "886ca256-9b65-4565-bcd1-ad3229e830ed", "comment": "Malware payload (Smoke Loader)", "value": "94dcd9eb97aa7ef0957f20728ef38d1b95c9fc6f16c1467c752e019046ea882b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762487, "uuid": "87a3b452-1f45-4471-864e-3f1b985cacd4", "comment": "Malware payload (Smoke Loader)", "value": "51ec2b8292ae25dc53c1bb96722228c612651e05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762487, "uuid": "9baea684-6de7-4530-8ad6-e61d532c5ee4", "comment": "Malware payload (Smoke Loader)", "value": "cded431b58e292b2965600bb3f92d7eea741fc33e1cd67fa36ffab0c8f134583d8cb6dcd26a16007b43d2c8580bb3e9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762487, "uuid": "c846728d-9141-45e9-b466-16e7cdc8498d", "value": "T1BD545DAAF6AA46D0F95C4CB074DB8135171B3C33BA9C19E1D80B37D313F52A8609ADE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762487, "uuid": "51c0cd92-9c61-4a2b-90a2-db00bfe428bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762487, "uuid": "35adc3cf-e244-4494-80c2-d5f87fef948e", "value": "6144:SOe7vYYo2U4YRNNbKL4pTYdkhVoi4Fc+dVkR52:SNvYYowYtiisdkEDFc+7kr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675762487, "uuid": "62f48fbc-b383-4aa8-938e-7b7713677b63", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675762487, "uuid": "8241365e-9f7b-43a8-8486-d1f21546caa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762487, "uuid": "dfe63b11-9bf6-4360-a2af-60b8d89c6c55", "value": "7c2b7f94b57d15b6f5f4ed31a96cc0ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ceaad8e-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675783350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783350, "uuid": "ee20f318-87e3-4760-b981-f4ef4ac4decc", "comment": "Malware payload (AgentTesla)", "value": "f5823ba2e7052a283526eed8f4dac9e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783350, "uuid": "767e7eb5-3f21-463b-8d97-0df026aca431", "comment": "Malware payload (AgentTesla)", "value": "94e367e6b334e6fc3e50624503159a06b45083b763238c47aaaa3fd6fe492628", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783350, "uuid": "43cb93e0-1836-43f1-abe6-7f26bd201dd9", "comment": "Malware payload (AgentTesla)", "value": "6f620ef0385f8e74cca147b03050877591abbd6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783350, "uuid": "1a289d29-e1a6-4da1-842e-a87e13b555fa", "comment": "Malware payload (AgentTesla)", "value": "69f7b1833f34f78f841c29d2ac02ce074dd875f3688e3a8eb390532af263580e258e10b27727b38dfba3f9893248ca5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783350, "uuid": "1c81850d-763a-4363-8792-895ea97bb9ce", "value": "T152256D013AF6C863F04A0E7460283DCC3A3CE4479BD9419FB972A96453E6BB6F5D8D61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783350, "uuid": "610c848b-1404-4823-a92d-7f54563ad950", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783350, "uuid": "9c1efbeb-4b66-4bf3-9b4c-3bc4b153836b", "value": "24576:bp1jYGDkjwJsoGlWYwHyR1HFI3LHLHa3QbsgXc3:bphY5UsoGlx7G3LrvrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783350, "uuid": "42c4b679-7db6-4590-a07c-beb72cf4a981", "value": 982016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783350, "uuid": "8614a995-a934-45d9-952d-b58f3f227d3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783350, "uuid": "55087f29-0e8a-474f-a4f4-85bf8a458e99", "value": "Solicitar Cotizacion.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188c6192-a687-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675733468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733468, "uuid": "0628064f-5cfd-4b01-a6a2-7a69d9e80a18", "comment": "Malware payload (Smoke Loader)", "value": "702c7bb40212622dc74074b582820643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733468, "uuid": "c841c147-c523-43e5-bd63-fe98ff4686c4", "comment": "Malware payload (Smoke Loader)", "value": "951346a5419a0eea3d0abe581914f760fd6807263d61093ad5309bc6a2c06a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733468, "uuid": "8f955beb-d4a5-40dc-b7a5-139f6dafcae7", "comment": "Malware payload (Smoke Loader)", "value": "ddb166c00c9b84897daad37681ca607b5fef817b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733468, "uuid": "8c6e9522-f646-408a-a3a2-ad0980bb8687", "comment": "Malware payload (Smoke Loader)", "value": "7a546994bb8293165dcff548268c463147572c5a09f03e4666a91f45dca1b807e68908f8b3f56be4b9484564143077cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733468, "uuid": "fdcdb016-3e37-4825-94c0-f70fa92cb619", "value": "T14C545C4793E1BE40E9268B72CE1EC6E87A4EF9508E7977662218EFDF14B1072D173610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733468, "uuid": "51170de9-1e04-4936-884f-b19ec5f2950e", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733468, "uuid": "f0f39e23-be20-49ec-8908-3285fb0dcffc", "value": "3072:Ctb6bepLO7Rm60Fvy7N7LcrLHNvHJSqSYxEZGuQjiMTE5dKPpa5D:U9pLOov22LHxPSYruQj9UKxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733468, "uuid": "8f0f41d9-92aa-411f-8ee7-9e0cbe3f9600", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733468, "uuid": "6ed54a81-d623-4065-8bb3-edf78d0782d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733468, "uuid": "cf35a1de-c418-4fd6-89b6-314e8064826a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6a5337-a6a8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675747867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747867, "uuid": "7c401065-6c51-48b7-9d15-7587c484ba07", "comment": "Malware payload (Amadey)", "value": "7062f3341be62a7e6590f1afba296c54", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747867, "uuid": "889201c9-6bab-4e53-a9b4-11699f8bc215", "comment": "Malware payload (Amadey)", "value": "9546cd73e23c5cd64f462ed61097c7df0ac48c64ffe3a907cc0a97b6747fd4e0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747867, "uuid": "17dcf70c-2f41-4c3b-8f8e-a64be4851274", "comment": "Malware payload (Amadey)", "value": "3bfb73d4f3ceecd97a047aaa294bdbe6bd415c1b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747867, "uuid": "2777fc18-f5e0-4d28-aec4-3f249352c53e", "comment": "Malware payload (Amadey)", "value": "5c154dde1b66c87dc9fd497f9bbcfc437ade3a215fdeb0235eace68890dd868d6c7a0952234e603d76778bc6501ca478", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747867, "uuid": "db3a8c0d-1887-4c5e-a247-f69c3ece5d06", "value": "T17314D02275D0C032C7AE55309C24D7A52F6EB8324D77CA9B7BAC176E5F202D0663A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747867, "uuid": "8d4865f1-004a-4a51-9954-d0cf04eaf321", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747867, "uuid": "a4603f14-da0f-4d21-b3f6-399da6dab0c7", "value": "3072:7wKOf3+3XZYLg61WYJF5gVa7mG2XaD6TLbykJDCE+ytjKAPXeRgST+:7wKAOCLh1Lr2FHnJ4yUpSW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675747867, "uuid": "06195ad9-5a43-4410-aa54-331fb02248b0", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675747867, "uuid": "dd470c7f-73fb-4a55-9605-7db2b7fa4bf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747867, "uuid": "202e04f4-4b0a-4b1b-add6-67ce61691f02", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf7b48d-a716-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675795190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795190, "uuid": "7cafd329-ee32-4a08-8b7f-1eceef9dadfe", "comment": "Malware payload", "value": "6a7b1a1a041bfe75fd88f1ac5010c63f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795190, "uuid": "43eac38a-e9e3-47a0-9a7c-4151fb8dca84", "comment": "Malware payload", "value": "95907dc57674aa31e1a86f3bf1feb2997072f2cd9df58eae3069275619968118", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795190, "uuid": "57736412-aa97-4b16-bfb5-235f5ab08f7e", "comment": "Malware payload", "value": "47746d829b0c113792e6f1acefe8ec8b7f7cdd03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795190, "uuid": "642dcd54-9868-43a2-8783-677ffd06554d", "comment": "Malware payload", "value": "246661a1ca543dcd006ddc2b1995474f4a347114843ddee0fd117ea891c35834177aeaab12ad945714350738cf9a3062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795190, "uuid": "b869d809-097d-4880-af5b-e8e1ae4312fa", "value": "T1BAB3F20B71C8D0B7E56615316EBBEB7BC7BBA71921B0066B8B702FBD4A060C3A513715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795190, "uuid": "a3dce073-566e-4aa9-b662-35507759bc37", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795190, "uuid": "4664402c-b3ea-4ff3-8fad-837f9bdb159c", "value": "1536:MUeHiWRgkkjH8nyWmJgTFRP6mKeCIHQJbmj+d7DuDtKNR07ePEj6hjrlIkukhLmJ:Md/vyWmJgTF05e7wJ6E/K7ePRhjxjuEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795190, "uuid": "0c83d524-6be7-4b4d-915a-09b7871099fc", "value": 116158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795190, "uuid": "b816a8c1-be40-42fa-9ecc-c240cd58c1c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795190, "uuid": "97f78318-c649-4b05-b68c-0c090a6798e2", "value": "SecuriteInfo.com.Trojan.DownLoader28.21983.22104.3915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a286aeb-a6a5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675746489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746489, "uuid": "6bd3adf8-1e46-4a40-8454-bbe95b42af28", "comment": "Malware payload (Amadey)", "value": "649ca36eedfb0d273f7ee638f948abe1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746489, "uuid": "07040264-0ac3-452d-9e31-164cdcb42581", "comment": "Malware payload (Amadey)", "value": "95c712597831d387c3818b0f2d15a5ecb2395eddcf876c2b95b5f355af42ec5f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746489, "uuid": "bc9aede8-0971-4101-8203-de336494d2c5", "comment": "Malware payload (Amadey)", "value": "7c0da6ffd3495bf609bf2a79e64112c761c979df", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746489, "uuid": "dba7e6a2-41d2-4b72-a8f2-facda395fbdd", "comment": "Malware payload (Amadey)", "value": "21309d433cd636151578592afad40c7b97e07f7a620a96b4927993ce57f12bd9cb92622359cb06c4ced2ac6929b1e2aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746489, "uuid": "aac13bc2-0324-41dd-b024-46429747c8f2", "value": "T104C40213E7EC8173E9B11B705DF707D319367DA15A38879B278EAC6A0C72660A53132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746489, "uuid": "94390eb7-819d-4980-94aa-20802311d062", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746489, "uuid": "778898e1-df8f-4bcd-afb3-5cc697c1626a", "value": "12288:kMrQy905Nh3xVn0dU4YSfe2XsxOCx27kfQD8XK:kyAjV6iSfe2XsxRfoga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675746489, "uuid": "494505f8-b410-4aff-b9fa-dd4adda72bdc", "value": 570368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675746489, "uuid": "96b0afe1-6578-452f-84a4-31fe568b9097", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746489, "uuid": "c0480ab4-4daf-427b-8807-34c39cbc8b18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b6d9bf-a711-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675792836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792836, "uuid": "e2a569bc-4233-4510-86e9-9286dc86e845", "comment": "Malware payload (RedLineStealer)", "value": "f28f8b036b37dfc95420fa4678ce7b96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792836, "uuid": "0c2d8711-2688-4285-a67b-cd7d3198829d", "comment": "Malware payload (RedLineStealer)", "value": "96591c0ce9dcbd29016ba5516e5dc36ae19646a492667bf46c05629b4214b971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792836, "uuid": "06f561ee-55b0-4a89-85f5-63a2a89dcb87", "comment": "Malware payload (RedLineStealer)", "value": "55b238276d47601b6c61783ab43d2c45417da96d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792836, "uuid": "0d7880ab-d8a7-4eb2-b002-70c48513b5c8", "comment": "Malware payload (RedLineStealer)", "value": "76e7fa6bc1137020918c9891920e90f86d9a99ab5c48af8b42f8bff7db82da8d5a81b55e9489eee16b5662a61c534fe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792836, "uuid": "d6b52407-c4d4-4053-b746-fbc83a587d71", "value": "T10A64F1323AC3C0B2F96651305C30EA65ABEEB53155B4CA57FB5807AE9F302D1873A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792836, "uuid": "1e0f5f6e-3d62-43de-bcea-bdc729cb60d6", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792836, "uuid": "3b9d566e-a9f3-4093-b5c3-d5d74c8f833f", "value": "6144:brXPKbLqv3uYfWUm8+uBCyTKUlZ/CU3GiRU:brXPKbuvL+Um8ZjKsxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675792836, "uuid": "7daa41aa-10be-4349-a9ff-d68d65622c08", "value": 311808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675792836, "uuid": "591d087a-d1e9-45d0-9fe9-30f387ac2550", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792836, "uuid": "101d5cf3-e6d9-4f95-9298-3bb0c1e272e4", "value": "f28f8b036b37dfc95420fa4678ce7b96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9618edd5-a6b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675752576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752576, "uuid": "f9459641-8120-4bec-b263-262f90587c1a", "comment": "Malware payload (Smoke Loader)", "value": "1f698de6cf8caaca94dbb2caacd5ad25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752576, "uuid": "c6b790c5-2d3d-40c8-87a9-f71603e7fe92", "comment": "Malware payload (Smoke Loader)", "value": "966ec85c6b93c43fcb51bb9377985ae862c0701a230d20998cc903cbefb78695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752576, "uuid": "90fc343a-6629-48e3-b52a-5c8296b43dfe", "comment": "Malware payload (Smoke Loader)", "value": "552d70f2a18f3226335c4a143a0a42818b922965", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752576, "uuid": "b7e86c2a-c59e-40c4-8a24-3e7511cac003", "comment": "Malware payload (Smoke Loader)", "value": "e4dce04ad29829744745e65c5194f3ef7cb89e23e373f56e99d837edc5d469fb82b5bce4d7a2b924f5bdd18fadf6e175", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752576, "uuid": "470c6077-1e68-4831-9917-d951361885af", "value": "T13314D03E36D8C072C5BB24705834EBA42BFEB8315675866B7B98167E5F302D05A3A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752576, "uuid": "9c27ff23-aeb3-4023-9dde-dcf14ef9c8bb", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752576, "uuid": "91849642-e379-4ea0-bf62-aece848c97ff", "value": "3072:LI+OcA8o4K0UL58PWq3d5a9a/BvLh1Hb3beHOEX4ErpwsIdI2RJkB:LI+WuML+PvHKz4Eru9dIMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752576, "uuid": "3865f209-5e64-484b-bacb-920322836d62", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752576, "uuid": "96c00fee-7ce6-4976-974a-5fa490a58cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752576, "uuid": "5077dc37-a631-4c74-8f2e-f37b517bd643", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24a42904-a73b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675810797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810797, "uuid": "fa65ee9f-2a96-4f10-92bc-77c0cdfb07ad", "comment": "Malware payload", "value": "e190e8b37c554154ceb4f662a539875b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810797, "uuid": "928b7919-4b54-4832-bd87-85576de21b71", "comment": "Malware payload", "value": "9703795dccfd734fa337bf66ae22e202261b531d932fa7946b4c022673dccba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810797, "uuid": "71a08d39-7b06-49dd-900d-25120f0b88ee", "comment": "Malware payload", "value": "edc62248d3b8ba46ee0f8f98bae3c281396bf7f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810797, "uuid": "2f55d115-1610-46ec-aa67-e92d91407f1d", "comment": "Malware payload", "value": "b2843b12321c20c8e04a8641faff16e90859dc7fc08c60b44930f6ec17fcb7ab0dfc0fb3afd1a28da2d94562f42732da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810797, "uuid": "e2c60828-47ae-4d2c-8460-dc2c6a5610fd", "value": "T100B40247E7FC8522D8B4537048F607C30A36BEA16B78836B674A7D4E1DB27A4A131727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810797, "uuid": "4fcc5230-234d-4b4b-a733-b8c46aecf2a0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810797, "uuid": "5d0b52b7-5db7-4979-a874-9ad1dcf1d083", "value": "12288:eMrPy90UjoL5jUsIpnI9zzVsiAwWLpZiYa1velodL:1ypjo1x3uj251PdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675810797, "uuid": "09aaa776-9af1-498c-8409-b127d0979661", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675810797, "uuid": "68778f39-8faa-4102-a2db-8d07d47c2218", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810797, "uuid": "e2977f0a-f616-455b-a288-30ca6cd9eb27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f73ea635-a6e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675774643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774643, "uuid": "4f4886e2-e1a7-4e9a-a748-10e008fa9f3e", "comment": "Malware payload (NanoCore)", "value": "ac2609d2181f756550e3c180329b121c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774643, "uuid": "c517c5be-33fa-49af-9bc6-8158a8e85a85", "comment": "Malware payload (NanoCore)", "value": "9730aee1d4d04bb12e1df2a5550741eed7266625f8d99443dd0cd0dffca07112", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774643, "uuid": "f5017833-6085-4f65-bfcf-25cb3ab4701a", "comment": "Malware payload (NanoCore)", "value": "2ac2462013be76e3bb606c7deaec5e0e4609cd59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774643, "uuid": "ad49fbb0-97e5-4c19-aa7e-f4edadfba523", "comment": "Malware payload (NanoCore)", "value": "e46ea6069f08caafff0217b812b9690b616c98fdc9318db19cf7bfd3b5b39d070025840997608d3f06cc7c5d5669f923", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774643, "uuid": "e15f4a32-e293-4ee6-a03b-5a109db7ad1f", "value": "T139E401811D64CA58E2F90EBD0F7C5A2D8FF45C9923E3E2B40BE6B4D9A463783C815536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774643, "uuid": "fa38039b-6a5c-4af3-af4d-f08a6fc78cfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774643, "uuid": "52343b86-c487-4d07-acf8-d99c9d81e488", "value": "12288:VVC66Bm2iNNHOp7HPfubIVc1E0cE3UyV5sXoDCnJ8OSTaHlUI1FuH66B:GVM1rut21E0cEkI24D6PSuHlvuHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675774643, "uuid": "df47ee2e-57b3-4e5b-abf9-851b5c8e320a", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675774643, "uuid": "ec286130-4e25-4074-a1c6-e677bfc571cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774643, "uuid": "481d3e99-dcd7-4883-b88a-026d5133db52", "value": "9730aee1d4d04bb12e1df2a5550741eed7266625f8d99443dd0cd0dffca07112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96971060-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675788225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788225, "uuid": "0db9933e-8459-4b59-a055-bf0af6de38d5", "comment": "Malware payload (Vidar)", "value": "77808244bdb7f35042b644d5dc91b5b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788225, "uuid": "2b3f658f-501a-4dd9-ac35-4b305a882373", "comment": "Malware payload (Vidar)", "value": "974a97240c456efd3e47da6d3fcd1063fdfcbeb32d9adb8d3874e105d74deff0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788225, "uuid": "d0b99114-d0c7-44fe-92ab-804c13dadd45", "comment": "Malware payload (Vidar)", "value": "c467cb6bab3c9b184f74161bc68c811ae2d6d273", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788225, "uuid": "8c70d591-a5d7-40f3-8151-7cc8e7041687", "comment": "Malware payload (Vidar)", "value": "06131d48d41b1ccff53ec0334849fa786136ad8e0ac01c5ee57c359d88c4272dff5c1aff97ad0b136982f7532feece8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788225, "uuid": "9ae302e7-ab54-4777-8bd2-6d31ce48933c", "value": "T1E7847D25F200E032E4A60175BE6F9FB6987C69B0136565C3FBE40DA92DF02E2163975F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788225, "uuid": "3ddd96a5-efe1-4390-900e-187c8241016a", "value": "23d55f9b1cc23c82683612f9785195e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788225, "uuid": "2da2fa3f-d4a0-495d-8ed6-4c96257b6552", "value": "6144:L1R9rz1Q1iUp+eLEcFxE+2u35ZHff6XUWTzbu:L1Rdz1TUNLBQNu35B6P/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788225, "uuid": "b380a8bb-7a2c-4509-aae2-8705c4c2c9e4", "value": 373760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788225, "uuid": "61f4b57d-8f4d-4178-931f-c5d3c29f7832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788225, "uuid": "0815e1ff-6dfb-4b73-8cf8-08336e3e845f", "value": "974a97240c456efd3e47da6d3fcd1063fdfcbeb32d9adb8d3874e105d74deff0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82cfa685-a67a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675728062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728062, "uuid": "bc3fa992-97c0-4838-a689-80829a6c207e", "comment": "Malware payload (RecordBreaker)", "value": "a97fed9c529571b5fb38587210e019ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728062, "uuid": "84979d02-04b7-4353-b484-12f46e64aae3", "comment": "Malware payload (RecordBreaker)", "value": "979e6375e26c44315315f1e2d7476a074227a3464b7b96f7d7e4f08e27a2518e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728062, "uuid": "7feb30db-d954-4017-93d7-f7df7f8c15e5", "comment": "Malware payload (RecordBreaker)", "value": "6128ef718208e3b1fd79021cd256d0dbecd654fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728062, "uuid": "cef67f46-1241-4d26-a708-d2743021882c", "comment": "Malware payload (RecordBreaker)", "value": "10db8cbe8983be16e0eb181eb12e32757fc86c5f69ebff51e94d72926ce7fa81d376a4947aa3af4eee3368f637fe00b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728062, "uuid": "abe5cfe5-1ae9-4226-a58a-db6c48a119e6", "value": "T183662313673004C8DCB64C3794177EE135FA555F8B817CBA22DFA9E625239A2E21BE13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728062, "uuid": "3d9ca90a-23a7-43c4-8b53-f4ec3d67342b", "value": "11ea24073ee65343ee563e3160c77fde", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728062, "uuid": "56947047-6dab-43c8-9315-f785c43b51eb", "value": "98304:7dEPYMOo5jW4WF7KhlKBLaNi54hqjzB0gbY+ApQJMQZCWpn4XAWwLYOgLe89:KPYMVna7GK6i54hqjqmA6dn4XA9YO8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675728062, "uuid": "13dc5cec-db2b-42f5-80dd-d02f2152e0e3", "value": 7089152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675728062, "uuid": "083ad276-b507-47b3-b6bf-2cb6fb038d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728062, "uuid": "ba0b114b-913b-434a-a70a-ee6b56ae83be", "value": "a97fed9c529571b5fb38587210e019ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f3ba34-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732718, "uuid": "e79af9b5-c730-4ffa-a7ba-8489b3f42707", "comment": "Malware payload (Gafgyt)", "value": "4bb612b733348d02217e768f99c3e118", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732718, "uuid": "bb1b5560-845e-49a2-be5a-2a0f1acee983", "comment": "Malware payload (Gafgyt)", "value": "97a19d8fc98a4d29236372ead89626d75eba9607365cfc91355b4a807e8bf142", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732718, "uuid": "ea39f21b-e7f3-4ad8-93d2-09a3081abdbb", "comment": "Malware payload (Gafgyt)", "value": "33361f4a2b3a2050cfb93401ea737406d2c63272", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732718, "uuid": "3c0caf86-648b-4e00-a657-dbaef8fdeb88", "comment": "Malware payload (Gafgyt)", "value": "5d48d76bbaf5f8a98efbdf8e2feb7e7fb99692e3a7224378f0152f4f4f5731fe7fc3baf52b7706e9f0891ac7f8d2ad74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732718, "uuid": "fe7473e6-ffd6-4aac-b080-66d9c749c845", "value": "T162833B46E3A2D1B3D4831B7A02E7D7660332F9660B5A9F09E35D6EF4BB064C4319B316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732718, "uuid": "555fff04-e25f-458e-9219-46107bd0d47b", "value": "1536:O+OC5+7fe1rEyCxA+jxKZEyVIc2WJBrHn9tUAqmm5CsUpPVYexf:yd7fe61Njx+hVt2WJRH9tUUmwsU5VYeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732718, "uuid": "7b5653d0-4392-46dd-84bb-749f3065529c", "value": 87724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732718, "uuid": "e7794284-8735-42c0-a1f1-04f99cd6e60a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732718, "uuid": "f28beb40-9f5c-4976-bc54-af13fe10336b", "value": "4bb612b733348d02217e768f99c3e118", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b969557-a690-11ed-88f6-42010a9c006e", "comment": "Malware payload (BlackNET)", "timestamp": 1675737338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737338, "uuid": "45423dae-5765-44ce-8645-0c0d831184de", "comment": "Malware payload (BlackNET)", "value": "c77e5db3244e658843f06ae2e61ad95f", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737338, "uuid": "5618f3f1-2428-4bca-a315-9cb6f9d2bf5a", "comment": "Malware payload (BlackNET)", "value": "97ac2f7c9ff8e79aa217a8bac22bc9575cecb39bc87bcd753d428c56ea4899c9", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737338, "uuid": "f7d5e326-694b-465c-8685-0ca088bc9baa", "comment": "Malware payload (BlackNET)", "value": "5bcf4c83cd1218db713c1be89369e368c6c0f115", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675737338, "uuid": "537de393-1660-4b35-91c1-55be467536d6", "comment": "Malware payload (BlackNET)", "value": "ce42493e2f6b07b17cef203e48b3fdf95fd308f56bfc30243ee68bc796eefb74241fd50e3438cb2931910b6df11a453a", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737338, "uuid": "2edecbc6-7f3c-45a6-b422-031f720d44cc", "value": "T191D394522AEE245CF3BE9FB16FF1B2EE8A6AFD230516E17D04C112064732A41ED41776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737338, "uuid": "30be9708-82ac-49f6-8eb4-3324f0b5d774", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737338, "uuid": "7ae548e1-0714-4a98-9bb3-aef97b028cb8", "value": "3072:BI7KpEaKA2L22xYWVVz8pWzWpBZ7ubozFyTO1wbCl9fGJu:u7kKAhI8pWzWpB0boQMZGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675737338, "uuid": "b87252ed-0364-4db6-8abf-e4720a8cf1ae", "value": 136704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675737338, "uuid": "6feea76d-4a33-4a78-946c-153d7306a5ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675737338, "uuid": "7a5688ca-db07-49c6-9c59-8eb659704446", "value": "c77e5db3244e658843f06ae2e61ad95f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fce0f8-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675758559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758559, "uuid": "b7ba127d-8080-4ccb-9359-5f058b319098", "comment": "Malware payload (AveMariaRAT)", "value": "d8c168266888261dc783a5b141c4b1fb", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758559, "uuid": "c6d2eca9-5e0c-4782-84ff-dbc2c79b4970", "comment": "Malware payload (AveMariaRAT)", "value": "97bb73a7c678dc8cf65ad807b2915efdd8f16d7cffe5520511425bb1c42ecbfb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758559, "uuid": "66e0d999-639d-4b2c-904e-80c53b94a2c0", "comment": "Malware payload (AveMariaRAT)", "value": "c5d6a9a6bca2cb6c9db40c62c6f2ec302b916c13", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758559, "uuid": "49b534ac-8d6a-4fe0-8eb9-9cef62930591", "comment": "Malware payload (AveMariaRAT)", "value": "def1bf1c4938a528d1556d32edf5feedbcd8b9a72f68d8bd8f21ab17fafe490a793319b51cdbea7e5e3d5283a735459b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758559, "uuid": "889eaece-35c8-4e78-b144-2bcce1c2042e", "value": "T14144ECA8A44F0576D294AC4D60D572147D76FE9230C8A871239FE472CFA6FF9ADC009B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758559, "uuid": "71e34f17-6a48-4ca0-91bc-c406105fbf66", "value": "1536:isj6Uot68YL5L30EvXLhy821HovFzNYeDT5WoTeqaVbUxZVzFz76mAg5eeVhMDwB:iGL5x9/bVzFtr5RDAw5wfY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758559, "uuid": "639e0090-0ee4-473b-93a9-70c9645742ac", "value": 263324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758559, "uuid": "699a0af5-af7c-42be-94f0-5729f9ca4d12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758559, "uuid": "26940230-ab78-4630-b22d-aa53acdbbd51", "value": "Invoice # W0005588 deposit receipt.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39b3ad9-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758692, "uuid": "9c57b5ee-2756-4efe-8aee-15f3f51a3571", "comment": "Malware payload (Gozi)", "value": "fbf1e5dbe6790ee01d647d37fc47f6cc", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758692, "uuid": "7174e828-f37c-4822-9666-13292b383a14", "comment": "Malware payload (Gozi)", "value": "9834250e5b762d25cdf5435ee31e1e66259c04efe7bb321f26c36812bd4cb42d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758692, "uuid": "f658c462-12e9-46f5-9233-1ae6bd68d684", "comment": "Malware payload (Gozi)", "value": "6b3c85b35f9bc24b2f591fb28cc78dc392f24547", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758692, "uuid": "a7141b79-3a0f-4e30-9e6a-b30e72acb708", "comment": "Malware payload (Gozi)", "value": "51043b876b9771ac1dacc0e4c677459ab446ae4b6357486621156e77f6b7f2cb791f12d847c54c1210ba1c2a071dd87d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758692, "uuid": "0a20f45b-f9c5-4c6c-87fb-8230086eca0a", "value": "T161A17C564FD80A4297D6B5CA2BE798BA575CB0410B236508D603F3176F15B9DDF0343D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758692, "uuid": "bb0aa89e-9a63-4a34-a436-d8a1ac082186", "value": "96:g4Ja6Fg3PyskPw9ewNYGNXn29Q45bOtkUcL8esx+3sX4V8KS/CvH5Pd:g4YAw9ewNYGJn29RbOj5eZ8X4nS6vZl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758692, "uuid": "cda3586c-7ea2-403e-9436-4abf2103d08e", "value": 5052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758692, "uuid": "7e1dbd2b-f3cb-4845-9da2-1c030d70be47", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758692, "uuid": "7a3b3563-01db-40cc-8271-69679729338b", "value": "azienda_31.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "834b3512-a6cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (DBatLoader)", "timestamp": 1675762852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762852, "uuid": "261c85e4-1016-4972-91e2-6eb269cf3c0c", "comment": "Malware payload (DBatLoader)", "value": "af46fa6d8e0138bc144cc09d4d0f4b1c", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762852, "uuid": "91f8285e-203d-4d9b-a677-62fbe69e0f63", "comment": "Malware payload (DBatLoader)", "value": "9846c8ffd0aec6ff3c8b8db350032e4d9586ac6aa22b06944672c837d3bbcf28", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762852, "uuid": "8f868c89-f6b4-4c9f-b886-ac0c4be4aca7", "comment": "Malware payload (DBatLoader)", "value": "0ae1a69baaac7ea9128751447f9bc6b2eee272fd", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762852, "uuid": "182071ac-c599-4473-9cfa-5f7bfc5a45ea", "comment": "Malware payload (DBatLoader)", "value": "928bea2a5234014fa783ca1271bf6074ba92b702db72b0eb029de87e2b299dbec9ac9a5a19d82e94a883fe392cb8353e", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762852, "uuid": "81a2f4ca-ff96-4692-90b2-d194f789dab0", "value": "T1A2259E62F6904837C5336A75CE0F73949C297E513D28D8877AF09E8C4F7A68039352AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762852, "uuid": "618e9fc9-657e-48b7-97f1-1ec0f97058a7", "value": "6c3620595af3d09c3e1478621557659a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762852, "uuid": "aeffc261-0b4f-4b22-b9a2-b845d51ae735", "value": "24576:87Je3RHKC7+5fxxViZhPYpnSZqAEuoLI9:8sqvCASkAEuoLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675762852, "uuid": "d869a848-03ce-4102-8479-e0296bb09f39", "value": 1015808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675762852, "uuid": "90e7b160-bc0d-4668-9fc1-29c76c09e930", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762852, "uuid": "4e5368eb-72f9-4051-aa29-f76aa13dc7bc", "value": "Scan Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1596affa-a73f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675812490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812490, "uuid": "90dc2556-4b66-46b6-8edd-83b423e24ede", "comment": "Malware payload", "value": "f70e34a6c487e8b151217fa3369916eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812490, "uuid": "1c9aaf96-13cd-426d-8a33-f627d6f8a1a6", "comment": "Malware payload", "value": "988ef64cd469464d4bee4c53235426e7433f40de7fea0de7ed456a83516160bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812490, "uuid": "68259fd4-291d-4174-b21b-bbe8b4aae342", "comment": "Malware payload", "value": "2aa8910210f6957a0c8fd0fd8a59ce4d8cc538c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812490, "uuid": "11ad8642-4896-49bf-8610-2360ac490d4c", "comment": "Malware payload", "value": "af298acc298486c537f4e4fa5611e8bbb835dc5fce001e80b5229a8a54e61f625038808ab2fee260990a2c2314d09187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812490, "uuid": "4966684a-dc18-42a0-a164-d7e63004b3ea", "value": "T17C14D1323E80D072C52B55305CA0DBA5ABBEB83146798957B7681BFE4F302E1673A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812490, "uuid": "d805e5e9-40d8-46c6-a858-92a8c0225b7e", "value": "ae0d5a157fa4c5b2c2783d24fb5ee840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812490, "uuid": "73e7c797-fdde-42c9-b276-3f1ead866668", "value": "3072:pd+OSKwNZuyLmAZjWZl5xM5nh+zEoelg1CCgseNbshHhQS:pd+P+yLrjEpCh0Eo9M+ehshHOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675812490, "uuid": "bbd9f9d7-d3d6-4010-a512-460f51d2c9f3", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675812490, "uuid": "c18b6df5-fcd9-4588-8ce5-32731dca892c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812490, "uuid": "01ae5b36-a3bf-4572-b8b8-47c249effe5f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e7ec09-a6c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1675761136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761136, "uuid": "4b0f526e-c63c-4e27-b196-b40fd596cf44", "comment": "Malware payload (LockBit)", "value": "92429807c7d957566d1897d5bf7c6639", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761136, "uuid": "98ff2394-78df-4f86-bb46-7e0357ffb15d", "comment": "Malware payload (LockBit)", "value": "98900768d564c6962981edde2759889fdda11bb1113c851468e5c40ddafe1d4d", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761136, "uuid": "89763eed-fd61-4702-a0c2-80f1d5293514", "comment": "Malware payload (LockBit)", "value": "d1dce09219c0df46742fa0eec6f7a6b72ca877f0", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761136, "uuid": "1c9b1f51-d1d9-4f0e-9957-f2142211f61d", "comment": "Malware payload (LockBit)", "value": "8622e35f6a4ead3416612b77bd835861bae1ffcd36becfa0e915807d947a55898c028b83689fe81d9244ea404689e420", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761136, "uuid": "b34fe234-904f-45e3-85f5-0b02e58cf2bf", "value": "T11C859E1663014E86C893507941FEADF2B8B70731836F5CF6A78456D842A2FE5B36B353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761136, "uuid": "c96e2106-49ff-4aa0-8828-f1183504d40d", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761136, "uuid": "b7bebc1f-8396-4ced-a0cf-b7abbb429775", "value": "49152:rjrc2So1Ff+B3k79nfIVGQ41P9x9tHpYZYp+:rjrcSmQ9Njx9tHi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761136, "uuid": "69c77cc0-3679-4047-8cb0-18f8d2976a71", "value": 1845248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761136, "uuid": "37087072-07cc-4e8d-84b5-388f245ab06f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761136, "uuid": "9b924e39-a6f5-4ccd-b4c6-90834a58ffd3", "value": "2023-02-06_92429807c7d957566d1897d5bf7c6639_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919d927c-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675756864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756864, "uuid": "7d81a3cb-e713-4a3c-92e0-e080b4a04222", "comment": "Malware payload (RemcosRAT)", "value": "cdb152784a28538e5231435f8c8777c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756864, "uuid": "089d0a9f-0b6a-4708-bf36-948d5556a763", "comment": "Malware payload (RemcosRAT)", "value": "999ba722b71c6d0dff443436e9b2c4154fae7c8f599c0a43cb291972099a73db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756864, "uuid": "922594c5-6a50-483e-9f24-1a1d548c618d", "comment": "Malware payload (RemcosRAT)", "value": "d5612367156bdf209d5c1cd1d3d48ff49a5390c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756864, "uuid": "f1a607ea-6f73-4ea8-92ba-00239b4b9d26", "comment": "Malware payload (RemcosRAT)", "value": "0f73b8ce7c7957e329314dd79ff6930caba7366093e03e324b70815857193582304f931b2ab6d9266fe0af3790c32199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756864, "uuid": "ad02be94-35ab-40e9-9b46-4f275450e5c9", "value": "T18483009977B69999E81E06B108399218107F1F5C8895572FB0DD3E2FFE7330224F29DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756864, "uuid": "d14efc69-d2c3-4820-8514-cb155aed30e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756864, "uuid": "185a1899-1907-482a-8466-dc93debabea5", "value": "768:bUsES++UoWSU2Ip4jBqltCF0AxEjenoB69+Fx6/:D+3RSFHBWAxEjc+S/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756864, "uuid": "1766efe1-9803-4b85-aaea-3a2e2ee55019", "value": 88064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756864, "uuid": "c49ed101-533f-48c5-aa7a-b51da63b8661", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756864, "uuid": "b8bb9d19-9923-4c8a-b3c8-adf299b3a51e", "value": "1778. nolu icra dosyas\u0131 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15dfe9e0-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675758374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758374, "uuid": "4729d784-2c4b-4039-b384-e2a8eaa1107e", "comment": "Malware payload", "value": "1f44e0dd7d6b6ddac3e2706a712a9c0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758374, "uuid": "6485e2ab-0a26-4c5e-96ed-6cf1867028dc", "comment": "Malware payload", "value": "9a1e02584381a1368b208bee0882f505cd421426c6553cc4da31e573e8f6cb8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758374, "uuid": "fd0da8e4-0c7e-4601-a6d4-81b83096f79b", "comment": "Malware payload", "value": "22bef3c981936f909ad7845a578145b8ecd36218", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758374, "uuid": "1e189b34-22be-45c7-81cc-e5b327cdc51d", "comment": "Malware payload", "value": "1626ed315e7031cfc7bd281fc9a0e78f04eb8d41d2e8b5a168e2c33d57454023368602f8e185a487bc302da6495dca3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758374, "uuid": "1654f187-21c8-4b38-90c8-4b4d59d43098", "value": "T18DC6337F25CA80FFE6C03570A727BBC732F556A305174C3AE4C9EC8A9883E257068956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758374, "uuid": "490fa3ee-0902-474f-b380-faefd24e1b90", "value": "24bff06826129533a09ce490c5fe8ff8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758374, "uuid": "bcc5d80e-9a96-4cfe-ba5d-73ef0c1a77c5", "value": "196608:KbbIN0np8Fqx4AkMiIrmg8KHy3aIpFjbcvJ5U8GUAcXpmAQr/rZY9/yJ8E9AxvfB:K20npMAYIrfS31nbK5U8JAVAe9a/mzsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758374, "uuid": "1b670140-27aa-45a1-af91-6ad9c1e5421e", "value": 11565056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758374, "uuid": "8feff516-f5b5-4793-b5c1-a8f062b4f58c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758374, "uuid": "ccf86eb6-b559-4f09-b28a-8e51cb5b44e7", "value": "1f44e0dd7d6b6ddac3e2706a712a9c0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9272d965-a6f3-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675780058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780058, "uuid": "d0ab105e-a01b-40a4-85a2-4ef53a3c5165", "comment": "Malware payload (SnakeKeylogger)", "value": "0a1c7648ea08ec9716e7a7bae7fbf488", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780058, "uuid": "5b130fc1-8763-4fe4-8ed3-5314f1dc63c0", "comment": "Malware payload (SnakeKeylogger)", "value": "9a42f6f94bbb304dc608954e9c5d4a8fbee7a78166fc2bad251fd7f0343114e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780058, "uuid": "c2d4617f-0a56-404e-977b-91ebe080bfcb", "comment": "Malware payload (SnakeKeylogger)", "value": "ab8430d97edda6edba2464db80d8d064c45bc3a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780058, "uuid": "36acac3a-228d-45d1-a160-15e4b0a90daf", "comment": "Malware payload (SnakeKeylogger)", "value": "b7d367dd8266caa7d0e50b6ad47814d573c09b29cf3e28ae8e100f1810ef9c5cb05e8b1e7526839fdb0797747a456aa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780058, "uuid": "3a39ea98-d3d9-4542-9ea2-7b02508ad1b9", "value": "T198F4120D6EFD9B16D51E4BB964700960477BAC2ABA62F31E0D8A70DA2F37BD08401F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780058, "uuid": "a51ae13c-d065-4b5f-8d6a-22940e866de6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780058, "uuid": "edc2ae64-6c3b-49e2-8055-bcbafa62c0e4", "value": "12288:lMzKqJMsIiyZXz6BEbWgucadfS9GMkSTJSawHRr/CB06KuLp4bDDlG:lMzKoMsXytifda/kjawxO5d4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780058, "uuid": "543daa60-693a-47f5-9db4-e8fe4c9e609c", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780058, "uuid": "eda4d076-4aab-4054-9d08-1bac23612131", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780058, "uuid": "ebea07c2-c85d-4bb8-8fb4-970090e9eaf1", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db6b664-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789955, "uuid": "72f5ec92-747d-41a1-a732-8b6b22e5d373", "comment": "Malware payload (AgentTesla)", "value": "73896476cf1ea64d5e1bc4f4f0370373", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789955, "uuid": "9157ba61-5367-4ce9-868f-efe15a23674e", "comment": "Malware payload (AgentTesla)", "value": "9a4dba9c3d3c74e021c2a07cb5d44aee1f36f697394d729f9735cb38792a86eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789955, "uuid": "851388b3-5a08-4448-8671-318bbdc5ad50", "comment": "Malware payload (AgentTesla)", "value": "1e07236b11ad013e5cee514e8f0c61e6d28fb0cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789955, "uuid": "a1942062-c47f-43c9-93c2-cf39d1f703c0", "comment": "Malware payload (AgentTesla)", "value": "7061ba5363123efc78feadb110fb652f2d75feb66f27537a74f368f18948c805d847372168095e6ce7eb1b2d9453e59b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789955, "uuid": "c36834b3-7b5b-4e0f-9b9b-596d9680315e", "value": "T10A654EB455FB49EDE00BC8501AFCFCE512B672F3CCC60D6543ACB6086E6AAA47E4550E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789955, "uuid": "d50f6020-6ec3-46cf-be08-567838ead177", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789955, "uuid": "2e291d4c-2578-4164-9440-9e51bb3948f6", "value": "12288:8UqDV2GfvtdWRETEK8zukxhWB5OrcmiW2vcLYBtrkRLMUuhHb:FNiW2vC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789955, "uuid": "c6e3c7e8-2be9-4596-80a5-5d5c4e90c7be", "value": 1420288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789955, "uuid": "a913c9b1-3078-4a57-a39e-ce0e7d887d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789955, "uuid": "3be73cb1-b8ed-4cbf-8ddb-bb8a3de9cfb3", "value": "FedEx Shipment Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346ea516-a707-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788490, "uuid": "3ebd7141-364f-403e-8340-a21efbd61c27", "comment": "Malware payload (SnakeKeylogger)", "value": "7ca630fd51cb4ab3ce34f18339fbde18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788490, "uuid": "4b2754db-d643-4954-9587-ebb0bd60ee0c", "comment": "Malware payload (SnakeKeylogger)", "value": "9ad2d4101e53d0ffaf2ff4ee07fc1454e08a910570f19621d2ea56f6033e93bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788490, "uuid": "1e744e9d-8d41-4df1-b0b5-b16f219d4e33", "comment": "Malware payload (SnakeKeylogger)", "value": "a08cd6f7e3741cda5870933cbaab71fe2084b98c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788490, "uuid": "ce368ce4-88b0-4e79-b087-136f7e96e058", "comment": "Malware payload (SnakeKeylogger)", "value": "e0a894d28c20b0128665b17594fea53b48f74315e185ad3a3216326530894b5c943ef598b3beb9e6622585a1937f506a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788490, "uuid": "6c178052-5bba-4c4e-bb89-a8dfea9d240b", "value": "T10E155C013AF6C863F04A0E7460283DCC3A3CE4479BDE419FA972A9685396776F9DCD61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788490, "uuid": "01de6a26-8731-4b87-a859-9de09a6bd369", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788490, "uuid": "e2a996fd-2f68-4f7b-b423-39eae76fab0f", "value": "24576:up1CYGDkjwJsoGlWWbDBrmAkcp3yGmiwc7oNY3:upMY5UsoGl3b8Akc9Twb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788490, "uuid": "9aa5607e-167d-4ac7-ba77-91fc296500f3", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788490, "uuid": "c9d92534-4161-4358-a5b8-eb35abd6d1c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788490, "uuid": "3dbbaa2a-8c2e-42a0-8029-8f9f171c0a66", "value": "Maersk BL 208268807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05452000-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675783257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783257, "uuid": "e30cb379-3dbc-4e84-95cb-6d7a6824715c", "comment": "Malware payload (GuLoader)", "value": "97a3c2d356bd0a11e4d88083a0b85dc0", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783257, "uuid": "90e67070-d85a-4b46-9506-fa093eb7a08b", "comment": "Malware payload (GuLoader)", "value": "9af43e8e2ff6ba1018af973bf3d770ca6e9c0b8251d193db24bb3670dd844d63", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783257, "uuid": "09d06997-5909-48b0-b3c6-cf7f89a86447", "comment": "Malware payload (GuLoader)", "value": "eb57910445dc4c5ec79e6477db0ea1aa6f4b7608", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783257, "uuid": "e1f293e0-b633-4c4e-b5a6-b59a34b71c0d", "comment": "Malware payload (GuLoader)", "value": "51255226cc28e5af2b4c14849dc43cb32c83c56440ac6dcd5b777c2311c205849643d38b67b4c916fc29863963020422", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783257, "uuid": "cfa66d06-c216-4a3f-8bd3-fe205bce1606", "value": "T119B42387EC66AE09897DB27C317D087CD3AD0523CA5B2CA476C7DD1C4924C12EA2357B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783257, "uuid": "534acf78-c73b-46f5-959b-117e8a9eaacc", "value": "12288:mrS3ZVCwuRg+5K2P3RJVK1w8rY/lmNc+WOpQ/:mERuRgeK2PtKNecc+WD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783257, "uuid": "62a3da1f-f218-491c-9e2d-2d6233f5373c", "value": 504426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783257, "uuid": "68573ce8-0b56-4c07-9de1-be2365930809", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783257, "uuid": "c37aa50f-9d3f-4bc7-b291-ad73321a7088", "value": "200333852-042536-sanlccjavap0004-4332.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9715fa53-a6e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675772335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772335, "uuid": "cb5ec9e5-e204-4935-bf48-f16147dbfdf0", "comment": "Malware payload (DarkCloud)", "value": "11b9eff39e0af7a2d28ecc715d423ee7", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772335, "uuid": "d9523e52-0247-4591-b839-6c6ad50ed48c", "comment": "Malware payload (DarkCloud)", "value": "9af527e423a1019fa81faf04a9a2b12438655848387639b0ea334dbb09d55e27", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772335, "uuid": "d0dc94e6-0cc5-4288-a8df-35236bc7fcb8", "comment": "Malware payload (DarkCloud)", "value": "12f4aec77ad89453ebbe7aed11e45602da6a97b3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772335, "uuid": "703ad9c9-b1f2-4222-a201-1202a7502965", "comment": "Malware payload (DarkCloud)", "value": "96917ad50c56900cde1bb5a757aab715cd54f3bbbc70003595e0c778b1550195523706f40be6a294491a23dc697bf76f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772335, "uuid": "dbd70fa3-6550-4e9b-8388-4eb7dfec011d", "value": "T1E62512A9C36DCFBBD65943FF14B01188ABB116BBF052D70D0ECBB0D4848BB405565AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772335, "uuid": "90e48703-0bce-4f14-8034-e245df701c69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772335, "uuid": "319479c1-6426-4a6b-88d6-bef2e575b4c4", "value": "12288:NeoWenD1dQIgTy/UBPyJv5X0ogiAaMCLgsZSg8T3lh/MBnNawCjWeh3ih9HnA:5vDDfLvuolAa+gy3IBEjBYTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772335, "uuid": "d620e2ce-9946-4b4c-ad64-26f130fe1d3a", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772335, "uuid": "1d98f7f2-29ab-4eeb-83e4-0cfbb2e87d70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772335, "uuid": "81ad6e44-b32e-4fd8-bd90-643e1f67ae66", "value": "9af527e423a1019fa81faf04a9a2b12438655848387639b0ea334dbb09d55e27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "807631fa-a713-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675793771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793771, "uuid": "4ba1e4ba-4aad-4737-bd4b-72b6cc1d2b94", "comment": "Malware payload (Formbook)", "value": "54315b77193020b244a0741d23c399e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793771, "uuid": "168fe9d6-fa76-47ea-95cd-59f1b3be19bc", "comment": "Malware payload (Formbook)", "value": "9afc074ebc658630115d98a5ad12f30a53509d43183cf855489be266890225e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793771, "uuid": "ffb6cdaf-5551-49ac-a1d0-17359e3f071c", "comment": "Malware payload (Formbook)", "value": "8576d4d489a4ca7d4689a34f68fcb4ec6dd10a9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793771, "uuid": "c693e83a-d21f-4b45-8b8f-92b3dc38cdf8", "comment": "Malware payload (Formbook)", "value": "bb5834b88df4935bdac84d1814992b22b60d2d985981f7cf40c9e41085711ca11045d88c690af30ecedcd173a0cae818", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793771, "uuid": "ddf5eafb-e6aa-48fc-9930-c07882967318", "value": "T1DEB401993250C467D69A073109B5AE3C1A641E25B9F1A64FB3203FEFBBB76421D0D363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793771, "uuid": "7bb722f2-e13e-4b68-b532-a2ba7bfa092f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793771, "uuid": "d61f31b0-7bff-46a1-ab61-c74b8539f43a", "value": "6144:UYa6C2ziKii1jKqbnPOsz+ls2kfS6V4jikIZcivdTnZ+DDw3AY5MykokE1vTvUPC:UYlzjkqbSKSo4jitdT4DEdaE5oPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675793771, "uuid": "f565643b-7745-4f48-aa88-f7824feb659b", "value": 507530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675793771, "uuid": "cd3ee543-2491-44f0-8395-59c6a13eea57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793771, "uuid": "769809c3-a119-4818-bdb1-b5dffb56d2c8", "value": "54315b77193020b244a0741d23c399e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1ce4d3-a714-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675794276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794276, "uuid": "a14c2213-8215-4acf-a546-0ebf44fa8c3a", "comment": "Malware payload (Amadey)", "value": "8024fa7a6251ca8d4d869ba8880561a7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794276, "uuid": "b478b6cd-f944-43b0-b7eb-a16bad9a92df", "comment": "Malware payload (Amadey)", "value": "9b29593a97dbf3bcb47275cc534da1fe32802b5bcb581a83d738b3f5f0ed8248", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794276, "uuid": "7c500c92-5c48-49ae-a3aa-e4bc0f746aeb", "comment": "Malware payload (Amadey)", "value": "58dbbec8d62553e54cf8e6f6a70fdd19a35e863b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675794276, "uuid": "bfacab8b-d548-40e2-a2f1-c854df26542e", "comment": "Malware payload (Amadey)", "value": "9b5977c82ccbbb4e2267daaf33edec0d21857b7dcee93e2e8a3489bd721d43297cd47be02e80d7c5de0a23113c0e061c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794276, "uuid": "37209fd9-b952-4710-96bf-8b638ae9da50", "value": "T142B4010BE7EC8032E4B4477019FA02C70A32FDA15A39825F775EAD5E1873670A67536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794276, "uuid": "55a1d5c6-4aa6-4f3b-a7bf-ede9c8f643bc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794276, "uuid": "92e90359-d224-48c8-a0a4-5300ac4993a1", "value": "12288:8Mr0y90NeWfy4nWCvNA4tWSic8mqLBQJSq:4yhCy0CYqvmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675794276, "uuid": "d6e93f7c-5738-4093-9f42-20ea44ad9ae4", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675794276, "uuid": "d15df840-d290-4f8e-a9cc-dff76a96c68a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675794276, "uuid": "8a591a0e-43c9-488e-a426-ed328dd261dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b4e741e-a682-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675731459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731459, "uuid": "96671b1f-ce91-4ef2-be62-94f07bd2930a", "comment": "Malware payload (Smoke Loader)", "value": "e39bcd53121afd8d6be9a9082ebac2a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731459, "uuid": "8a3c4bb3-0505-4d69-88ac-213002b48a5c", "comment": "Malware payload (Smoke Loader)", "value": "9b538f340f1f13fdd507dde8111d7f7680e356e8a0284b38d794933b087eb419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731459, "uuid": "c96eafa4-fdbd-4a6d-8f4e-510c9f527fc8", "comment": "Malware payload (Smoke Loader)", "value": "224ea99fc4ad05ad541338854ff33cdbec83d5f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731459, "uuid": "eccccd11-4823-4732-9130-453749ce557f", "comment": "Malware payload (Smoke Loader)", "value": "5bf78be3500a39227c7bec4716d55cb318109339d3006d9aba835e405d0df44be52f48d103fc73cdf82fd7f227e41d5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731459, "uuid": "b4cf7e65-25d1-4171-b23c-028cb2920fe3", "value": "T121644A4392E1BD40ED268B72DE1EC7EC7A4EFA408E7977652219AEDF14B10B6C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731459, "uuid": "ec9610df-3f66-41a0-b2d2-eb907b77c9e4", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731459, "uuid": "1e26acff-42a4-422e-8384-1154ad1d6622", "value": "3072:U7b6bwgNLCbSRmQMr39rTIVZ7jQr2VjB86SAUVMauhOrQuQjiMTE5i96Pha5hN:0zgNLCbhhL6VZP3VdXUVsh9uQj9T2aL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675731459, "uuid": "4000c06c-c670-4da4-8239-fcd978c2cb0d", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675731459, "uuid": "06314b09-32f4-46f3-8bda-49301a5e58f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731459, "uuid": "3388b8af-2ffe-4523-965c-bb4c419ee416", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a64f7f2-a700-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675785493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785493, "uuid": "d4b4f5f6-613d-40be-8089-286e942e07e5", "comment": "Malware payload (Vidar)", "value": "0b622eb410bfb32c5fa7b45eb3c116d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785493, "uuid": "1abb1d70-0d27-4185-b385-4aa21457cf9f", "comment": "Malware payload (Vidar)", "value": "9b7b45434353b99f97d33f44e225e71b9c164cd21ae56335c078cca20ae29c1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785493, "uuid": "88aceef8-de74-4fd4-b466-6ba3a5868c36", "comment": "Malware payload (Vidar)", "value": "606d111174079e4d784e95f285805f14116e6d63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785493, "uuid": "ebca479a-aaa0-4195-80fa-f79122359dda", "comment": "Malware payload (Vidar)", "value": "229a9f4d082707758106767fe3ef1acdf6f3098c160fc7bf8a73a2e89b61169f314b67c7e908be94f0c73bf8b58ec104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785493, "uuid": "82dac8f0-8bb9-4d7e-9510-740cac40d273", "value": "T187949E4393E1BD40EA268B72DE1FC6E8BA4DF5948FBD77753218AA9F14B0072D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785493, "uuid": "3b8d22e2-2af4-49f9-b6e6-0f1dd9aa251b", "value": "362b00b7c7bfeb7a79c15e736bbb9859", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785493, "uuid": "e4437095-d7e1-4f69-8cfd-b7fb809befd4", "value": "6144:CY4YL2UoScaKQBaPFc7rBty0MKpjZ49xAhbPuQj9Eah:CnYC5ZwOe7rBSKpjZGxIPljK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675785493, "uuid": "befefe22-1f98-40cc-a7a7-4d455bf306ed", "value": 432640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675785493, "uuid": "ad22b2c1-9f73-4391-b921-48d24bba47ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785493, "uuid": "bfd953f4-1ea3-4731-b35e-1f436e9ca26c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7913278c-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757252, "uuid": "78edba69-2bd5-4500-9d29-c7685cc20322", "comment": "Malware payload (Gozi)", "value": "44b177b19558678908e630d8b8417a42", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757252, "uuid": "204dd65f-9e06-489b-acba-557bfabe03ff", "comment": "Malware payload (Gozi)", "value": "9c0e1d6757b3d880418d1aacaebde1afa1412c3b180113343dd106726635da42", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757252, "uuid": "7c3977da-4d8f-4fac-8d61-7c7a0928f72e", "comment": "Malware payload (Gozi)", "value": "29a8811b5c4ccb565c1064030ffcd9ca0937a938", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757252, "uuid": "d8f87090-f3e2-4c4a-aebc-63331f756966", "comment": "Malware payload (Gozi)", "value": "e05f43d197ade37767757d61a0d147956166b304be1dbe6a0e10418eaf1beb1ee253d7c46f9edc57f84c2461c7cf91f0", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757252, "uuid": "45ad7f1b-5ba4-4b5e-a9ea-afe90379c9a8", "value": "T1DDE18D8E9DDF541BA78182EFF2733C20FBA0597EC9292204B5F2E70E6B62727014125C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757252, "uuid": "a826c9a4-e4d1-4b5f-afa6-7f801969c17d", "value": "96:wY7LVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dh96rK9B:nU77rIKdn863jMM0OD9+VVF4nx4kuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757252, "uuid": "d84dcc8e-56a4-41c8-859e-20d9e5f90bf1", "value": 6993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757252, "uuid": "75a06cda-7c39-41fb-8def-4203eedd7aee", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757252, "uuid": "5af481fa-883e-42a5-a59d-614e8ecbb887", "value": "azienda_06.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3bd7af-a6b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675753447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753447, "uuid": "6fd51e0d-b382-4ca0-bb73-0fbb533183c2", "comment": "Malware payload (RedLineStealer)", "value": "7cde6e0b0f060f069881ffb77c25f1de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753447, "uuid": "22a8dd84-793f-4e4e-92ee-d6e652146a4e", "comment": "Malware payload (RedLineStealer)", "value": "9ca1be0ab1b3f510944bb3c8a9f37be3819db136b823c5a479e57f161db20b5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753447, "uuid": "a8ce6ce3-9e2b-4531-acc9-df1feb3cf038", "comment": "Malware payload (RedLineStealer)", "value": "5a040d826765d8a0e884d4cf16c83ef4553d4268", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753447, "uuid": "1784e154-c178-40df-a4a4-54e14e51b01d", "comment": "Malware payload (RedLineStealer)", "value": "460e21827f5104b830344ccff84b33a11b890cd8e8e6862e953e07659ee3394720b46bc6ed98b9835d7e653b140acf0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753447, "uuid": "2f552823-7362-4082-899a-a533acdbb2a5", "value": "T17DB40247B6EC8262E8B527B019F606D306367E606B78874F225F2D5A0C72260FA31777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753447, "uuid": "9dc7c07c-ee5b-464f-b07f-91d56e3364aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753447, "uuid": "f9f0b97b-1082-4f50-a10f-c2cbf272499c", "value": "12288:0MrKy90X5HIJt7lOB+X17jAQqj7aLhcGUn/fK/QM:WyIpIJtROB+FvAQGa+na/QM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675753447, "uuid": "aaf8f4ae-ed1e-40d8-b185-4b4b5a02fbdb", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675753447, "uuid": "bf34fc37-97db-4e8d-9d3a-aca8d887df5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753447, "uuid": "a47d899b-61a7-4269-a5f2-c9e18683c625", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15740d4-a6b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675754742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754742, "uuid": "aaface89-d4a7-45ad-ac41-999babfb0a88", "comment": "Malware payload (Gozi)", "value": "34fe297ae7f34d3062cb6adb5363970a", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754742, "uuid": "46cfcd2f-f9e4-4084-8cf9-413bd617298d", "comment": "Malware payload (Gozi)", "value": "9cc3318cdf29c5b6a1c170facbd0e7849b674ecd2072d9741424709e0931f8cf", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754742, "uuid": "9d9255ee-5878-4cf4-a00e-a74a4e75dd73", "comment": "Malware payload (Gozi)", "value": "ab2c8edc316e5e55ce258bcc6f165ec9b7e92e28", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754742, "uuid": "456896c8-2387-45ce-8201-811de2c247ca", "comment": "Malware payload (Gozi)", "value": "9a56037963e96b297383393efe32769ac3e9387042ccbecc7e0f6e4173ec70a7b97d6d95a288ff6660e63c428e26f617", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754742, "uuid": "0d1d3a9d-7817-4da7-821a-bd65fe016445", "value": "T15FD450AAB9E5FF19C8778478D960F365D02A7C314246484AF3CB36117EB13EC6D42E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754742, "uuid": "b5df8f5c-93a2-4ab0-9fce-66b6ac361141", "value": "91d84abb2a106c8482be2981cbb80ded", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754742, "uuid": "972a6cc9-3edb-4af6-a030-514b52555765", "value": "6144:pYQoxugZKqxvBWqg+wyJzYH7nQYorovRQWDRSpPUeinhnBeY:kYqdBWOvNgorDWUUeinhnBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675754742, "uuid": "229b3780-fb94-480a-9c72-fa1e30f22f34", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675754742, "uuid": "024b66ad-d90d-4820-bb4d-8f6566d9f39a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754742, "uuid": "6890b8ef-efb9-4faa-905d-aa8d54e422e9", "value": "login.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d7aa1fa-a6f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675779593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779593, "uuid": "24e5360e-0f50-4da8-bc32-761fdca9766c", "comment": "Malware payload (Quakbot)", "value": "b316d485fd16aceca470c36e55540133", "object_relation": "md5", "Tag": [ { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779593, "uuid": "946ed477-1fed-4621-a07f-fe25473f1ffa", "comment": "Malware payload (Quakbot)", "value": "9cd900111f019f32112eba2c1ce1ecd9345d05f5d9a8a617c4a609d77cf2f95b", "object_relation": "sha256", "Tag": [ { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779593, "uuid": "090348df-a598-41a0-b18e-782f7b2d2a9e", "comment": "Malware payload (Quakbot)", "value": "9266ced16696c10983b7252a2a1a53f6d5c9efbe", "object_relation": "sha1", "Tag": [ { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779593, "uuid": "d7f2b659-6223-430f-9a43-829b46c23274", "comment": "Malware payload (Quakbot)", "value": "0658f1d74ca0d4002a237f6c39c1cab50e2e0fea16d33aa3bc86d026a47ecf7961ea0a34f55a49171f796c70a15e9564", "object_relation": "sha3-384", "Tag": [ { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779593, "uuid": "34b805f5-ce4b-4569-97b1-94fc0499ccee", "value": "T109B3D026B191864ADB29413A09E77FB4B373BE029591571FDFB62E1C4DF0284CCA468F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779593, "uuid": "770d9d3f-1ca2-4b00-8589-8a44c9c803e2", "value": "3072:RgS2EJbyYeMYkKkyX3DWvLLATir569RgSwfg:QhjZrHDgQkFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675779593, "uuid": "7f2fd69c-11e3-4232-aed7-ec0a9c55f7e0", "value": 116904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675779593, "uuid": "953c37f9-bdc0-4fe6-a477-7ae2d7c9ce8a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779593, "uuid": "d966af62-aecb-4a6a-a64b-a61f8d988c08", "value": "Item.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67542786-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675758511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758511, "uuid": "5c9a27a5-7b1b-4051-b8f3-3949db979f35", "comment": "Malware payload", "value": "b0fc22f60b9f840805b08d6c56199741", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758511, "uuid": "3d2f5b1a-c628-4e7a-a2f9-72cdae8e9344", "comment": "Malware payload", "value": "9d5fcbecd88af08eb9437ace362ef250f2d94e501c2bddf0ef14a8c2f00dd858", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758511, "uuid": "4e87e7e2-3df8-4371-9f9e-28494581d5d9", "comment": "Malware payload", "value": "b79c02bc94d4e593b7bbf4307ed2c5d1183973b9", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758511, "uuid": "23b189d3-98e6-4632-b5c6-bd86596aa27c", "comment": "Malware payload", "value": "47aee4ba391ed3275656f1ae7c4b5e0c7b3f9f4d8d4bc040ce561062dfd2573ed6c091513c133aa48d56099702ff262e", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758511, "uuid": "4d888f5b-7367-4a40-a249-0600f8863db4", "value": "T14AE50901FB99C60BE9BB4B3058BA47912B36FD029B75471F52493A3C2FB3AB09D10765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758511, "uuid": "ab5b4a05-aed6-482f-9261-96626530a293", "value": "49152:+JBC0ossYpcyDlij31RJrEOgtl+IgMMDzTXwrXWfy6+cpTqqVFW5IOBUHiaPZjIF:yCShppDC/Qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758511, "uuid": "36325fbb-289b-479a-8fc4-9e15b36870aa", "value": 3253760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758511, "uuid": "0d1e7408-4643-4add-920a-16a526abf06a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758511, "uuid": "bd9a0971-f723-4603-b6ee-a2722ea977a4", "value": "PBD 4 ZAMRUD AKHIR TAHUN 2023 (2).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b972af58-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758648, "uuid": "8521715e-0464-4e00-a483-ec3b231d7d80", "comment": "Malware payload (Gozi)", "value": "c874e93c6a73f5cdf4479334de63fa3e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758648, "uuid": "b0ec845b-5c1c-4575-bc88-9603df5f67f3", "comment": "Malware payload (Gozi)", "value": "9d87104c40a15c6a37a8eb46f760d1f1805b2e5cc38c7e9bd44f466fa3b8e391", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758648, "uuid": "6c7e5525-25ba-4cd0-a91d-12ae32e01001", "comment": "Malware payload (Gozi)", "value": "cb1baf45349d4835060a046a38efae622dc1c253", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758648, "uuid": "d89839b7-500b-456b-8ff0-fb80a4ac9268", "comment": "Malware payload (Gozi)", "value": "297f3f19b7075dfa31a33e6251575165a078edd7f4c34ae5710845764587f47ca2715f5e9eb3358c64f607bd5ca8f0db", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758648, "uuid": "fd407446-9294-43e1-84a5-0929a8e39f36", "value": "T122A18E5F030B0948DAA099567DBE4A1C878BB4F748627E4ABAE4FE0E7DB6555B000843", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758648, "uuid": "48f3997c-884c-46ab-9cd7-c5d3929b1e13", "value": "96:Bv5ngrGbTEJf7WX9B9kNGBLNVKmSOeOBFl4IO57tqlURiIW:BvNgrKqs79jBZg/XQ+IO5UlUkIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758648, "uuid": "f05edf4b-fc8d-41e3-a800-918dbcb8218f", "value": 5080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758648, "uuid": "30afe9e0-9278-4377-b618-3adfc752ee1d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758648, "uuid": "8d50e469-4d38-41e9-b0f0-226df47922c7", "value": "azienda_23.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11175b5a-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675783277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783277, "uuid": "f5635698-8917-4d36-b582-3409073feb48", "comment": "Malware payload (AgentTesla)", "value": "20c9a9ac84644f8ba67da36960ae4a9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783277, "uuid": "10e38b3a-6d25-4de4-b99f-ea591e4fcaea", "comment": "Malware payload (AgentTesla)", "value": "9d8720d03350b0737e0a315bdf24d79a1344d87c1027a7f01b9971a3e000d01c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783277, "uuid": "502923bd-1268-4521-ac0e-b2b6ff30d36a", "comment": "Malware payload (AgentTesla)", "value": "e261b7fb60e76fb2d08e9d14f679b83aad5123a3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783277, "uuid": "79d61988-c784-4318-97a3-6c1dd8778e41", "comment": "Malware payload (AgentTesla)", "value": "a52a421d390afa2e1b6b13bcc00cdc860c94c40b06fb6fb58722b92f0a1f1ed0c47f402350ea9364919ee1504a369a85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783277, "uuid": "595fdc70-54d2-41d1-8cd7-d6027786ab2a", "value": "T15AF4224113A9D620CCBD99B6FB39A5D4433C63126466D76C0BFC61CEC9B0721EAA031F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783277, "uuid": "13d3a368-6db9-4f91-ba81-d89fdac2227e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783277, "uuid": "11e09c74-1140-433d-86c7-ddb8c6180ab7", "value": "12288:Bpk+PAZcXnyXx6q16ahRZ5GryyLm8fxyhqIZywxR3s0MaImkh+/k8glHy5QOa:jAZ1NMS5Grvm1qIZycR3TMih8RlnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783277, "uuid": "1c3b9ccf-73f0-4986-a182-f43ab16e4daf", "value": 793600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783277, "uuid": "5797028b-565d-4652-8ccf-28cbdf5447f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783277, "uuid": "433d0161-bc55-4812-989b-ae1fed2c5503", "value": "PO W003126.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c1aacd0-a73e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675812286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812286, "uuid": "58145a1e-e6f3-443c-8274-1053540497a5", "comment": "Malware payload", "value": "4c074fd2dc2db09e1371de82de0adc71", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812286, "uuid": "4741a268-efd0-4f9a-a746-385200c92b54", "comment": "Malware payload", "value": "9f0c37ff84dd327ff0582104c59478dfc3ac20f7ae5e3c531be5e636f3fea629", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812286, "uuid": "2ee9d267-a5d1-4f40-a66d-6dfeb7b13aed", "comment": "Malware payload", "value": "dd8a41d93b7f9203210d2210c659a7f7553b6a95", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812286, "uuid": "db01b61e-0900-4063-9231-b5196180bc31", "comment": "Malware payload", "value": "e5a8e4147cb5dca772e946c6a1ad3d7f66a3049840bed4529c24bd8001b5a288999c49f7d76926bcf56153d6a4bbc707", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812286, "uuid": "4fb18a43-cc5c-4290-b456-353852622dbf", "value": "T115C0C0A3F9C338C4D45379A4D22EE6D01161EC84344888B3E389C00F48C251A75CEF0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812286, "uuid": "9cb3eae6-7526-45a6-bb6f-776f04fbda9e", "value": "3:2EKDDcGSJJFsLTzTH3x8J3k4vVTrO6rNKMJAFm7zBJyGCEIYXu59zBJyGcmXnfar:0g9YzLh8JnN+6rNKMdXSGHPu5JSGcmXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675812286, "uuid": "5bdcc445-86d1-42c0-bad1-3de022b19d4a", "value": 185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675812286, "uuid": "d0c12c2b-aade-4726-b30a-25d79a358fab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812286, "uuid": "bd47a634-2cd4-4491-9f77-49f56a404977", "value": "in.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a197703c-a688-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675734127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734127, "uuid": "69904159-b02c-47e4-81d5-290dda759103", "comment": "Malware payload", "value": "252dce28cead6f65eda67869eda6c221", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734127, "uuid": "2f9dc8c0-3b1f-4641-b022-59f5d861ccf2", "comment": "Malware payload", "value": "9f236e3b2f3a95af60bf5ffea2a532de08ae0c17c80f450ae5b5f0bdc800830d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734127, "uuid": "84c8cea4-8ba1-45ee-8c55-31df37e49805", "comment": "Malware payload", "value": "faa68532b5b1947ddd22e1a70319d612c8e02d9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734127, "uuid": "f89c6500-9487-48d4-b5fa-7c94d3b6821f", "comment": "Malware payload", "value": "4e7e93d6c1ceeead5dd454f8f456dca6ca756da1b20a4d1cd38767c1bc904388a46617c8335694326b186b30c1f9b839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734127, "uuid": "5d301e44-e114-473f-a72b-614b291f871c", "value": "T14F76330036E088F9EB06483788178F63A35FE605BF7A559367FA5394E837794DD92382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734127, "uuid": "d0707e64-03b5-4689-8932-1e0b391b5dc5", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734127, "uuid": "4b951af5-8d0b-4d3b-b730-0887c881cf77", "value": "196608:91OHwcbmqSAtQv7GkKPZGbXqVq/ENoXkOwrVTxl:3OQcyqSA6vwhGrquyoXYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675734127, "uuid": "b377412a-b77d-401d-aa3a-f57054dffe3d", "value": 7589583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675734127, "uuid": "5e82283f-ca6d-4426-8fb0-a86e02420599", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734127, "uuid": "3d0b88e1-7932-492b-971a-20c8a5ce4418", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b604fc3b-a71c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675797727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797727, "uuid": "3fb6c535-719b-498b-b0bc-a4c903b7c746", "comment": "Malware payload (RedLineStealer)", "value": "e3fdc576e0dd0cf9044e26c287caa367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797727, "uuid": "c06d838c-6315-494c-88d5-95cc5296169f", "comment": "Malware payload (RedLineStealer)", "value": "9f431354af0eb47b70e6b30df50f89d78b0c290f0dc4d93a174bd625027b0937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797727, "uuid": "2630246f-0dd5-4c6e-885a-5341bb0ad40a", "comment": "Malware payload (RedLineStealer)", "value": "654e57e83ed214bbb49788c5ad39b1a7d0c5055c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797727, "uuid": "df90f6c2-d760-445f-b07e-3797b683d2f6", "comment": "Malware payload (RedLineStealer)", "value": "8541251b664698298dcf313df177b06e9d620689ef4fa5cf6b3f8089e69213d3d220281c74ebbd5966e4f1fd18d6968f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797727, "uuid": "f229a23b-f0e9-4b29-a87b-e8e1ea7ff42d", "value": "T1E6B4020BB7EC8066D9B55BB00DF603C31637BDA1AB345397234B6D5A1872A74A63073B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797727, "uuid": "3a259c39-aa9a-43cf-ac9e-961fb9ebbc7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797727, "uuid": "ff3953f2-2459-4bc2-8049-c7887e7ca4f6", "value": "6144:Kwy+bnr+4p0yN90QESuCFSBh/klVGdbAsUFIfDYn6EeYWPmSNVzAwtVFjVteJo1Y:YMrYy90IsrsVSUIbZYaVtzBtDs+a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675797727, "uuid": "ad7b10d9-e5f9-4afe-9132-d247d02d8c81", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675797727, "uuid": "9a8564e8-5647-4e4a-aaae-e9286275869a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797727, "uuid": "67039c96-45e5-429e-ad91-f39d60bc2d12", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c433de69-a70b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675790449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790449, "uuid": "96f24af2-69e4-4133-ac68-5d5f13e5a693", "comment": "Malware payload (Loki)", "value": "65009c747166ef405a0fea28bee94aef", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790449, "uuid": "9f3f50e0-c245-4144-ab90-e07197f72ca0", "comment": "Malware payload (Loki)", "value": "9fc3f3894d331d6d061cec04bb65b6c82b5d038de9532bd98e73c84c895e4618", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790449, "uuid": "6fb3ab78-a9aa-416c-984f-7f5250c69616", "comment": "Malware payload (Loki)", "value": "c644432ca50616f760428aa1551855932a35af29", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790449, "uuid": "5de38e3a-1fc1-4a96-b819-0e0f97a3b58a", "comment": "Malware payload (Loki)", "value": "9a752c1cafefc1c6df3ef231fd6068890f4ba328a8177f754cc5080ec636fdd2c68a1ba4cf56e81c7febf31839a493d7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790449, "uuid": "1e43dc65-f5ba-4988-ad12-82b677c9ac81", "value": "T1C04423488B072086C5F2AEF64A21CF27823D1B6D2B65131827C7D57C9CBBAC95D433CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790449, "uuid": "2aecac7e-dd36-4706-afb8-b46db6888f69", "value": "6144:HQWuEr4yF8VOfMYq8SeBUDjvyoujvsd4lkLzdaOjITiV1E4NP2kL:wWuEkR3s1BU7ujvtQhaOU2njNPTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675790449, "uuid": "0d5f38f5-147c-413a-a3aa-d1f6bda64f63", "value": 265787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675790449, "uuid": "5a28e62a-28ff-457e-8723-97ef30b10387", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790449, "uuid": "6a68cd01-3d4e-4bc5-b9b5-ed0b9b1a19f5", "value": "Hsbc payments_Pdf.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e083cd9f-a716-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675795221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795221, "uuid": "e8e1d64e-46f9-4e26-9a3c-922ec23ba658", "comment": "Malware payload", "value": "82e0a3219cc0da8b25a741f04aaf608c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795221, "uuid": "ccfee76b-8978-4e9d-97a1-fe057513d267", "comment": "Malware payload", "value": "9fd403dd52142b2d611ca793ed0b8c44079b120a3fbc49848470421ba26e25b9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795221, "uuid": "76a11526-94e4-46e7-885a-c2ade151b4ff", "comment": "Malware payload", "value": "209bd3598e1b6c0748054b02128a978a84f9c9f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795221, "uuid": "f4c688b1-7581-447b-bd12-72600ceaedbd", "comment": "Malware payload", "value": "212d399ce0a0f4a0bccd9dfcbc5fa88fb4ade78cbdf898587865f7927961fd1c531e7019a2c0f80fa6b900af184778ab", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795221, "uuid": "3dfbf8d0-a8d0-4be8-a8e4-0edf76348888", "value": "T145A3C31126008436F31D0B386A56FAE049ADAD3D19E4F04FFA7C7E7A59321939A7724F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795221, "uuid": "de1db8d2-8950-4cfe-9a0d-ad0f8d713792", "value": "eee235c6a48d6478e73fb0b3acd00596", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795221, "uuid": "caa7c4ba-c5eb-4b5a-9158-a4e00cfc5be6", "value": "768:Y5R2DL+h0V8cBQVqAhiUhk6A010oMR3KviJlZU9qZU9TBHMTmPaTxvuQ:M2PHBUhPNqRavizpUaTmPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795221, "uuid": "684e5710-2283-4d58-b51b-1ae84d53aa8a", "value": 99192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795221, "uuid": "0d13be46-8281-44bb-80f9-7d3155fecead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795221, "uuid": "646d43f1-8eac-452b-9ee9-007342308d5c", "value": "SecuriteInfo.com.PUA.Tool.Winelevate.9.10825.24837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9075ff32-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757291, "uuid": "2fb625a4-2517-44f3-a031-deaaa8ad2f64", "comment": "Malware payload (Gozi)", "value": "25e38ec8f14a359d65fa0475cc358825", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757291, "uuid": "25720b61-b66c-49d5-8139-a27e6e866625", "comment": "Malware payload (Gozi)", "value": "9fec4340b7719abd75e744a833acda6d674b0a15875803a529faf8673a2cf73e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757291, "uuid": "2abaf064-7f3b-4cea-a66f-3ce6a4f0c31c", "comment": "Malware payload (Gozi)", "value": "80020b13049d0513329ec68b68cb5fb87c2a1b4a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757291, "uuid": "7a982540-878e-4464-995b-251f1e6ee295", "comment": "Malware payload (Gozi)", "value": "e954c32b297f89c9a4363794bb9b45a88ca6fa8a05f1f2f51f128685d530eaccc9916ce135c741a9aca383c0880d30c1", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757291, "uuid": "433dd150-2a97-4ab5-8038-259865363b89", "value": "T133E19E8EADDB541BA74081EFF6333D11FBA4197EC8293104B5F6E70E6B6272B018065C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757291, "uuid": "b860489f-0d75-4a2e-9e1f-606cbf5307a9", "value": "96:wsWLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dh96rK9B:kU77rIKdn863jMM0OD9+VVF4nx4kuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757291, "uuid": "53dbed8c-21e4-4991-846b-9d409703bd33", "value": 7013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757291, "uuid": "4a8f3d87-036e-4876-91f8-9a1fc64cbfeb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757291, "uuid": "5e91e887-931c-41f7-a737-b34a0392474a", "value": "azienda_10.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acaf136-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (Glupteba)", "timestamp": 1675788232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788232, "uuid": "5bf74e88-09e2-481c-aac2-bea4eb8b9db4", "comment": "Malware payload (Glupteba)", "value": "030e4d9f85af50a40fb931ed1f33d8dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788232, "uuid": "8852e750-1a73-4885-859e-10b76940a2a4", "comment": "Malware payload (Glupteba)", "value": "9fef942a89db70d1bfb0c5c9efb6e7c4c4e180b0038e61df58936e794a6323dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788232, "uuid": "e42ee1d7-04d9-4126-8199-67192a50e411", "comment": "Malware payload (Glupteba)", "value": "b0c7f33e2b78c8f02f2e66c0c4cf6c728fc68b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788232, "uuid": "bf7ef2f5-857b-4f31-9f6b-dc6e61726b52", "comment": "Malware payload (Glupteba)", "value": "3515464bd3a309264a83b366e7745acee99e1334761a50a3cea80279dd1370e771bf65b16d39e2f4a593a3121e4a17be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788232, "uuid": "76c81671-37a4-4395-aa65-c9b5fc84f8f2", "value": "T1DC163342F7A0D1F7C7AC20B06741377D02A8D22B23ABE97E35602D2F55A55CA48F7369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788232, "uuid": "30b019cd-b104-46f7-bffe-3140b365a83d", "value": "ab6f9c627ad0c79047c9942afaa32bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788232, "uuid": "63c36798-bd84-4ce2-9002-97888264ae67", "value": "49152:9MNvexabSZTToojLB7UbO6dnx+03A71JWahrq2wQubFruTaBlQqbwxBHOn/4Zc6M:2Nv/SMoQO6JE03A71JNJ2DBR0xhH38b3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788232, "uuid": "5fb0b49a-39ec-4aa9-b1fd-789abe3de190", "value": 4237864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788232, "uuid": "549ae941-7b96-421c-83ff-3df7c810aeb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788232, "uuid": "1dabc55f-9e5e-4c6e-a611-e0f76c109987", "value": "9fef942a89db70d1bfb0c5c9efb6e7c4c4e180b0038e61df58936e794a6323dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bccf2e82-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757366, "uuid": "de079861-9aed-498e-a7ab-5ff028181623", "comment": "Malware payload (Gozi)", "value": "b026be0a60ad580af96acd394305d89d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757366, "uuid": "1372e989-2149-4c8d-b21b-de86d15f93e3", "comment": "Malware payload (Gozi)", "value": "a068a7a34d62f1b77d9c2b65199286cee6d325257a8a13789bcc8848e0308660", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757366, "uuid": "53915007-c8a4-471e-8d32-455d9a77c597", "comment": "Malware payload (Gozi)", "value": "61c41327d1e64d8d491449c522ec8fd744b55786", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757366, "uuid": "f684b350-7304-4e68-b1d0-e57c6436026a", "comment": "Malware payload (Gozi)", "value": "bfc0f4fd7b6b0adcd9a3dfa88986b199279d54fd6357e87799e71d0c5afe47d8f4bbf5bd68bc1b2c3bb79a6fdb7b075a", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757366, "uuid": "f9471199-5214-4784-bc76-151f9243bf45", "value": "T186E18D8E9DDB641BA78082EFF6333D10FBA4197FD5296204B5E1F30E6A6273B014125C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757366, "uuid": "728719ca-6fa7-4b2c-aa98-d86a6a8d1a5e", "value": "96:wyB+LVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dI96rK6:N0U77rIKdn863jMM0OD9+VVF4GxikuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757366, "uuid": "28518019-bec9-48f7-b0a7-858473f73409", "value": 6992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757366, "uuid": "69630094-236c-43a5-973d-8af7d5b741b7", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757366, "uuid": "c10043ff-774e-4450-b3ef-5a91dd6667ce", "value": "azienda_14.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "579b5975-a6f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675780389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780389, "uuid": "ea5f7854-13f9-4af2-ae87-f0706704cf2d", "comment": "Malware payload (Loki)", "value": "38e7aacad8e6cd46fc2dddfa743b223f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780389, "uuid": "67f61342-3f7e-432c-9d29-02de8130ba91", "comment": "Malware payload (Loki)", "value": "a2030b4cc31eeba0dec3265f4a30324f1825bd5c2fcff922836d7d4d8cfb085e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780389, "uuid": "d6567d21-a580-4304-a359-591d4070ff6b", "comment": "Malware payload (Loki)", "value": "e1e48d6876856ddefb800d2d9f15efee5ed64ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780389, "uuid": "2319646a-3688-467a-b077-9de56bc36b36", "comment": "Malware payload (Loki)", "value": "72876c9a1c93babd8794e0a94e127f84ee54ad44c77957d0724241f3e9d16e871bfac48236efa00a984f00e12923f1a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780389, "uuid": "284f06f3-7594-4163-bf44-f8e2405f0fe8", "value": "T152B4923E297B56E2C578F93986E18420F5AD93923303C999DDDA2BC0CF026867DCE55C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780389, "uuid": "3c71fddd-b652-4a50-82c8-d14744df4aa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780389, "uuid": "df933b84-821a-435f-ae0e-ee451f4c37b4", "value": "12288:V6LPDcQVElDne7f4WYMTyPdLX2tuCAe/ZX55x8qdAZBWf5i7qAO4Nxbe+FiFF6:Vgc0y7MTyPdLX2tuCAe/ZXxL+rOkbe+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780389, "uuid": "c1037c05-858a-4d24-8b80-85ab71a67ecc", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780389, "uuid": "8dc295af-f1c8-4262-b6da-1c9602c2f260", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780389, "uuid": "72e88c8f-2fd1-485b-9cc1-9653f8b6c041", "value": "TRANSFERENCIA R\u00c1PIDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbbae329-a688-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675734171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734171, "uuid": "c62652fe-dee0-48b5-929c-871d37d4c300", "comment": "Malware payload (Amadey)", "value": "4a583d6fc139cd933fc5756f5934466d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734171, "uuid": "511075dd-b31b-46c8-933a-997ecdfc8b7c", "comment": "Malware payload (Amadey)", "value": "a2235df46cd1c36aa66a4d73bc23bd94efe6b696be1532595deed7aab82b45dc", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734171, "uuid": "f55010fd-fb00-4c3e-a4e9-e9f951ace0ae", "comment": "Malware payload (Amadey)", "value": "c3367d44d65578f290cc41911e8069125efe16c9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734171, "uuid": "696d1a8f-2f7b-4c05-be22-27cff37c050a", "comment": "Malware payload (Amadey)", "value": "698e5bacc3a1d4443f7b0a58106edf9476770b6c7fdf4db05a87aed54559c3a4858cebd68c6d3f5be3923c7373fd1e83", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734171, "uuid": "b5858737-eac1-46f8-aa2a-0ec3b7943ba6", "value": "T195C40207E7DD8032E87453705DF603D30639BE916B748397728E996A09B36B0B23536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734171, "uuid": "13219f95-d023-449c-8d45-c6e6805c61fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734171, "uuid": "6f71b52d-c594-4bd6-ae68-8229f3aafdd2", "value": "12288:gMrPy90FA3sKtviLNNnd+RZhbegCm7sOkXLqDUb:/ywA8KFIXA7R/Cm7sOqLs8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675734171, "uuid": "af9d231f-81d0-45b8-a6e4-b44c34950952", "value": 571904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675734171, "uuid": "7933cb09-3d1d-4e91-b3cf-52c77cd1075b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734171, "uuid": "f4ab75d4-2e62-4b3f-baf5-72b7561bc748", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caab7a57-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758677, "uuid": "03d7291e-8258-41e7-8f56-2aa72fb35a16", "comment": "Malware payload (Gozi)", "value": "64a4e29f24ece363b4c1f29c465cd15b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758677, "uuid": "81b187f4-fd91-4c27-bd8b-a96f7e48f7c9", "comment": "Malware payload (Gozi)", "value": "a26d98cb5bbca932c7fe3e544ba76b2121c82628486cb8215b8d199c23499d90", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758677, "uuid": "31bbdda5-1259-46e1-b81b-c57e152cc90a", "comment": "Malware payload (Gozi)", "value": "84e7a00e73abafa81f06fcfd40f0fd0737027730", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758677, "uuid": "fd1a9d65-ee69-4c76-9396-835c625e6137", "comment": "Malware payload (Gozi)", "value": "1cc55eed0ae7fd0ad3212e9f0d87ad8645fe909c38b581daf30efe5126d1d7e7f0f592bd61f5a57fdaa5edb1bf0e7df5", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758677, "uuid": "e154d352-9f6a-4e70-a77f-144de1ac8243", "value": "T122B17D5D7C6C1ECD16925B1C8EDFDAAE0009B5A89805879AD71F330BA9A0A236440E3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758677, "uuid": "14fa17fd-7315-4529-aa7d-b254e578237c", "value": "96:wdijzKPPKiePT/C9MmIZOy9P3NJDwqtYlVzw5qsAgsH08MdL:6ijmPibHm+9P3NJETzLgWkL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758677, "uuid": "b5dec1e4-13c0-4acd-9448-3a7fbcb73ef0", "value": 5095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758677, "uuid": "d2358a01-45af-45ca-8edf-badec9a1b943", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758677, "uuid": "cd7b57a8-c68d-42d0-818f-e716d35e250d", "value": "azienda_28.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acebfaf-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675796232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796232, "uuid": "60659a9d-004b-46e1-b42f-271f39d60273", "comment": "Malware payload (Rhadamanthys)", "value": "38e67b1288479162d6bc93ee31a90564", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796232, "uuid": "064b01ee-af0d-4257-bb1d-238502d66940", "comment": "Malware payload (Rhadamanthys)", "value": "a2ae21d0e3746dd06ac2b1c69517df60e3998d4d3db47d655b1c01504bba21aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796232, "uuid": "aed7efde-818c-42a8-9466-73b8c2c4c268", "comment": "Malware payload (Rhadamanthys)", "value": "3457ae59ac2fdcf4b2013b4245ebebfd22841196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796232, "uuid": "e749b963-890e-4e82-89e4-67eac215fce6", "comment": "Malware payload (Rhadamanthys)", "value": "12ec2a246b8cd2b5d74d7f303a87af01d95f483ea9112f9004d90a9a4130a2ed338ff9f5bc1e07259d8519024febf902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796232, "uuid": "e07031a5-3781-40a1-8bf7-ab17340328fa", "value": "T15E44E1333AE0C4B3C5AB21346820DAA56BBFB8315578894B7BA4C7ED9F302D15732756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796232, "uuid": "5ff4b2c3-29c4-4e73-ae5a-b170f756b98f", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796232, "uuid": "de373942-905a-45a0-b8a9-ba368772103b", "value": "3072:LRvnO9N2bPgOyL/dnBYWZf354wHGXobm/JRO0LDl8ABIx8VM6Q3DTNJ3nJWPfo3:1vnptyLFBYkmXF/DHFJw8VM93DDEPfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796232, "uuid": "7fd26045-a789-48af-abd7-b211c0dc1ec6", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796232, "uuid": "274d3e5e-3bcd-4838-b018-3914750bb63f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796232, "uuid": "820691d2-5669-4752-9fce-6e023552c326", "value": "38e67b1288479162d6bc93ee31a90564.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850fcf46-a72d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675804946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804946, "uuid": "0501e09c-9928-40be-9f9e-e26c857a9703", "comment": "Malware payload", "value": "7b496ed05993dc9e0510941660f450b1", "object_relation": "md5", "Tag": [ { "name": "1675755007", "colour": "#67AD32", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804946, "uuid": "55d48738-c997-43ac-be80-c44a339556cd", "comment": "Malware payload", "value": "a2d81d7963debab5291457fba18e7e46d716c1271e32b5b5125441bed3d5573d", "object_relation": "sha256", "Tag": [ { "name": "1675755007", "colour": "#67AD32", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804946, "uuid": "0f5b23b9-a065-4846-9a71-08c432633d99", "comment": "Malware payload", "value": "1d05d4a1d54d9db7e0636d2462a2ad4f6136e57d", "object_relation": "sha1", "Tag": [ { "name": "1675755007", "colour": "#67AD32", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675804946, "uuid": "899cb5fd-4762-4ca2-8f3f-11028c79d680", "comment": "Malware payload", "value": "e5dc740b34d07738c598de992f3c22d976777aa9ad38ee507e23d0fabd580179f2c05705ac0d89f046ac7fe6f90dce0a", "object_relation": "sha3-384", "Tag": [ { "name": "1675755007", "colour": "#67AD32", "exportable": true, "hide_tag": false }, { "name": "BB14", "colour": "#673138", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804946, "uuid": "e8d3e4bb-ca60-4a37-8ccb-066abb8ff407", "value": "T13AE0C060110A4B9C34B010A9498ED986B750565F23E913EFFBC6964BC8C024730B9384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804946, "uuid": "ad06ae43-bdde-4840-8fe7-620422d0c9ed", "value": "6:sKHLgyKBM34HR1KCsu2xKthIYWNgvBSAP/7XfkfYRRjpm+Rs3FEY9hMS/aXXrZ/I:ssLgyaI4HPKC2EwgvBS2/7Xjj4+RIFEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675804946, "uuid": "13ae6177-22f8-47a2-8850-93b5bd9a32d2", "value": 372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675804946, "uuid": "c8e77ed0-82d6-41ea-bc1a-027d3a190e29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675804946, "uuid": "deafbff9-9bb3-41b6-b36c-2485440f2838", "value": "Open.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42873a13-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675789373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789373, "uuid": "2c1adbd3-f70d-488a-86b8-9e698850371e", "comment": "Malware payload", "value": "6cbe250f6a40822854e05c67f70f2615", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789373, "uuid": "fd9fcd44-ff66-4a49-92e9-d27af1dadee1", "comment": "Malware payload", "value": "a317a1912362f2a4f7b697283a0eaf9e56aafdd44370246fd4fecdaa1d52e7d9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789373, "uuid": "d4234fc4-95c8-466b-9eea-c7e990c3e8da", "comment": "Malware payload", "value": "0bde6d130c43a4d13ec4ddf09a6cc079a55ac0f5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789373, "uuid": "c796e73c-b545-4a66-8f0d-04bd16f240e4", "comment": "Malware payload", "value": "6555276387906d614258165f9e7d37cc58e14a7c8a818cf1d1d8170c4bbbcc94c0f422297137213507f736bd5bada90a", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789373, "uuid": "149e80c9-deb0-40a0-8a1b-43b0f35939ba", "value": "T1EE45F11BE632EE2AEC2BC53DD85E158281159C757829C64DA0C3B31E57336F109BFE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789373, "uuid": "5963d4df-a6b0-4f8d-9715-3a6b84087b79", "value": "24576:aMeoKgKxGVS3hFec4FzDc734GzgeB6nubgST5++Ad2:39KNfTWVc7IySupT5++A8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789373, "uuid": "834662e6-fe4b-44b0-9ce1-26991ad1af9f", "value": 1251840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789373, "uuid": "48c3dd99-d659-4d54-adc7-ae8d22f4cddb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789373, "uuid": "7be6ccbe-e6a8-4623-9df3-c4548dfcb967", "value": "Payment advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5762416f-a6a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675746028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746028, "uuid": "bd2b3909-7ac2-4b59-9926-b68155f0fdb1", "comment": "Malware payload (GCleaner)", "value": "a7fe9ef4af03dfa3a4fad9cf09d44d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746028, "uuid": "4c1ff364-0ce5-40df-8253-c2a2b0aca53b", "comment": "Malware payload (GCleaner)", "value": "a37317562db2d0aa1428a0edb61b9612d59f48da672d72c39ec7e05ef05b6bcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746028, "uuid": "5d7f7872-4e63-47bb-88b9-46a559bd9cf2", "comment": "Malware payload (GCleaner)", "value": "418a2cf2f2ce19aace971e6b707ab6672dd24011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675746028, "uuid": "08040a6d-4b3a-443a-bab1-39532a344256", "comment": "Malware payload (GCleaner)", "value": "4047a3696718a02da53297e1d1dad532897b0c0105e14a0d5e9f219c716d1691b172236c1be9e6cc14b71f41274764fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746028, "uuid": "89240fdf-6554-4819-b662-0ef065e41e42", "value": "T192C5E00A5D98D0A7D1608F70C9D76DFA9C12DE6FE8BA009317047FFAF231245A94AD39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746028, "uuid": "7163bd3f-74e4-484a-baa4-752d6913ca36", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746028, "uuid": "b37db5f8-9a66-43c6-9bb0-0ddd74b51c15", "value": "49152:wDzVJrXWv0G+dMEMP2M/Dgmud3kUt0GPIVuBtQWLCgv2MR:+Dsd+dMXP2M/Dgmudt+GPIgBqGv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675746028, "uuid": "bc123811-3b7b-414b-88f2-25c29d7610b6", "value": 2737564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675746028, "uuid": "0fb98a4c-2a0b-48bf-9954-4e60377e579c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675746028, "uuid": "6ccf2d33-62ac-4aac-9e39-6556b1e46d48", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7828fad-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675789998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789998, "uuid": "d87374cd-2ea0-420f-bbc7-d4827df71c1b", "comment": "Malware payload (Rhadamanthys)", "value": "2173293fd71b02ebb90e2099f5fd7f8c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789998, "uuid": "93c5e28d-4a42-4448-a5ca-83af4a525629", "comment": "Malware payload (Rhadamanthys)", "value": "a3b76444db87856c6f2ef326f5d1f2c22712217aa36d36bc58fa575cc3ba1bd3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789998, "uuid": "c704e057-9156-4be3-919e-2530ec5a2e7e", "comment": "Malware payload (Rhadamanthys)", "value": "09a6b465040e08223dd96dae85cd50cea28706b9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789998, "uuid": "c1d9ffa1-ead8-4789-955c-a3f377cecd40", "comment": "Malware payload (Rhadamanthys)", "value": "d17b4004e662a55b15ec9581a98dcf1f2f433ab6bdb7e1fa05243fd54a7ee0401145861b5fa56f91dcfd00c789109490", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789998, "uuid": "ad9f9be9-f640-476a-86a5-a5e60bbc6aa6", "value": "T17F85BF5C6378FC5CD01E8AB6D855EA97C01E14B53235016F48EF29FAB7A2B48C5B09CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789998, "uuid": "0ef80415-d854-4904-b2ae-73ff588c6531", "value": "7a7a9ac40cd670433b285ea5ed2b1d4d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789998, "uuid": "49c7a4ec-e29d-4e4b-9424-6c12241436b4", "value": "49152:F5V13B+RU5cmaJeDlNIcinp8iFGv7WG6fp88:vVeIcEDxin5GjWG6fT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789998, "uuid": "ef6e629c-e084-4d56-b4c4-d74c411754a4", "value": 1792544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789998, "uuid": "76d40402-047b-4d0c-803c-77e3b4ed0d0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789998, "uuid": "e877c3d0-bf86-4e66-beb7-b059eb7f83da", "value": "DHL Original Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca266cd-a734-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675808153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808153, "uuid": "097f4779-8614-406e-bdc3-d72964d3aaed", "comment": "Malware payload", "value": "27661438b7a4e35c944421e99f7de1e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808153, "uuid": "3ca6dc8a-ab86-4065-8b82-2c587ba5a0dd", "comment": "Malware payload", "value": "a3c6f34bb69b8bb88982f021ac326cf061bcf198ab75a411bc636d42385c14a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808153, "uuid": "1a674fc3-76de-414f-8eb3-b893b1343b73", "comment": "Malware payload", "value": "bfdd70c752475b35af7aeb4e921622f12d3a4999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808153, "uuid": "6a69495c-3912-4557-9cad-95bfff3ffc02", "comment": "Malware payload", "value": "4114ad9c5124a14ecf12212a716f0ca25ccb386b62f4b5720ceca64c7bf5a27ec6586f23f01344ab4fd47f3ca09ab820", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808153, "uuid": "f38cc70f-3e78-4683-863c-1427ebb9a2d0", "value": "T155C5E0195D94D067D1608F70C9CB6DFA8C16DE6FE8BA419313043FFBB632246E84A978", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808153, "uuid": "1f5b4149-a618-4ff2-9dc3-fc56cba9feda", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808153, "uuid": "4b5d67d2-df36-474e-9baa-5b37892a1581", "value": "49152:wD3Q/3xOpeC3pKL+l+4ox6KfPBKN+xom6gk1l5IwSxk88xLCgv2MR:+3Q/JeKCo47K8N9mun88dv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675808153, "uuid": "f71753f1-0a9d-42df-ad87-b5e6163fb99f", "value": 2706016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675808153, "uuid": "e7366979-08a2-4c90-a82a-305a215c02d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808153, "uuid": "ec5ce9d5-46ce-4c9b-bd0a-b506135af2b8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958ae0d6-a6b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675752146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752146, "uuid": "dc327f37-3cc2-4af7-9a47-138c50302b9c", "comment": "Malware payload (Loki)", "value": "8ed4cf27c1633d3c25e6980f5ee8d8fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752146, "uuid": "cd5a8b47-af2e-408b-9895-46f113293168", "comment": "Malware payload (Loki)", "value": "a3c7d60f19310f7dbecce1acba480a79cc7d7839aed4467bdd3eb374bfcd68eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752146, "uuid": "e3779488-cee0-4127-8361-03c98bdec3a7", "comment": "Malware payload (Loki)", "value": "10565a5953569a1657afa4873401e2d8e8940f2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752146, "uuid": "35276b8c-4e20-481c-b1d3-599175eba7b1", "comment": "Malware payload (Loki)", "value": "69f1daa96a2765908d9149076b3ce7552e6a632c3c4e37410b2b859f42133e04a0590b909c84d99fa9cf06acdec97b27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752146, "uuid": "4f48a6e1-ddec-48e1-83f0-92b83679b444", "value": "T18A74CEC0D99DFCC1F8720DF568BA5916342AEC7F94BA5D6A2912B0042873487B5BBD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752146, "uuid": "e1afcabd-5e6b-46ab-922a-f67769fe3707", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752146, "uuid": "75ba6e55-f388-40cf-9fd9-03c12f721975", "value": "6144:8Ya6O4eRhQ9sVnQxU1vg8eE9N43l6lE/Ml6yZq0Shc8PGzAZ:8Y1eRh3nWUJg8eE99l6Uq0Shc/zC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752146, "uuid": "09c8228f-094c-461a-9c9e-99d5dcec064d", "value": 352674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752146, "uuid": "8ed14640-89a2-480b-b6be-68ef354e3408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752146, "uuid": "0ab8474c-af80-448d-a00a-bb5618df888e", "value": "Shippment Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b767f0e-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675758383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758383, "uuid": "b8dea84e-e2bd-4ebf-9741-cb45555e2136", "comment": "Malware payload", "value": "9e18e0eaf1e31c604d04b5cab8ce3cc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758383, "uuid": "6b6df9b4-3558-4d64-8974-0cf10ce87807", "comment": "Malware payload", "value": "a40aee29bf2ba1c033f54a839e74d887282fb13a833a4eed3bdbea9e7a0bb1b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758383, "uuid": "2f500a34-6f18-4a77-b3b7-307c5b9a066b", "comment": "Malware payload", "value": "0ef0e2b3f182e36394a458ede83fc60a128f5d5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758383, "uuid": "5bd800c2-72b1-49ea-927c-1b48d6f77f44", "comment": "Malware payload", "value": "9b395a2c0f551489f86c0c13b1bd55dba97008f1e8a6329de8e5efe9af29ff4e0b430cdd012146ede6951463fc1b5aac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758383, "uuid": "6c7ae854-ad55-4a8a-89ab-20fd5d05a48f", "value": "T190A5331274E9C273E4756BB051FB039629363C2E1E74E33797902966CCB3A98973274B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758383, "uuid": "78f3b6d3-2628-486c-99f0-b289e440f286", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758383, "uuid": "d3712424-e18a-4a12-bbce-bcab858ca55d", "value": "49152:ykur4OiD9CaQTkHi7jqPoiLnqPuOp2rnztyKsg6:+7iD9CaQ4PNqGJrnhyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758383, "uuid": "dde26d6e-0020-4706-89e5-9b082eafde10", "value": 2187776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758383, "uuid": "08f8548f-b632-426f-9a45-2b5ba13c1a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758383, "uuid": "b572965f-66c5-44c1-9d2d-eef88810b30f", "value": "9e18e0eaf1e31c604d04b5cab8ce3cc1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bd988a-a6e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675772713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772713, "uuid": "0e899269-8d92-4de5-a66d-d7ac3ff41b86", "comment": "Malware payload (AveMariaRAT)", "value": "a28a8c381f7460d2a35f10186ca34dd6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772713, "uuid": "6e34a1f7-b9ed-4dfa-ae0f-b4632aba081d", "comment": "Malware payload (AveMariaRAT)", "value": "a43a0cacbfaf5aa649acc0d29ce25855ea92c50af2729f30c5f2ecfad376ef4d", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772713, "uuid": "af5b8f0d-6c88-4a5d-a1e6-65c8771e60f2", "comment": "Malware payload (AveMariaRAT)", "value": "0ea66a29cca600bdd91f3505884d74dd7df09d9f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772713, "uuid": "60f83af7-80aa-4bd4-afd9-afcb2b83dd43", "comment": "Malware payload (AveMariaRAT)", "value": "8c5adaea1c3aac3972072db766cf27b1dc0990c0850fe1d7f3f025b2b0ee59b24f36c321f1c0f6050bed11cdf428c114", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772713, "uuid": "6c86e1b0-a592-4b52-a410-88d99170ad29", "value": "T1E1C422101262C5D5C2A786327EB6B1777FB72DA560980F2F1312AF887DB8181C92F767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772713, "uuid": "b863305a-5b45-4701-b740-792f2c9c9af9", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772713, "uuid": "635c387a-8690-4df3-875c-ef69916b3d53", "value": "12288:0ky6tuXby71v1f+fWQ8+N8v2ocCSivrlicg3ULa+kdkP/:M6tuLM1v1f+Tt8vcKG3UGdkP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772713, "uuid": "b01d8fbd-31b4-4501-8926-28a6aa3c4dfc", "value": 573592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772713, "uuid": "2fa686b9-ed53-40eb-8992-a2e8ab84003f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772713, "uuid": "98ac70fa-e637-4961-afea-832c3ca2212d", "value": "Solicitud de Oferta 07-02-23\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943ac1db-a67e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675729810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729810, "uuid": "4d428f1f-8290-4a5a-beb9-fe12a40c151b", "comment": "Malware payload (Smoke Loader)", "value": "b842a479439da33afaf7571f90418b57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729810, "uuid": "e180e012-b150-4d36-81c4-71f18d9286b3", "comment": "Malware payload (Smoke Loader)", "value": "a43c1ed3070d931a00375a8bb6a89f6459fa156e9ff16dc5272094265b9861c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729810, "uuid": "1f103d74-0c04-4efb-ac75-fcc041bc91e9", "comment": "Malware payload (Smoke Loader)", "value": "ee7441abb41772d7541ba5764c1c3b548db165a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729810, "uuid": "8ced3f3b-3904-4f6d-9601-67342f8ab441", "comment": "Malware payload (Smoke Loader)", "value": "8f4151de026684aa278058079607d870d087ea18e470ddd4da6ec4f8383348e12a04aa55e715347edaeb820503ac4bf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729810, "uuid": "332ee2f8-e64a-45b2-b38b-714001e2c794", "value": "T15E545D4393E2BD40E9278B72DE1EE6E87A4DFA408E7E776532189EDF14B1072D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729810, "uuid": "ed59e898-4788-49a1-9187-656f71fb5f12", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729810, "uuid": "9e9ea91b-7fd9-4777-9cfc-f8d1d933ad51", "value": "3072:2Lb6brLL4dRm3RAMnw3ITLnJW8DSdeW91buQjiMTE52l0a5D:OULL4y3xPLnUF9puQj9Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675729810, "uuid": "06671ce3-785c-45a0-835c-d69660833cc6", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675729810, "uuid": "be007827-f3ce-480d-85cb-9ce850f7832a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729810, "uuid": "6d0f9324-e36e-40d5-b7e3-8a599125013b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90c716d5-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789933, "uuid": "e467656d-0e27-4148-9e40-3ee54381e76a", "comment": "Malware payload (AgentTesla)", "value": "8322eb87ebdb798f2dfd2300e831b76b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789933, "uuid": "57e57c94-9c0c-4144-9f2c-c7f69b0837b8", "comment": "Malware payload (AgentTesla)", "value": "a4a0c131bfb6011c53eb965dea3ba42f710b6aa076c6bea7efe1e40c0fda74ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789933, "uuid": "5479fc9e-d0c4-4aa3-ac84-1b6f89f58911", "comment": "Malware payload (AgentTesla)", "value": "71f6fb04a7592e8157a49e0f2c6ecd64d504ba42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789933, "uuid": "b6fd462d-2d7a-49be-a4d6-8104be4450b6", "comment": "Malware payload (AgentTesla)", "value": "9dfe47d85c8eba4057c70768dc64755b38f25f639c4a924e5d3ffc874974ea3a57b91374c94d5cd65aaa9e660951f4f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789933, "uuid": "db78407c-203a-417b-a4a5-d5d91129cc58", "value": "T10D742360A784F84BFCD242B71AB76768B9D3861C2075420B17149F9E362F2C5EB8F325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789933, "uuid": "c3951c01-dc2c-4ebf-b22e-74b79617ba17", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789933, "uuid": "d838b9fa-c911-43a2-86b1-92530ec88af5", "value": "6144:/Ya6H7KkSgiVUClRpsE0zlIEors2Np89PceEJKmkwhi+W8R4JH:/Yl7hNwUCV6zlIJrs289dEELwhinV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789933, "uuid": "4d0c9bc1-b392-4b8c-9a1b-afade0b5f45f", "value": 342623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789933, "uuid": "ac2de386-b363-41dc-91ed-bef579f777bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789933, "uuid": "a8d7f7a8-b776-4a47-9512-c323dd12c0b2", "value": "Fedex_Shipping_Notification_606350692146_Delivery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e66d77-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675761644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761644, "uuid": "eee4560e-5fcd-4a35-8144-40a4c552737e", "comment": "Malware payload (AveMariaRAT)", "value": "72a6aa16947a6b0a491cba700e6b47d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761644, "uuid": "739efd2d-dd82-4d73-b28b-a0c4acedec5c", "comment": "Malware payload (AveMariaRAT)", "value": "a4a1163ee346e765b3903a0f23d5a28c4df49872198bd79866ab6dd54e36d423", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761644, "uuid": "ea50689f-feb1-4b87-8d6c-d65e67e73433", "comment": "Malware payload (AveMariaRAT)", "value": "02b85edb22023481d08da1386db051385432c303", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761644, "uuid": "b82c8ca7-a4b9-4f2d-9d82-4ec05a4328ca", "comment": "Malware payload (AveMariaRAT)", "value": "0f79a504f93652e119c1a29a0a2f924f638b70ef37f6c999262352e61b6b0b468c863a191dbc0bf1d662874c28caf32b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761644, "uuid": "6e1588a5-b104-4f02-91e5-83532fbaa241", "value": "T13D55D60277991967F4E299F142FE602B7035DFB2930898D357A83DC9A7392F5BC32606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761644, "uuid": "46fcf63a-a83c-4247-b75f-e097987c045f", "value": "998288a19e8050ed5a88195fc11cf00c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761644, "uuid": "58d22839-a82b-47ca-aafd-557fc79e02fd", "value": "12288:GHs3k6pbTKiiEuuSl34BMtWTUagOOM7PUEUz6EZKuo0HHCCCBjsBkp:es3k6pbThoW4agOOM7UP2rj6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761644, "uuid": "a2126260-a331-46af-95df-22cfbbc72949", "value": 1356800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761644, "uuid": "e300b5c7-5386-4190-8680-09ee8f007b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761644, "uuid": "64937246-2164-42df-b791-c5216522a465", "value": "72a6aa16947a6b0a491cba700e6b47d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592b5724-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758487, "uuid": "8417922d-fef5-4247-b9df-45eb30af29cb", "comment": "Malware payload (Gozi)", "value": "b6c39f7a3f446a2fbd80f8cff1832e6a", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758487, "uuid": "16f75470-fc78-4822-b07b-abcec19e78e6", "comment": "Malware payload (Gozi)", "value": "a4e46b45a5f88993175cdc799e6736a9a144c217e8e134db16aa646f6e7ffe58", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758487, "uuid": "189eedf3-fecc-4961-9e9e-f884ff56b036", "comment": "Malware payload (Gozi)", "value": "0d8aee98fc42bd38e65d1a1e6767aa0d970aac6f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758487, "uuid": "7c119ec9-727b-4ff3-b2a6-5eaa9993c53d", "comment": "Malware payload (Gozi)", "value": "65ed6085fdbf4d9b917081391a20b86deacc7c09cb152e896b81e61ca6d454cfec1b0ed3ac01d45f54e90f9baae2bd98", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758487, "uuid": "423d0d47-76f0-4b3d-bbd1-1af00424b5c2", "value": "T191E15C4FDADB641F5B8592DBF2732C11FB5018BBD929620475E2E30E1A62B67004165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758487, "uuid": "8fcde051-4125-4756-8516-c73eb784aad2", "value": "96:wAtfLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dnr96rg:LU77rIKdn863jMM0OD9+VVF45x/CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758487, "uuid": "5a633743-2cff-4958-b760-78361cced98c", "value": 7008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758487, "uuid": "183452e3-d951-4f46-abb6-66363ffaf647", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758487, "uuid": "6cc5fdda-491d-4a2c-96bb-2c9a39c12002", "value": "azienda_40.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e7391c-a6b5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675753403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753403, "uuid": "6af4f89f-a73b-4703-b1b0-bc3409d4f106", "comment": "Malware payload", "value": "5c35c185793624b0fa3280a8d97db99d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753403, "uuid": "022030a0-9ea4-404f-8935-ad3033c8103f", "comment": "Malware payload", "value": "a55b52be8d8c6aec521cc1ce351892b26250a7e3aafa09ffc1701e0849a34cb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753403, "uuid": "cd1ffc5c-43d4-4e11-8327-878cc08c828c", "comment": "Malware payload", "value": "fcfbaa15c34003dab6b209275340e1873eba3265", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753403, "uuid": "8704f7a4-cbd6-41cb-be55-73967912e5e1", "comment": "Malware payload", "value": "d9f2c304264d3b4eb1afd04bf7a31b6343ef05384b811151cdc951acfb948878feec7b44c4f5b47ec1fe61434ca43393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753403, "uuid": "f8e5217c-fef8-4425-b399-aac5686669b1", "value": "T1487633A0BFF4D4BCF3162032AB962E4995F1F3820D725D4313A806D53B7D55AE327A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753403, "uuid": "7f392a08-20e2-43a5-ba73-6a21f8a16e1b", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753403, "uuid": "bd505a14-6028-4821-918c-1008f47f8877", "value": "196608:91Ok3paE2kmAFl+pU1LqaThZ/0C+0yAPVJ4HhjTzweQ9ikbt:3O0oEtm+IU9Zt+0lPV8vzwb9Nt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675753403, "uuid": "46b00881-8b33-4363-96f6-db21e8717597", "value": 7652595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675753403, "uuid": "cd2198d2-e805-410d-b5bc-52413cde5b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753403, "uuid": "f96e991f-9ec4-429f-bb65-84e47f76904e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "564a7c36-a67f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675730135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730135, "uuid": "1d2384f6-b598-474f-9f58-c38249ff7a99", "comment": "Malware payload (RedLineStealer)", "value": "a9d1296417d1bad42a427ee8e61d13cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730135, "uuid": "430251cd-69b8-4915-a0c7-c4d156f3cec0", "comment": "Malware payload (RedLineStealer)", "value": "a5a4482518cf1c516b66a1b57b34ed5ddc45c843114245b9cfcb8bf782ed5fdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730135, "uuid": "d81d7c3f-e829-4cfb-a937-c4550e6e94a4", "comment": "Malware payload (RedLineStealer)", "value": "85e949d98b24b0d8dd82e25bdf449ad2173eb57d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730135, "uuid": "8b4cb365-8ae8-4c0c-8ac6-2300cd20751d", "comment": "Malware payload (RedLineStealer)", "value": "f425f19acbd0a70986e8f8c0a502f8ea67aa97ce5b69982bfe6533079809a4fc7d6c419e7130bf1332bed845922b897f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730135, "uuid": "c8a3d2d6-d32f-4696-8ecc-8c0bcffc18a4", "value": "T1CD347D0052B85A15D36E0E32A43441F55EA7AD06E0F3DE594A587FC9DA33783A334BEE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730135, "uuid": "6a043c11-3d01-4350-bcb0-caea91fa7a49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730135, "uuid": "1b2e1dc8-0f4c-4ab6-8eda-e4395baa2de2", "value": "6144:zWjOHJqoDArrEsrHobRcPz5QVu9wmgu9:MOHkoErBu0D9wmgu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675730135, "uuid": "183795ed-13dd-4efa-abe3-42aad13442af", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675730135, "uuid": "e55449d3-f609-4ced-9da4-7ec644d7fc8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730135, "uuid": "56091662-a30d-4947-b3a0-78bddd022341", "value": "a9d1296417d1bad42a427ee8e61d13cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d8b79f-a735-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675808254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808254, "uuid": "44f4a2cf-80ce-41dd-8eb6-2389f5c4ce8f", "comment": "Malware payload", "value": "458f5e1a600cde06f3a9f64bf60b340c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808254, "uuid": "a73f0f7f-27a4-4593-8a76-d5165dc9e701", "comment": "Malware payload", "value": "a5d85d2378799fd6729e673fd3d186779fc8b238e5da9e21040197ce496172e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808254, "uuid": "81975fd4-ba73-4ed8-8a9c-a260fb111189", "comment": "Malware payload", "value": "0281b966e43eafb0a336e92a95629262637b2a45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675808254, "uuid": "08f301b9-48ed-4270-b88d-fce5f6a8f761", "comment": "Malware payload", "value": "69f6aaf3d7d345a795c36589aaf36f179e2a14ff0a161e1b00a5065add28cf5ed25363eb05c55e8648a9cc28d4143ba0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808254, "uuid": "605f6bd4-0d40-47fc-9b0b-3fb960a2dee1", "value": "T129B40207FBE88432E8B167705DF606D306367E511A3952DB674FAC1E18736A4B230B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808254, "uuid": "695d28aa-967e-4de0-b75c-adae3882d256", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808254, "uuid": "d923baae-6ea4-4892-8a61-d50a3c9079ea", "value": "12288:GMrmy906E6LlREDzqhenqfV3JlZd677HEm7rieb4E:8yHEUlREDu0nqfV3JlZuEKriRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675808254, "uuid": "6c4d0ccd-b416-4640-8556-a60ad200e59c", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675808254, "uuid": "90037d7f-907e-4c3e-815f-77e79ca87470", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675808254, "uuid": "99657f7e-c86e-4ba0-b2f8-a9c5c5853cb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ca0baf-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756926, "uuid": "d8687099-3633-4770-9042-728d6285d0e6", "comment": "Malware payload (SnakeKeylogger)", "value": "043b8cd7c3419e3f7be0eb941f96e2b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756926, "uuid": "a2b3d801-1371-4a03-b36a-d420d40abe1a", "comment": "Malware payload (SnakeKeylogger)", "value": "a6e558a7ee14c7f1f0ce50ce0493cac0f7fb33bdbe59cdf722423f34910d81c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756926, "uuid": "1d4bba86-cae8-4ab5-9d0e-37a04b789689", "comment": "Malware payload (SnakeKeylogger)", "value": "d329b61f5f354209f8df4ac4a07dd19d7dc6724f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756926, "uuid": "6fa512c3-2ff4-433b-8642-af83d431c8d8", "comment": "Malware payload (SnakeKeylogger)", "value": "38165f091c60a316b1d33f0ed445e5a12ac9e13bf13041fb94e5861f4aeaf33a52acf91fd61073d3a869442069db229b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756926, "uuid": "367303e6-854f-4bd6-ba66-ddbe80d55c58", "value": "T106B402808D9021A6C57E4F71D2F085BD7B417112AAB1B0BB010DFDAADE919C1FC6ED9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756926, "uuid": "89a3cc5c-478a-4beb-b40c-218cbc7b0a8b", "value": "7dc8a7abc496d99feefc72c0a0d7748c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756926, "uuid": "7e23150e-7a55-4661-a533-40affb677650", "value": "12288:2CcmFM0luMoL4Ip5iYVCZWOERUB3HDrOtW:27m20M4IpAqCZZE6B3POc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756926, "uuid": "518048f4-8ace-411f-933e-412ced7bb18b", "value": 495213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756926, "uuid": "aaaf8f28-e71c-4db7-a0a8-5d1741760660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756926, "uuid": "15d847d4-f907-42ba-8192-268282ee84b1", "value": "043b8cd7c3419e3f7be0eb941f96e2b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bde538-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758404, "uuid": "62ce2449-6eec-46c9-b0ed-c0cc3d3d821e", "comment": "Malware payload (Gozi)", "value": "6a933e21ead601f7e56b0e973fc515a2", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758404, "uuid": "983f517e-6e24-46f8-8528-565ac3632476", "comment": "Malware payload (Gozi)", "value": "a70223a402bd753f82fcf6fb85dcd2a82a1d718e6fe3ae84ca6cc956a02786c5", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758404, "uuid": "92e2df11-4965-47b2-b132-ff8d1e5873dc", "comment": "Malware payload (Gozi)", "value": "fa34e413ba6e72769b566df60710198987a37f8c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758404, "uuid": "1b732b67-b57d-4a00-b954-83d74f8eacb7", "comment": "Malware payload (Gozi)", "value": "3218cdbba64a90d2464ec3798280529fb81afc66ca9243aac2b2d997ed0bd463d029cc31af18a5ea5eee98f8f65e5060", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758404, "uuid": "440ff101-ab12-4aaa-9bdd-c9f7cb5cf50a", "value": "T102E18C8EADDB641BA78482EFF3332C20FB60197ED5293204B5E5E30E6B6272B014165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758404, "uuid": "b2aa7ec1-61f3-44f5-a78f-71125badc1c5", "value": "96:weB2uLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dV96rQ:fRU77rIKdn863jMM0OD9+VVF43xYkuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758404, "uuid": "5571479f-93dd-4229-849a-20fc6502a105", "value": 7011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758404, "uuid": "1dd83347-3089-47de-b792-6bb1ac49c57a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758404, "uuid": "85d5fe02-51fa-4f07-b68f-b6cc3542d595", "value": "azienda_25.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b494d67-a6c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675761067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761067, "uuid": "e8d636cd-59b3-4718-ab4f-deb3a3316be7", "comment": "Malware payload (GuLoader)", "value": "26145dce6fda35bca339af8f8afd7345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761067, "uuid": "f5ac1477-8b2e-4650-977c-b3b60721da3c", "comment": "Malware payload (GuLoader)", "value": "a74359d60b55e3e6e3bafabb03b0510470d0296a039547babe5a14954ab619cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761067, "uuid": "fbe53d83-1926-42fa-a96b-6e32ca305390", "comment": "Malware payload (GuLoader)", "value": "d8fcff5598eb97fc52705dca7bf0879a44d5c4da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761067, "uuid": "4c366f58-7030-4d35-88ca-b6b58f581d57", "comment": "Malware payload (GuLoader)", "value": "b8a01bc04312fcc0bb024155545dbc9ccc9205bbfe441eb074f720faa0b690eec1f334b4dc9c875ac5aaa86adf59ef84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761067, "uuid": "1df8202b-80b5-4c15-9268-450fb175884d", "value": "T1B8D46A4230809A52FC2BC97A563F655F05173FB92779023F21A473FAB7B30519E86E29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761067, "uuid": "8d31244e-d3fc-4224-b2f3-f4fa7e9e1fec", "value": "7192d3773f389d45ebac3cc67d054a8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761067, "uuid": "81723fd5-1e30-41fb-97f1-0b8dd880aa23", "value": "12288:ADGz0I+MksfaN00Y1NSmIEP7hOT9VMJ631S:10tMxfaA18ZgI9Vt31S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761067, "uuid": "25aeec6d-b3ec-4742-8bfa-17870254d64b", "value": 638724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761067, "uuid": "d5847560-6b9d-4284-adaf-be95d1a36a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761067, "uuid": "8e249c89-72db-4187-8b18-05b46e84eb3a", "value": "a74359d60b55e3e6e3bafabb03b0510470d0296a039547babe5a14954ab619cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6631fd-a6f6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675781152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781152, "uuid": "d63ac646-3add-4708-88b4-9b11e50b35e4", "comment": "Malware payload", "value": "a649c2e7efbc776df5d9810f1a59d7e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781152, "uuid": "be6507df-1d39-4441-84c2-d754d16c7b56", "comment": "Malware payload", "value": "a79a8a0fc02e826e8dc6ad7dcd3020036b3be094411b974f9f444d07d8b7c5a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781152, "uuid": "f83687b5-063a-4fcd-8747-655235b8a150", "comment": "Malware payload", "value": "ca0b4fb80ed54d5334a707fb826b5196d9e5d591", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781152, "uuid": "c614e195-6c54-4ee5-af18-76889915eb60", "comment": "Malware payload", "value": "bafab67539ecb4cb021d9ed00fdcaba64b8b20705512f852ed8b554eed4344f2fd62814c61f915fc7e18d35b60f411d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781152, "uuid": "d11ea589-470d-449a-818c-fc95b0d7d991", "value": "T10996331BF22746DCC987F174BB8106A37C3A3C7D4614A5BE83A2E6781F12F528B9D851", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781152, "uuid": "79c23644-14fd-4b75-9301-89795010b4ad", "value": "17b0697e03f7522ed78b3cafa7b4608b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781152, "uuid": "1f37986d-d45a-405f-8a9f-5a63956705c1", "value": "196608:+4D5YPTsr6IG+kzd4ersOF1l2+zYUxJIMuUFpqtYle05ZMw2t9:bD5YQWakzNzpjEUQXUF5lj63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675781152, "uuid": "fc398feb-d408-4ff0-a759-4d668c7eadc9", "value": 9141104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675781152, "uuid": "9b451df9-6f57-46c4-9ff5-b92c711f3bb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781152, "uuid": "cb7ef987-3a64-468a-a50b-8f99e7ee327b", "value": "QmWGYm2HqaT7gVV3khAweBFc4LcX7ozKSJmvd5kyf35fub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d41688-a741-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675813314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813314, "uuid": "4d7df0e5-2bd8-4d06-b8a9-6ff0726e5e33", "comment": "Malware payload", "value": "bcb4520bb9e51d6cfac3f0cbccd0c0e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813314, "uuid": "a9da8e24-1c09-489c-a93d-d9850b8b48a1", "comment": "Malware payload", "value": "a7ad36813c43eb2ce35d937c3f72a466e32ec6224bd69b14d82fc164d37ca70b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813314, "uuid": "cc905ddb-261f-4984-b95d-02f05051c2ca", "comment": "Malware payload", "value": "41e8e0047b9d5b008a5a9543d02d4092e045d00a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813314, "uuid": "61f0f936-711c-4f6d-960f-19e3adcff217", "comment": "Malware payload", "value": "8859a52fe08d5c7b131a6bc15b81c201b87f3a7c07a073f2ca660e927db8bec8de2a8092e6d4f99a521f12cdffe22c37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813314, "uuid": "8e7f5080-2912-423c-8e65-aa1f109252b8", "value": "T1507633337CF094BFD4A084768F343FE8E99686795E8088676341DC84BBF6285EC5616E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813314, "uuid": "78d86c5e-084b-4235-a88d-f0161dc575e1", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813314, "uuid": "2afaeb54-76d7-48df-a93e-2602d9065b4a", "value": "196608:91OkFuYWre1GYMJpVkJI5HVMYNFkY+RtHSfMi0+qYP:3O7je13EpVJHNGYmtGr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675813314, "uuid": "2c0e60df-a0ba-48c9-9424-dbf2eada110d", "value": 7641829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675813314, "uuid": "2e1f2a4a-95e7-4f49-a437-b99a78638514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813314, "uuid": "270af430-452d-4776-b899-37c3f395ff68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be156d95-a6e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675771971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771971, "uuid": "2352973a-2cdf-48d3-a84b-a967c9dd9592", "comment": "Malware payload (AgentTesla)", "value": "d4f15199752ed13b01d662fe0080096d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771971, "uuid": "c8723902-4494-4542-97ee-476151a5b2ef", "comment": "Malware payload (AgentTesla)", "value": "a808b2dec6bb188edaa16a54f10660276056567b3b5f83264ec98aeca4f2fd3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771971, "uuid": "9c6cd558-3861-4412-98ff-634f0ec188bc", "comment": "Malware payload (AgentTesla)", "value": "3427ab9c32ac8baea53523d368bddb6c5a1b7bdc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771971, "uuid": "ceebbecb-14b6-45b1-b2ee-954b6225e75b", "comment": "Malware payload (AgentTesla)", "value": "8db5cf698b187be1a572a4504b058c37d83e5b5ff315c82de6faabbed9512aea2804b170487a74e602e8e66b734e7910", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771971, "uuid": "60aa0d35-e7dd-45b6-948d-47aa13ed5f77", "value": "T1DC55D3D132A8484EF0BE0B75C2B31DE14B717E1799ADD64E0C8675CE20F3B419926B6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771971, "uuid": "b884b9a8-4fb1-4a8c-ade6-36dbd898e526", "value": "12288:dh4MY6W+dt+PCwNujVWsBCt9BJtr8BQ8mYEAB1G:v4lg7j1BgBJGWTABY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675771971, "uuid": "28bb3bf3-35c1-4bb9-b788-cccbedf13190", "value": 1318912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675771971, "uuid": "4a797d64-dc4d-4820-9aa6-2f0d9cd994ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771971, "uuid": "97a13eae-6cae-49b5-8af8-01dffb242e22", "value": "a808b2dec6bb188edaa16a54f10660276056567b3b5f83264ec98aeca4f2fd3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1377f6-a707-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675788504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788504, "uuid": "a895c4b3-0a23-4b05-a777-b3fe2eca065d", "comment": "Malware payload (Mirai)", "value": "975f3b6b3df2313559ff8a522b227489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788504, "uuid": "de30affa-09d4-4f56-8b6e-5307befcf6f6", "comment": "Malware payload (Mirai)", "value": "a82547b2a53d23fd2c88ede8fbd238e052ffb9581504ffc2d0e5270e96c79a62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788504, "uuid": "ff9240a8-a923-4359-aded-9f2e089f40bb", "comment": "Malware payload (Mirai)", "value": "4fce8e1b5b7e2d3061874b5d19dc0a89f8a8a112", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788504, "uuid": "1c98d290-6e47-406b-b890-8693e3844835", "comment": "Malware payload (Mirai)", "value": "53ec365158d00dc98f2ad06e39d04e639d5666a670b12e38c94c90570110524168644e44d540ff4ca90e6e9007a932ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788504, "uuid": "66c85e15-a933-4bb1-a091-6e1fe04c51e3", "value": "T1A982DF7A1F62312FD45845BEF3050EF4EA1DDE0C6BAD824DC75C9A49E2871AA60781E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788504, "uuid": "fec792b4-3231-4915-9a37-94a9331ecacb", "value": "384:MOjuoDNsGONkia2R6NXxtg+RfSQoCGJhCO70cUdkWQ:wDGbYR6NXRfLZHfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788504, "uuid": "84fe03d4-847e-49f9-8a36-666add0516fd", "value": 19060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788504, "uuid": "d84d1acb-dc71-48ad-af35-12a42ab4f6c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788504, "uuid": "83848006-0d06-4d63-9dc2-d343aa32b694", "value": "975f3b6b3df2313559ff8a522b227489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17ac0592-a6b5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675753223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753223, "uuid": "6e49edfe-4a05-4fe1-9d30-67a89fa56a9e", "comment": "Malware payload (Amadey)", "value": "2bfbbc815896cb174cc19a058b22c991", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753223, "uuid": "28713b51-d72f-4017-98e9-2c744814c98e", "comment": "Malware payload (Amadey)", "value": "a8dbb1db26f055eb04105ddcbe4c71860691eaa3bc6f72ffe364c22aa7a57c83", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753223, "uuid": "0402d97c-d121-4a03-b8f8-dfca9e99bfec", "comment": "Malware payload (Amadey)", "value": "9921b49b70a4953668edb6a408f89b51e128ed61", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753223, "uuid": "446a2b0a-a0ac-46bd-9e1f-3dd7dff07c7c", "comment": "Malware payload (Amadey)", "value": "2ed2d3d3f07116c2418e6b513b0bb597befc83fae499b8894072731dbd37d9145388de7d44164163a2fa777ecb8f3b2e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753223, "uuid": "55b761a6-527a-431a-bb03-c29990c0d400", "value": "T17814D0323AC0C033C5A721327924DBA52BAEB8315675C95FB7941FAE5F302D1663935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753223, "uuid": "132c47b8-9366-4479-8ef2-0f89d8826aa2", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753223, "uuid": "bc33eecb-4c60-440d-80d9-c18a1acdf8c3", "value": "3072:4zOOAI3WPGvLR8KZWqZMC5U2VVC3nSs8wgxEhzkuqmC6jlm8Sq:4zOGzLDZd0q9slN1C6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675753223, "uuid": "4d438e99-b069-4e89-a1af-26849c04bc88", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675753223, "uuid": "1760a927-03ae-440e-9005-6e48d26d2336", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753223, "uuid": "d3755dfa-7b96-40ef-8865-bda54e756c62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b85091-a6ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675778433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778433, "uuid": "1db93a27-762c-45ec-b93d-2dc37d5548c3", "comment": "Malware payload (DCRat)", "value": "8f6ffa5ae56fd12b4c7e7e7ad6cf6122", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778433, "uuid": "8cfc917b-99b9-4eeb-8334-2619f671e70b", "comment": "Malware payload (DCRat)", "value": "a8f5fc1fada12db013dd13ac5e963825842d92a84472ec2073160e3a1486bf99", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778433, "uuid": "419f8b49-7f34-40a4-a737-f0c046201170", "comment": "Malware payload (DCRat)", "value": "2d43ec8122adffcdab6a95dcfb79dd13ec0f9d67", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778433, "uuid": "150323fb-3b42-4d99-a52f-d0ee97c639d9", "comment": "Malware payload (DCRat)", "value": "457ab10101eee2a63580f803f7247bb6306e48ed974a72266f0c35065977c8e4862185129962d1fffbe21ca1f5d7c1d1", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778433, "uuid": "af091ee6-1ea9-4231-bc18-09244a5e0951", "value": "T19195BF01BE44CE11F0881A37D3EF45584BB0A9916AA6E31B7DBE376D16123A73C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778433, "uuid": "da27ce1a-4305-4419-b304-103aef44ee7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778433, "uuid": "0e8f5623-acca-48bf-b606-0fe110322615", "value": "49152:dndSiKG7Idc6Rm8sDJMSgkdEiVTpnjyv:dhURm8vSFVov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778433, "uuid": "eb3c0f23-b244-4be1-b6e7-5d269d173eb2", "value": 2045952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778433, "uuid": "3ab1848a-2851-46e5-a5ad-11c26d44e585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778433, "uuid": "e9900264-d398-4240-aea5-44c8606a1bbe", "value": "a8f5fc1fada12db013dd13ac5e963825842d92a84472ec2073160e3a1486bf99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9a86c4-a737-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675809416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809416, "uuid": "e992b86e-c533-4a91-b06e-1ee78b62132e", "comment": "Malware payload", "value": "3257881e62a257c178caceece00d8536", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809416, "uuid": "dcc6d1ae-7de9-4d49-ace7-9760a6b0bb10", "comment": "Malware payload", "value": "a939b2bb4736505ee222329733ab6502b4fa8edc73a1456f8bb5d4cef037e674", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809416, "uuid": "175e3c27-f33c-4742-9162-f234c1446513", "comment": "Malware payload", "value": "eee8166d2b0863584c03eb34889f4c05b1c2f263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809416, "uuid": "d1f89771-6543-4270-b215-3818d09615fc", "comment": "Malware payload", "value": "b40c0d80fc506d8112461eebc64cf7de1b23108dfc4eaf9fc1ac4e2c31514811b850210d4de7bcf8ddf2a475d11679b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809416, "uuid": "160b5bbf-b1d4-41cd-89cb-80485823508a", "value": "T1E513F10A47EC0872CDF9577209224313E7B1AA3A563DDDCDBCA8422D352B36647C2769", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809416, "uuid": "c522cc61-816f-4984-9bb8-55e991242cf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809416, "uuid": "05c49964-4610-4fde-958c-f546d7c43eb6", "value": "768:z1Af3nX/xBqe3UL7TfFPUBC9Lubg9fLelA3KPOwBh:z1A/nJBqdL7TJZhlKCC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675809416, "uuid": "a58714ed-0dac-401d-a90d-509e8e269636", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675809416, "uuid": "4de86070-91ad-4ccd-8d30-04f225090a21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809416, "uuid": "28386036-f830-47e9-84f8-360ca97f85a4", "value": "SecuriteInfo.com.Variant.Lazy.261325.23845.13395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17df746-a6c5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675760380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760380, "uuid": "b97aa201-75be-4f90-908d-0af7c2f5af95", "comment": "Malware payload", "value": "8dedac7c3d1f058fd14737053d95bf07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760380, "uuid": "324ce577-47a2-4a25-ad41-bf326deebf46", "comment": "Malware payload", "value": "a9590fdd8d5d226554bef38bde1167e59b2091cbe0c1b40172f538964daa2f79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760380, "uuid": "c260725b-8777-4a8a-8215-e8826d5adb40", "comment": "Malware payload", "value": "f0111c34995b6e60e5b14fb789aebd07bab516c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760380, "uuid": "3d902139-779c-4004-8dcf-f2a2f06273fc", "comment": "Malware payload", "value": "66a97b663ac0c9cdc069c39d5ecc503b26e63e388a2edb3544c07ae3969236c5ad242de28c508485d73003853dbe2237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760380, "uuid": "9ec82fa0-4dc8-4554-9d46-3fb39fdfd2c7", "value": "T1CDD1B510A39D0233E9724B76ADA353D1067DBB13A98397BECD90601E5C556CD4671BF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760380, "uuid": "5b0e0be7-616d-48d5-a3d1-7c780d85edb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760380, "uuid": "49591efa-2ecd-49b3-9af7-079e43fc4541", "value": "96:d6rGsa/lE+Xy0ToyIXRXRhNrasAhoOrkbgEQGnQEFnU:d6r+f38RXdZOAlFng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675760380, "uuid": "af6e8137-c60e-499e-a214-a8f9a54108ce", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675760380, "uuid": "af178814-2dc1-4bd9-aea0-3482bf23cb67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760380, "uuid": "85e7c890-91fd-40d1-a6d6-6297ebbc2515", "value": "00000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce584db-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675758493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758493, "uuid": "e8789b65-0289-42ff-b556-c2d0082a2980", "comment": "Malware payload", "value": "75382de01db15ae57622cfbdc48749c7", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758493, "uuid": "de5f20c6-16df-4cf7-9aa1-550f28f38892", "comment": "Malware payload", "value": "a96045acf34d07de7f0f05b0648b7f910ee7af15c880c407a393a6c42c271248", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758493, "uuid": "41c557b2-dde9-4599-977b-ea4c526e5adc", "comment": "Malware payload", "value": "8302c50ace964a0f906107bfe095e85552672020", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758493, "uuid": "431fa2aa-2f64-4e59-b155-d74ba7da9718", "comment": "Malware payload", "value": "752881bdf1fbe5808655247c8ce2cbb4f0378684daaf4a6a6d870c2b5f3eac60d5edb84d8e8a2a3bcfe2f57746e9077b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758493, "uuid": "bc45dba8-f931-43d8-9545-aaa177f8f876", "value": "T175159EA3A943C911F9630B7D3E7E89552303BC06EB131E57A210B79D6EF33A41682D5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758493, "uuid": "963db42d-78b8-4c9f-9b36-f6ea3d1d9ec9", "value": "12288:jaFiKXKx9H5TX9M5Tm2BTiz7bbGNZVL2ksBdr:mLKbPf2kzvGVz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758493, "uuid": "8c5f7258-72bc-4c97-83ba-dacda48875bc", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758493, "uuid": "63bf3ff7-1968-481b-a23f-6d4d6203ef5a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758493, "uuid": "60fe4309-849c-427b-9e0e-eaa7264e2be3", "value": "411.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f82f59-a6cb-11ed-88f6-42010a9c006e", "comment": "Malware payload (DBatLoader)", "timestamp": 1675762854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762854, "uuid": "b954e418-ea7a-4adc-8776-cb0e5c0a9277", "comment": "Malware payload (DBatLoader)", "value": "be889f4ab5ce7e99c131463c58205ba0", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762854, "uuid": "b3a7cf5c-6c8f-48b7-b7cd-a6eff2573937", "comment": "Malware payload (DBatLoader)", "value": "a9ecf18de63cd7dbb8782df532f774e4f20b5562d8464c352494b46c474746f0", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762854, "uuid": "86c71732-5f98-4ac5-8e53-57fa8481b4c8", "comment": "Malware payload (DBatLoader)", "value": "9c737b759bb04367539961cadd87af219d3b71f1", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762854, "uuid": "021dcd6b-3c49-4a1a-af82-b4f54b0caf2b", "comment": "Malware payload (DBatLoader)", "value": "f42bce10106b7d3cd86e23e1d865a63443bcf2ff075cc667b49e1ecfe0743947b90c5161f1e4e7d86589a0ee85e06580", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762854, "uuid": "dd119a7d-f91a-4413-a6d8-8ee9643c4bc2", "value": "T1D1112B102FF70B24F3F29A39ACBBA31184B57955DE52A39E022055081832220D2B5FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762854, "uuid": "a7d9685b-3c78-4258-b6cc-304ef6079c11", "value": "24:8dwj/erlZygbDhF+GG2+svjafzkK1DOSDVdda:8s/6lZH+ArckSOuVdE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675762854, "uuid": "c3fdc10e-5d5d-4c6a-a148-d897cd6978fc", "value": 1032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675762854, "uuid": "1d5964cd-2032-4b7e-a9e1-401651f14d29", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762854, "uuid": "6da88a87-ed45-448a-ab5f-96a5c5007071", "value": "Revised_Order_Document.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ea38f0-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758562, "uuid": "aabb4a81-4294-4596-be15-0ff187d68dbb", "comment": "Malware payload (Gozi)", "value": "d728426b778a4c03acb199daa19862a7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758562, "uuid": "276b2ba9-0e26-4ee4-95bc-37dc7a47ccaa", "comment": "Malware payload (Gozi)", "value": "aa4d4a0452cb5999d23e81df6b4655b4717513982b905716fa939bce024a2af6", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758562, "uuid": "69f1a1d8-f9a2-43c2-9df9-c2a5b20446b4", "comment": "Malware payload (Gozi)", "value": "769e8c6023ba1a6a10f94c8d2bfe151557a5df82", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758562, "uuid": "1673639c-2ec8-4142-aff9-de47a1c2eb90", "comment": "Malware payload (Gozi)", "value": "3b8785ce1020effabddec4e5758d16b26e28fd9eb459eb81b1e98bfb7e29418c7be31e323f40457fb5f36bff095c4997", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758562, "uuid": "751ad207-ed2f-43da-82d2-70be3e7be5bb", "value": "T1FDA19E1AC91FDDCAA859900AE2FB80FF5592A6903E27511077D7F3396A3260F23D300D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758562, "uuid": "8f4df415-8f7d-4125-acd6-3b4ec995d992", "value": "96:yb3pX6CZKaTZI/R1lXi6xNZq9ffqlQytm2iR1zTy68Oq/YVqOfmLdaSvI:kJZIvFq89m2iR1a6hqSIaD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758562, "uuid": "20855dc0-fccc-4ab3-b4c5-7179cf517447", "value": 5083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758562, "uuid": "cf8f1bbf-6a33-43c0-a6f5-5f0c7b7d8c1b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758562, "uuid": "ddc909f2-34e6-4300-9e7b-4c609375966d", "value": "azienda_07.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723069d5-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758529, "uuid": "ada24d40-69fa-49e8-a854-262e5592b468", "comment": "Malware payload (Gozi)", "value": "6b335bf246d7e988bd8a7134838ded04", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758529, "uuid": "8c93ff98-07c7-4b78-8b01-43857dabf35d", "comment": "Malware payload (Gozi)", "value": "abc3a0da6c26e662368c56ff9ffbb8299931d38df691a83df4ba49bdc6de1f03", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758529, "uuid": "68e63a9c-52c4-42db-91ae-20e9f4e36629", "comment": "Malware payload (Gozi)", "value": "b3cc98d0eab0dd42d7f1dfb393caea06b7233d1c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758529, "uuid": "7ec05531-9328-40a6-895a-ac98488bd5be", "comment": "Malware payload (Gozi)", "value": "9c668732fa5bc23d634553ea5028307af9822d29b655cbc0cde016fec3271c1c59e49a253f57bab05096844c97025c60", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758529, "uuid": "b77c9e1f-ce9c-4047-980f-e5a469a8bbab", "value": "T181A1BF1E856D183E52CC09A1AE3F949731BBAF8584208F64CFED4E32CE606E5E684173", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758529, "uuid": "df1306b8-5599-4c2d-b749-01f3378926ac", "value": "96:SqZ9Z2bbNHMMN5ycrQFHIEUmnpvuBJ01LtrfzSW2D727:SGexMY0WR6v8JgRzSn67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758529, "uuid": "9a55b966-3870-4e54-b6e1-75a4852f6f02", "value": 5065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758529, "uuid": "e5b597ed-36a2-43de-be9c-90a04917d217", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758529, "uuid": "b77aa481-8fac-46cd-9db1-ff8330985a5a", "value": "azienda_03.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c601f5-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758481, "uuid": "6c62a4f0-8124-4e5d-a848-84fec78a2900", "comment": "Malware payload (Gozi)", "value": "4f44cdb9f2bbeab1b5aaa73a2ea8761b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758481, "uuid": "0b2224f2-61cb-460f-84f6-c57140410ba5", "comment": "Malware payload (Gozi)", "value": "ac345ff7ee42a6bc8c6ac8acb07643a829b35cc3000e88bde60d242aaf22c494", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758481, "uuid": "0c1fca9c-39b8-4583-9f6c-ebf535be8c48", "comment": "Malware payload (Gozi)", "value": "e2f6e4878c7f51ed02958135a59fcab224b27cc3", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758481, "uuid": "4983a789-d376-4700-baec-ada811254893", "comment": "Malware payload (Gozi)", "value": "4e0a1572185342e3d83f77ecad018bfa03f36b482b222361a27de5c9147e702bd1c93df23dd136f62abcbde3853b33a7", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758481, "uuid": "d48f9140-6759-4981-a213-5eb14eb77168", "value": "T165E16C4EDEDBA42B6B4181DBF6733C11FB9018BBE929220475E5E70E2B53B67004156C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758481, "uuid": "c618210f-7e48-4a97-b297-6413b4577727", "value": "96:wuBPBLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dnr96k:j/U77rIKdn863jMM0OD9+VVF45x/CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758481, "uuid": "1a49257c-ad57-45f7-855f-76d5a49f12ce", "value": 6974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758481, "uuid": "9b4df69a-a9af-4de6-92be-6d02fe0fa047", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758481, "uuid": "32349f7c-a275-4f24-8bde-a5d3ff2ee60a", "value": "azienda_39.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa76f696-a697-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675740719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740719, "uuid": "90e4e9f6-daf3-4835-b9d4-72a2d1df73ad", "comment": "Malware payload (RedLineStealer)", "value": "e69c2d0c4452da5c0558107642430855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740719, "uuid": "1aac9793-a8fc-4dc0-acb8-d7c647ba91cf", "comment": "Malware payload (RedLineStealer)", "value": "ad3005fe37f9f69b3697286853cac63d78d1773b0cf412b99d1dcd359ed1a5d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740719, "uuid": "e2a5cb73-eded-4718-8f69-608cbd1b2778", "comment": "Malware payload (RedLineStealer)", "value": "0ea929009aa634ba0b751871d354635c40fb96e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675740719, "uuid": "feeaa49c-d395-4c7a-aa55-f309bc911861", "comment": "Malware payload (RedLineStealer)", "value": "f6c3013423d2b1da7b10a426d6c4ce5e3af9ff7b31c515c3c92a41ef52b6bb52246e6534046c557e0537a2bec5777f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740719, "uuid": "f1a0fe27-bed1-4bbf-a2e0-95caac1aa281", "value": "T153645A4393F1BE44E9368B729E1EC2E87A4EF9408E79F7652218EEDF15B1076C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740719, "uuid": "ea40c0f9-acde-4a2d-9893-ca0eb46b6471", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740719, "uuid": "b82b7e97-935a-4999-a2bb-617a83237246", "value": "3072:A9b6bqkDLIJpRmu/YTQKyEP/sG0tKLeN0pfc8SdJq6FrUuQjiMTE52SF4a5hN:uZkDLIJuqlqZtgoET7QuQj92qaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675740719, "uuid": "43901f85-02af-42cf-a462-e1b65e272853", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675740719, "uuid": "9b89d4ce-7981-48e1-991e-3c08792c6be6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675740719, "uuid": "0a192ff2-11d2-4fd4-a6b3-7db9dcf66877", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71923aa8-a69c-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675742636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742636, "uuid": "a544700b-26f6-4ed1-8326-39da25e26da7", "comment": "Malware payload (CoinMiner)", "value": "80aa6f4cb1dd804d3aad02c03e40954b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742636, "uuid": "1502c3be-c92d-4681-8fe6-73640001952e", "comment": "Malware payload (CoinMiner)", "value": "ad44fcd493e59a2750bf2dd139126ac0b1699b09ed7d8f14e143435dddeb0e94", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742636, "uuid": "2fb00dc4-a08e-487e-815d-b46f62ee8b55", "comment": "Malware payload (CoinMiner)", "value": "f1caa056d4cfa2c49912cb86c4eabb674f542f63", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742636, "uuid": "b59f4394-0e2e-4871-82f9-264ff24b673f", "comment": "Malware payload (CoinMiner)", "value": "829325de8f3d0375934ac0a4b631a10cd1870f7216e592967aa7dbc5d3477a62a9955d26833aab5812c3276cb8792348", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742636, "uuid": "6606e11e-4e98-429e-88ab-2d7f4a137b5c", "value": "T1DB644A43D3E1BE44E926CB72DE1EC6E87A4EF9408E7977653218AF9F14B0076D263610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742636, "uuid": "4584dfb3-46f9-4405-b1db-89201d29333d", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742636, "uuid": "72e15be4-3a8d-4171-8402-a952b415664c", "value": "3072:Usb6b6QML0ZRmgvXlZ1fiyvE1PZ5FGmX/9NdKrrG64zuQjiMTE5pHRa5D:LptL0eg/l3xEt/9NdKraJzuQj92HRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675742636, "uuid": "0203d627-3e9b-4794-a229-8d473940f9ff", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675742636, "uuid": "4e37fa03-c01c-4089-8f6e-bfc299d6798e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742636, "uuid": "dac10645-32ae-41d6-a6ad-9b634c1a70d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28fd6e49-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675788900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788900, "uuid": "abcb9868-dcff-4160-98f4-54dab3a15b27", "comment": "Malware payload (Formbook)", "value": "b8e30ede8022408c39d10db8ff222fbe", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788900, "uuid": "2394c130-9cba-48d4-9213-695bca78275b", "comment": "Malware payload (Formbook)", "value": "adebba09537871a3147e2985c5ec4947f7eba0af7ec6749c3b53c39b9ca756d0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788900, "uuid": "09e346aa-30d9-464e-b889-a1f0191dbdbe", "comment": "Malware payload (Formbook)", "value": "1fdba8c36c840ee4523f52e0234fd44556a97018", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788900, "uuid": "e85d5c92-0db6-4d1a-b45a-87679007d5fd", "comment": "Malware payload (Formbook)", "value": "9ccd4e7a5739aeb24d687f8cf4f613fe87f85e059e42a3759610ddcb72d586ab52cddd35a58945fa5aab69797343c672", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788900, "uuid": "244ef832-c0df-4e16-8c10-fcfa796c3322", "value": "T10755AFB876047DE6266F576BCE96ACDD03B627639ACBA4CC806477C30563376FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788900, "uuid": "2ab19b5b-eb99-42a0-9b09-d43f55b6d473", "value": "24576:iLYZE//9yHtvQ+9t7NywpnUXmDdtvkdOBuNgCMMx50DWpmIAjm9xIgN2Zn8HL:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788900, "uuid": "defa9a17-c32f-4b00-b62e-d2e9883184db", "value": 1287262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788900, "uuid": "9b6814cf-bb16-41d9-95d7-c7e7d926f7ed", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788900, "uuid": "5687411c-6d96-4cdd-a7ef-abe1c4dd9308", "value": "SecuriteInfo.com.Exploit.CVE-2017-11882.123.5363.10145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8224010a-a70b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675790338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790338, "uuid": "a851d055-b2f6-4f80-8123-05d6dfe06dcb", "comment": "Malware payload", "value": "8cc8be5b3249612b209e6d7cd6a54746", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790338, "uuid": "d04dceb2-ba20-41c3-9f9b-cdfaea4e010b", "comment": "Malware payload", "value": "ae701de43c685b684067850f6de01160ca25ac03f2637432e1590fe5f4f38b75", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790338, "uuid": "5e541e34-05c7-472a-913b-f9df009578ac", "comment": "Malware payload", "value": "26a3daa4bd3816dc7fdece5d08df155a28bf2506", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675790338, "uuid": "138fca97-4ec9-4be2-9112-7c17b72584c2", "comment": "Malware payload", "value": "89d31e168bde8de877287a18679cfbce7388c6936a71d9cbb31ff0c2427820a1a10073ce33ad4b146224950ee072aeaa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790338, "uuid": "f0989aa4-166f-42cd-a97a-6723bd913954", "value": "T18B03F1B3C8B552D4FF2862FF24680A1B4698DE9FBC4F78BEC0056040E66375968C6E53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790338, "uuid": "da0b59b4-62a7-4552-91fd-92ae53acc635", "value": "768:veQNbg7xkZex8r9qHValNH1K8yfA6JQ2KEbLHgOvgQqTGNjQFIIVurM:mQNbsk8w9KaIHrfgOvs9FvurM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675790338, "uuid": "b27a77f2-7d08-481e-8ff7-45815b9591f3", "value": 39098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675790338, "uuid": "66960e09-5490-4d9a-8795-96abf8603fba", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675790338, "uuid": "02b8fa57-904b-46b5-9140-e76ca740c40b", "value": "sample-2238962-3257881e62a257c178caceece00d8536.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c56981b4-a6c6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675760816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760816, "uuid": "b06c5646-bf3f-4fe4-803f-cbc01a21bf27", "comment": "Malware payload", "value": "2f1d00c1bdfd5f08676446945d2278e7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760816, "uuid": "9916832a-1ed5-47ca-b3cc-3d1de4ea5d82", "comment": "Malware payload", "value": "af2aa752562cce5c736f003fe42fc6b47320f417768a72b6a35d747b31ad2a8d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760816, "uuid": "13f165ed-cba1-4018-873a-f7231a44fbd1", "comment": "Malware payload", "value": "fa2aa336c1b2e8f8a976c1de5eb8ae7e7193d863", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675760816, "uuid": "848ad481-9bbc-4998-9981-bf0f136afd30", "comment": "Malware payload", "value": "edf90f818556e081e2107db495777ad2468bf6bc871f64be98ce72bb17482d5591650f54443e766fc6b5f3698cd2fb2c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760816, "uuid": "1a968aed-b8a6-4b7e-9070-b11b2cda0793", "value": "T139030605B640C437F8EA01FFDAFE4DB6492CAD781B6A91D361C345E92B502DB20367CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760816, "uuid": "9ff6c5b1-2a70-4937-ad51-8e7c24950cf6", "value": "f5dddb638083941ff67d8497588c6ad2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760816, "uuid": "692604d9-ec44-432a-bc26-d46ec9638bcb", "value": "384:Sm/VbTZuR5MzEIXJmH7LBjvHCwPhMW6lh6iBBD215IrMb:SYFZu7MzEEJo9DjhbkTBBD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675760816, "uuid": "3fa1a296-c1c8-452b-8db3-7c801123a14f", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675760816, "uuid": "1f0a2989-a174-4f03-b94c-9f843545fda0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675760816, "uuid": "61b1cd2b-0949-44ef-b29a-1386b2b9f57e", "value": "VirusShare_2f1d00c1bdfd5f08676446945d2278e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e574ac-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758595, "uuid": "245d0f2b-0de3-4c63-b761-401a55e03217", "comment": "Malware payload (Gozi)", "value": "c454a20301c27fb4cfb2077a63ff7425", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758595, "uuid": "b0b04b3d-53fb-4f08-affe-1458e02c720d", "comment": "Malware payload (Gozi)", "value": "af8089feda1994fc7cb05c611003562d3e5e65cec86de77a397d7d8859e401a4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758595, "uuid": "19e3ca70-b16c-4446-b23c-62d048d40215", "comment": "Malware payload (Gozi)", "value": "41dcec14b127cb9480d25c145624a8424c2cb45d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758595, "uuid": "6556b98b-6dc9-4d43-a602-e160302222bf", "comment": "Malware payload (Gozi)", "value": "75d5376e4748836d7ac12fe1ce354fd47f3a36730c2ab102ff56038e53ab8ff73ba863612de3e38ef1c8b56a6c629deb", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758595, "uuid": "de58cd82-359b-4bf6-80d9-7c12fff01b08", "value": "T127A19E687D8E4F9FE7440C089D628BC2302716E23B6A1A5DFF2D1257993B63195854E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758595, "uuid": "1a621a4c-7694-43e4-b4d4-69912cc5e512", "value": "96:O7OL+GAAx4jroHWL3NWp74GyZYTL8//Y42gpFxN9QuBT27FLqLAT:O7OLUAxoolbVWQ4dxNPuF+kT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758595, "uuid": "5aec9bec-2370-4df6-811c-79ca84c15753", "value": 5051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758595, "uuid": "3a6b52a0-f537-4bbf-9225-d63d89437cea", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758595, "uuid": "53256cee-dbd7-43a2-bb9c-928d7ff36d42", "value": "azienda_14.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53bff627-a730-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675806152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806152, "uuid": "fd2fb945-7116-4ce2-9d3f-04d585ae2b27", "comment": "Malware payload", "value": "c751a39f3a11f03be10f70f79e195b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806152, "uuid": "47930fae-159e-445e-b982-f809a00f7e29", "comment": "Malware payload", "value": "af82dbfd22e98abda309d3ba925983d4b91ba9996376218097ce32ef04309119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806152, "uuid": "e50f79a9-d522-4742-ac96-c4de276411fe", "comment": "Malware payload", "value": "50857669ac487ed4e354c678989467f3d86ff3b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806152, "uuid": "ff47d09c-62a0-4f0c-bbf7-e4b3e09b121f", "comment": "Malware payload", "value": "a84b327545f68e9ea4b6add4c491ae2897675a5b679b3630cad547b39711a7b9d8ca8737230f37d23868b4aa8f8ce9d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806152, "uuid": "ffc151f6-1ea7-4676-bf48-85e4ba545006", "value": "T1D2B40247F7EC8076D5B4577019FA02C31A36FE609A39828A374E6D6E0C725B4B63436B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806152, "uuid": "40aab6b0-ed51-48f9-9eab-16a2e9fde6e1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806152, "uuid": "798fff12-7e6f-4dd2-b3e7-275eb1edad74", "value": "12288:DMr/y90lfvuXpYi9xvG0FGTHEh6e2eiBeDm5l0kyQ+HE31:8yqfGX+AxvGbK2BBImkkyQH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675806152, "uuid": "db573dfe-4311-4092-805d-04dbfdee16a4", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675806152, "uuid": "3d2501c6-c33e-4338-88b3-91c37033598c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806152, "uuid": "b1e27964-bb30-45de-9d72-fd6e4b25652b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c2380b-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675789425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789425, "uuid": "9edb9d3b-5e2d-489d-9803-960fb18da171", "comment": "Malware payload", "value": "c5ba24d5d02308b27b87815c9c3fde35", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789425, "uuid": "98a92165-b5f3-40ca-ba99-f4f81d5cc233", "comment": "Malware payload", "value": "afc419733f4f052ac9cb2ef70fb3d6027f3bc24123842842856716d9790fc3dc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789425, "uuid": "455ceb2c-c3be-4e58-b68e-89b587635874", "comment": "Malware payload", "value": "ee9c4f5c78ec017824acfdc3ae7864be62179275", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789425, "uuid": "983e271f-ce23-49d4-8615-8f361eb297d9", "comment": "Malware payload", "value": "092f5d6fa1ccccca7a016df4150408c914eb6b4601a3815b4afab13592503a70a0318054c21cadfb27d24b026b65e5ed", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789425, "uuid": "a37a610a-a097-4dcb-aee5-d5c84f253189", "value": "T12617C33196737DDCEA37A2FFA4BC4FC48011B5F0A155E96B23786FA48E9164620B2D43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789425, "uuid": "73ee7e40-6a56-4e8d-94af-0002d33614b5", "value": "393216:PzNEwDN9JztN02dRNrkG+4PXKoi8q/jHbFlC+Xrt1NsnZ:PDfpXXCG+4vfq/jiHnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789425, "uuid": "7aae5a58-5eef-4cec-924e-9a590b3288ec", "value": 20146176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789425, "uuid": "139afb07-4979-4ab3-8e2b-12612ff05c4a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789425, "uuid": "b554c12a-b429-4352-b6c0-5da89004df9c", "value": "ContribuyenteQASHZXTQSPMG.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28d0327d-a73f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675812522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812522, "uuid": "2e50a5c2-314f-492f-8850-eb58f1c212f4", "comment": "Malware payload", "value": "7709a56136d978451f09df8e4ffff53a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812522, "uuid": "67cc6566-ee9c-420c-ac71-d105d5e787fc", "comment": "Malware payload", "value": "b030722b0b793e180ceba1f2272bd32061227e277a11013a3205de84fb746bc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812522, "uuid": "c11851a5-a7fe-4891-a1dc-9f405846bea6", "comment": "Malware payload", "value": "03c9690548fbffe9aa06c7c99cceb1f28039a6c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812522, "uuid": "c36c4a92-e497-4763-a865-8529315375c8", "comment": "Malware payload", "value": "6db2e3317a182db2edbb71ea846b66bff1a52943bf3313dd1a2b0eb3e0422191d3c274d293ceb03bd2f68c5a30d9a5f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812522, "uuid": "f326472a-0f47-4744-aa00-5155d7528095", "value": "T188B41243A7E84472E8B61B7048F302D316367DA16A39C36B770F2C4A2C73675A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812522, "uuid": "cb9f3021-833c-4770-b1d0-af0a8a92a071", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812522, "uuid": "35be2383-d34a-4ea4-9048-63b64a8cb077", "value": "12288:+MrQy90rRd9fHQGN0JSf0lzo0rkzzrsungjFb:qy4fLNR0u0rkzzrsugjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675812522, "uuid": "a56f770c-fb5a-496e-80c8-3c1442df4b71", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675812522, "uuid": "5d5740ee-1e24-4bb7-bf4a-6c9e5a4b9405", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812522, "uuid": "b932c79b-2a80-487e-8442-05fa9fb125b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4faaad-a726-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675802064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802064, "uuid": "7dad3ac7-c5b7-4dc0-aeb1-449229e84ae3", "comment": "Malware payload", "value": "9c6e981ba0b3fdab7b4e1678e368d077", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802064, "uuid": "9bab2ebb-6334-409f-8437-48890e20a033", "comment": "Malware payload", "value": "b04dc99271c3aee968744595497da9db2ac5cedc9a69706af58d2373d33526f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802064, "uuid": "9fe8ead1-343a-4235-b5f3-6a49a681ee8a", "comment": "Malware payload", "value": "1f02466f751743bbadac637559616b1000cbd0d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802064, "uuid": "006cbf44-34dd-4ae5-a680-ef246c9a01bb", "comment": "Malware payload", "value": "5995a702da7d5623d1da5d7540f7bb9f82416ecbe3ae8389a7d39fc1cf1ac55d7aa8ee94a0874daa1214e257bcf13722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802064, "uuid": "11fb4a59-991e-44d0-8cec-347f376b4000", "value": "T18FB4020BFAEC9132E9F4177019F602D31936BD610A79929B175FAC5E0C326B0A63572F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802064, "uuid": "558fe45b-dee4-4cfc-ae3d-f963419b3da7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802064, "uuid": "24b88fa9-291b-4a98-bc08-4e701ab08a38", "value": "12288:XMr0y90l3ZIqe3OM1OY8cf1Q7nX124cY:Dy0ZITOMSX7X124cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675802064, "uuid": "bf50792c-07a0-469f-8b99-d487e148d84e", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675802064, "uuid": "0cc6d0fc-c5ab-4ade-b9ad-422a5c2ae4d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802064, "uuid": "d1844cf6-5cdf-4197-843d-f6b4cbb13044", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7e2f27-a6e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675772639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772639, "uuid": "84644305-921f-4aec-9c22-0381dca051e3", "comment": "Malware payload (Formbook)", "value": "13e43031adff85fe50ac06dac620783a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772639, "uuid": "814fa868-e800-4099-8f9f-d1617f07f334", "comment": "Malware payload (Formbook)", "value": "b05ecc4ac14415823adaa358661e80c9785371a97e0c756d6d174092191373c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772639, "uuid": "dbd2c803-a012-442a-a244-8838666c3f5f", "comment": "Malware payload (Formbook)", "value": "1792afba0aa73ac2552f614859814e7098e12e56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772639, "uuid": "49d0068c-7872-4e43-9b9d-941a6464d469", "comment": "Malware payload (Formbook)", "value": "3ae330eafde8360c2312d81d8f8f70e68332857de68d60df14a252e4dc1f413f5b988ac381870b5203fc266248204932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772639, "uuid": "76535e2b-d376-407b-90d2-00013a72ee7b", "value": "T18254120145E0EDABF97684707C3273923FA7E82251556B1B1311ABA93F7B281EC0F766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772639, "uuid": "c40e414e-e9db-4475-9c10-e4beba167ea7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772639, "uuid": "810cad20-309d-4ae7-b6ca-ca1988585c7d", "value": "6144:vYa6ewVEElPEfCIcn8QWmh7RNFhWwCpClKqjPpBIWmI:vYQwVjCU8QWm1lcwCpGKqjUm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772639, "uuid": "ab404b18-8599-4632-a476-c2ccc627021c", "value": 297412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772639, "uuid": "2b1aea63-93d9-4470-bb6f-d2c3488fad47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772639, "uuid": "31425736-b879-463a-9958-c0baf4894b9c", "value": "FT_20230702_230K.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "493f1f27-a6ef-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675778217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778217, "uuid": "f42f06c5-8ea6-4d86-a30d-0edd2c6f4ccf", "comment": "Malware payload (AgentTesla)", "value": "176dc5288d1aabfb767c2034ce91da04", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778217, "uuid": "e585b7fd-852c-4ebd-b8ea-0f2ac89ece79", "comment": "Malware payload (AgentTesla)", "value": "b06352277a420718cfe365f7eba12f91a57779ea67d174f567c32bf0c8953e40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778217, "uuid": "a4209665-6698-446f-8097-0bc893c7d5ab", "comment": "Malware payload (AgentTesla)", "value": "2730e2a9015d99d8cf6d8c5aa3f07b938a461d55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778217, "uuid": "cb0bf65b-ee7b-4a42-863e-49de43984fae", "comment": "Malware payload (AgentTesla)", "value": "0135509ed052831c445b28f73b37d3fb00111007e14babbeeecde09e3634d8a4abaf2928aeb6c8dcafd4f11d89374f5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778217, "uuid": "62277e0b-d56c-44ee-a6f3-ce36d9eac3ad", "value": "T101B4F1626FD89F6EF83D83785330148017F6B58AE322DA9FBDCA11CE5A25B450721772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778217, "uuid": "d959e41f-70a1-4fc5-9e49-f0d7d7a3cf4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778217, "uuid": "8bfc6881-5bab-4b53-8959-174e9d73e448", "value": "12288:RfGN/p5hM4+kLcU0Sx24xPKXuW9SctIJaeumhiF0AQ8ZazAsW:1q/ZM4+TGPKXu9h8Q8ZassW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778217, "uuid": "a9b065a0-b5c3-40e5-ada7-3a69a2ce36ac", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778217, "uuid": "9b69c2df-1fe6-41b3-b51d-2e60c2faeee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778217, "uuid": "1509f5e7-3338-480f-ab8b-6ecd394cdbbd", "value": "Req For F1 USD 33 325.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdc167e-a6bc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675756236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756236, "uuid": "8a60fce5-63c3-4b78-8365-e97e1c042220", "comment": "Malware payload (RecordBreaker)", "value": "824e45ea6e411da4b9049f035dd1ee10", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756236, "uuid": "d57aa9b5-b71f-4194-ba91-5da611fa9beb", "comment": "Malware payload (RecordBreaker)", "value": "b06c5fb7651b8a6c683b62babcabd18da4d992f7d1e0f963c530832b18feacf4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756236, "uuid": "f56ab8fb-cafc-4f7a-83e2-437389cf641c", "comment": "Malware payload (RecordBreaker)", "value": "7f8a235a80c0d79e2a4ac83495b7aeb9883e3795", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756236, "uuid": "10ec2eb4-f9df-4f60-ad75-bfbd615ae88b", "comment": "Malware payload (RecordBreaker)", "value": "aa7efbb05e5e152b9f33648539208bbad1f471ad767b90ec155709e4fb492d030a577b24ce0264a2725b167001354200", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756236, "uuid": "d258329a-caec-466b-a1ae-d40f00a5f655", "value": "T1A775CF0089C6C071F47DF83C29AF9D18B8E0755C5710732BA9E36F273E53A4E6D16AA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756236, "uuid": "21077117-a89f-4c4a-8ba3-10dc47eb216c", "value": "a2833106949ae6e20c40ed0128f9df4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756236, "uuid": "2074fdd0-5093-469b-9b09-521b20532b14", "value": "49152:k9RU6ElBFXa8cQAdWduTjcFlvbJDrHQmuB2:k9C6A/XSQA48/KlvbVwmuB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756236, "uuid": "e4f7eddf-c224-4afd-a9ca-da47aa03e14e", "value": 1673880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756236, "uuid": "edfcb660-b0d4-497a-99e1-a71d96367186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756236, "uuid": "2464cba0-5443-4a66-92f8-fdf4e3994e48", "value": "824e45ea6e411da4b9049f035dd1ee10.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4621da2-a6f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675778799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778799, "uuid": "c9d38731-682e-45e9-a069-57fadb1a86a7", "comment": "Malware payload (njrat)", "value": "33c5ac88c77a64db9e75829208db8e23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778799, "uuid": "9033f178-5885-48aa-a62c-3101f6e32397", "comment": "Malware payload (njrat)", "value": "b0e41ca5712b59a062ebd29ebb76e2870effaa605a73f91c02af746f5fa60d72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778799, "uuid": "0714a181-7c9b-489b-a356-1d3d44bb26b1", "comment": "Malware payload (njrat)", "value": "a20ec23cbd17452b1f8d66c6feea1ea17f5d3db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778799, "uuid": "19d93fe5-9e95-4e9a-bff1-dec22be03035", "comment": "Malware payload (njrat)", "value": "6d376fe4cb684b11dead11f0a5e06fb8c5778a9b54b676446dbf95896755e3b43a0b21e9af380153cf8981537392b5ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778799, "uuid": "951a566e-ad01-4e78-92e4-22b323bb8216", "value": "T12413D88CB740D174D5FF8BF1B892B2990B72A017A946930FD9F114D98BB3AC09610EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778799, "uuid": "65079726-db1e-4a50-ad1c-8408c995bbeb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778799, "uuid": "d0cc25fb-87da-408b-8a5f-0cca37b9d1f8", "value": "384:8Zeqa33VarE8yTNJFqfQYMEnapai0+djX2CnKs1jUNNNCP33hYCtVKwJR7AMumgm:6Jq3MY5TnFqfpOp1X2CKuUVupVZuC+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778799, "uuid": "41e623c1-e810-4915-954e-a15a16eb216b", "value": 43008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778799, "uuid": "1b97ea32-555e-4a5d-be0c-54a4f749f91a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778799, "uuid": "f6e0f5f5-b51c-4747-8e0f-c289c634bdc3", "value": "b0e41ca5712b59a062ebd29ebb76e2870effaa605a73f91c02af746f5fa60d72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71730a7f-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675758528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758528, "uuid": "62bc3fd9-a23a-4099-8318-4eb3c1cedc03", "comment": "Malware payload (Smoke Loader)", "value": "68063c43aad9b7cd41bdcad90d79d5f8", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758528, "uuid": "aaa10290-06e9-45ac-82b0-34fec819b02e", "comment": "Malware payload (Smoke Loader)", "value": "b1613c6a847424a9ab5390ddd438cce123576f57a0abc18d4d0bf480215a6a9b", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758528, "uuid": "586f4438-737a-48fc-a7da-bfb14ab21b42", "comment": "Malware payload (Smoke Loader)", "value": "fad7708358a2c7c189d85a7a8526d10570d785bc", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758528, "uuid": "ec69478d-c337-43be-ad67-a1760bc351a0", "comment": "Malware payload (Smoke Loader)", "value": "4db59442867d8c3b486e43538f9f04258e93a616762bd0e127b2122d6e3bfe8c7f5aa7e2928da290f52021d9b2eeefd3", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758528, "uuid": "00c36fa6-f1e1-4b1c-aae0-ad87d5148c40", "value": "T12C85E107A411CF87DC2DC3B4FD032DD54B166F59E8196ACB21927B8B7B321B2085BA9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758528, "uuid": "b80e49af-0477-402a-b7f5-93636abeebda", "value": "49152:XLKiB90Dz0ZRuGpB9g9+03keBLT74SL4E:7dAz068y82BLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758528, "uuid": "19225db4-bb0c-4f59-886f-22168aaab5a0", "value": 1804288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758528, "uuid": "730483c5-2bac-446c-b31e-1e8204623ca5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758528, "uuid": "d11c3e53-6385-4ce5-8a7b-45754a8e5af2", "value": "Pedio #20230873.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa86f16-a723-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675800634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800634, "uuid": "9ea85e76-8280-494a-b71e-5ff83ef77955", "comment": "Malware payload (NanoCore)", "value": "1fa59731f8126d3bf208ab64efbc7f5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800634, "uuid": "d27d5c85-26bd-4225-9179-87a42f00be99", "comment": "Malware payload (NanoCore)", "value": "b1e8fdeec8f7d3e7e899e56e21aad2ed9a1988a20976bcb6817b558f8b47538f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800634, "uuid": "b034a88f-6019-428c-b560-4419f852f729", "comment": "Malware payload (NanoCore)", "value": "c8d6b1e563275d5ee3b8f5126fbb15725a668de6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800634, "uuid": "1328231a-21ef-4241-b3fd-6fa1204da61b", "comment": "Malware payload (NanoCore)", "value": "054d3492f4009e0dd3f2c5443c8df17e8c1448a84552cded5121f160ea3cc45de76dc4e5fecab048d835d2507aec13cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800634, "uuid": "7f6c20f0-1216-4e52-8321-0cd784a3e8fb", "value": "T1B074E00DB2E6EE22CE0982780AD2E2F00721DC5A5752D74739C97E1F3A6B7C429465F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800634, "uuid": "ff63e436-d5db-4208-874d-802264e6013d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800634, "uuid": "f80e2ba8-7acb-41c2-99f0-da7e869fb0a6", "value": "6144:pjYm+9R/FvTWvx0ViODg6+wuUEBZGZtfoO5lW:5s5BqRKgNwFiZYfoOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675800634, "uuid": "446a8509-849e-4f10-b1ba-1412b4a2d156", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675800634, "uuid": "227543ec-313c-4a5d-8f22-88e8ce583c27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800634, "uuid": "4526dafc-46d8-46b8-b226-31474ccae199", "value": "B1E8FDEEC8F7D3E7E899E56E21AAD2ED9A1988A20976B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6fe65a-a693-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675738925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738925, "uuid": "0189123a-af14-4f91-a69b-bb13d12dcc78", "comment": "Malware payload (Amadey)", "value": "1c176d9d7cd461e38da54137fcbd1b5c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738925, "uuid": "e227dac4-afbd-4d34-8ca2-df3d98234958", "comment": "Malware payload (Amadey)", "value": "b21e134580f83456750ad87725b8523ec309df994b8d71fd2d2fc8291a2e827b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738925, "uuid": "9c2c83db-3918-4709-ac49-2f7ffe4e3bfa", "comment": "Malware payload (Amadey)", "value": "4994a9c806485bdc7149782de04b2f524ff328fb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675738925, "uuid": "7c145543-10b5-433a-93dc-9f2880b7e73d", "comment": "Malware payload (Amadey)", "value": "2988fdfa3434e2b0a351dd9839ac30ad3bedbf67f5e29dd7d20671f84e4cbf88f02bb3cea0651646662bcd1b4586f7b5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738925, "uuid": "8c7ed35b-cef5-4ce3-add0-00541c558827", "value": "T1EE645B4393E1BD80E9278B72DE1EC2E87A4EF9508EBD77652618AFDF15B0072D163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738925, "uuid": "dbf9d5c4-66d5-4a7d-870f-476be4ee5178", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738925, "uuid": "da9a14fe-03eb-4a8f-b9f6-eefefaeea19b", "value": "3072:3ib6b1eL25RmIXGS1niAB/5mo+BxM4g78GyUCblSpeqCuQjiMTE5adWZa5D:SeeL2+IfAABIooWOlSIvuQj91Ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675738925, "uuid": "d32dbbd3-d933-4c04-bcc9-399b3e261e52", "value": 307200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675738925, "uuid": "c96bfa9f-30a1-4ad2-8cfd-b566a4cc5634", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675738925, "uuid": "9dcb3560-dc76-4ec8-a6af-e9b0fb1970af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0785dce8-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675783261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783261, "uuid": "49394b08-a129-4b74-912e-7963516d812a", "comment": "Malware payload (GuLoader)", "value": "7c20d5ade929824c67ae1784fc049959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783261, "uuid": "857c12f2-1c7b-4ae0-82e2-fa05dcb864b8", "comment": "Malware payload (GuLoader)", "value": "b229c10377a08caff5270bbb27cf04093974cf2fd6d3b5b516c1831cc1fe3f0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783261, "uuid": "c882cf7d-2f16-43af-9cfb-1df45c9beb75", "comment": "Malware payload (GuLoader)", "value": "d301a4325c96cd39e3b44154a41171ae9527578e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783261, "uuid": "6fffeb13-3f2e-47ca-b0cc-9557f73faea2", "comment": "Malware payload (GuLoader)", "value": "0a226006117e393504f5e6b4c3a32039d1e27a189a313408e4921f0089654ab4978a4ebc259a17c5b8e31cfaaef05be0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783261, "uuid": "6a863d9b-d887-431c-82fb-a20af6d50bd8", "value": "T1AD052200E3E32183CDA548B549EF1674ACC67D5244C51E838B8D723766F6E41FEAA8BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783261, "uuid": "89b34b22-5559-42fc-a0a0-4fc65f0f3366", "value": "076b06e6a65c9b7cca5a61be0cd82165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783261, "uuid": "04a93e3e-efa0-45b7-a5ac-4d7eca3d1cf5", "value": "12288:BVKBG73lOUG2H7zS8zjOVx+it3OPw1idainaauDQoKp3pAyYGHuC00I:RrlMa7zbziH+mKwhMP37U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783261, "uuid": "04696615-21f5-46a5-b766-fa16bc2b4493", "value": 867534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783261, "uuid": "b39d7643-96e2-44d1-a752-734c351a39c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783261, "uuid": "f13ba843-8b19-4fb1-aac8-4e4999eaa384", "value": "AR_STATEMENT_13740_ARIHANT ELECTRI_02JEN06_115700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb48595-a710-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675792369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792369, "uuid": "358aeeed-bdef-416c-b3a4-a68f76ea40b3", "comment": "Malware payload (Quakbot)", "value": "eb82946616340003a34f3917b18fd349", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792369, "uuid": "96a1f11a-2e6d-4e44-b52a-655e8db1663f", "comment": "Malware payload (Quakbot)", "value": "b258c6a501fb7d45896cd4c4b2638e552149845c391c4ce035fafa9e5b5d9a39", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792369, "uuid": "222092cd-1bd7-4b68-baca-62cd2ccc1f60", "comment": "Malware payload (Quakbot)", "value": "85aba92382536f80a7674e66828397d5ae472c5f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792369, "uuid": "9ca2ce22-aef5-46e4-83da-dbdd9ddbaf3b", "comment": "Malware payload (Quakbot)", "value": "06441d744b47eac374379733def19eab0658ea5bdddf42c656d669cdda42be416a73977ef7a5adeb1973cbc42bfae74c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792369, "uuid": "69b5f4f5-b4a1-4b1c-a903-430567e1a902", "value": "T189940805B792873AFEC7E0BF0346829A9A74627BA433501E6514BD75FB303B1716E932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792369, "uuid": "9573475f-cfcf-49bc-8ee6-23be87e3c914", "value": "ed7b82ba2c3d48fc4ed65dff68081358", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792369, "uuid": "1f645458-5fd2-43bc-adb5-bc3fa760448f", "value": "6144:Iubpx1ymed01f3UBRxFoNgKIlp6Ydc2Zo5QLxZ8Ex6kmh08PfJO8L:XN8d0dkfxFoNgKIlbdc2WQLy28", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675792369, "uuid": "a07e5b2f-2369-4189-a54c-8aea09fed934", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675792369, "uuid": "ad1c7877-34b1-4db8-999b-c138415a16af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792369, "uuid": "ba13bcc6-6dd8-425e-9a9d-b1c90d0638e8", "value": "41067.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408ec147-a700-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675785504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785504, "uuid": "02dda199-a6fd-4e5f-a08c-60384d5fc314", "comment": "Malware payload (AveMariaRAT)", "value": "1b3d01265bd68ad96a38966e4f8526f6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785504, "uuid": "d94df61f-782e-47d3-8a2b-19ac46a98e54", "comment": "Malware payload (AveMariaRAT)", "value": "b320fa114a23a5a628f5e3bda3a287fe38a925c24141f6acbb3737ebd8ddfcf7", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785504, "uuid": "77b24b6c-5cf0-4ad0-995b-32f9d49c416b", "comment": "Malware payload (AveMariaRAT)", "value": "c7db1a071b9860dbfce0eeb39ed79e1c0ee5832b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785504, "uuid": "a3af6480-a11f-414b-9782-7f9e2fb54ac5", "comment": "Malware payload (AveMariaRAT)", "value": "6c62293f531c395282b4c94541918afccff79f44d181403061699cf49040aecc8710b8cfd644c14a40ebf47de8ea24ec", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785504, "uuid": "9c672f98-e2fe-4601-b88a-ffc6205ce4cb", "value": "T14665D70236981557E4E195F142AA632A70E5DFB2930898D353A43DF9B73D2F3BC32636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785504, "uuid": "38411176-9aab-45b1-963f-ffa1ce2e2fbc", "value": "998288a19e8050ed5a88195fc11cf00c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785504, "uuid": "3c06c8fa-c56c-4a63-aa4d-ae8528554ce2", "value": "12288:JHs3k6pbTKiiEuuSl34BMtWTUagOOM7PUEUz6EZKuo0HRCCCBjsBkM:ds3k6pbThoW4agOOM7UPgrj6k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675785504, "uuid": "0bad96f0-279e-4a1e-9d20-5e2a41340ce9", "value": 1517568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675785504, "uuid": "e1bbc8c7-a82b-47ea-adbe-217cb1f63b78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785504, "uuid": "260b3ae4-bbf9-4bce-bdbf-038bbdc0a191", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2065d7d-a702-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675786607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786607, "uuid": "fd299695-91a7-4a15-91bf-c2cdc365e63e", "comment": "Malware payload (AgentTesla)", "value": "b8f8bd49c53de62e11ae91fbe40b8620", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786607, "uuid": "2d92e388-9079-4f1f-90a8-a19bbfc4e8cc", "comment": "Malware payload (AgentTesla)", "value": "b4638d0cb5a9f014b950e3e0b6f935885a1e57f791dc5bb580429e19ce62811d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786607, "uuid": "56416385-840a-4994-9343-5f278b6c7a2f", "comment": "Malware payload (AgentTesla)", "value": "b9d9eafd0a6b40a20795595fd633761e90abe137", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786607, "uuid": "28ec8e34-6718-42d4-a7c2-9fca030eb466", "comment": "Malware payload (AgentTesla)", "value": "da2f02d71d4468d3f910b0bb3637c850e39733376392d82aa8d4c258f287d82cc039866858d387ae186a26e1ca454366", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786607, "uuid": "fdb5264d-25f8-4bd8-81f2-359fd2ad42ce", "value": "T108541364E3E0C0B3D4531F72197B426BAAF3B866247983CF07806A6C7251661EE3D797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786607, "uuid": "3c2bbf46-f680-4bae-b3f6-735c3f78a2d0", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786607, "uuid": "bd1032f5-ee0f-4f2e-9f36-e75b904e0900", "value": "6144:/Ya67R7KnPvAr/Bf67evl8L6KDvljn5cDyCbDrG2UC6FCUxpfK:/Yhgna5f67IlCnvl7wDrepfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675786607, "uuid": "b17f921e-2e7a-4766-8ada-fc2f8f6dae17", "value": 280736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675786607, "uuid": "7221f191-5fcf-4895-973e-fc38be34a02c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786607, "uuid": "bff87b7d-b9fd-46d2-ba92-a45091d73a0e", "value": "OR98764357890-098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c2ee21-a6b3-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675752420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752420, "uuid": "1b6aa381-14eb-4199-b003-a66e78508df0", "comment": "Malware payload (AgentTesla)", "value": "486d936356731034818982b47a91d8d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752420, "uuid": "db918bf7-1dda-47d6-b09b-178af874c0c6", "comment": "Malware payload (AgentTesla)", "value": "b594b5806104bcf450e25c6faa6d79c74006821c9d110b012703966e0da33b9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752420, "uuid": "3b067212-d2f4-4d2d-9a7f-8d0b0a8bf19d", "comment": "Malware payload (AgentTesla)", "value": "e0ea865a0be027898bc84ecdb3acbac050f0fb4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752420, "uuid": "92d2f868-f9cf-4083-914e-99af9bf129b4", "comment": "Malware payload (AgentTesla)", "value": "8ff0511b2b0d4b9ded7df8387a246234de90bc6315b4f219fb01c46fd93fae7ec8bd6873f19d9ea70c5f2a274fa1fe9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752420, "uuid": "efce2a4b-f43f-46a4-a04c-a5f877b21f65", "value": "T15B242303442B0D7AECBE64480971B16A8C634AC35E2478D7161DD78FFB46B3B68D91FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752420, "uuid": "54a2cd5d-2991-4b16-9768-fe877a3ac694", "value": "3072:XkAhSM2CQuFdrxW7HiIavWvebaX7jGdTihaujLSZVr5HYzmlI1P50NW6fNYE/NRO:XLYvZakeeuBihHL6rBdK1PCVNt/z+Q2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752420, "uuid": "641c67c5-6738-4128-a4a4-ab5b19d209dc", "value": 221211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752420, "uuid": "440cdd43-9f22-491f-9131-bcbce905d0b3", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752420, "uuid": "776a87ac-8fc1-400d-9c60-f7f4d27455ab", "value": "factuur.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43acce78-a726-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675801830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801830, "uuid": "ced2d5c3-9301-46aa-ae5f-6f1dde0e3c5d", "comment": "Malware payload", "value": "32f2463ca98d21cb2dbcb19bc0fe8628", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801830, "uuid": "0f90bf67-be5e-417b-9c6a-adb2019aabe3", "comment": "Malware payload", "value": "b61905f1af8d22e51fa0c293801fd2f2e15bb9358ff59a26239dd190e4d089aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801830, "uuid": "db019add-0ddd-4884-8fd0-56667feba6b5", "comment": "Malware payload", "value": "53c7ef403eabc8d3fb96d34bf3ee62512748cd15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801830, "uuid": "c69038ea-af20-449e-8b48-4566c3640576", "comment": "Malware payload", "value": "f9f098f4eb3f42b391876441c992836e7b1d88ca27f37660a3fb56c1be40ec7455457a725c4b93aeb3bd6775aa21aa71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801830, "uuid": "efaef2e2-4f42-40f2-ba13-8a6d6b4775ad", "value": "T1C676236362140112E0E7B83475EBFE9830FA1F93DF01E53D45AE7AC5163EDA8BE2154A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801830, "uuid": "46a5987b-fe78-453f-8291-a26ff4745a4e", "value": "161839a78ef6f07a30d3f07895f6fe23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801830, "uuid": "2868d80e-d02b-4cd3-9bc9-c2eafed54ac4", "value": "196608:sMYfGG6DsnE8h57KvW3q/tLuas8BBX0Evc:geGnEAVKO3klBnDv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675801830, "uuid": "426fa1d5-fa9f-4035-a89b-e22c89807e17", "value": 7269888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675801830, "uuid": "68b31630-0aba-4387-a3ba-a1b23ad0e626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801830, "uuid": "32fd3919-1cc1-4dde-8b4b-1ec97a48e5de", "value": "Set-Up_File-PC.stripped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914590f3-a70f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675792082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792082, "uuid": "cdeb2754-64f1-42ea-bec6-257f388340e0", "comment": "Malware payload (RemcosRAT)", "value": "779b2202c0535b45df0764eb66eae774", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792082, "uuid": "a99b2307-8b7d-4805-bb6b-9a05a1dc5c83", "comment": "Malware payload (RemcosRAT)", "value": "b66218a3deea95832497e55e03b016cd2df88c8d56d39821b6d76115e2e88120", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792082, "uuid": "ac0f8c75-f724-497b-9d11-c9c334159815", "comment": "Malware payload (RemcosRAT)", "value": "111bdf196e0965d3bb819427cd54b3c6670324d3", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792082, "uuid": "f54cd7f6-e053-45da-8265-0ea0f653cf13", "comment": "Malware payload (RemcosRAT)", "value": "b860ca7f71eac0fd2a794de383a32d7e7c53b2d8a31d182b377e393d409fa624b9403a619ee848d12b8b51d23540edd6", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792082, "uuid": "bf0d9910-9041-4e0d-a52c-91eeb620e02c", "value": "T148B423DAEF9F9F1B2165F01C125685B1884E278073BE082643F5202E64B4A6F6F78F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792082, "uuid": "fc3b2082-4bb3-42af-8782-784a8f894f7d", "value": "12288:XXw/mqqMeRdy2biJGepPaSMIDsQmEaPvSVHMvset2rpqRimh8/YBCXF+4iiHcGdy:XI8MY/elaFIDbza3S5+D82ibHXF+7i8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675792082, "uuid": "496f8eaf-3a35-4334-add0-ff5c4cf5fda8", "value": 525857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675792082, "uuid": "d8e4628f-1174-46a5-a008-f8d26f35e993", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792082, "uuid": "68c0000b-f67d-4675-bb07-05ab56d18759", "value": "hesaphareketi-01.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2f4e21-a6f0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675778737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778737, "uuid": "7350d26d-a33a-46fd-848f-1436355d6a47", "comment": "Malware payload (RecordBreaker)", "value": "fdf79f44f760c5278cc0e232792e03ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778737, "uuid": "8e619e83-daed-42dd-a38b-a8d2a045cac6", "comment": "Malware payload (RecordBreaker)", "value": "b70426b39bb8cea6d9f7d30ece7f73f466ac233fa9026ba5b4d526cac58a1534", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778737, "uuid": "dc2f09e0-9852-4214-a951-b1fbaa3f596f", "comment": "Malware payload (RecordBreaker)", "value": "c1de9c10c4c01b33d5268e7f2d4f28e4e8e303e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778737, "uuid": "1939fc82-16bf-4851-9cea-1c66febfaed1", "comment": "Malware payload (RecordBreaker)", "value": "ca493b0d8ab6282a5a75da039771b06f090af5ced3035ac0075335e14284c4c5c147c240ce39382b0dd1cb6aa493b3c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778737, "uuid": "28184466-b2f5-467c-bf93-d74b6a492749", "value": "T12614E032FAD0C072C17A243C4874DAB4ABBEB8315675D91B779807AE5F702D0567A38B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778737, "uuid": "297477f3-a122-4dac-a866-d5eb21da8ad3", "value": "cdb2dd381be56018fc9552ac3271a401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778737, "uuid": "8fafb122-fa88-41d2-9e04-326967e5e512", "value": "3072:Te3ObVtrESOLByVGW5M5GtZUQGERJtLRoDOX/jCXErD:Te3onOLIVGOzUQGERTVoqX/eXE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778737, "uuid": "42ebc8c8-9cbd-428e-b79f-9536135febc0", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778737, "uuid": "d0ae20ec-79af-41e1-887d-316e6f5eed41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778737, "uuid": "46f5c654-0307-41a9-9de1-e258d99881fd", "value": "fdf79f44f760c5278cc0e232792e03ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e8b012-a73d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675811680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811680, "uuid": "b3cfb4c2-47e7-4df8-b47c-20904d94d0f1", "comment": "Malware payload", "value": "56261e0eec9cf06f0cec7be6dd273f76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811680, "uuid": "17744b89-ca82-45d0-b23e-c04ee45779b4", "comment": "Malware payload", "value": "b7120f670580add5d656f32ae0180c8dfd138ca9989403e649d5d642987cec6d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811680, "uuid": "4349ca71-c374-430c-be07-cb809c3cc0e1", "comment": "Malware payload", "value": "66cad4bbe85128af0d1c4dedad50861a523f4329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675811680, "uuid": "3f634953-3981-4e42-93f0-9604ffc3da15", "comment": "Malware payload", "value": "e0f9dafbc4e0202597b28efff14b8139acdf6b1238e3b63c78a1c13f1fa94bc06e144ce2fc3064fccb23b0b4ed44c3c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811680, "uuid": "4f0a172d-3218-4e0b-b5b8-d0d17942e9b4", "value": "T171B40203E7FCC072E9B547B018F602C31A36BDA15A39835F275A6D591CB3AA4627172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811680, "uuid": "93ed725b-2d5d-4fda-a4df-67ebb79d7eec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811680, "uuid": "77b7bf43-6761-4e15-97b8-2b5c95cd4ca0", "value": "12288:nMrOy90zV1m1TW3aOZK5CDlzo0yxz87Mv5ikj:ByIgTOZoCu0yxz87MxB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675811680, "uuid": "f33fde79-9749-4c8d-9743-ab8c4acec5b0", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675811680, "uuid": "84f6b292-d3e3-4e67-84e9-a7779ae38630", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675811680, "uuid": "8af2ddac-8ecc-43cf-b979-d1e507e07b26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "093e7693-a680-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675730435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730435, "uuid": "85e3d3d5-36a6-4c62-985a-c81e0dc6a961", "comment": "Malware payload (njrat)", "value": "a7c0c2333b7e07057647b6dcc1d0d5ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730435, "uuid": "ea9415e3-7a0c-4795-8c1f-587e20534411", "comment": "Malware payload (njrat)", "value": "b81f300ef1dfaa7f5c3d2bc0fa57a5bd74537eccfea550ddf44be4a30c39714e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730435, "uuid": "60cd553e-9895-4561-a634-fc5e506c55ec", "comment": "Malware payload (njrat)", "value": "d8f3b54f4586ac682a013650f4350b4c9a9955a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730435, "uuid": "684e81ab-e4e5-487f-bfdf-2954a1c48f9f", "comment": "Malware payload (njrat)", "value": "46b5e28ae1479a1ab508c219c97dce281244f8707175b38b73e6ce59761de084dad009a197960f7ac98b3388805a8b64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730435, "uuid": "9f0cba67-806f-42d0-988c-8a3d194643a9", "value": "T1BFA3101125FF405DF3A79BB20FD4F8BF8AAAE873161AB1B53A5017468722E008D52776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730435, "uuid": "b11da59f-774f-40f9-83a1-66798519aecd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730435, "uuid": "f8270c92-b61f-4731-87af-30856c227907", "value": "1536:6pvTI4X0UkJ2fe8o2VLWjOnZvU6l2MBnlLn/aaAqMnjkP:6pvE4uJ2Q2kFOZhZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675730435, "uuid": "3ac11da8-f399-45cd-a13a-92005cb45994", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675730435, "uuid": "fc7fb143-ccef-49dc-add1-35c06d42d9c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730435, "uuid": "542f8e52-63ca-4dfb-b416-4629a61a0550", "value": "a7c0c2333b7e07057647b6dcc1d0d5ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06b22f43-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675783259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783259, "uuid": "b3fe1f90-bd2f-4666-a999-9a872601d5e9", "comment": "Malware payload", "value": "1792be0e2f5b2b22117a43b093a71644", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783259, "uuid": "95e36806-e1c7-4b5c-9f65-887c0c2ad098", "comment": "Malware payload", "value": "b8bc29fc176a1a8626286ec95d6e6a50199c6c82cc5a973758d2aaa6e8d39a5a", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783259, "uuid": "b93a9749-0d7d-4ee0-a483-f33b9c45ebab", "comment": "Malware payload", "value": "36ab4e2d3149e43fb3d100ff66f8110f67776fe5", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783259, "uuid": "383e9c0b-ab08-4046-91a2-c70521ac336d", "comment": "Malware payload", "value": "5b94a816cff3d6697ce88227cd76958dff94c65092c7c5d79d3b6230b64d6eea77abd7a4332b526bc738f35ff719f0d6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783259, "uuid": "bc0ec0c7-dfdc-48b1-b28e-c196a8cd9c8c", "value": "T1E5517C023DDC714A97582CF056BB963560506F88F7205F723E58C2158BC2C9B317E023", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783259, "uuid": "23306500-c849-475f-a688-e6e7c63fc511", "value": "48:ZSnXFtHb8CKhKF33qijKFITGCEZRvCMwJnWC9RdvcBC7bc4cXAoVY9vcVH:ZSXwLh+6ItzEZRaJhJdkoQroEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783259, "uuid": "10db1d6f-f0a8-4543-91f7-7e78028afece", "value": 2798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783259, "uuid": "3440d039-20f1-40ff-9db2-2958eb97e69e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783259, "uuid": "e2bfee46-f860-4518-b830-9768414d312f", "value": "210909836-042205.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a2adc1-a70d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675791394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791394, "uuid": "b8ceecb0-a316-4a43-a11b-e60ba9c5295f", "comment": "Malware payload (GuLoader)", "value": "6dbc4b8acb26300c2246e753f18f482a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791394, "uuid": "c9c9a582-9a68-4a60-8cc1-e8904d10da86", "comment": "Malware payload (GuLoader)", "value": "b8d50e753171579f486f0f2aa2a2c10a1d11f785c78c257647a6e5cb62ec7fe7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791394, "uuid": "0d76f2a4-464e-4f0e-8bb8-e8c187709b41", "comment": "Malware payload (GuLoader)", "value": "403df794c6e9ce3e538a9eb020228dd68e18b97b", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675791394, "uuid": "baade97b-cf6c-41b5-aacd-2df78691b8c4", "comment": "Malware payload (GuLoader)", "value": "389f217385acdba94ebe1222c73d905423e52f440e9eb8e1f043574a878a937bfddd1978fb0a19b54d2288e0b57f4a44", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791394, "uuid": "58449d83-bd86-4d59-a3f5-a756cbd3ac8b", "value": "T1DA937DA0AE2EDE1449063A15AC831E88FB7AFD26542315FBBDE13F49151214CC67F72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791394, "uuid": "6d95c6b5-d8bf-4053-bc97-0dcf968bb117", "value": "1536:QA/mpA5Ob+jb52SAUmzk3iTY/Wxfi0PS6LW1XHp4ASi:n/iyE0b5wUmzk3iTY+xfi0PS6QXJki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675791394, "uuid": "7d492406-827f-4bee-aa24-c5deeebd78c7", "value": 88874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675791394, "uuid": "f4414b71-e03a-4457-8089-7f5ce9aa7b3b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675791394, "uuid": "a29adb59-26a5-4ffd-969c-06b62644a5d7", "value": "transferencia........vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b37a2a-a69b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675742165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742165, "uuid": "78f0d1a8-34d9-4775-aee8-0f56f044ebef", "comment": "Malware payload", "value": "8f013c4e4899efef8c99848bed445f12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742165, "uuid": "b9661b62-440d-4db9-8375-fad3941dc489", "comment": "Malware payload", "value": "b8f90d0c9bb5720234ae64e3ead00ccb9e7a87300dc3c6bdd55b06788286b540", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742165, "uuid": "0d4241a8-d6d0-4b2c-a91f-4669727f8e1f", "comment": "Malware payload", "value": "ba42bae8e45928612934a8f06081dbfaae230545", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675742165, "uuid": "1399f0f7-f78e-4966-a5ba-f5204c82616f", "comment": "Malware payload", "value": "e337d78e1ddf19d4d15dfcb2fc1c8d1ebb246e188c9fa83b97492cf5a9770a1606a659846a8965f468699220a7a96d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742165, "uuid": "b7669330-4e5b-4083-ad7c-204c072c7486", "value": "T1287633A4B4C00972D7616630C572BBB433FED2BE2F5628539BCC4A2F3E74565C439A89", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742165, "uuid": "4108c691-d081-406d-94fd-a0487bd3c792", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742165, "uuid": "45c8b8d7-da28-45ad-8644-5abbaf06956e", "value": "196608:91OdGJ8q9VuZ83a2DP3Ws8hDWp1GkIEcclO:3Od9CupC3WsIDSGAlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675742165, "uuid": "42340745-3906-44bc-9199-3fb0a45599ec", "value": 7600530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675742165, "uuid": "8ae2e2f1-a8bf-4aff-9b58-55f8b4e829d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675742165, "uuid": "56972520-6a15-41d2-ba73-e36daa25cd09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38e8d25-a72d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675805024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805024, "uuid": "e5cad32f-976e-4e66-86a7-04a30e2ec341", "comment": "Malware payload", "value": "2e1cd7c549ec6f71c27ab2372d8d69e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805024, "uuid": "d002121a-c9c1-435f-9ca8-86cd7fe31d6e", "comment": "Malware payload", "value": "b969b84747e1b67f7947a6274e8354bc1a876c48476d7f47c1b71b989aa2c270", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805024, "uuid": "bcef42be-85df-4094-b26d-9aba792e383a", "comment": "Malware payload", "value": "73e9434c1253014d0348218c76c48c5375cc19e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675805024, "uuid": "1970dbaa-78fe-4bb2-9cbe-6d2015ff01ac", "comment": "Malware payload", "value": "b54d4e4d38dfc333adeae8fff5acb3eb9ca6fd756ac58d956dfa4e043984841444c6d7c41e0d6fcc9e728675c1150239", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805024, "uuid": "1b49eb3c-da62-4aa8-890a-6c83eb25b55f", "value": "T13F14D0223AD0C073C9BA54304C60EB617BBDF93096758A5B7B941BBE5F306C0677A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805024, "uuid": "8499d711-b951-4530-9f74-2eb8b1bb4852", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805024, "uuid": "15c9846c-1717-40d3-9754-c16393b14c02", "value": "3072:GWKOk2QNYC0TL9IEWy/5C2JgDULcOrZmkITUEGVbKgud0aFp+WZFbg:GWKdqTLGEvU9NOlmkITdguyab+WZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675805024, "uuid": "56617276-7d27-4626-8b24-d21ff92af2e7", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675805024, "uuid": "e70e15ed-430c-4383-b758-d266157c4a79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675805024, "uuid": "cfd1c465-496e-4c27-aef3-6dfbf3f282fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59c5cb0d-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675758488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758488, "uuid": "ae850c34-aae5-416d-b044-6928a3d0fe5c", "comment": "Malware payload (SnakeKeylogger)", "value": "2a5ab8de43e107a3dcfbcdaf9d7822e9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758488, "uuid": "fe1df4a5-482f-4991-ba07-6ada1525625d", "comment": "Malware payload (SnakeKeylogger)", "value": "bae79b629c06453b7f34ef8786f7759bb7a891f0447aadb08ed6136648d6d815", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758488, "uuid": "e542c32d-d333-43fc-8a44-232d95e9dd59", "comment": "Malware payload (SnakeKeylogger)", "value": "fa206129c276001aec693f19853b2aeb12bff66d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758488, "uuid": "fb7e112b-f3e2-4891-9ff9-bb1e196ce65b", "comment": "Malware payload (SnakeKeylogger)", "value": "af5dbe259303d8936f6d85fa96c920be4859499a9b9ee85244d6c385cd95fb76c764a456b00ff7ee9d88b87809d1bbf5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758488, "uuid": "576331d8-267c-4e14-8668-14788055d0b1", "value": "T1DC135C1AE79F12A4CF511273131A1A899AFDB33DB35054B1346C933433EDC2E46A6ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758488, "uuid": "9c6950fc-b424-4568-a93a-4fc44f96633a", "value": "768:kFx0XaIsnPRIa4fwJMFepNI00q7MXp1YaiSdualSgP:kf0Xvx3EMFeb7MpiSdualSgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758488, "uuid": "b9b63cc7-eebd-422b-afc6-fed908cd06ec", "value": 42070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758488, "uuid": "45ad0cdd-49af-429d-a143-9774fec92c88", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758488, "uuid": "513af933-da65-4af0-8654-e6b4b949ad7e", "value": "items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593b53d5-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757198, "uuid": "a38cd7f6-dcd4-4ca6-b3c9-b36066369563", "comment": "Malware payload (Gozi)", "value": "b76bbcbd543e10142885d78c832e98f3", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757198, "uuid": "b5e88658-fe41-48be-b861-6d21d61aa9c3", "comment": "Malware payload (Gozi)", "value": "bafa75bdfa5344ae1c718207a575eb2daa20b89d0f6ef4ca92b81c5950f9d564", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757198, "uuid": "385d0512-e81e-4644-a5c3-717fe9309773", "comment": "Malware payload (Gozi)", "value": "1127f62830d9dd93de97b412204f832099e7cc7d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757198, "uuid": "4712e44a-179f-4085-a6a9-5a88b6157f9a", "comment": "Malware payload (Gozi)", "value": "a9bcbed0a989c94568fceb1f0ae860324ed72896d3bd932adcf288cb668bc684eae01fb8c6f001ddc966f593c02f2836", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757198, "uuid": "a26a5127-4b25-42ec-b44c-d89a87750a29", "value": "T12BE18D8E9DDB981BE78081EFF2332D20FB6015BAC9297204B5E1F70E2A6776B014175C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757198, "uuid": "8d1dae62-51f7-4131-97b4-469de6ce574a", "value": "96:wWySWiLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dj29o:TU77rIKdn863jMM0OD9+VVF48xYkuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757198, "uuid": "5661b5c2-65ad-441d-8b8e-97251c6fdc8f", "value": 7020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757198, "uuid": "8f8f6c97-c2d6-4b96-85b7-92019465364b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757198, "uuid": "304ee937-9e2e-47ad-a065-6828e3d755cb", "value": "azienda_01.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d69dcfdd-a6ee-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675778025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778025, "uuid": "233b37c4-a4ce-4259-8387-ae6febf31c6c", "comment": "Malware payload (AgentTesla)", "value": "a91b952255664f9d052d71b998b5093e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778025, "uuid": "a4860841-0edf-4b13-9384-c726c6eaac90", "comment": "Malware payload (AgentTesla)", "value": "bb8e578f777a7963c7e18be9484136f341dae13f47afed2b7c6c46a3f4d47ca2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778025, "uuid": "2f6ca074-0784-451b-9778-16949fe2b988", "comment": "Malware payload (AgentTesla)", "value": "2194ddaa5ffaebc15d0901fe9837a3ef96609406", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778025, "uuid": "04a1ea0a-f1ce-42ba-a8c2-8c7e20d9afdc", "comment": "Malware payload (AgentTesla)", "value": "15f4c4b61cb86d38fca6075c59f220f6033921e8a2d5cccf7af0a71b2a5f8d3500b2485ab7a55601afe06c43afb33973", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778025, "uuid": "712a326f-c05d-44d9-b4ff-0e2148a76660", "value": "T16A357C013AF6C863F44A0A7460283DCC363CEC57ABE9419FB972B96453B2766F5D8D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778025, "uuid": "e35e97c6-6566-4d55-9bec-a396ea61bb01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778025, "uuid": "70f2dd5e-e03b-4055-8033-efff0a606df0", "value": "24576:dp1WYGDkjwJsoGlWzykX0RShZtfMeGTx6IryXZfR3FYYejL:dp0Y5UsoGlzkwSztfMeKx/EZfcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778025, "uuid": "93e5cf85-3b76-4934-af2b-6a80923fe8ea", "value": 1087488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778025, "uuid": "4d37d254-3b46-4c38-84e4-2587c58af879", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778025, "uuid": "8828c8e5-b01c-404f-8b5d-e6e0861836e3", "value": "Encargar art\u00edculos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2bcf916-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675789964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789964, "uuid": "0d0d9d35-2852-45d4-9615-c5e4e1a883c0", "comment": "Malware payload (Formbook)", "value": "7ba779a892c46cc26e45bc4c53241a70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789964, "uuid": "5a91d7b3-f953-44f0-8d31-210c5ef91123", "comment": "Malware payload (Formbook)", "value": "bb9b28b17b4e52bc320af0b1a70445a60c859f2205fa243516545e4f6cd0990b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789964, "uuid": "2292241b-f5f7-4662-a47d-ed97fffa64cc", "comment": "Malware payload (Formbook)", "value": "6db1d5b7822f02fb533c93c1d3f0d8e408c835f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789964, "uuid": "b240d26f-fcc9-48ab-aef3-0fc10b5b09af", "comment": "Malware payload (Formbook)", "value": "d26367292f2c9547883b6415f736a785db6a849a8baab6b93af1c943494c8872efc95778606678e3998c10c58314e41c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789964, "uuid": "c5259be5-6485-44e8-beb5-4b8ce483c362", "value": "T107257D113AF6C863F0490E7460283DCC3A3CE4479BDD419FA972AA6453E6B76F9D8D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789964, "uuid": "9742c78f-96ff-4cc8-a7b0-2d2872c20b2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789964, "uuid": "6160c6e1-bc03-4fb8-b927-04caa8440d55", "value": "12288:Ip2iNiETzZKNYTW0Dro9znvZlqhSYMJJlE5328JJYGD4FjwJszywOE4iPlnW+n3:Ip1kh0H8zKSR4PzYGDkjwJsoGlWw3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789964, "uuid": "99026b37-c19b-404f-a018-02d5509619bb", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789964, "uuid": "46bea9ba-5c1d-43f6-bbab-66a53bde86b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789964, "uuid": "742f8d37-64dd-4170-b5f3-ce3670f0e3be", "value": "Payment Notice_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72dd325b-a713-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675793749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793749, "uuid": "744e54dd-ac30-473c-98f5-a102d48d9c26", "comment": "Malware payload (AgentTesla)", "value": "a75fbbc32fd2fef0b8e9ac44ce01bd08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793749, "uuid": "78345d20-e936-4eef-9956-0c3f7e337ef4", "comment": "Malware payload (AgentTesla)", "value": "bba28ca66b05cb8733dd5fe3deaac9f618ddeb2218e349a900501399a70d50a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793749, "uuid": "c36a0642-9a35-4021-af9d-48a0ed8f3956", "comment": "Malware payload (AgentTesla)", "value": "dfa7ab7bba79f071bdafe736fececd9321135589", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675793749, "uuid": "27c3f923-ee67-44ca-9688-cbfbe2e6ab4e", "comment": "Malware payload (AgentTesla)", "value": "f49e50668468080396a866d193c7fd290562d1c4567b7245172433effd39bb45e4b3a2880050228f1da63a938e64b281", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793749, "uuid": "d9accad7-8dc8-426a-a2ae-82d7ff7e801b", "value": "T122F28E1576EC6323F87617F488D6656207B1B5926501EBAB1CDBA0CB4ED3B901710ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793749, "uuid": "ea4fe1da-57f0-49bc-ba2f-da892dac2760", "value": "768:mfCUhXwRCYUwM+x/TrVSciE7CT8u1XC7WYUByiRu6:K5XWM+xt7ZOtC75wyiI6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675793749, "uuid": "f3bbffda-01a6-488b-96af-e2f9a5b3adab", "value": 36200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675793749, "uuid": "9bb18902-b101-4634-8a3e-96ea0a462f88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675793749, "uuid": "831b96ca-2a44-4881-bd83-b5c85067a332", "value": "COTIZACIO\u0301N.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a3b5f8-a700-11ed-88f6-42010a9c006e", "comment": "Malware payload (SystemBC)", "timestamp": 1675785511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785511, "uuid": "326431f0-5eb1-4a0d-8155-15303d86cd00", "comment": "Malware payload (SystemBC)", "value": "046ec1348aa8b770b48b9b4530d2d407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785511, "uuid": "fcaf5d3f-4b5d-477d-a10a-6b85e69d57e9", "comment": "Malware payload (SystemBC)", "value": "bbaf5140518acfc1cd69cc595184869b0f6adda59134f83566393bc3435fb9d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785511, "uuid": "90e29f94-a397-46ff-b36d-cc1deef8fba5", "comment": "Malware payload (SystemBC)", "value": "781ecc1f27da4f8177271a3265ba16df605989b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785511, "uuid": "8e71f4b6-ec94-4391-81e0-3d117d80a048", "comment": "Malware payload (SystemBC)", "value": "5d7c41ef9aa657f46868110299a4201e537e06ab8781ae679f8f93cd823a8ac236aca2fc8642b1fd5d3943ef719a4976", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785511, "uuid": "fe86913a-1264-4976-8849-6e9dec0bab57", "value": "T13514D03336D0C0B2C5B765301820DBA66BBEB9310679C95BBBA8176E4F706D1673A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785511, "uuid": "180b0563-0047-4ab0-84dc-1737f6c2f4ab", "value": "af0a92fe52cf161a7b179d1f32aa9186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785511, "uuid": "af6e3e59-ac82-4941-9078-f84337aa9a73", "value": "3072:eYQO2z+akvRzLGFK4W2bB5QBfzr+JtIBCvN9LvR+u2JAzwxII:eYQnOLSK4+x3Yt2CXV+hAMx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675785511, "uuid": "82b48366-2ef0-44ea-8ddf-586e653404dc", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675785511, "uuid": "4d8d03f0-17fa-49de-a338-697406668db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785511, "uuid": "17438ca0-6723-4a85-9cdb-e4fb13b20fad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6475f6c6-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757217, "uuid": "e573037c-abf8-412e-938a-41c4f24f0e9f", "comment": "Malware payload (Gozi)", "value": "3cb28a5437cc6dfd208443cda93579fd", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757217, "uuid": "2f6622cc-b789-40a1-abee-9d95c688aa82", "comment": "Malware payload (Gozi)", "value": "bbdb8cc9ebe9f3d6a0792ccf0c43882594d716497ec34429e231254e8113d319", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757217, "uuid": "b84693cc-bf45-4cdf-872a-236610812d08", "comment": "Malware payload (Gozi)", "value": "864fa3974d30e0819cb5c14f6bcb7a461b84e5d9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757217, "uuid": "6d837a0f-97a5-41de-a2b7-69f3c98ca5ba", "comment": "Malware payload (Gozi)", "value": "d13a2179e8ebf560f7897f7589f17fa66004402b4e1daf699e175a97b1096c7e4a81c331cad87c54f38aa985369a812d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757217, "uuid": "a897c5f4-d67d-40fa-8378-d09b9b1c905b", "value": "T1E6E18D8E9DEBA41BA74481EFF2333D11FB6019BEC9297204B5E1F70E6A6372B014065C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757217, "uuid": "0cecd37b-4fb2-4232-9324-b5db05c43a88", "value": "192:KItPU77rIKdn863jMM0OD9+VVF48xYkuX:tS7EOM7/F4kuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757217, "uuid": "d1be5a04-029b-4a92-8760-7ebed4de6799", "value": 7015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757217, "uuid": "2e88e77e-922b-4a17-9c02-05e31bf4e0bb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757217, "uuid": "b88d84e4-8069-4873-b4db-1d43fa5dd417", "value": "azienda_03.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ea10df-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675788385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788385, "uuid": "6a89cc64-cbcf-487e-8777-d229a185381d", "comment": "Malware payload (Amadey)", "value": "555cf9bcaaa4f09ed4a6c18ee26f407f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788385, "uuid": "6ce3bbac-a887-43e0-ade3-ba9f10b9848f", "comment": "Malware payload (Amadey)", "value": "bcdf88965bc8ed75a73c532a1f3834f197490d57e9d6900c466026c4781759b7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788385, "uuid": "232ac019-a4f6-4b29-9106-990d78700610", "comment": "Malware payload (Amadey)", "value": "bf881d48e3a0f9cc42e4892996adad9ae123d3a4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788385, "uuid": "65f39bf2-87cb-4f5c-9187-619e38a1c313", "comment": "Malware payload (Amadey)", "value": "9a3995d70192fcc3fbf7973c8b94993f631675d3686674e621c9127c4e9113e746220cdf10671eaa7dbb21bca2bf90cb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788385, "uuid": "9a4cb906-4d5b-4510-ab2d-d8b954f7ec4a", "value": "T1B1B40207F7EC8022E4F5477018FA03D30A357DA16B78871B579EAD4A5CB25E0B23576A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788385, "uuid": "fe1efa6c-5a4b-4f18-a8b3-20cfd5aa1af5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788385, "uuid": "af83a7a4-14f2-46b7-85c2-838ad93aa258", "value": "12288:wMrBy90V/g80Bj+kE6UHRQILkdjOGeC1xoFLrb:hyqH0Z+n6EQ3dj1eOGFLrb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788385, "uuid": "234ebde6-7f77-4b07-ae94-f83214887b78", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788385, "uuid": "1c710867-cfd6-475c-be14-f8ebea7ccbba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788385, "uuid": "09bb3e3d-9444-4892-84ef-415f30aa0e39", "value": "bcdf88965bc8ed75a73c532a1f3834f197490d57e9d6900c466026c4781759b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae3411a-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675789279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789279, "uuid": "72ac4be9-1e45-41f9-acc4-7b88e0e585b2", "comment": "Malware payload (Formbook)", "value": "c78de47fa93850a67dff6acca9f9c099", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789279, "uuid": "4b2c78c9-922f-4aff-b8aa-e702c5988f28", "comment": "Malware payload (Formbook)", "value": "bd543b089126f0a1a7641a7bbbc4fcc2dbaae8d35ec5b204bf4ca429a5f50ee7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789279, "uuid": "963bb75a-12d9-4fa0-9fcd-028c51dd395e", "comment": "Malware payload (Formbook)", "value": "a81a642022ae1def29d9b88a4ca31a7e91fd8b83", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789279, "uuid": "011fcc12-9691-45ec-815a-a344ea1053a0", "comment": "Malware payload (Formbook)", "value": "05c487535cf5038aad512eb34d74c8f18287d6c03a7cdba5ad36801c785c42bcd0b8c523f0cf056670360b3d213a5024", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789279, "uuid": "24f1e209-dbbc-41ae-a329-4192a7d51ce3", "value": "T1A345AFB875047DE6667F576BDE96ACDC13B62A238ACBA4CD80647BC30563371FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789279, "uuid": "a44eed99-8e25-4a30-a820-05ecb948ff1c", "value": "24576:5ma7xJ52y8nwviBp9e0XHlhmSXneR5Jxuih/H573576Y0FebpqMHI8xWo:P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789279, "uuid": "4c083b6d-d79e-46d5-87b8-fed6523c076d", "value": 1223536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789279, "uuid": "3bebdd13-b2c2-436a-9123-1369913c11c1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789279, "uuid": "2d39a77c-c9cb-4048-96d1-4c9d3982ea8b", "value": "Sanos-Control-Product-Inquiry.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a69252-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757387, "uuid": "6f42ccfa-760c-4739-a54f-56923d54967e", "comment": "Malware payload (Gozi)", "value": "0ce2cfdeb3da2bd5ea36810257de54ca", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757387, "uuid": "a9f53acd-1a63-4ac6-a17c-a2f07f700388", "comment": "Malware payload (Gozi)", "value": "bd6bde893d7af70e740f72161d53e3544e38e0b45412d247b5f44b70918cc263", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757387, "uuid": "27bc3cb4-2121-4fd7-9255-4ce71126de17", "comment": "Malware payload (Gozi)", "value": "3ec488936ec3bb1d553f8df48fe04e9be3b0a343", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757387, "uuid": "c6a91d84-c8dd-4a2f-8aa4-73ca9796bd50", "comment": "Malware payload (Gozi)", "value": "5fb892fc7c08fba70fc537409a958cdf86cd66de5deb7a1869c3466c3cc965640283a60e5170cae03cf923ecde58ab40", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757387, "uuid": "23b2c1af-8b73-463e-8055-4f0d4db9e27f", "value": "T1EBE16B5EDEDBA01B5B8181DBF6B32C11FB5028BBD8396204B5E6E70E2AA6B67004115C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757387, "uuid": "f941e1d2-bea6-4d08-abb4-00ddc9ab451f", "value": "192:/OZhU77rIKdn863jMM0OD9+VVF4bUx/Ce:/Oy7EOM7/F4q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757387, "uuid": "26d93262-409c-4f1e-b54d-4117e90beb73", "value": 7026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757387, "uuid": "4954e2b0-14bc-4b92-a207-4d5a02990372", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757387, "uuid": "d2513ac6-67a5-48f3-9d4e-10b52127cfa4", "value": "azienda_16.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ef0a56-a6e4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1675773757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773757, "uuid": "1d0fea16-2678-49a8-a8f8-f5ae169405b2", "comment": "Malware payload (AuroraStealer)", "value": "a2b6bd94819a9dc7a06ec140f3885d66", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773757, "uuid": "57be2ecc-3fa2-4afc-985d-edb831073882", "comment": "Malware payload (AuroraStealer)", "value": "bec57545bc4d781eb4b601a93dfe6d8ae87b2bbb3e1be0258d49bf6327dad016", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773757, "uuid": "c644ad61-3af3-40d7-8ec2-ffe37e13bf11", "comment": "Malware payload (AuroraStealer)", "value": "7b89ee3609157a5297b437f015678f0dcdc8c136", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773757, "uuid": "6d10c5b8-4e85-4ae5-b6f6-901af7cc3f1a", "comment": "Malware payload (AuroraStealer)", "value": "c56546fbdf28de385adac90cb53fb78c7d504971e2c5d11511e5bce86fa6aba3a57ff6ec702bfd7df450fc2646b2d70e", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773757, "uuid": "ab9a1071-e812-471c-8952-105a804809d9", "value": "T14F262847F89581F4C0AED230CA669216BA713C894B3063D73B61F7B82B77BD46A79350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773757, "uuid": "3d210fea-7869-4999-8c6e-4f1cb78c29ba", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773757, "uuid": "957fb01f-029f-4303-8b1c-2869240434ef", "value": "49152:JN9W6Bd3ayC1XJ+33w52MUJKPjaxCsECa45ElvntGH5RDHZ01H:k6BRCv52MITEHGZRDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675773757, "uuid": "b3b995ad-76d1-4e41-8662-d07a484139fa", "value": 4659974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675773757, "uuid": "bb6be657-1520-4a13-947d-20c5bd8c6471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773757, "uuid": "a39c0776-60ea-4473-beaf-8b96e6b36ab5", "value": "bec57545bc4d781eb4b601a93dfe6d8ae87b2bbb3e1be0258d49bf6327dad016", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419cb7f6-a726-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675801826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801826, "uuid": "6288d726-e4f8-48ad-b772-bff111cf7b97", "comment": "Malware payload (RedLineStealer)", "value": "7b871a96ec93e02f9a0565027f0edf8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801826, "uuid": "1c71badc-9cc5-46dd-b210-94cd870dd219", "comment": "Malware payload (RedLineStealer)", "value": "bf04af3c3fb2bb3293577c3a0c45693e49d352ca08b6fa8e9e8071e7b587ec1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801826, "uuid": "2ed22607-7317-449f-ba75-31f68d9bfcc2", "comment": "Malware payload (RedLineStealer)", "value": "03aeceafd1af474e69059b7923f2bf26d5ce6ec5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801826, "uuid": "493c4a51-0db8-4bc7-92cd-e6ccd8179293", "comment": "Malware payload (RedLineStealer)", "value": "7c0ca67204945bf28ebfeda140928be343a0999a794aef3731df94d3f5dec49944ea5f714f88637c5afe888f4fff1865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801826, "uuid": "39ee7b3e-f012-4d71-8fb4-ad96d0ebe069", "value": "T17E64F1323990F071C5AB54709860E7609EBF7C304675992B77A507BEEF702E1A23E25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801826, "uuid": "7f8f6f07-73d0-4757-b7c4-5da86e04654b", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801826, "uuid": "57f5ce83-6fba-4a4f-87a2-7b2f369e88a8", "value": "6144:PWP1zKkWL29H7cub5Ap7X6g/hBECZ5SAt2P91K3oLU/l5QyFwu:PWPt1WK9H3S7fpB9SQsFY/8yF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675801826, "uuid": "e3c994c3-bb38-4ee0-900b-457d39a16bc9", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675801826, "uuid": "0f70d4e5-db0f-46af-be9e-84e2829e3b15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801826, "uuid": "483830fb-ef4f-4a12-a9b5-5609c931e990", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb9454a-a6a0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675744239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744239, "uuid": "79d9a568-c2f1-4922-966c-d4cd0d873400", "comment": "Malware payload (GCleaner)", "value": "6e747ee225add919a351a61fdefef27b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744239, "uuid": "03b8ef57-d669-4642-a418-9cfa5e4bea81", "comment": "Malware payload (GCleaner)", "value": "bf0fce0cc95f1921b8904e7083bfe09fdf454dfb234caada6d29504b7a6e46c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744239, "uuid": "52e71031-abf7-4be5-b6d5-d64569233d4d", "comment": "Malware payload (GCleaner)", "value": "623a35af7ced8ab35284eaf5ab033883c5ea4b32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675744239, "uuid": "73bc0330-08fe-4fd6-ba15-3bcf6c6399e1", "comment": "Malware payload (GCleaner)", "value": "ba6fb231b1e97a6e841bcab5f5b3aac6cfe261dcdb1b2090ec7a6113055899130430bdeb69744e2406f50860fc4727fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744239, "uuid": "0d9c963e-aa37-491c-ad89-72b3e3324c9d", "value": "T1F4D5E01A1C94D097D1608F70C9CB6DFA8C12EE6FE8BA509317047FFAB631205E95AD39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744239, "uuid": "70d91503-5694-4db4-aad6-2684079b854a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744239, "uuid": "25bb16d0-b3a9-49b5-91aa-33d938cf9907", "value": "49152:QwiSxGbF7w9NdrspuSfEgzoJ1zLIB6IQ9oREWNkkfb1vdJuQ3LCgv2MR:lidbFc9T0uOBo7zLIB6vINJdJuQDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675744239, "uuid": "6e2b7274-b6ea-4041-9bc8-b54f77a74e8c", "value": 2779204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675744239, "uuid": "0c38e407-1395-4503-902d-112f1583c81e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675744239, "uuid": "f9c289c5-63ba-4b6f-95ed-5604c6cff8c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "217c34f8-a717-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675795330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795330, "uuid": "6c4b0b5d-898f-40e6-9687-4b0d6d2cdc6e", "comment": "Malware payload (RedLineStealer)", "value": "568b7bfb4704fd983f84f85239b7ffdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795330, "uuid": "062cb951-7419-484d-8f33-83cf4f8ab151", "comment": "Malware payload (RedLineStealer)", "value": "bf704081a2b7509fde6efff9ab9213226af10ea0059e8abacd6c633fd16687d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795330, "uuid": "ef931b5b-9bc4-439c-8551-d7dac7405950", "comment": "Malware payload (RedLineStealer)", "value": "5b1ee5f39e914ce7359d31c87921b3471d02e1b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795330, "uuid": "b673eb97-9137-4cdd-8d41-1aa1561e0570", "comment": "Malware payload (RedLineStealer)", "value": "9f30dbd790e248f82797ecc1dedb63471d0fcabfc1225eb9db4d8c403a5551eafbc9be0e7ca07fd5e17cec5e4d18d83b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795330, "uuid": "f85e2dc8-6e1b-4b7c-94af-e45bdd38e54c", "value": "T1C965225AF7808194E43D83B16E7E49C82E337C2BB874A9793158B31D0CB31679A7735A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795330, "uuid": "004ee391-f50f-4f34-9aa4-6888435bc609", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795330, "uuid": "b8500cac-38e6-4b9d-8e73-bb612c1fcc7e", "value": "24576:kBjeUe5UeJmfIHM4O4muFgvZciS5lJ3ZGosy80EMbF71tsKCv9AAv1h3oS0wslL:kBab5bcd4muFgvKiCgy80EMB7TglAAv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795330, "uuid": "21c74029-3f7e-40b5-9ced-ca80bec9adb1", "value": 1534248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795330, "uuid": "73632e80-312d-493c-a795-85b0b05f78c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795330, "uuid": "543975b1-9d3b-4855-9ca0-4804b82613a8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37995f37-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758431, "uuid": "58b71ef7-30cb-484d-853c-87cacdaf032b", "comment": "Malware payload (Gozi)", "value": "c644c292ce374d3c6db193f2bc606206", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758431, "uuid": "8e2cf6df-df6d-44bd-aaf4-db02c6cddf09", "comment": "Malware payload (Gozi)", "value": "bfa6498428f0dd177a037d8c4a948369180d603c9b3a72e148b8cbcd8d9a2d71", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758431, "uuid": "025e326e-0281-4e3b-bb73-cc9331419be1", "comment": "Malware payload (Gozi)", "value": "32a3b6dea383219b25db3929ec0ebb9d9775230c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758431, "uuid": "86b3de6f-b0b1-4d54-94d4-c82a8a20e294", "comment": "Malware payload (Gozi)", "value": "b60d623c3221892f8ebeb39026b2ba4e3ed72a32ec9fee967e665a724c98dd71f4393930c2756de4d495be240c73d09e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758431, "uuid": "ceee9ed7-be1c-4357-b572-92c09b4c3bdb", "value": "T1BCE18D4EA9DB641BA78081EFF6733C10FB50197ED9297104B5E2E30E2BA6727004175C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758431, "uuid": "542f67ab-d901-4f81-8d04-c5a5ec608fb9", "value": "96:w4BG1LVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dl96r2:D0U77rIKdn863jMM0OD9+VVF4vx4kuO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758431, "uuid": "9d69bc63-d721-498b-8cf2-f5c1883bcf53", "value": 7034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758431, "uuid": "84204ef8-be85-44b8-9b12-9f5b5e4dba4f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758431, "uuid": "e69e44db-0549-4319-9e2a-8282b851af49", "value": "azienda_30.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfc49eb-a6e1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675772479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772479, "uuid": "26237cee-c012-4700-bf48-f39055269447", "comment": "Malware payload (Formbook)", "value": "e092974dbde1ddbcd359bda0538e611a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772479, "uuid": "cd5cddea-2b96-44d3-aa1b-eef0b7b07e09", "comment": "Malware payload (Formbook)", "value": "bfbb813e9a05c15ec2bc9aa9088bf82c7f5d57e7bfafee7c197944e339d16431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772479, "uuid": "6dee9b79-74e3-42e2-8946-a6fcc9158eb6", "comment": "Malware payload (Formbook)", "value": "4069e96dd291156f0ba5060bc58c7cefd2ec04a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772479, "uuid": "f07261c0-94df-42e3-b6a1-306bdb048b3e", "comment": "Malware payload (Formbook)", "value": "2227b34dd8bc0425e21a39f1a1e316e494a695be7a5c831cec9cb3feee810c9d20f7a919ae62493406299e92ccf24dc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772479, "uuid": "842cd334-535a-4a41-821b-fb4eaf4dc489", "value": "T15E6412A4B5CCE86BD46303716D79262BF975EF242424130B07B08F5CFE65683DA0A7B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772479, "uuid": "05fcfc1c-fe5d-493b-b373-a2482aceff0c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772479, "uuid": "bd77e2fb-f7a5-43d4-a933-e49f39645671", "value": "6144:/Ya6TfVC7xXKhPQ7HWpHFHZq1A7tynn9LSXHUBbPv/LsDB9FiZeoQ:/YxfVC7xXcwHWplH468nwkh/LNeoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772479, "uuid": "afd216a1-d17d-4aeb-820f-8b5fe26a2e46", "value": 309403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772479, "uuid": "007e3cb7-0032-4064-8bd1-3e1f1923a33f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772479, "uuid": "3ac6bee1-9669-4582-aba0-da01d45ab71e", "value": "bfbb813e9a05c15ec2bc9aa9088bf82c7f5d57e7bfafee7c197944e339d16431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d15681e3-a689-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675734637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734637, "uuid": "3c07b2e0-66e8-4ebf-a46d-3a42122c80b4", "comment": "Malware payload (RedLineStealer)", "value": "041c77d71d120efb0e2cd960c4508698", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734637, "uuid": "31325ebd-cfa8-4272-b98b-6878b0ed48f8", "comment": "Malware payload (RedLineStealer)", "value": "bfc306ee068219e7e538f6426c5b92bcb00d1289d82805f6e855b09f73b71514", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734637, "uuid": "195b11ce-2294-4cbe-a5b8-5f363cc7faac", "comment": "Malware payload (RedLineStealer)", "value": "cdab651ce3b9618aa29f9b6b82f336f246b475e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675734637, "uuid": "01dd3330-73d6-4b18-87e9-8ff409b53ddf", "comment": "Malware payload (RedLineStealer)", "value": "649de4e6dd276edd581c919be5b31fbfbc617669492acad8389b2ddf1e70f07a91caf1a2be1f326d3d2a8c53f9e5f7bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734637, "uuid": "cb33119f-296b-4907-986c-e7cdae803f8b", "value": "T1ADA63313B7DA982DE7F30736B8F49775A9B5FC221B16D20B1AC538282D66FC64D30126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734637, "uuid": "6529ce1c-ff5b-4f51-ab81-6323da95a0d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734637, "uuid": "5adf84a9-d63d-4763-8ad1-ce5fb228d0b2", "value": "196608:eAIlXzkneX38DXDQ9/tbYPvbJQlHHO2SvJCQJ8CeGIP2W8ye:yly0MDTQ9/kJQlnneO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675734637, "uuid": "7aae460a-4b0e-4431-986a-88d79075cc2b", "value": 10060288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675734637, "uuid": "d615806e-4b0e-45c3-8941-5aaea15e53e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675734637, "uuid": "3e72aae1-3085-4e12-a771-ae52abd1877b", "value": "041c77d71d120efb0e2cd960c4508698.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb6d87b7-a725-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675801601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801601, "uuid": "4088f04d-9527-44fc-961d-f47f58005bf1", "comment": "Malware payload", "value": "9bc3f65193e2c4d9b8c6b2bd9d68ca53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801601, "uuid": "3e24cc79-ab59-49d0-b736-498786b2da83", "comment": "Malware payload", "value": "bfc3633e1f0f1f2ca6be2607b90bd2514117fa74f0bd53f73ee4b9d3a2ef2acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801601, "uuid": "a043337e-d1a1-4398-a708-7075aa1aced8", "comment": "Malware payload", "value": "5d85f3c08a2cf41b9afc8e0bbb291348a5da53b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675801601, "uuid": "8f5c0210-1edf-406e-bdbf-024f6593757c", "comment": "Malware payload", "value": "9b55c6100b33e7425e324beaba1865adaa76c949c8e877bd85ed67dd7eb3985f9b46023770a8c2076e1575e60aad044a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801601, "uuid": "e26a7f0e-f55e-4760-8133-1b757fe1acb9", "value": "T1FFD5D03A98C35AB5C4549C31A3B818F812FDB72F3047EEA654551EE5FB102CBAD124EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801601, "uuid": "b771d504-11f1-4ccf-a7ba-d52f300e07b3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801601, "uuid": "efd65d45-8ec0-40e4-982f-d861db14491a", "value": "49152:VTpr5MnBsRHgoEXzHxu24lkeIJ+uqyXFuns:VTp3NGx74lPIo0X/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675801601, "uuid": "a089ab56-1cb2-4f99-993c-fc5adbfe94ec", "value": 2837768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675801601, "uuid": "c1dbb118-0831-4cb6-acde-746eaf4d6c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675801601, "uuid": "fd9fe851-b46f-42d7-a5f9-10436dc72ee1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71802e10-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1675788163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788163, "uuid": "1dfc61fc-9ca1-4f54-9704-aca28df9ea90", "comment": "Malware payload (RaccoonStealer)", "value": "29d8b6368c5a7b9fec94b107baaa7329", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788163, "uuid": "95a23bb0-a602-47d2-b196-a77066cd27aa", "comment": "Malware payload (RaccoonStealer)", "value": "c08e2ca15e8534820ef3b1241054cbdb4a62a2cd56f21a153695554f5a79b783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788163, "uuid": "b2658102-2db3-4898-8b21-d3bbbb23de9a", "comment": "Malware payload (RaccoonStealer)", "value": "e5186b8a1c4b0b9b8cefe699e80e5554cd6a0546", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788163, "uuid": "dc9ef3cc-30ac-4aea-993a-456de8fa862a", "comment": "Malware payload (RaccoonStealer)", "value": "966fad53e7f3c5801accabfdc967dd01581b3d49f79fcfe93ffa246455b6ad660bd3ff4d7caeab3ffd9369c68c16ca9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "VidarStealer", "colour": "#F1960C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788163, "uuid": "5a7bbc17-5196-4edd-8746-d64f238120a9", "value": "T11406237762A91485C0EACC39C437FEB1B1F6137BA681E47476FF69F12A114DAA212C43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788163, "uuid": "931d0e17-7d59-4c0d-bca9-16de5d4add55", "value": "dec71b085dc5a08706fa389ac5f0718d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788163, "uuid": "bf026f65-8db3-41f1-b639-cfff7524531c", "value": "98304:I2Gp2qVeoJAYyFClDOSAJBZO+os/ATYCVN/4AINYYh3yQdS:wlrJAY55OnT6sNC/45Nxzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788163, "uuid": "368a4511-b28b-4302-9930-1a379f8b9c9a", "value": 3999232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788163, "uuid": "89f04aed-639d-4e12-8c87-4b900200efd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788163, "uuid": "e3ead89f-3efc-4571-aff4-5e3a6b904690", "value": "Application_debloated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7e4472-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675796181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796181, "uuid": "9df12b81-b827-4cb2-b43b-68d1b2729c84", "comment": "Malware payload", "value": "300523044b06600929941b3b24759cb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796181, "uuid": "84b7890e-ae56-46b6-b904-19cf635f5dcc", "comment": "Malware payload", "value": "c0bc0c4e7100fbae70efc2141dd9975fa675c1c9a5acaad17bb1a52cdc766f59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796181, "uuid": "aeb91c39-684d-46c6-b0d6-8b035ffec012", "comment": "Malware payload", "value": "40cb13674e66d93c7bae28781abfec49ff1eda8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796181, "uuid": "204893c7-723e-442d-b961-72a797fec853", "comment": "Malware payload", "value": "440a49bf1505a991a746e14a94661b55b78fd711c7d5d3aff89e50aaaa395995f21a2fdba2c54f324a8d8e6308ddadf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796181, "uuid": "2d23de62-6900-4dc3-95e6-965687c012ac", "value": "T1684633166AC29136DD7B5C3434B194361577BDB23E78CF8BB3945BE806205C0A33FAA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796181, "uuid": "55c236eb-3e4b-49ec-8fef-184dbeb78802", "value": "e6f4169f2a5c3a8f93171d9f593bd22a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796181, "uuid": "620acf9c-da92-490e-8ca6-c111cd093ab4", "value": "98304:zMBQincG0v42FfxF0PJrGTQcSkoCRzslGbAZKojp6h276JBN/2997w7D1epEWGLE:zrIWLrTNSgx+8AtpM2Y34M7ZepYU2YP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796181, "uuid": "a59f60cc-bb2e-4c94-834a-3a94ff2ef0c1", "value": 5688055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796181, "uuid": "0fd23db4-b226-41ff-86e7-13dd32881846", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796181, "uuid": "04e821a4-2fed-40b2-b52e-dcd51b5b8712", "value": "300523044b06600929941b3b24759cb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51b0202-a716-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675795202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795202, "uuid": "ee385bd3-9aee-4f08-8f28-c3a6ca4b272b", "comment": "Malware payload", "value": "97011b19f2683a918f1f07f7f4ec1998", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795202, "uuid": "8734cee3-fd72-4268-beb1-fac73121c0ad", "comment": "Malware payload", "value": "c1469167b9700aeca987573c023ec7f160dadf8309a7a4feb2cd1969ad66673e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795202, "uuid": "d57ba84e-17b2-40c7-a700-941e41a9713c", "comment": "Malware payload", "value": "4b486d0b67994fabe961787f5facdf9a0e3f6672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795202, "uuid": "1d87240b-88be-4390-a16d-de7d3ed45cd8", "comment": "Malware payload", "value": "057195a9eb1a138ac7bf48a736948ebd4acf4a4317ccef13c80244209a9ec927802ec7ddc38345b70dee270317630d29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795202, "uuid": "c5f0c487-c22b-4808-8afa-ccfc68cbd961", "value": "T114B3021F79C5C89BCE6529B0167B837792B9771605210F8F27B04FFF983509A9B0A18B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795202, "uuid": "693d248d-66b1-4e94-8ebe-e902490ee1b6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795202, "uuid": "a69e71f9-09da-4700-a932-9bf415cf2d1a", "value": "3072:Md/vyWmJgsn5f630mFNCwivNDd+r7Ncxnpjw9:MXiY0IMfZ0N0npC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795202, "uuid": "9c89050b-4200-4de4-aa44-2ed7e3e921f1", "value": 116184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795202, "uuid": "0f2d66d3-c060-4ebc-9b6e-4a14d2392b56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795202, "uuid": "c7974e1c-d9e6-4f69-9dd8-0f4a069e5fb1", "value": "SecuriteInfo.com.Trojan.DownLoader28.22066.19106.30146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c8fa05-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732730, "uuid": "2c3eb6fc-deef-4e16-ac48-f11eee4789cd", "comment": "Malware payload (Gafgyt)", "value": "7c926bb238e914058958e43eeba89933", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732730, "uuid": "3267524b-27a8-4417-b117-366658fc2976", "comment": "Malware payload (Gafgyt)", "value": "c15065c4cdf3e9b5c2ec83a30a490a39e0908e2b7ccffd0d47f83b42bbc6c253", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732730, "uuid": "a4d6a71e-79fe-46b6-8c64-b07342dde8c5", "comment": "Malware payload (Gafgyt)", "value": "82c6e9fa017aee575ccd8e53a0deecb078bdbfc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732730, "uuid": "e23b581e-4ad1-4429-bb97-86e572fdc116", "comment": "Malware payload (Gafgyt)", "value": "b724992a37af1376144fff8360fa0d452ef918ad6615ca026dd5fde3d770b33f3d3d67de6db14e440baf1e2b648003c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732730, "uuid": "79dc1ec9-5169-4329-adcc-2a7abecc8b38", "value": "T194C3A617BB618EB7C84FCE3306AA4601118DE59612E57B6BB2B4C96CF74B84F08D3D94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732730, "uuid": "a00f7583-2185-4b02-924e-46fc2edfc4ff", "value": "1536:FLeTDnGBQ9LV12pjMtZYXvayNgVao7mtb5hJddddddT9yxElwmeFfkq+QCyRnVgj:FEGBtpjWAwaV5h9GElwmeRkq+QXnVgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732730, "uuid": "20392baf-7095-4940-9d94-aeed5130fc00", "value": 126905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732730, "uuid": "7d647414-a840-4f5f-a1fa-a903a390f57d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732730, "uuid": "f6fee110-68b3-4870-aa2d-6fdd20550621", "value": "7c926bb238e914058958e43eeba89933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b70f1d9-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675783267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783267, "uuid": "917db39d-1fed-4cf9-bd05-ec9c8cab963e", "comment": "Malware payload (AgentTesla)", "value": "a169ae631ac877e4e89d595b6ba03600", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783267, "uuid": "0495dbb3-b7b2-4e27-99f9-c7f2f745f7c0", "comment": "Malware payload (AgentTesla)", "value": "c1add17549206e0ea3e1025ec81ff8d7e5ae994381600ec84d33eeab50ea7232", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783267, "uuid": "df908754-fda7-426a-bca0-e30f538ae8be", "comment": "Malware payload (AgentTesla)", "value": "4589dd4afc4a6c9423ddba7442137e5beb502fb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783267, "uuid": "9ff2ffed-328b-45f7-94ac-9897f813e3c0", "comment": "Malware payload (AgentTesla)", "value": "dc7ba7744e52c8c4063ee06c5f200d285d554222b3bdeb14fd083b641a528c0e31c56ed8d2b05a8462eac56b666e90bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783267, "uuid": "cf1271eb-52b1-4868-9521-41c7a78cb2be", "value": "T18B05220D2FFDCF10E86A5BBA99B016A1073AB416A633F32D2EC520DB1D677A44542F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783267, "uuid": "fa02d0d0-3562-4099-ae51-aa9896a3632f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783267, "uuid": "812891e4-b970-40ec-9c8d-8f13564d8741", "value": "12288:Nrt0wdeWKBp5gYcjzioNo5IhMbmfEJhJm6I6awHRr/CB06KuLpgbDDlG:NrGV7p55Ki7WhMKfCm6xawxO5dgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783267, "uuid": "8673ba4f-a81b-4c9e-9b50-b1a3a1b5f8d9", "value": 811008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783267, "uuid": "b1a5f111-9c88-435e-9dd5-919752a440a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783267, "uuid": "e3b43e44-e3e2-4d1b-9afc-c979d1a784c4", "value": "AWB NO. 8148557141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570c3593-a707-11ed-88f6-42010a9c006e", "comment": "Malware payload (NanoCore)", "timestamp": 1675788548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788548, "uuid": "8f585c59-f471-4730-9760-9cffb85aa8a6", "comment": "Malware payload (NanoCore)", "value": "2148dd1b01a6165b6df470ee5090c0be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788548, "uuid": "16f19935-f359-4b38-a325-b429ebf6b58f", "comment": "Malware payload (NanoCore)", "value": "c1ffc1401ec94705eefd0d7e204e74cc26179fb7d23b6305cb26bef0446acbc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788548, "uuid": "631306ae-4ce3-42e5-abd1-6e10769f669c", "comment": "Malware payload (NanoCore)", "value": "f2f609a8abb2920986b0feb40c5792c0e0dcc145", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788548, "uuid": "920034ff-95de-4981-a5fa-ac8fea4dc2da", "comment": "Malware payload (NanoCore)", "value": "a9a715b2d560180f9cbde33700b1c5ba480e4fb2254f7fd580fd5fa5b0ced1f50fc50a0073281d6d006ad3bf74305192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788548, "uuid": "3f847023-ae5b-4fa6-b099-7db19eed3b85", "value": "T14614CF5637A44A2FE2DE85B9B11212539379C2E399C3F3DE28D4A5B74F663E10A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788548, "uuid": "7bb0195b-bb0d-429b-b710-6a714f92f808", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788548, "uuid": "df055142-911e-4454-8a85-acfac0933b36", "value": "6144:QLV6Bta6dtJmakIM5czIVII74L8CvrjmWWNV:QLV6BtpmkzfI74oYy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788548, "uuid": "036df7f8-3a54-4249-818c-20a47dc1c6db", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788548, "uuid": "7e3b7d3c-4d4d-4c8c-87ee-86f5e26f0c30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788548, "uuid": "06383942-71da-4f6a-8480-39320cdb48d7", "value": "rac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97dec4c2-a67b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675728527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728527, "uuid": "5882ba93-8f56-49af-b0cb-cbceb49d3566", "comment": "Malware payload (Smoke Loader)", "value": "bf0dfde86387701ca7f2d0f588f45a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728527, "uuid": "0a8bbfa3-e2e0-42bc-8b36-c7f5f44e414f", "comment": "Malware payload (Smoke Loader)", "value": "c2121e45bca3f193881080e9319f1f462217ccb8c3aeb05de6c9a2bf85c2cc43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728527, "uuid": "f48329b0-8dd1-4da9-8ada-eb987b671080", "comment": "Malware payload (Smoke Loader)", "value": "b1f7c5849a945d0c8e75e6bfd8b2c05a2571819d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728527, "uuid": "172bd8c6-47cc-403a-8fb8-9cd8fbe2eec4", "comment": "Malware payload (Smoke Loader)", "value": "edc4536c5099dff042d7a0a60601230aeb5cca101eabd4aae1cce118ab1843e5fe8a3b32cc5ab78325475a96d1b20a8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728527, "uuid": "c6dcb84d-923f-4f7c-a8b9-4e5de599e007", "value": "T140545BC393E1BE90E9268B72DE1EC2E87A4DF540CE79776522289FDF15B1172C163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728527, "uuid": "9d39e29b-1110-4b02-9f9a-50eac6aef864", "value": "e8720dc2abfc37e1a047ce92fd890111", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728527, "uuid": "7664bf6c-6fc4-4aec-99fe-8240ad6528ea", "value": "6144:CWyuEL5Q8Hr/1thY8S5vuPRkluQj9RLy4a3:Czflrb1thBYeR4ljPLZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675728527, "uuid": "150f691c-5ff9-487f-b0ef-ddc089d792fe", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675728527, "uuid": "6004bf41-8be5-4b04-8caa-02246910ded3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728527, "uuid": "eb405de5-2ba5-4b8a-a572-b37bd16b788d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7cb72a5-a710-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675792576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792576, "uuid": "d63e6652-fad5-45cf-91c3-59807a430eb5", "comment": "Malware payload", "value": "c3db284eb8ab9a8a75312a1b23cb7088", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792576, "uuid": "672aad0a-e61a-4d7b-949c-f9c754ce2a4c", "comment": "Malware payload", "value": "c32c63b814d65d77b588ce2c78887d14ca7e6c9037238158a791ad08de42e6b1", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792576, "uuid": "86e58524-1eaa-4d2c-9aaf-3a64f42fbe52", "comment": "Malware payload", "value": "bd459e04771e5128c31f21428dbeef05f5517527", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675792576, "uuid": "3ee6e7df-c9e2-43aa-8186-495e2e80894c", "comment": "Malware payload", "value": "5cf13052577d082ea28195c538cc149118d4599ea06dce5cb6077fbaa4ce684f43e345eb15af8ba6ab8b854e94758fe6", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792576, "uuid": "de596da0-3cd0-46f3-a320-3ecf90d18b76", "value": "T10B65BE30A5F25AC9E899CEB38E61E209FFE70D859952821FE57839F21633784C5051FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792576, "uuid": "2a7acbe9-6414-4399-91f2-548d265f3cee", "value": "12288:EiSxNJkVnVWQY1UPNiRWXga1sHM4lNJKN3To2mBOjAPB3WQtlADEBNFvFlRP:Eiy2VWv17RWQmc3ektoA597RBNFvFDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675792576, "uuid": "7c17e732-9a99-4b22-9b3b-833b73c5a877", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675792576, "uuid": "4d97ff76-8bba-41c3-83eb-f675b77d8eee", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675792576, "uuid": "f73e18ad-9c9c-49ec-9776-e44960211590", "value": "RFQ__QMGU79sw0272.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cb22ad-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789913, "uuid": "d8fa19d2-4199-4140-ac4d-0b4bd0759693", "comment": "Malware payload (AgentTesla)", "value": "c3d4c0cc054705db80f8d9ec6b7a6538", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789913, "uuid": "e530bff6-9768-4e14-88d1-a837b2c1d770", "comment": "Malware payload (AgentTesla)", "value": "c354b8d4a8f5e856f22ad54f95da35cecc116ec557aea366d98e16ebba218631", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789913, "uuid": "23f0f2fa-d77e-4f4a-af28-4286433a65a7", "comment": "Malware payload (AgentTesla)", "value": "be05bd2fc3953cdfe422c5192fc56db2edc047b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789913, "uuid": "31e95b4c-2007-4ae2-b319-6ae784266425", "comment": "Malware payload (AgentTesla)", "value": "70690bbd3ef707550025cb29fc0abc54d49d84342c378ee8c964ff0755e5f28064b43dfd6d75fd0aed3d163d8bb80557", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789913, "uuid": "33d7ef27-6c09-42dc-bf91-02862ed55330", "value": "T10225F184328404B5CC76E6339725E1139D1E6FE86BF0D54E21D23B9E377BA89D6CB212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789913, "uuid": "d9ca725b-7fb8-4cc1-a2aa-3ad9795dd733", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789913, "uuid": "e4a3c08a-d0b1-4164-9f34-96714c7f0a89", "value": "12288:YYgxPgUrPHmPbhaYuCRnk+W/qNGJe91CsyDfKxIuZ15PdBiKu+MafvNbd:YY4lHMbhGnl/qIKChjKxd1vDnFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789913, "uuid": "1cea86fd-37e8-4db0-a39a-aeecdcd57d7a", "value": 974295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789913, "uuid": "e5de8834-0483-458d-8f35-5f7d13247f7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789913, "uuid": "fff9c3f0-73bc-47f3-8f80-5c88abe8c606", "value": "hesaphareketi-01,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7abe778-a67b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1675728634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728634, "uuid": "d66a8197-40ee-4158-a2c8-07c8e12e9c51", "comment": "Malware payload (Vjw0rm)", "value": "5347f986bc63f447116cc3ff9c991c38", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728634, "uuid": "c894314d-33d0-4b87-9d41-d75e4c3f844c", "comment": "Malware payload (Vjw0rm)", "value": "c3708ca56dc71073eed421b174b58df12381eea2db4ae7b5966b02a7ea3a175b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728634, "uuid": "2feb66ef-df2f-4295-a348-e4355c88f9e5", "comment": "Malware payload (Vjw0rm)", "value": "88936a5c4be3c38e1a6793b7be22c62924fe9421", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675728634, "uuid": "288cc72a-139d-491f-86fc-d3374af73fcf", "comment": "Malware payload (Vjw0rm)", "value": "fc1e9d2b25cea1b196729a56e0b9cc539fc72ebfa1d9291e721a83a3ef4c9bc055acdac705afaaa7aa6e6601a26c3adf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728634, "uuid": "1b4ad41b-6ac3-4824-b2f7-e036781e0ae1", "value": "T1B405CE8473CC948ED3F175794BBC2B0D9A7EC4B1D86468E5F553A820E461F228F9C9B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728634, "uuid": "fba7a8ae-f962-4716-b30d-55736818be8b", "value": "384:zjYMb67+0Ljek5tpTzADckX4gcch7688KCtDEj/ZjlNO3pOmDZp:pY+KestpTocfchV8VEjBjlNO5OkZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675728634, "uuid": "11254bce-d316-4e1c-bb8d-db6eb3a2c042", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675728634, "uuid": "85d41f14-27fc-453e-8135-23da7b9cb3fc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675728634, "uuid": "afde029a-0fc6-4575-a723-8e27cc052e75", "value": "E-receipt #202110206-NNG.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f489ac74-a6b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675754023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754023, "uuid": "a637af27-1605-48e0-8f0e-0609ed0b9abc", "comment": "Malware payload (Amadey)", "value": "9f425c882835f4be11ed15213f27d61d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754023, "uuid": "6dd66c19-d949-4d22-a016-535bbbea5563", "comment": "Malware payload (Amadey)", "value": "c3b322c3dae816c27c30f6cd99dc010447ff89564705268cc04371ee0f6c0d34", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754023, "uuid": "6a855dc8-b659-47df-8e69-8ab97eb85639", "comment": "Malware payload (Amadey)", "value": "da50079615d17b2572017b46ae285826b5f5a7ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754023, "uuid": "f21424a7-6438-499d-9ee7-f5d0dfa41501", "comment": "Malware payload (Amadey)", "value": "cf8a40d4aade394679c713306b098f860d9e5b4db8802294f91b254a249ec6411912f451ae97e5d5281bacab1a8a4845", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754023, "uuid": "1ddaa473-c46f-4b23-b115-86a2fbdf53b7", "value": "T161B40107EAE88166E8B45B7409F703D30B367E616E34878B364EAC5A1D72271B631737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754023, "uuid": "26db30a3-5d4a-43cb-a005-35ac09d3c4f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754023, "uuid": "8883200e-59c7-40b1-b4ba-e0b9e172340e", "value": "12288:HMryy90rEvtGI/Fm9Ti1u7jAQqj7kLhcGwl2z18zUFgev:1yS4GEwTHvAQGk2l2z1uc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675754023, "uuid": "daf4904b-aa5c-4f62-bff5-9af17e334bfd", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675754023, "uuid": "b2aed252-b433-4dc4-a4bb-4301b5da8098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754023, "uuid": "54f1f5b2-1fb3-4274-b6df-17b65517b53b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f7c7486-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675783274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783274, "uuid": "c3d94dd8-e16a-4d0f-856e-62fd9825131f", "comment": "Malware payload (AgentTesla)", "value": "2453d91d5e1b3ba88a35d9b3776e2e8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783274, "uuid": "c93866e7-9bff-4827-9eb5-6fe55d98f6e9", "comment": "Malware payload (AgentTesla)", "value": "c401c299ae6aaa43a559d44471448b3c177a9d74829832fed88edf3bd6e5e789", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783274, "uuid": "7b7a9803-19a8-4331-9a08-0157328d733c", "comment": "Malware payload (AgentTesla)", "value": "a717ee643a2d55a59aad2bcc7f00f36be9b7f5ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783274, "uuid": "3af1d34e-e6e9-45a6-8113-70b669e70fdf", "comment": "Malware payload (AgentTesla)", "value": "aace265a6c95756231adf1b258b4693cdde9076f368c4621d4b3a0dcf18f6137ef0d2cb355a27d34d6329d967e6084bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783274, "uuid": "05bda90c-b615-4dca-b174-29ffe793c4ff", "value": "T192F4234D53B48610DACD8AB6DCD904391375962CB261F32E9EE850EE2B23FA14B43B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783274, "uuid": "a92cb746-385f-42eb-a59c-3210625148dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783274, "uuid": "e29900eb-2391-4211-9774-d104cf409dc0", "value": "12288:QEO4gMruVR2lWPatYntDTYBEy/7uHT2sOrx7p58lCrd4gyQapWMsEPA:Qb4gMruPoWCtGtWjuHIrxN5IC54TWMHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783274, "uuid": "0605769b-b465-4f3c-9329-d780c45c0073", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783274, "uuid": "5a9b943c-6d0b-402f-9a4a-463dd06c978d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783274, "uuid": "b72f16d4-4401-420e-aae5-f12f4aec1d3a", "value": "PO-7654321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ad51b2-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788891, "uuid": "de38c349-a2d1-4fb8-bec8-b25fc1ba2bfe", "comment": "Malware payload (SnakeKeylogger)", "value": "5bac232d989fe6f27edcbe947b335894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788891, "uuid": "f8a296f1-75c8-45be-b8f8-29fdff499d44", "comment": "Malware payload (SnakeKeylogger)", "value": "c486c324dbf69dba15085f5020664872c2734a13e163477901b2bb57196fccf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788891, "uuid": "905810e1-ac58-4524-aa7d-0bbbad1de6d2", "comment": "Malware payload (SnakeKeylogger)", "value": "c428e610571b67983f6b9e243fe5352cfa76cffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788891, "uuid": "5ff568f2-c4ef-45c4-ad48-d10453a46f2f", "comment": "Malware payload (SnakeKeylogger)", "value": "4220fb8b94d2cbe4f72e8a5aad4a739f68cfb329d576185f9723717e82730c7ab31e803186352f4ef5cc4e3240ee1a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788891, "uuid": "b1b9db9a-76fe-4a94-9a9e-be43fa916429", "value": "T1D9554EB894FB4ADAE00FCD911BFCFCB8117671F3D8E20DA5436C66445E2AE947E0950A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788891, "uuid": "b8d1e392-8ebf-4dca-b392-6a0e276f8374", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788891, "uuid": "352d4363-bb7a-4378-b8db-76e63a19877e", "value": "12288:x5ap2tHUB7lceAvhDlgqoZS8Of3JTrVt4zak8LfWQmfaHt:TfZXVCzV8lvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788891, "uuid": "b08913ff-ca46-466d-b7f4-da190d558c2d", "value": 1347584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788891, "uuid": "b60da7eb-fe48-4a39-a60d-dc22fb193c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788891, "uuid": "858e7969-385f-4805-ba20-f42e0d7b04a2", "value": "SMGS.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43eeffbc-a707-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675788516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788516, "uuid": "c29fe388-3738-49be-9bac-aba836180f45", "comment": "Malware payload (AgentTesla)", "value": "fa7768af423cdad3e70b5f4d6ea48dad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788516, "uuid": "e73fb6b6-1115-4c8b-be62-3558105c4700", "comment": "Malware payload (AgentTesla)", "value": "c4ed07f70b08074adc0b1ca4901a277fe226703a5fec16b990729b83459d1339", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788516, "uuid": "e655384e-0538-4d74-bafd-1a63d67ee660", "comment": "Malware payload (AgentTesla)", "value": "3469a90fada490e88d09d0ea513d9fd8d6b5ee80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788516, "uuid": "e095942b-fd03-4ddd-9062-9a3b101663b4", "comment": "Malware payload (AgentTesla)", "value": "9ebfc9e8f98a0c09fadb1b36559687c5d0c81115ceee060de50cdc159af90d89973c9a5c384bf9bd5b7bb29fe67371fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788516, "uuid": "c1dc546e-5d77-464d-a405-51ee7824a5e7", "value": "T18C05222C67FDCB10C5AF5AFCD8712660477664206A22F31E0DDB72DA3D66B908B40B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788516, "uuid": "5132ead7-53b8-4c1b-9e91-b0e35e1bd25f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788516, "uuid": "26f45d2e-e6ee-464f-8994-5aea5c4da5b7", "value": "24576:aVawxO5dWpx5O501WW7UUirvmi814dEyBEcZ:yTs8px/7x2J4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788516, "uuid": "f95e3011-2ffc-4b3f-945c-c015c2c2b285", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788516, "uuid": "b8b034ba-3e33-4a34-9f87-b8b2ffce6292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788516, "uuid": "42f50fbd-0a15-4817-ade3-94734839a754", "value": "Payment copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce18e4e-a71f-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675799134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799134, "uuid": "6d7c34b4-9f87-498d-b6cd-f1c16b76bf18", "comment": "Malware payload (DCRat)", "value": "377abee587bd128b4853ca8ff8f9a03a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799134, "uuid": "42eae99c-1c3d-42b9-829e-085f894ab894", "comment": "Malware payload (DCRat)", "value": "c519cc898f46412ed6b7d4e8392590027d5ea95a40542591c716787e68a6f67c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799134, "uuid": "193ad0f3-5fa6-47a4-948d-ec9dc3ac37f7", "comment": "Malware payload (DCRat)", "value": "85f8743de29978b5bbd744dbbf83a446eff1ccf7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799134, "uuid": "06b6a294-2311-4767-827e-3d6ec21e5a27", "comment": "Malware payload (DCRat)", "value": "5d472479648971f4b6171617be270115c4aba504aee01b911cde6d55c9a35a1726330e097271ea0b78f01a4c4a371ebf", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799134, "uuid": "adcedd97-04d4-4eeb-96ef-6e70b8e699ea", "value": "T1C93518023A46DD02C2292637EDDF456407A8BD457B66D71ABE9F379D20123A78D0E3CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799134, "uuid": "9e141203-eed6-4891-b0d3-07d4d91ac1e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799134, "uuid": "fa9db30c-1340-49ef-9641-c78992b42ffe", "value": "24576:3RzXTlL5kedDpGbnJX6okxAxvfS7RP6w+4:3RsedDp6J3k0wP6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675799134, "uuid": "e967f968-1972-4653-a0df-fbb4990f8021", "value": 1114624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675799134, "uuid": "f02627e1-8b9b-4f13-93da-a361f0b7e690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675799134, "uuid": "d369ba14-7487-4d79-927b-911e21485008", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-c519cc898f46.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd0e509-a67f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675730205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730205, "uuid": "093edca6-5123-4abd-832f-190b8fd1216e", "comment": "Malware payload (Gafgyt)", "value": "a2cc200b6409f411bfa96f3a488b053c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730205, "uuid": "4d23cef1-57d1-45aa-8c71-c054ed42cea5", "comment": "Malware payload (Gafgyt)", "value": "c6373e2a97f8160c8d10057c28371d048de343038393f502387fe3b8d1e4931c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730205, "uuid": "0cfc38be-214b-4aaf-b309-e354b8063d16", "comment": "Malware payload (Gafgyt)", "value": "641a09755b4e906ee12012879c03ea413e4484a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675730205, "uuid": "ba75b1ff-a3c3-4667-8d4a-c4f5c146e2f6", "comment": "Malware payload (Gafgyt)", "value": "0d192dad084eb97a8bf12dadffb50a1bd4dc5a19280102f0d427714f3ac03d648df97693e1e8c81e9592db7a4daeae7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730205, "uuid": "b944208e-96a9-44ab-b345-19b44cb0c0d8", "value": "T14A934B23B452C6B7C48787B51BCF9A15AC33B4BA0B72324673E87DA46F128D91D5AF40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730205, "uuid": "54aec508-153b-4ff9-b27f-8fac0810aa1f", "value": "1536:GI7i79zbP7Q46tEDn6Ja3kan7PdLc3OZ3a15phTddddd5CRgm9HiVrHjDFZS5j:GuCXP8raDea3fTdLc+p+5phrjmFiVrHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675730205, "uuid": "c11e0ae4-7ce1-4ebf-8a6b-14725e498579", "value": 97272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675730205, "uuid": "1c2c8d6f-16d1-4f14-b4e9-407dc3f54a55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675730205, "uuid": "7389c5ac-d2e4-428e-b60f-9b4975574d6b", "value": "Ayedz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85638aee-a6f2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675779606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779606, "uuid": "24b8bf2f-e025-468a-923b-ec514200e6a0", "comment": "Malware payload (Quakbot)", "value": "fdf899a24e502ade4eaba466c27efc16", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779606, "uuid": "ae078c84-a332-4ebc-8803-4d9819bb53b3", "comment": "Malware payload (Quakbot)", "value": "c666aeb7ed75e58b645a2a4d1bc8c9d0a0a076a8a459e33c6dc60d12f4fa0c01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779606, "uuid": "17735f3a-9800-4ee4-819b-65b062a14868", "comment": "Malware payload (Quakbot)", "value": "2122db7e4bf8ed57cf1fb8118019af0c39affa02", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675779606, "uuid": "eccf0795-db99-41f0-abb4-ba05f15f9d3e", "comment": "Malware payload (Quakbot)", "value": "803bb52c45e2025cb8fae42836fe4df2b8514a46eda8e50d620bbd50fe244dbcfa43a29c1172ea79fba7be2eac752a52", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779606, "uuid": "617d7dc5-0c5a-4cf0-b44b-0725fac7ff02", "value": "T135E39D83F9D1D6F1D47E2A79847A93500B3F2A109F16CCE7239912641F660D26F72B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779606, "uuid": "61121383-98cf-413b-b922-98b02fc686d8", "value": "6652f1a4d5005cb50ad0e122c1bd7ba8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779606, "uuid": "4e4aa367-ff37-4a50-92a2-d382aaeb424d", "value": "3072:8uZ6hcvJTZ9oVFBfnIyht8vPs1XQHBC92ePuH:dTN4HBnI2t8vPLu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675779606, "uuid": "4474929e-328b-446f-b3f8-045003b2f585", "value": 152467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675779606, "uuid": "1793c6af-b5cb-4990-b568-9d413f5c1d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675779606, "uuid": "176dd863-3079-40ba-855e-5752d3a6c3fd", "value": "00.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05568ddf-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675761353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761353, "uuid": "e2ba801c-9049-496d-b366-fc266edc9b44", "comment": "Malware payload (Formbook)", "value": "fa83567f03d87b72513d62b46bfd2587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761353, "uuid": "ccb6bf4c-a120-4ca1-a017-afffdc002809", "comment": "Malware payload (Formbook)", "value": "c6bf8c1564ce282723cd0789071f875443b6215db1ea5cc316f5884d957f00ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761353, "uuid": "1ab40c9e-1b9f-49f5-936d-5e99199a9061", "comment": "Malware payload (Formbook)", "value": "60948ca6df440bb4e4cb74e5177ae4780eaac688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761353, "uuid": "92bb4871-eea0-4801-b5c2-b29d49378029", "comment": "Malware payload (Formbook)", "value": "1a374eaf225e0768572b809c82d5b8e8cc5ef978a41bb5c30efaaedbec98ecf2ac8609c6aa25b0aea2b843275c3896e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761353, "uuid": "5bb5ddcc-b0cc-4db5-abef-4c42136f33fb", "value": "T1EB04AE32D642C070F2B211B5B67D0B7B883E0E357295A0EAE3E516E16EE09D5F16931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761353, "uuid": "c2f1f3b4-e70e-451f-8ff8-b2e3cfc6a60c", "value": "3072:Vk+xkWn5IK7YK3IXqtvWQaPBUN3e/08UFa87BR7fRKdU:1UMI6tvNaPBUN3e/nUTNR7fRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761353, "uuid": "37c452ad-129a-4e7a-8b19-3715c520eccd", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761353, "uuid": "098bdc9d-2f42-492a-b807-0b28e66857fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761353, "uuid": "24cbfb24-c088-48e6-94a4-500e7ca6c179", "value": "c6bf8c1564ce282723cd0789071f875443b6215db1ea5cc316f5884d957f00ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcd94e8-a6f4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675780610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780610, "uuid": "2ea10ebd-50a2-45f0-9fed-69bc5b58685f", "comment": "Malware payload", "value": "12538df9f57857ed66917ec0f0dbbad3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780610, "uuid": "83c84669-d0da-4ca6-beb8-ddf2f530f3e2", "comment": "Malware payload", "value": "c6ccdb265bf5b09aeab95dc3165cccc01fdc90f9333247985c839726fc0e098f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780610, "uuid": "2a8550c3-830c-46cd-a0a6-b07cd23b1cec", "comment": "Malware payload", "value": "80dc6962345f1ac9ae12e837bca5dfe9e6a6c7f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780610, "uuid": "ea2c5ddd-79e4-4f17-ae4d-33bba517d80b", "comment": "Malware payload", "value": "2ed2289c29338633f4316a2e291c86efc6bfea86bac21990a6d4213736b1f167f360f35c6351856cccecf3d959546b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780610, "uuid": "42b38acc-4074-4f57-b851-2a5b95da2f88", "value": "T1CD4383D57AD98CDAEA14423C41EBD231257DB6E087134B136A34B6320F22BE17ED725E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780610, "uuid": "3972e255-8ac6-4e7f-9775-e5bd97e0b858", "value": "2d92d5604c335f822a4100f90b667732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780610, "uuid": "f3a8ce0b-9bdf-4863-9848-f33b21a39af7", "value": "768:VT8UTdgXgXOJfEqTIYv4gKNwFPMoHhQbu7x7+j:3T6QXUEqTIm4gKN2PMoHhQbu1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780610, "uuid": "3cfcc205-9869-4814-968e-527776989a35", "value": 55766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780610, "uuid": "51606215-9421-41ae-a43f-90f16892e631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780610, "uuid": "1cca3ec0-6d2d-4c30-b3dc-0d77d820a495", "value": "QmYAd15qhMNeFaDy9nmbTd9GMoJThq1mKKKJ4cyiv1uFyr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874cbbb4-a683-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675731935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731935, "uuid": "6dd9a94f-3c93-4032-b29c-c756fd76c85b", "comment": "Malware payload (Loki)", "value": "02fd87ee564cabe3e669053eccdcda98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731935, "uuid": "033c7d23-ea25-4b51-b695-5ce7e1f735db", "comment": "Malware payload (Loki)", "value": "c6e65200ca75517312a1787338289bf89a3753c7065b63ff314b0214a31b508f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731935, "uuid": "0f181c31-8120-4b4e-ba36-e5dcea85e19e", "comment": "Malware payload (Loki)", "value": "bacc41873a28529766c2abf68b6ee5dbd02f4405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731935, "uuid": "306896f4-1f55-4b9b-91fc-305d4f0377a2", "comment": "Malware payload (Loki)", "value": "2de913ee40452316c252afb74cbafdbe6fc780eb74e1fac34c75b8a237c05d8ea862d52c746aee2df37e1a49df2a86bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731935, "uuid": "6d9997b6-ed5a-4bea-9b30-7e835b3578d0", "value": "T16BE41942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731935, "uuid": "5be47280-0198-4079-b514-7536f9431642", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731935, "uuid": "302f91ac-befe-4979-9940-e2c871e5564f", "value": "1536:vzvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/Eq8Izmd:USHIG6mQwGmfOQd8YhY0/ExUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675731935, "uuid": "40c49984-2afb-41e0-859f-c42196693795", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675731935, "uuid": "dfccf29f-5946-4481-a309-f326c07b28ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731935, "uuid": "824198a3-1adb-4e39-84df-5b2bc86ecff7", "value": "02fd87ee564cabe3e669053eccdcda98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c78ddd6-a707-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675788557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788557, "uuid": "d8ce1a6f-5a22-4c77-a164-5b6045701e76", "comment": "Malware payload", "value": "29a6ced9403758ac36df361748050b1a", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788557, "uuid": "82b9f865-e372-4353-ae98-b4c14e6b5e4d", "comment": "Malware payload", "value": "c74db95cfd34f94d78e295c55cd8d5f048695f3e1f5f2c9280443fc8f6e7f362", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788557, "uuid": "a2223ffe-6f02-430a-8547-2e263d48560c", "comment": "Malware payload", "value": "3e7fb78cfb49293daabbc0143da9438f9e9ce681", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788557, "uuid": "c2641fa7-645c-4344-832f-d2172a870eab", "comment": "Malware payload", "value": "33fa8165f29e516df22fddee97e3cd2a01cf8a1b0d0a9842df65526e6e97e438e6625613730983bb6b9e90040afd47f4", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788557, "uuid": "82670363-038a-455c-89aa-75bddefbbf1e", "value": "T16F44A1039D8C09C6E21D93A8FD441CAD3D8C635DEAAA7EFF90604FE47E94A275C13466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788557, "uuid": "415769f5-c4db-4301-bf42-530b45ec9bdf", "value": "3072:r0v5hp/+08uvWaCbnOXHmuoyKWQ07804yALy/8bUeDHG/7LvKR1RjfST:on/+00IGvyKYMLDol/fvCRzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788557, "uuid": "ed97d311-728a-468a-a1db-ecdf1a524a3e", "value": 256067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788557, "uuid": "1461f894-2246-453a-9024-fc52ab6856c1", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788557, "uuid": "3b2aa826-7b0f-4408-a278-08a461a45811", "value": "\u4ec0\u4e48\u60c5\u5f62\u4e0b\u6263\u7f34\u4e49\u52a1\u4eba\u9700\u8981\u8fdb\u884c\u4e2a\u4eba\u6240\u5f97\u7a0e\u6263\u7f34\u7533\u62a5.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcd5ddc1-a704-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675787430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787430, "uuid": "6a6e46a0-5bf4-4b98-867f-1d1f3557e3ef", "comment": "Malware payload (RedLineStealer)", "value": "df982949b8c074fef5ef37b5dc4dc4d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787430, "uuid": "6ed00b60-bb96-4639-a439-1b270515a8bf", "comment": "Malware payload (RedLineStealer)", "value": "c7f6ca85876a416debb5494c6cb9a5efcb865c7b0cd04030ce31a22ce78c42a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787430, "uuid": "f07747bf-adac-40ac-9cc4-30dc945fcdfd", "comment": "Malware payload (RedLineStealer)", "value": "e8b0c5d81501e1306765ac30148b8b5bb58ea9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675787430, "uuid": "8a09fe95-02a9-4001-9741-a5bce2af4e43", "comment": "Malware payload (RedLineStealer)", "value": "fb10e50a0b773cc5e7ad60b4cd5f0d2a971d1403d482296fbf1ac0b2ff7c50c23f3295c5f50730dceadee3b87d1e7c9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787430, "uuid": "2732aafa-4f5c-4248-b82a-4c0a6781bf75", "value": "T1B164F1323690C073C26B24799864EAA5BBBEB8301679D94B779403BE5F703C1A779347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787430, "uuid": "3b62c8d9-0745-45ac-81ff-3794cc81ec4c", "value": "cdb2dd381be56018fc9552ac3271a401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787430, "uuid": "7e89668a-b0af-4138-aeb0-2f4e3e5d4695", "value": "6144:zeK2RKL4epZUfnBESH/hgSjGF+E9iROWoyWF/NFnR:zeK2RKsez6BB6VP9i8Woys/NFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675787430, "uuid": "f85050de-9941-4869-9bda-5b16083bec11", "value": 313344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675787430, "uuid": "749dd13e-b05d-48a6-b555-23f9baf64139", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675787430, "uuid": "c3599da3-ea2d-4d6d-ba62-eab18b554b50", "value": "df982949b8c074fef5ef37b5dc4dc4d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a3dce9-a6c7-11ed-88f6-42010a9c006e", "comment": "Malware payload (a310Logger)", "timestamp": 1675761268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761268, "uuid": "6b527f89-9c78-4699-88b5-7e0da5e33d36", "comment": "Malware payload (a310Logger)", "value": "ca00d2f2365ee039aaf60f4ece67ca28", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761268, "uuid": "f7eff88d-8fda-47a6-a0f6-ac3c0e7d793b", "comment": "Malware payload (a310Logger)", "value": "c8101a5208b14c4f2525283415d587ff0013732771393aedb21b64e1da31dccb", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761268, "uuid": "62443ce7-d6a9-45ec-9ff9-4576e670fc44", "comment": "Malware payload (a310Logger)", "value": "251bf86f9d923538d3c833b57408e09b22a38838", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761268, "uuid": "7851bfec-1b65-4f9d-a18a-54668a490929", "comment": "Malware payload (a310Logger)", "value": "0874ac125c63b502ff4e633297be5751a241c544de972091a4fbaab1a76b6c819f12d1a2c806c1301f0cf9f5b1f8460e", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761268, "uuid": "971c71f3-6002-4d12-8101-ee41597012b4", "value": "T1D3A44B17EE617C2AF153C8B1FBA492665C25AC3A1641A81BF7C16F8632315D3A4F132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761268, "uuid": "0ff02049-5253-4fa3-a223-0f922f2b0e19", "value": "c2ffc9fc505320fd3aa838a7b7693ecb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761268, "uuid": "475a9b0a-feb3-47cb-9f28-7947307bbc1d", "value": "12288:hQLxt0zyO15gALBoWsD1VGkfjYKkJj6GmZU:hQTg5SGk7Yb6nZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761268, "uuid": "94fd45b6-3854-488f-ae2d-54f1d09d400b", "value": 451072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761268, "uuid": "f12df52a-f393-4ddf-915b-f0a113887f7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761268, "uuid": "2f7a185b-1fa1-4c88-9d19-998169ede854", "value": "c8101a5208b14c4f2525283415d587ff0013732771393aedb21b64e1da31dccb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78992f4f-a729-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675803207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803207, "uuid": "51af42e8-0d56-40f0-ac6c-ee85c5245fdb", "comment": "Malware payload", "value": "efd0967b1b167f64e19fe93a90c8c8c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803207, "uuid": "4a002b5e-3be1-45a7-a5fa-fa9b477e661a", "comment": "Malware payload", "value": "c82c693f68d39ce360641d61e414c2b5ef93c3d838e2d8517165cefb106c8b08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803207, "uuid": "9a24e338-b7ce-452a-b06c-0717bf7f6e22", "comment": "Malware payload", "value": "0d5da092dbd4d7bd5226cc30308df3510aa26362", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675803207, "uuid": "e4ab1e54-1d19-49e2-8300-71193afa26ac", "comment": "Malware payload", "value": "d80b038e2a77e7ed70e3c2fb629e9fb5b7028774006a1f25dd6baf5ab333e6a2ce3cfe7427cbfea66405a5b0a32baf77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803207, "uuid": "8bcd63ae-cabd-4f05-9d87-b1ecc672c781", "value": "T12CB4010BF6EC4532E9B52B7019F603D3063A7D619A78839B238F5D5A08736B0A53537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803207, "uuid": "9c49341c-660b-4fbf-9535-7635810a48b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803207, "uuid": "ed5dfcc5-162a-4aaf-acd0-3228b453c278", "value": "12288:DMrEy90TQsjW/OL1EVZHKof1Q7n56ywpktGNnh:7ywQsK/O5WKj7c/pkti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675803207, "uuid": "fc941041-b0df-4b07-910f-c4e420686c39", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675803207, "uuid": "1d127c94-f746-46c1-bc3a-b00a686e523a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675803207, "uuid": "c67e027a-631b-45e7-830c-5bec8d9d943b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b70e4c-a728-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675802776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802776, "uuid": "3df8dd42-892c-4d02-b293-85b2fd16d928", "comment": "Malware payload", "value": "6308599cd9e31a476fb68a01a6a72de5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802776, "uuid": "0ac3685d-503d-4f56-84a7-c86ac0c2fe5c", "comment": "Malware payload", "value": "c87e9c46010a2d7a7be50f7ee41d5002081de279f6c5e18859c907efaa6d50da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802776, "uuid": "d3c8df45-c126-4dec-bbbd-4016eee3ad1d", "comment": "Malware payload", "value": "e1a8970c4f8308a613c5121784a56d7e11560483", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802776, "uuid": "920d8cca-06e3-4ffe-aeae-7a16376fc188", "comment": "Malware payload", "value": "5b9f33dc5bd169fceae40d61b46ae2f523dd2615b460ed501846345556e5046cab9a84613c3ca700c9eaf7b4545e4e0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802776, "uuid": "7af7dce5-282a-4c75-a7e0-3463f66040d0", "value": "T132B40207F6FC5122E9B4777019F603C326397E615A39C39A135B6C5A2CB26B4B63132B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802776, "uuid": "bec5bf7a-f074-4548-9071-36ae7847fa17", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802776, "uuid": "3da4d458-9a52-4488-89cc-eaa19c3758cc", "value": "12288:YMrgy9035NNy0CbXLWo8f1Q7nLCopkux2:Yy+s0sLt37eoT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675802776, "uuid": "c78e7788-4d3c-42cc-8aed-ce2bb2642a1d", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675802776, "uuid": "273febc2-aa18-4913-bc1d-17e83b386d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802776, "uuid": "aeee95b8-8c25-4fc9-a766-e0a66b3439d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39329c49-a6b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675754138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754138, "uuid": "e8b04fb8-90ba-483c-9a03-9424883ba357", "comment": "Malware payload (Guildma)", "value": "b04bd76f82ba672f9e7f25fb383404fa", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754138, "uuid": "7ed4e4cb-0728-4d6c-a06e-0e4ecc420336", "comment": "Malware payload (Guildma)", "value": "c8a6998125f1cb83fd830374c1c542415e927848891ca65452c00e14277d5781", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754138, "uuid": "ca95bda2-f0bd-4d5d-801f-c76ed62e83fc", "comment": "Malware payload (Guildma)", "value": "24d7834369236db1cecb3a01181bbfe129db6992", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754138, "uuid": "1169ef14-caad-48ff-9e97-d3ba527d7cbe", "comment": "Malware payload (Guildma)", "value": "0d806ab3f60dce9a3cea9c9754a4e35fb41487b24ffbbab98cde33c942de8adfc42dd29f82f886e3cdf0fcad78ac3077", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754138, "uuid": "4b8de2e4-66ca-4edb-9245-3bb73f8bfc91", "value": "T180E07D4F78490FD5910C200D8E4D12040CA896E11C082D4F6D5907854C06F98A7996E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754138, "uuid": "2bd750b1-4e40-428a-ad77-036b734ccf85", "value": "6:SGIfGlk9bLuncJYk97BZHJIjdmkMLj/5UOmU8cFmsXe+TejsOGakYWgBACwNI0jv:Qgk5LaxUTGjdmDLtUOmUNFm7+TWvKpRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675754138, "uuid": "15339745-d0ac-46fc-9218-c5f23b1c0555", "value": 305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675754138, "uuid": "ef34a3fc-20dd-46d8-84ff-439679fee3c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754138, "uuid": "a71193f3-5ce9-4e7f-ad1c-147328a63b59", "value": "b04bd76f82ba672f9e7f25fb383404fa.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bd1171e-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732695, "uuid": "7c836060-3cb4-4e1f-a472-0c71bde73957", "comment": "Malware payload (Gafgyt)", "value": "3e417aaf5c4b265f2032356b6ebae87a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732695, "uuid": "cd29658a-b7dc-4d26-863c-e529408fbc31", "comment": "Malware payload (Gafgyt)", "value": "c8d0af3bb61e3eb05a2d19111f551f15bec65f5b54c5b15576cf9fd64a44e35c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732695, "uuid": "93b9e68b-0428-4c4a-a2d9-9d7d0afbd980", "comment": "Malware payload (Gafgyt)", "value": "8adea66e1e6a6f6a1d828c7844994002c7920a6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732695, "uuid": "1903f608-7392-4a97-aa84-91edb9b60b3e", "comment": "Malware payload (Gafgyt)", "value": "6932c6f161481bada55487819719fd15c98674cfa8ee9a6067f371895cfc74f2a13396063666c66707fca828cbd234dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732695, "uuid": "449e510a-f5dd-43d8-88c1-15748e687a16", "value": "T1BAE33A05DB808B57C1E2277AE7DF424A33339B54A3D733095A28ABF43FC27995E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732695, "uuid": "95e77f62-bf39-49c6-bec8-34fdce64cc3e", "value": "3072:bjjMM7NwA7VWxbZaXmpvh7q078YgM/9l0sgURKXmQwfHcQrAN:bPMM7NZ7QZZawp+078DM/9+XmQwfHzrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732695, "uuid": "c795d477-e6c0-46ae-9d59-a203987fa8a2", "value": 150481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732695, "uuid": "92594711-ba0b-4a52-a863-a6891bd33bf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732695, "uuid": "e4bfbfe2-d2fe-4a4a-8976-4fbee7479560", "value": "3e417aaf5c4b265f2032356b6ebae87a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6064af4-a6f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675781030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781030, "uuid": "8fe42b0c-b065-4c51-a5a2-5825413a9229", "comment": "Malware payload (RedLineStealer)", "value": "a3fb0b17bcd26bc593a6c5009072d1be", "object_relation": "md5", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Misterium", "colour": "#3BED77", "exportable": true, "hide_tag": false }, { "name": "pw playmisterium", "colour": "#30B807", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781030, "uuid": "455a7deb-e356-454a-a46b-67f91d7b51ac", "comment": "Malware payload (RedLineStealer)", "value": "c8ed0a93981f84fd0d865046684ec5945f35b83540874fe38e29f9d9c0d3ffee", "object_relation": "sha256", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Misterium", "colour": "#3BED77", "exportable": true, "hide_tag": false }, { "name": "pw playmisterium", "colour": "#30B807", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781030, "uuid": "9a797974-46c5-4bda-b66f-0acecf82edac", "comment": "Malware payload (RedLineStealer)", "value": "17313514aa41641b4050be7e4b79679d75792283", "object_relation": "sha1", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Misterium", "colour": "#3BED77", "exportable": true, "hide_tag": false }, { "name": "pw playmisterium", "colour": "#30B807", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781030, "uuid": "96777781-05c7-427c-a4ed-4fec6b7444e7", "comment": "Malware payload (RedLineStealer)", "value": "02f936956588597feb67e19d76f6797255c70646c9bd28340ae0a54d8fe03c260fa06d5a7ab54269ae11d8639892a053", "object_relation": "sha3-384", "Tag": [ { "name": "162-55-188-117", "colour": "#58053F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Misterium", "colour": "#3BED77", "exportable": true, "hide_tag": false }, { "name": "pw playmisterium", "colour": "#30B807", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781030, "uuid": "6f6dcaf2-3b89-430b-bd62-e185d1b3f13e", "value": "T1E7D533443A0A28A9D4C510FA7AEE15B03301FB95B56D7E134E7058F9D86F93F2B52F28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781030, "uuid": "f7bddd57-964e-4a1d-829e-0ae81635aaef", "value": "49152:5le4WcMuU7f7GAVRcBDFOo4L98Dl8/Z+XLzcizDfdQHhXwIXZMjkwHICjFl71++M:5leqMuC7GicBD94R8DWoXLzTD1eWkuIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675781030, "uuid": "3427397d-e46e-49fc-aa87-d24631959a1d", "value": 2946976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675781030, "uuid": "2fc5895c-ad61-49ab-8daf-06ee84afa939", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781030, "uuid": "769ebf88-154d-49b5-8bd1-150732007b53", "value": "MisteriumLauncher.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863cf2ed-a686-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675733222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733222, "uuid": "5281d38c-f61d-4573-997d-33725cd7338d", "comment": "Malware payload (Gafgyt)", "value": "64fc7a095e433d168bb72ec2712a08d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733222, "uuid": "8c37cb5c-6c93-4b9a-abdb-c38461d7f301", "comment": "Malware payload (Gafgyt)", "value": "c90d77a5f5161cd340d7f7c254aba25e49e83e1bf2ed08eb3877f2d3fce5eacf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733222, "uuid": "48e13383-665f-448d-9ee0-b5726762cd64", "comment": "Malware payload (Gafgyt)", "value": "9ce1200c0a25269cc7652140d54415cb9377d3ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733222, "uuid": "93beb1fe-4a7d-44ff-a1d9-a600b60934af", "comment": "Malware payload (Gafgyt)", "value": "27da0b9f5827aa1827ab2ec3e746b589142fe0601909baec1b94858ff1de9a9bebf12aff0372554565e0b4997bdc9b1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733222, "uuid": "8e1c681b-df52-47e0-8f0e-3fc9ff8afe32", "value": "T1B9C32A2727670A33C4E6503441E75333B7BADB8435B89347AAD06E9C2F1AAD435933E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733222, "uuid": "7d160c0a-86a4-4275-a2f3-386dffbe9169", "value": "1536:/ZeD2TDvINcb5g/QAYrJnhQH94NXAE6RtBPQxTPjpCmuwA/K7yYPN:1vIN65tnhmYRc+jpCmuwACGYPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733222, "uuid": "4f77ff07-e1b3-4e16-b678-f02a921f5353", "value": 120506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733222, "uuid": "587c701c-68ef-4c91-8e22-6befd2aa90c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733222, "uuid": "3757040a-379c-42e7-983d-042e17c443dc", "value": "64fc7a095e433d168bb72ec2712a08d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092b65b6-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675783263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783263, "uuid": "c1cf1627-602c-453b-8995-32f00affcd14", "comment": "Malware payload (AgentTesla)", "value": "492033dcec142dfe938d2352df2d1bc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783263, "uuid": "65556a50-01d0-47dc-999e-2676cadb0836", "comment": "Malware payload (AgentTesla)", "value": "c90f6acb01061fcf8697b818f4cca93d05f446a60f019d89d9ebf9c30408252e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783263, "uuid": "5d77f443-5d4e-406c-b1c4-4e9c65cfb08a", "comment": "Malware payload (AgentTesla)", "value": "4e6aa5acf5e497b71e95f4ce0e92336ecc1baab9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783263, "uuid": "9a960d1c-989a-40d6-82f0-12063d61d32d", "comment": "Malware payload (AgentTesla)", "value": "ec20c0b2239323667ed6fc48cf5c053bf78fe8763d564da8ba6188708ea31d45d56339e0ae8f657993b1ef383d086eb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783263, "uuid": "1cc8962d-bc94-4303-8cb4-fe6a2e59fc6b", "value": "T1C5F433871DEB9EC45C96FF01CBA245FF9C3CA3DAD7A3E0547990001B9C676BC6682509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783263, "uuid": "96866a53-dd77-4662-a82b-1dbd45684901", "value": "12288:uHvYwjeaGBp5yYcpzAoXOTMhMXm9YVhJmMcAz5o1WX1jtVBxmn3:Th1p57+AvghM29UmMvz5oe5VBxi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783263, "uuid": "05384ed9-a682-4652-9467-d2bec5cafa6c", "value": 766015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783263, "uuid": "3279f9ee-74bb-4aa3-a543-55a7abe62733", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783263, "uuid": "9608f170-5b53-46a2-a18f-6fc8d6effcc2", "value": "AWB NO. 8148557141_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5c1ae7-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758735, "uuid": "02c857ae-e17c-40d7-8349-729455e7a3e1", "comment": "Malware payload (Gozi)", "value": "b84739fd64ad6fbc63a0b8c512330cae", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758735, "uuid": "2436b5da-f94b-4bfd-aa54-f5d6085b5a4a", "comment": "Malware payload (Gozi)", "value": "c93040de86e18f99b66afc2ac7a6afb1dc8d56fbfa07590bc2e9c8505a47fae4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758735, "uuid": "5198eab1-7339-4df9-a2df-f52f068b45ba", "comment": "Malware payload (Gozi)", "value": "af32ded3dc812e0f0cad6f8b28a5aaf85088247c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758735, "uuid": "d7cab4d5-abcc-45a4-8363-9bacaf81f687", "comment": "Malware payload (Gozi)", "value": "082300d6cd67f1c09806ccfb5a76b9c15ff3da36a7dafc1776ebc36f54386f34a4aac148d8f53f64364234ebe0fa6115", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758735, "uuid": "625b9f48-86d2-4b96-93b5-240e65294c46", "value": "T19FA1BFA14C4726DCF065663229A7BD4C8AE151AC0370932FCF0243B1429DE358E2F3CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758735, "uuid": "9a6398fe-960d-42c8-9e2c-eb2158177c42", "value": "96:rPeczTCoPopKJgtETVl17Np6NjH3MWZR4NaQWb2VuL8eCyWPTPz:6WOoYKCtEBlNN+rfZDb2tf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758735, "uuid": "fc1925ac-8900-4981-8574-3d6eb34e7c77", "value": 5075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758735, "uuid": "38d1e052-d285-42eb-80ed-b6930bdba26d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758735, "uuid": "c173334c-2012-44cc-b427-b9d22c73d805", "value": "azienda_40.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb8b3f8-a68e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675736486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736486, "uuid": "529b8008-b92b-4fe1-93af-3f8f0ac687ef", "comment": "Malware payload", "value": "b4a1007c29751904906f52d14c8a9920", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736486, "uuid": "22969ba9-301c-4014-9bcc-64d14483ec4b", "comment": "Malware payload", "value": "c9619395db1a3eed472b792cc62e216d72f4015c8d1e0de20f50e0aa5b74fb0e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736486, "uuid": "a6f49f8c-d568-43fd-a2f7-c26f4ec03b0a", "comment": "Malware payload", "value": "a6929ede48464b8efb93bf8770e0e7963ba2b2a8", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736486, "uuid": "46c36fd1-3815-4c72-b643-777413812cda", "comment": "Malware payload", "value": "f2e7bb4d6b1f8f905992565dcac18b93eaa25c7a7f4404bb5eae9154c46b4179ca2f5c58d267ea8102e2eb079369d2e3", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675736486, "uuid": "deb4b15f-45e9-4b5d-a8ed-4234665fcf70", "value": "T180D61283F758592ECC7785B24D6E4231666B4D928E839B837C48371C29BB5C42F99BCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675736486, "uuid": "292f6613-f80d-4e2f-98a9-da9cb51eedd1", "value": "393216:TlJbatL6W7I5XSPSqpE/EvMlww5vpNL3NrjrxhZ6wcxGYPX7bI:TlJQ+iI5XSPSqpE/Vlp5vpNLN/d6NFvY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675736486, "uuid": "9a080d7f-7c92-4f0d-a24d-462252162702", "value": 13632298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675736486, "uuid": "b1c49df8-b53b-46a3-b1c1-b781e9eb1ceb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675736486, "uuid": "98e97e18-a5eb-46c5-b5fe-81c250e27f8f", "value": "aplicativo.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4cc454-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758730, "uuid": "c0a07037-3f64-42fc-9374-655378165ae0", "comment": "Malware payload (Gozi)", "value": "3b48ca92ce78349442f8202318e0894e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758730, "uuid": "edc7b15d-5f34-437e-af4d-a5c6e9a5c12d", "comment": "Malware payload (Gozi)", "value": "c9739acb7e9c4bca9b7ad1cffa504abf436cfff52360d14c101aa72b363b136c", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758730, "uuid": "e9e13045-5576-4a41-a66c-15cf22aa0211", "comment": "Malware payload (Gozi)", "value": "512280be47489ecfb93372509c4e0addee1b5ea8", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758730, "uuid": "93a7a809-db85-4132-b138-7f50f59452d4", "comment": "Malware payload (Gozi)", "value": "8bbc644211106523a982bd42005068b4942477f83808e3aea2d0b176a09a097a58b3d39af1d0107d9d9d2fb911117d94", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758730, "uuid": "b095bdc3-f727-4f0c-8a48-02e030a7060b", "value": "T1F7A17C92C084742CDED571A987662FD3F02B1B0DE4045C598AA9190D6E482B16FAFA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758730, "uuid": "dc0df246-bf7f-47ba-bc67-6bd8a91ee992", "value": "96:GDIkTNIcHsUzMV2tn/yTQ0uL5UmM/QWcAAi9n66j2GOcoJXnE:UIkydVK6TnuyaWnAq2coe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758730, "uuid": "7c2abf67-2380-479e-ab5a-9589908defb9", "value": 5053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758730, "uuid": "403e4441-87af-4fad-80b2-d33ce5126764", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758730, "uuid": "7d853677-4a23-4d10-88bb-557adb265b81", "value": "azienda_39.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fc9086-a6e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675773032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773032, "uuid": "cf4e242b-e59c-4c99-a00b-30cfbac2f574", "comment": "Malware payload (RedLineStealer)", "value": "5d21a24b4a84825476b8a095b122a3c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773032, "uuid": "d1d5ef1d-e8be-488b-84c0-0728a6849026", "comment": "Malware payload (RedLineStealer)", "value": "c9df15c0e5c17d79b64b4075b6b5f8d44f66f50744c138e6c95bd55097218c11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773032, "uuid": "ae829fe9-5a7f-4ddd-8e8e-0c125365298c", "comment": "Malware payload (RedLineStealer)", "value": "c5b532a37adc31486c6c5d549bf816e7c7d23d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773032, "uuid": "5d38c9b7-6b8c-4661-846e-c7f8aad91c51", "comment": "Malware payload (RedLineStealer)", "value": "79a963c4acd0f9dffccfb08235d636bfc0a956e5828f973eb6eafc96adc9ff29badcc4f86fa4b192bf207c677eade101", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773032, "uuid": "39a9e335-31c4-4297-b80f-37cc8b7d6a3f", "value": "T107640122B290C0B3C76715309A3CDB956EAFB431167A85573BA406AE9F303D0663E377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773032, "uuid": "88004a13-fae8-4c69-bc8c-bc36051aa8e5", "value": "af0a92fe52cf161a7b179d1f32aa9186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773032, "uuid": "63993a6e-46c0-4051-8ff1-73f9edf1b439", "value": "6144:9UVp23GLFGbvJHW/KysdBoLi4FKJZOkUta/20FgZFL:9UVQ3GhGbxHW5sdGLi4FgN/jOZ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675773032, "uuid": "fa06c1bb-8f36-4290-8119-16240e524fe7", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675773032, "uuid": "6af77764-4378-4960-aad3-d9f5bd66878f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773032, "uuid": "aa63dd28-7d06-426d-9762-160dd72afe17", "value": "5d21a24b4a84825476b8a095b122a3c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b299edd9-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756919, "uuid": "46c97bab-6b84-406f-b4de-ba9cb99d8111", "comment": "Malware payload (SnakeKeylogger)", "value": "5c58266cf1f270bdb4a0c4b9406e4d5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756919, "uuid": "5d3b1e61-00f4-4e31-babd-bbe793ec169a", "comment": "Malware payload (SnakeKeylogger)", "value": "c9df7f08985a626d52021bab13ef44092697fa72b91aa78578ae84481bf7ea81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756919, "uuid": "d3d9bc1a-7ab0-44b1-a513-207f447cb5ae", "comment": "Malware payload (SnakeKeylogger)", "value": "d56edbae7de757469a6906738b34ace47c0f9111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756919, "uuid": "bd76ac35-a70f-403a-924f-8f701c5d23cd", "comment": "Malware payload (SnakeKeylogger)", "value": "4412f2c51964f98ed7fd647e41f42bec0221e70e8563938b35082feef9aef4bd98e0ea21e29b3693d30dc62968099e0f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756919, "uuid": "cf3652b9-acc7-43f8-9c66-5e56aa65903c", "value": "T12F45C23D58AE523B9AB5EB66CBE4541BF5D0E52336039C3EE0D3138246169437EC623E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756919, "uuid": "c1526843-393d-4e72-bcc8-ff00708a629a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756919, "uuid": "ba6325dd-25c7-4929-b3cc-46c068f459cc", "value": "6144:vre8DiwER8yHmoKSBZaJw05QtnbqlAbsjlcR:v+JHmoKSfaJw0qtnbqlAAjlcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756919, "uuid": "1aca7879-2b78-40b6-b298-fb9127952715", "value": 1266688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756919, "uuid": "cd1b8c04-862b-4778-9c44-4e5522121b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756919, "uuid": "c4a14c89-63ec-4208-839c-40201693a7c6", "value": "00290202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ecc1c0d-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758577, "uuid": "fecf17ed-eb07-4164-9425-062fd1694864", "comment": "Malware payload (Gozi)", "value": "ebb9011f9184b741a5df7136e888e6d7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758577, "uuid": "b361d23e-3455-4752-805b-b231d5ca0a63", "comment": "Malware payload (Gozi)", "value": "c9e15c7ba0a8f6eb91ac91cc68cf0f41ba574e480f5bff89c70dfb21505e1e8b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758577, "uuid": "676f2518-63ea-4251-9968-88b4990495aa", "comment": "Malware payload (Gozi)", "value": "e306ce3d2d79076b4fb626219c3e953f820babea", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758577, "uuid": "0737664d-fa05-4e5b-82f1-18cda16a2acb", "comment": "Malware payload (Gozi)", "value": "b5ca5c7b06eecb2785902e51bb54baf4cac6d7f87f91970c6bbf260e3e2d2ba98a3a1b5b166e71fb54071e68a135a848", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758577, "uuid": "e7f4da85-179f-4577-9725-379a15a9bfb3", "value": "T1A3A18D942EF3F04F58C8DC93684B420A1312D4D2E974BBE0B9A9FE5638609B47639D31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758577, "uuid": "13909341-f7b6-4d19-be86-7b54b381d04b", "value": "96:aQ/3WZIJy/vHSpZv6ioLXuJGufjwDQ625Qtr2WRuoDBnJGJN0r4:aImZqy//SOLXkLwO5u2WQodJcN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758577, "uuid": "9d208368-2934-4053-b1cc-c1eac4ffe4c3", "value": 5065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758577, "uuid": "03db62e6-8648-4f96-aae6-539ae1bd1349", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758577, "uuid": "7d8e3c4c-934e-47a1-99c5-8b28e7583c15", "value": "azienda_10.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315c74b5-a6f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675780324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780324, "uuid": "02639247-5673-4a15-b6ea-8f465589192f", "comment": "Malware payload (GuLoader)", "value": "ff782c4f5ba7dbd569b7a01862211357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780324, "uuid": "78a6e8d5-7779-4242-bf97-618507b1a1f4", "comment": "Malware payload (GuLoader)", "value": "ca199de162321d31d6ee4c6c475be9aee569d07f8a8b7f1e28804361662d1c09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780324, "uuid": "284e80c9-556c-4398-bee3-08f09f01c11d", "comment": "Malware payload (GuLoader)", "value": "15d07df5f4c8b39cc5e2686c782779cc32440d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780324, "uuid": "447e1e8f-c35f-486b-bd8b-65af70497c78", "comment": "Malware payload (GuLoader)", "value": "e89368f96afe2919511dc8d0884cbbc290ec654a49a399a7e0ee9c808a9ff38d52bb81193316d2c5c94af61919bdea77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780324, "uuid": "d01d9fd4-e1d8-4fb9-8a1c-b098541cedf7", "value": "T199D412413267C897D10D0C358DB3DE7FAE772F5669909A533B14BF1E1832681B84A3BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780324, "uuid": "04c0d797-bd1b-46ac-a1f1-94ade7f20c6d", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780324, "uuid": "f119cd8a-fbf0-4ff8-8343-0c5dc5e9c1e9", "value": "12288:6gL+rDzX8+uSoJF6qmbE8c+4kc/xKns3YfrxKU1GGLToA:X2ESofobEiRcpKdrkUQQoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780324, "uuid": "2726afc7-497d-4b41-8d3e-76ddcdc433e3", "value": 603152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780324, "uuid": "6d3abf5e-29fc-43fe-98a4-5aecc7665845", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780324, "uuid": "690c73e7-afc8-4f33-b034-e3dd43805d23", "value": "JUSTIFICANTE DE TRANSFERENCIA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9485964d-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758586, "uuid": "9332e472-cea1-4060-bf26-f2f44599f42f", "comment": "Malware payload (Gozi)", "value": "a07bc18adc99bf3596ca8fecdbe819b1", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758586, "uuid": "b71202ff-22cb-4879-ad8d-c4c48e047d07", "comment": "Malware payload (Gozi)", "value": "ca774c1dfbb0ee11b016878c83d5cb84f33e40114982a76f65f4b2a972d2e175", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758586, "uuid": "679c9860-3a80-4563-b5d0-cb26cd2311e8", "comment": "Malware payload (Gozi)", "value": "a2e7514fe0af712043ce1d2db78c9dc5149a4bb5", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758586, "uuid": "83b142bc-f954-4540-9edc-b5c948031c88", "comment": "Malware payload (Gozi)", "value": "4c8c78da55175ad1b30aa4b251ca161e2bcbb3d8801eff54daa501fcc92884050db693753ecc61da6d9711db71eac417", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758586, "uuid": "d045d65d-c60f-4d74-9c76-2bdc4fa22f38", "value": "T158A16EA56D5E4E154CC26F37B7FB9D761D40F6E3881E6A0AC262876CC31DA30137118E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758586, "uuid": "be2787a8-f2c7-4e90-9225-5683d56506a6", "value": "96:NrJNnk8i/ohSt5KhqeVAggfTkwWGlcSQ31eN2jnON9aHBfmqxZmzEsC:DNnk8yS85KdAlfTvWccSA1Pn7HBfm2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758586, "uuid": "ba47bdb6-1027-4efd-9100-b6bbc2ae226b", "value": 5067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758586, "uuid": "c13cdc01-3f3d-4735-a370-d8e98ad2abce", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758586, "uuid": "216905fc-efb1-4ecd-b67a-691cc35136ed", "value": "azienda_12.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e66a8a-a6d6-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1675767680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675767680, "uuid": "680bb744-61a6-4083-a248-762517b6d3f3", "comment": "Malware payload (NetWire)", "value": "b08e3670515eeb4c5a31b1a72a2c68c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675767680, "uuid": "66ed733c-ef34-4f87-8eeb-4d618737153d", "comment": "Malware payload (NetWire)", "value": "caee3d5e6fc0673b26429c6521caa57b97693660d9e0cef3b6a746b97c53f550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675767680, "uuid": "bad84369-3b61-4792-a4a4-74885bc6362d", "comment": "Malware payload (NetWire)", "value": "d106b746e5dd6a813be502604938a748a76f6f1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675767680, "uuid": "c02197cf-a6f3-4b45-83e2-dfa848046c54", "comment": "Malware payload (NetWire)", "value": "b14f5e11e7984f7a5842f1b9e329d79caa826a4ba66d4966da433d096a155d4322370954cffae3847d5c01b26132857a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675767680, "uuid": "1276f954-85a7-4415-85db-69cfefcfffe5", "value": "T1FB55E14E7F3C8851E6186D3598F68A2F03395C04A4ACE64ADE763DF56E336C57C422CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675767680, "uuid": "e24bbf11-1f39-469a-9751-b887ab0782c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675767680, "uuid": "348dfa59-83c8-4451-81e8-1fab4faba109", "value": "24576:FZ0V6sg5W4eiU2gqMxfzZBqNBk419jVKqrxN5IC54TWMvApxJWUMwQhrb:gYdWmnYloBk41955tgiHpxJxMwQhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675767680, "uuid": "ebd1b1f7-136b-44ba-8c10-f297293490e7", "value": 1327616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675767680, "uuid": "a58bcd10-c45b-43ac-bde4-c9dec0c20162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675767680, "uuid": "bfa81cf3-70db-4bcb-8f77-7fa430b0ff1f", "value": "INVOICE000298372-23-98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19b05e35-a728-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675802618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802618, "uuid": "74caaff9-d533-4a5a-8b71-6221d0f30185", "comment": "Malware payload", "value": "c8d49fdfdc969de7615a015adcd2b880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802618, "uuid": "cd549227-2f10-4a5b-8a91-1420bbc73ce8", "comment": "Malware payload", "value": "caf15a6e243320fa42238dab6e3d4ebd6bd57c6ad277b9555db7c0325d663032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802618, "uuid": "f90a0a34-3387-42fd-babb-70a81bb49602", "comment": "Malware payload", "value": "f1629844386b6396d4ba61632c5be2a7ede24585", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802618, "uuid": "091bb0dd-89e8-4f9c-a54e-f53fbd43ae5a", "comment": "Malware payload", "value": "73e95e50cdd0153a0f3641872b0c05db64d16ca3898a2c9a5f7f002f5a3e3868b30ccb93db2a3bd48f02cad6a81d183e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802618, "uuid": "5aacd906-e123-47e9-b09b-344e3e24c915", "value": "T1FE14E0323AD0C072C16B55309C64EB746BBEB93146B5CD4BB7A41BAE8F302D1577A34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802618, "uuid": "d21cd9e0-24da-487a-a15a-9d36a49a8c92", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802618, "uuid": "f3bd6375-3788-4117-9cdd-938d9fa124bd", "value": "3072:vdiOdhSlfuBLfcBW8d54zUByyx+Fq6Rw0V55LCkZqQMQ/aeP3adE/:vdipwBL0BpozU7x47RvPgkZqW/aeP1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675802618, "uuid": "af260e0e-0df2-4531-b625-0ca781d2e73a", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675802618, "uuid": "f7e7cce1-38b4-4e85-89fc-9dea78b763ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802618, "uuid": "7868bd9d-391a-4604-9a00-c0b315b2716d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab7d418-a6c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675758328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758328, "uuid": "bd00028d-3f99-4a94-b7e8-69f24b82cb11", "comment": "Malware payload (RedLineStealer)", "value": "8f8063ce9eac170c728987bcb886ba1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758328, "uuid": "7225b205-78f2-433d-aa6b-b16bbd158522", "comment": "Malware payload (RedLineStealer)", "value": "cb383f5456128b82b841492d8b0264e196d6c9fd742c9690fbf816d8d59c4287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758328, "uuid": "a072d7f4-2015-4767-864b-83ef243d3127", "comment": "Malware payload (RedLineStealer)", "value": "90e70d64b768aecd9f85acd4b2768102a628e29d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758328, "uuid": "f6de8eff-bfc1-4460-bbfa-229dd2048ca7", "comment": "Malware payload (RedLineStealer)", "value": "4f453c2ae765a24ebd6eef04d1ff0a8d7d3765d858a93fa8be3b41aff9f84d6a132d2da741d4de3807fa12bad77857ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758328, "uuid": "89ae3f54-d394-4307-99ae-2961ef85091b", "value": "T18C947C4393E1BE44E9278B72EE1EC6E87A4EF941CF7977652219AE9F10B1072C163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758328, "uuid": "1e6eb18e-6f9b-410f-b2a7-9f8e6317d05b", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758328, "uuid": "902b8270-190a-40e2-9b00-d93a93669d1a", "value": "6144:0KJ5hLnxiJdt+8OIxIdzfP7gBi2aJoL4idpEuQj9+hpaL:x1L4dOIuDP52a5idSlj4hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758328, "uuid": "6224c400-f30d-4d11-9922-4505fac02996", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758328, "uuid": "8f72f17e-026d-4332-b30f-7ef7c60340af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758328, "uuid": "d9c8f8d9-33b6-468d-98f3-d502d0c9b94a", "value": "8f8063ce9eac170c728987bcb886ba1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2aa632-a6a7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675747538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747538, "uuid": "98c79788-da49-49d8-ae38-4d94d5965f8e", "comment": "Malware payload (Smoke Loader)", "value": "2474a226df713a57b0e3bd04b5aa9b02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747538, "uuid": "4a61b1c0-0e2c-4f1f-b5b4-9a11625c3e2e", "comment": "Malware payload (Smoke Loader)", "value": "cbc1c728373aecaa4805b1f65d984e9f81616995bd53f313a3189a37732747f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747538, "uuid": "a8852db4-09c7-4919-997f-934446ab9135", "comment": "Malware payload (Smoke Loader)", "value": "6ce2ab156bf5e2aba3249d07af8a6cea5e8a0ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675747538, "uuid": "1a4e45c8-9344-43de-a791-295c37dc2920", "comment": "Malware payload (Smoke Loader)", "value": "d1b951bc91a3177785a29f985130267027dc54d20ff4211cad142f9aef6e3f116398ad7476a0e306f9e5f1874b6f8040", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747538, "uuid": "ccf7ec17-1989-4349-ab5d-ce4bb0d4dc03", "value": "T1DD14D02237D0C072C5BB18305860E6B56B7EB8325674896FB7A9D3BD5F306D0663A34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747538, "uuid": "04e49831-5818-4dbd-8ab1-ff5e44ef5ce9", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747538, "uuid": "2ab2df5e-505f-421b-bb61-1b5a428a42d2", "value": "3072:+I+OGGvZXd2U/LTK+WrTQ59MXouIpn9lw+LQUrGyEdsBOEY1:+I+6jh/Lm+HoouIpn9dQUiyEdsB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675747538, "uuid": "5dd2efe4-e809-4042-ba60-651cfeac3318", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675747538, "uuid": "43311c0a-c7c7-4c03-91a5-507ed8e6e1ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675747538, "uuid": "32732cb7-43ec-482b-b4d8-b71d03bb8f66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b588164-a6ef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675778274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778274, "uuid": "1f77e57d-0ca0-4f2b-9f9a-edbc2b784693", "comment": "Malware payload", "value": "80ac3557196deb1d021ee6d0ba2a36ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778274, "uuid": "9904788a-e139-40a4-9475-d011acbc1273", "comment": "Malware payload", "value": "cbf569e1c8dff91f7d799344d543e9f8ea0f5e48fd287abdaa78a976799eb669", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778274, "uuid": "19563d5d-6e2c-4459-9b25-0a3ad37c2ce9", "comment": "Malware payload", "value": "8d9845af474d79ef639ba22e01581828668e8293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675778274, "uuid": "cc2455ef-55de-4a79-9270-d5c573b87aa0", "comment": "Malware payload", "value": "1812ad526a486b9fdc6dd67dce77c4e2e8066047236f2e2058ca5a66ed4695c392d997e219003585ec32bb69a2737a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778274, "uuid": "69da5ad5-8dd2-420d-9b2d-e1cbe80b8cbf", "value": "T14683184378F188B3E57E0D3158639EA05A2FBD105A618EAB23842E29DF305D1FD35E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778274, "uuid": "00de0bcf-7889-419b-865a-c9719b897da1", "value": "659babcad126bcb9e5f04cb903f5eee6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778274, "uuid": "bc83ab1b-8ec5-4b6c-b22d-8fb62fd7d769", "value": "1536:YC47w33L1bvGC7zoa6PI+oXxE5jOGmJwRErkyRX/sWscdvw8yL/w/hhhb/xi:YK3L5GC7zWoXxE5jOGmRkyRzvwjL/4/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675778274, "uuid": "4dfbcc61-e7d1-4fb4-b928-2c62650202bd", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675778274, "uuid": "ca860b97-add9-4592-b208-edeca6322ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675778274, "uuid": "fc4adfb6-046b-40c3-ac5c-1b4e14128bcb", "value": "cbf569e1c8dff91f7d799344d543e9f8ea0f5e48fd287abdaa78a976799eb669", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454a7a88-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758453, "uuid": "dbc515c6-8ce2-45ac-a807-656aafd411db", "comment": "Malware payload (Gozi)", "value": "ef63c63f919688dcfa706ec8ccbd36d7", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758453, "uuid": "2fa33f9a-4649-46b6-b882-0b86045ccbb4", "comment": "Malware payload (Gozi)", "value": "cc79c4a6c3e6f937692746d740a2d77781cd7b8397384af5e81cbf43896e3705", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758453, "uuid": "8b55617a-3e1f-4bf7-8f30-b961b8f63532", "comment": "Malware payload (Gozi)", "value": "f5ec3767bc66821321927ac3fc3f86e5c83013e1", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758453, "uuid": "9de7e9b1-0968-4c00-9c41-32b89867f059", "comment": "Malware payload (Gozi)", "value": "48ac7d1e068df3afdbf3e7b29514363efcf7320c1aadfd46bcdd8d412586bb78f870833afa7c35478648e7fb8f959eb6", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758453, "uuid": "fa84a3b4-8baf-4e8e-ab62-3fa870df9014", "value": "T154E17E4EAEDB541BA74082DFF3333D10FB60557ED9192204B5E5F70E6BA6727008126C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758453, "uuid": "45209d3b-4d57-4dd0-a544-93d5473b9075", "value": "96:weiBzTLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4d296N:R0dU77rIKdn863jMM0OD9+VVF44xikuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758453, "uuid": "8e35badb-ea5f-42fb-8e01-945ce64f2173", "value": 7044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758453, "uuid": "1b9bc8a1-5c2b-4ac2-b85e-850f06606ccc", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758453, "uuid": "568f0701-560c-4562-a96a-9e1f05917aee", "value": "azienda_34.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74438557-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675788168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788168, "uuid": "2034fd40-25f6-4d71-94cb-2ee006bda024", "comment": "Malware payload (njrat)", "value": "921d7c2187427974a52b164873636bc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788168, "uuid": "7f71606e-f491-4821-ae2e-ad11ffb33f89", "comment": "Malware payload (njrat)", "value": "cc902803f8374f3f386b3537b86202b2f3c5557e9df541128a7b333c1db75f46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788168, "uuid": "c1296823-fb47-4088-b6f9-04ca14e08469", "comment": "Malware payload (njrat)", "value": "e8e3d80fa107c613a537bfabd6d6cd997d259928", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788168, "uuid": "798999c4-3b0d-4512-9a3b-1beef7934b1a", "comment": "Malware payload (njrat)", "value": "84686d65bd72e636b9866241054c10f059de16f3db7f6656416415017141b40bf6ed185fc1a75f2bf5c1a95f8a664d17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788168, "uuid": "4dedd683-93ff-4169-bedd-926bffe04894", "value": "T166C2D66D37B58231C2EF067E5562EA1142B1E04BE236EB0E0CD998ED4B1B7CA0B45FD5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788168, "uuid": "6882730e-0e54-4e3c-aaa3-b7aa727f6aaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788168, "uuid": "f2eb8599-0159-4bad-8a88-6d7784abac2a", "value": "384:TLo5FonO4Y1JVpMrI0CxPzdxRMkAQk93vmhm7UMKmIEecKdbXTzm9bVhca06Mr6s:3uZ/utkA/vMHTi9bD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788168, "uuid": "baef89e3-f6cd-4ce4-bc85-b8df24983823", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788168, "uuid": "d4467756-f2af-4fd1-9429-6961c52a2f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788168, "uuid": "e234be5c-e2de-4e7e-82f1-c703d790718f", "value": "0x000600000001ace7-182.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21587e1-a6f5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675781050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781050, "uuid": "8c1ead68-1b70-40e0-ae51-3fca03497518", "comment": "Malware payload (AgentTesla)", "value": "9b097e20ce724fed3f57883678c15416", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781050, "uuid": "2afcf4ed-631c-4f1c-a96c-e783eb39d0e0", "comment": "Malware payload (AgentTesla)", "value": "cd5656cec8a1dc94d9532d560422dbaaebbaeed83202e35a3f491598680bcb3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781050, "uuid": "0b61a6ec-97b1-434c-8321-50e5c8fa6279", "comment": "Malware payload (AgentTesla)", "value": "6efbea8dd73241b250f0c6ed981fe176d872dc45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781050, "uuid": "3081c36f-bfc7-431e-a8c8-e0f08e661f8a", "comment": "Malware payload (AgentTesla)", "value": "fc67b49b7c4137dc9e82e109f8cddfafab6aa7ce5a3a3375e581a0086b7e3e43c12a92874bc565aeb3b91111dfdc927f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781050, "uuid": "1e044dba-1892-4094-96cd-eaa98311cfea", "value": "T15A64132C2BBEE413E4635D706D7C53B4ABE99C3A0065931F0B602B5CB959282C53F7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781050, "uuid": "0220a43f-b04b-419c-8cda-d72471345396", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781050, "uuid": "4b8bec2f-cb06-47c0-9abf-bf54191fa0bb", "value": "6144:/Ya68yYQYC5llJQKES8SGdr6C1QPHpSiZtOanbuGom9Iwz6rz2y:/Ya1C5llJQK7RIKPXtOanCGom9urB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675781050, "uuid": "f0d47b4e-8934-47dc-bba7-77b92263d5f2", "value": 325740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675781050, "uuid": "2bf2350a-1cb8-4e20-ba90-3ca5586ad382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781050, "uuid": "c707ecac-a7a7-4ea4-99b1-f62740e35aba", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346f07ab-a719-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1675796221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796221, "uuid": "52b28d5a-2dc4-492c-9949-357323fcda37", "comment": "Malware payload (CoinMiner)", "value": "71095a4f6b9ead9cc80b81d3a5a1ffac", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796221, "uuid": "9faa2e6d-7035-4369-8471-ae81a0992974", "comment": "Malware payload (CoinMiner)", "value": "cd9adc5d92164b006e82ebc2498f7b1cd47656e3d2f1bdfd78351311224c5f66", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796221, "uuid": "ee1d0218-5739-46c9-9b59-513bd4e67a62", "comment": "Malware payload (CoinMiner)", "value": "728f0b9bfb588fb288c1900e8570cc743d8ee7e6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796221, "uuid": "6c6fa9ab-d65e-41e1-95ea-bf3dd207f935", "comment": "Malware payload (CoinMiner)", "value": "08292b363c32aadfb940e94cce228c12a45e0a9cfdc77c3bd235f694660d64be89d7253c6b7a3df35669299576732831", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796221, "uuid": "adaa2060-b992-484c-888e-71d366b87d44", "value": "T119049E1BAB548B33C52B6BB995E743753230CC419F8B5F06A6E46D397ECA3C27D09188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796221, "uuid": "8d07b6c2-37ca-4e53-9629-8636590c8685", "value": "1536:Cdc9URWzKr7PhuuUpV7+5JTiy95+uUCQahsf5mZIWiwwr7QXsouW2ASDDA6rRfCd:CdpWaxa7Dy95wS2cjxnqvXt/SSaSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796221, "uuid": "1f200495-66bb-4550-9dab-f2fe8ceeb5b6", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796221, "uuid": "4a3efd5d-89c5-468a-b82b-777245184851", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796221, "uuid": "6adf229f-69b2-4f75-a364-5b9b3f8ed8d7", "value": "71095a4f6b9ead9cc80b81d3a5a1ffac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87abd67-a6c8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675761680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761680, "uuid": "d2a7e4ce-13cf-4953-bf2d-02e9b4153eef", "comment": "Malware payload (Formbook)", "value": "c71d6374ee14811b90b888115a68ee38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761680, "uuid": "156a1ed3-7c33-4316-bbcd-4731543e7aad", "comment": "Malware payload (Formbook)", "value": "cde343d0c07a0fa310a05434efafe274503dc0a5ba64bd9fdff873301ddbb5ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761680, "uuid": "24710605-ac95-4c5a-b5ed-6689828822bd", "comment": "Malware payload (Formbook)", "value": "69647456d522067f625d2a4f3f52e438632d4778", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675761680, "uuid": "96e28f13-8eca-45c8-b44b-dc3c88a09515", "comment": "Malware payload (Formbook)", "value": "8d33c6de06f33fbbb93124f430365e00e513ef18cea78c7fba1737caa8a00a34b21d10f0a31d111775f06e88bb0c9322", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761680, "uuid": "d6841cd4-80a4-4064-ad35-ee6d3c0bc2e5", "value": "T1BD7423A5B5319093CAB441728D350E2B1FBE89306970C22F07587E95FEEB741EE6E391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761680, "uuid": "b8548cab-9118-4565-a4b6-62e7b1d8dd28", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761680, "uuid": "f9cc9e4c-17d2-4258-949d-d2455d995ff7", "value": "6144:PYa6m1XaVqcQOGYiZ07ohfxdAcI6d0xzs5UzoiOVcFnzVPk32BXbi+lIAZoEN8Qp:PYYQNGxdfbI6wzKRiuiz1k32BL56qNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675761680, "uuid": "02720ec5-3526-4716-9046-c5f6907bb641", "value": 364267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675761680, "uuid": "4a5740fc-3067-41f6-8190-72c4297be31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675761680, "uuid": "a122b552-80fb-4ede-970a-4dcd3a81617b", "value": "c71d6374ee14811b90b888115a68ee38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f991cada-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vidar)", "timestamp": 1675788391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788391, "uuid": "7dcb1277-71dc-44c8-8b20-efe2e632e05b", "comment": "Malware payload (Vidar)", "value": "6bc008d5e95ba85a97485f7eadcaada8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788391, "uuid": "14061b4e-a381-4fbc-aaaa-d101d1559779", "comment": "Malware payload (Vidar)", "value": "ce843abf3efd13e3bd245cce6797caf93cb24d03062966b311949d7344049297", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788391, "uuid": "92c89647-0a88-48a3-8233-b4d281012f2f", "comment": "Malware payload (Vidar)", "value": "3dd89c29b186e4aa2a20267e5dd5ddfdf0d9e709", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788391, "uuid": "74d6d32a-9d68-4acc-8da2-bf2093a8cf2d", "comment": "Malware payload (Vidar)", "value": "a9d763844dbf17038b9857a388795e224f7ed42f3d5187a2dede26e0e808c626e3932b56bc9ddd1f29fb8bedf1019ec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788391, "uuid": "9e35b228-7eea-4f5b-95f8-5eeb3c9483cc", "value": "T197E422317B80C476D7B79934AD41E6B667BCB43065B0EE6B33984BFE2F21191923530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788391, "uuid": "1f382cdb-1fc0-4418-8feb-2c1ea320d656", "value": "ab6f9c627ad0c79047c9942afaa32bfb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788391, "uuid": "7f9fea77-90d8-488d-abe6-1db7c504f2bf", "value": "12288:hgJYMeDQwdD9BXp8dW/12j39NODZjAziDmwHrGWsgjQ2gFtheYp:hQYywp84JvLraHtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788391, "uuid": "241ee218-2626-4638-9a69-d4a19f144fbb", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788391, "uuid": "71fb675b-3d08-462d-a97b-b93ed4444ac8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788391, "uuid": "5ed5e873-875b-43d5-8fe1-c2501e7b0a59", "value": "ce843abf3efd13e3bd245cce6797caf93cb24d03062966b311949d7344049297.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f451da-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756928, "uuid": "8c2ec47b-761e-4b7d-af60-f64a956cae66", "comment": "Malware payload (SnakeKeylogger)", "value": "fc2cedd3815343b254e92930863d492b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756928, "uuid": "1c420ebf-f0a5-4c0e-ba9b-7ebccdc9251d", "comment": "Malware payload (SnakeKeylogger)", "value": "cef485cd7fecbc6b4694ebb8bdf09d3e7c9ffb9228d2d0bc5ddbbc521d463327", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756928, "uuid": "9d5a8d3e-5e20-45ec-bbae-c4848920c21f", "comment": "Malware payload (SnakeKeylogger)", "value": "c0c01d002f98cae043940ee587deecffbe531493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756928, "uuid": "fc47a2c9-efa3-4742-8888-ae349f651003", "comment": "Malware payload (SnakeKeylogger)", "value": "047968e2fb378295d32586a639ea4ae37fa934d48c2586e71b4a56c77198fbead45c29fe72509474200dab390d0625a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756928, "uuid": "c19044bd-8812-45e0-a86c-3c7084ad7080", "value": "T1DE65043D98AE5237D9B5EB76CBE4541BF590A9233513AC2DE0D7238206239437DC623E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756928, "uuid": "50a44fd1-47ce-482c-bc15-79f92c78e886", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756928, "uuid": "358aa93c-131a-4d05-bb3b-e6243c832916", "value": "6144:6re8DiwER8CHmoKSBZaJw05QtnbqlAb46VV0BuqQc:6+tHmoKSfaJw0qtnbqlADqBuqQc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756928, "uuid": "ecba08d0-a3cf-412c-8123-67e50b524ce9", "value": 1429504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756928, "uuid": "7082f431-14bb-4a84-93ff-602d3d8fb249", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756928, "uuid": "e46defd3-8850-47e1-b3d7-b636671935c1", "value": "INVOICE 0029020 2023_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e2837b-a688-11ed-88f6-42010a9c006e", "comment": "Malware payload (Tofsee)", "timestamp": 1675733898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733898, "uuid": "c6576948-41aa-43f2-a077-fd0c23f92bb1", "comment": "Malware payload (Tofsee)", "value": "554879592dac3efc1711fab6d3af54ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733898, "uuid": "b661f5d1-6851-4ada-bde8-f53fb640571d", "comment": "Malware payload (Tofsee)", "value": "cf08cb921f0bfdf2876df5f4691b06233515e150be0456b7d3ee5dee5e9d55e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733898, "uuid": "76d088a0-c4a3-493f-8776-08be4f510cf7", "comment": "Malware payload (Tofsee)", "value": "e26c2828e08ac6f03f3061bdb22505bbcb41c99d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733898, "uuid": "73e616f1-e9f2-4253-bd4f-ea44bd4da086", "comment": "Malware payload (Tofsee)", "value": "8663c128ec6c50f318b1f5960b3422200b5454dad563c154e0795b0c3eea103e5de5e3694d65f0f007f03a256ffc10f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733898, "uuid": "9c1b613d-2ed6-4498-bdaf-1472701e623c", "value": "T131643A4393E1BD80D9268B72DE1EE2E87A4DF9508EBBB76532189EDF15B1073D163210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733898, "uuid": "333072f0-52fc-485c-a4c7-b180344e135c", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733898, "uuid": "c9f7bf98-5623-4eca-84d1-66ad62039711", "value": "6144:nW/LvlQkaDpjZ+mg5exp7sCkuQj9+Rrga:W/LS3Dpd+mp5klj2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733898, "uuid": "fc864794-30d5-4b60-9697-5057f18fd4a1", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733898, "uuid": "e9c29c48-11fd-4b41-9f69-4ba1548419c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733898, "uuid": "dfebc75e-0698-40f6-8299-4451dea0fa86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e255f0-a73b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675810739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810739, "uuid": "87be22ad-73d9-4293-82be-8c630285ae36", "comment": "Malware payload (AsyncRAT)", "value": "79396e0c781e2c31d4ec0cd97d434d86", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810739, "uuid": "ee14edee-3e9d-4226-b813-4031951e204f", "comment": "Malware payload (AsyncRAT)", "value": "cf4921a55199c27c24e4fbacc4a3e90d4d5249e4aeb4de2eafe56d395cdfbde4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810739, "uuid": "cea2231a-d74f-405f-9c74-f0813082759f", "comment": "Malware payload (AsyncRAT)", "value": "588a5243362892c4cbbb9fc42d1dbb454687e5a1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810739, "uuid": "8147567f-3039-4d6f-a334-e02798f7e93d", "comment": "Malware payload (AsyncRAT)", "value": "02a0d68702c53d39fd898dd43b60c99a74678e62c4f5e3ff1a3809b264c69406416fa978269d25ab07d494d466de51b2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810739, "uuid": "8ffe3d60-d0d9-4a83-9a6d-3f0f23274a79", "value": "T1F0F38BBCA5DB49D8F54F944536FCFFB1023233F399C91E61132896448BE9EA92E4448E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810739, "uuid": "6b490dc2-c8db-4510-94be-58f5dcb2fe69", "value": "3072:oN2A/QIyO2MjD9L8mtvDNOQkowmGcA63Ap9:oN2A/QIypMjD9L1xUowmGcA63Ap9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675810739, "uuid": "917c523b-366c-4119-8a91-0f1e37b06fff", "value": 166429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675810739, "uuid": "a057d0f6-a2a0-42a0-9452-be9a3c48091f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810739, "uuid": "ed23d960-3c61-43a0-8f8c-572ffc737fd3", "value": "Report.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b38287d4-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756920, "uuid": "c5696508-0eab-481c-acf1-b0f580fefa4b", "comment": "Malware payload (SnakeKeylogger)", "value": "0e83d9def9f0d8b855725f0e0136201c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756920, "uuid": "506b5d0c-c9cd-421f-b7bd-44422e30d909", "comment": "Malware payload (SnakeKeylogger)", "value": "cf635b3f6775fdf343dee0e703f1ebc24a740d4b1c76ad11e4118bcc1e636882", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756920, "uuid": "838de860-ef34-4b21-b4f1-d2bdc092b228", "comment": "Malware payload (SnakeKeylogger)", "value": "2846547d5f34abc3084192dbc6976484fae3c0a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756920, "uuid": "2e561836-4194-4583-a7e4-84b5dae031a6", "comment": "Malware payload (SnakeKeylogger)", "value": "0289e2c4f3a897a5f10bce3b206c352487179d8024564109ad8654fe1670451d66c00d7153a497804c50227b6fae3bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756920, "uuid": "69f80902-9faf-4b3d-9548-13b12646c20f", "value": "T1FF7219267A5D9730E965873FD4E7D11403A0E78AF413C90B749BE30A9C433EACA71299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756920, "uuid": "0f2082bc-000a-4d09-b085-e3f7a1efa1a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756920, "uuid": "dc84c167-c625-4cde-bd86-14c7c35e5cb5", "value": "384:MFqF+L4TURdJJsjYa4uz+0mYKC9fn9/Awh:0RdJJsjiM+dCJ9oS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756920, "uuid": "7850dc47-69cd-4769-ac61-621b2e2ab4d7", "value": 17408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756920, "uuid": "c1495e2a-3542-45ba-ab15-8927d8c26ef7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756920, "uuid": "2e00f674-379a-4c22-9ec7-a66e64aa07e1", "value": "Tvccjkahqr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a53032c-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757281, "uuid": "a19aa272-8038-4c63-97c5-8820866aaab6", "comment": "Malware payload (Gozi)", "value": "016718b37c3165ab7b8f6ab427a76cde", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757281, "uuid": "5ea48647-5389-4129-815a-25c88fcc5b01", "comment": "Malware payload (Gozi)", "value": "cf793c17598eadcc77f3fc79d0a35bd5af59792e932946c7115a3033a44fb070", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757281, "uuid": "06e36008-ac96-4b13-af8c-f84a400b953c", "comment": "Malware payload (Gozi)", "value": "19d90ae53d5e22ca818cf713cfd3a500021f4da9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757281, "uuid": "8c43e7bb-5bb4-4f77-a89e-b43441400a1c", "comment": "Malware payload (Gozi)", "value": "f5a354e8d96aa09fac7e6560f6d2ffb3ba5f5ec740fae204229ffe19f6ca4110256103afb0708da54d596f29ae648b24", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757281, "uuid": "027758a5-9d66-48a4-8dcd-0d41f2459a45", "value": "T198E18C9EEDDB641BA74082EFF2733D10FB6019BED9296204B5E2F70E2B66727014161C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757281, "uuid": "ef619420-143b-40c5-ba69-9190a39959db", "value": "96:wlYnALVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dh96r8:xmU77rIKdn863jMM0OD9+VVF4nx4kuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757281, "uuid": "3aa352db-05f3-4bce-9c83-3d73c84c6a03", "value": 7051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757281, "uuid": "f70e86be-4cc2-408b-9860-19fc288d8690", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757281, "uuid": "6b4959fb-e03f-4503-80a8-31cda2ba25e9", "value": "azienda_09.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea2c7cd-a738-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675809579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809579, "uuid": "af11666c-9568-4eea-9997-866c6e94865e", "comment": "Malware payload", "value": "74a00ceb9e320ae4b72ada428c632283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809579, "uuid": "5abc2100-873a-4997-8c6f-9d678b91329c", "comment": "Malware payload", "value": "cfdfd8ff03edee0872b737413c7e1093690c97e7841e0dc48c91a2b4bb5e9d09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809579, "uuid": "65a055a6-0bd8-4441-a392-700275fbb62d", "comment": "Malware payload", "value": "cb2744ab81d6ba877ba5a69fe65e5dfe8a677f5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809579, "uuid": "ebc30e69-1e8b-4b5b-b664-d1582ec04399", "comment": "Malware payload", "value": "869333828c43e3bb24bc5e2d2f6a69fdf15ef3ca884c639fd2ebffb1a6c68f4373513fd0cf53877048e73e4bb70863ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809579, "uuid": "42b1a256-8ef2-47dd-a4b9-f53854c89be4", "value": "T136B40257EBFC8563E4B567B048F703D31A367E606E3843572A4F6C5A0D726A4623432B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809579, "uuid": "2841be56-6fa8-4450-93fb-9243a0ccd3eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809579, "uuid": "c11910de-fde2-4caf-88be-7285970c2bad", "value": "12288:WMr3y90kcbd+vQ8yoG3mrqc6jSyAwdLpSa0NNsfl07:lyMZyQwG3mrCcCi7gl07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675809579, "uuid": "c6ceb82c-11d8-4622-b30a-dc835fa9f3e9", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675809579, "uuid": "fe8d0011-020c-48bb-8386-e0195dd1281a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809579, "uuid": "75db9767-d5b8-433a-8757-d9b778fc01a4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1374c0-a722-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675800259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800259, "uuid": "131e888e-5d55-4474-b977-2390491f77a4", "comment": "Malware payload (Amadey)", "value": "7cc2acfc5254fe96374f1e4e2c7b1868", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800259, "uuid": "4e1ad63d-6c2d-43f7-9e9b-67f94b8a47c7", "comment": "Malware payload (Amadey)", "value": "d03cc2a0662c1682e5f2b387d942baa6479db36e92dd5cbf2b7cb86e3d8d83b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800259, "uuid": "84cc45cd-9fa7-4605-9165-3b82bc14feff", "comment": "Malware payload (Amadey)", "value": "c5b3b8481d5d27f62651fae6a5958719b704d353", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675800259, "uuid": "c8b8f64e-a4da-433a-b445-0497af0e6c96", "comment": "Malware payload (Amadey)", "value": "e822c9f402334d6823bb0fca82eb6f3d1280755436ca36f2d2a1f3478e12d6e061832d2c7d726dd4cc34596f70ee6346", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800259, "uuid": "a390af48-6bad-4479-a724-9783424c184d", "value": "T1D6B4020BE6ED9162E5B457704CF702C30A367D92AA34939B228FBC6D08B2574F13576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800259, "uuid": "1a82d6cc-0f51-41d8-b563-08d3bda67357", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800259, "uuid": "8d2caf65-8600-448d-baac-3e2e0ed8c8a8", "value": "12288:sMrMy9054Va0TBHXrz5NOZdEUauDv5sOs2J:wy64Va0TZXOHEURDv2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675800259, "uuid": "2a943d38-1dd9-4495-ae4e-797db6dc7cac", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675800259, "uuid": "731a25af-d75f-4fea-8029-71b16c9188b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675800259, "uuid": "91e1d7a3-98f1-4660-bdc7-ec275e434c82", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efc1856-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757208, "uuid": "8c645128-5887-4335-ae06-fc0937a15919", "comment": "Malware payload (Gozi)", "value": "94045dbfad80169ceafd5bf795e93830", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757208, "uuid": "33320089-81cf-4c23-a622-684cc1e26f96", "comment": "Malware payload (Gozi)", "value": "d053cd2fb41966e2006baaeff5d4362243a2920bfa6756ed1bc711a05b2d3fee", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757208, "uuid": "a5e1c41a-d6b2-43a7-9299-e9a627680544", "comment": "Malware payload (Gozi)", "value": "98fd2109c6f3cce147cee19b1c8d4119773869a6", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757208, "uuid": "171fdbd8-0c71-4697-a1b7-b7e9308cbbcf", "comment": "Malware payload (Gozi)", "value": "4c8275ccb1840609fabe964fc579f198841cd7e562e5165d45d84a8ab5fa65cd503f08610809d9d6ad584cd31e6f1a94", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757208, "uuid": "a1160059-15af-43b3-b2fc-bd2261780a41", "value": "T1DCE18E8E9DDB641BA74041EFF2733D10FB60157EC9297204B5E2F70E2A62727008165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757208, "uuid": "a1db23d1-7b16-480a-80e9-db38791d9453", "value": "192:SbUtU77rIKdn863jMM0OD9+VVF48xYkuX:SYE7EOM7/F4kuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757208, "uuid": "0a2e8e03-d469-408c-95c0-306c1c97d598", "value": 7001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757208, "uuid": "ad373926-6941-402c-bec5-b473b6dc22ab", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757208, "uuid": "02f61717-8d5a-40d3-b7e1-67554cf9ea9d", "value": "azienda_02.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc31a63-a6df-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675771621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771621, "uuid": "35670134-6fe7-42ff-8887-f19d6be94cde", "comment": "Malware payload (Rhadamanthys)", "value": "d1f453af9f56a30af3db2d6c6feb40e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771621, "uuid": "14dbc2f3-49b8-4c87-a05d-63a1384e0e8b", "comment": "Malware payload (Rhadamanthys)", "value": "d088acc3d5699c3f7a024683ddda2503624535bc7648a0e80fa34f890208865d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771621, "uuid": "4aea7408-4cb6-4bf4-a9cb-a659c3d1393f", "comment": "Malware payload (Rhadamanthys)", "value": "8edce17ea7a49361d5464ca9ba0088e5e1f3431f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771621, "uuid": "23bb6357-e895-464e-8caf-7197e8c22170", "comment": "Malware payload (Rhadamanthys)", "value": "14887f7d28888256da0d1d6aa0d00b999d3da47572cc4b28d4d9a03736a45d33169fdde6fbd8885a296232601c3bca4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771621, "uuid": "a47abe1b-effa-48e4-8ed4-cf44e0a27945", "value": "T156859BA1965ED39BC2A0DCBF004AC341DC353678317F7251AEA31EAF24E51C9DB95B88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771621, "uuid": "6adfbfd0-f913-4b77-96d7-488839c411e9", "value": "936ec0127d07384555806d82af01c27f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771621, "uuid": "7a238dd0-8427-4a23-906f-ca57c02563e6", "value": "49152:WghvKOWTPrvvJA/lsXWy7KIfN/m5llkvvEnKKgN:WghvLKzBANpa5flm5lCs1gN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675771621, "uuid": "bd21ac02-a4c6-43c3-b14a-3f051186f309", "value": 1712552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675771621, "uuid": "4093fa99-d7cc-465c-a707-f23ab5d4abc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771621, "uuid": "c3613f74-1b25-4a48-94b9-d2a7112f5de8", "value": "d088acc3d5699c3f7a024683ddda2503624535bc7648a0e80fa34f890208865d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df933420-a6b0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675751411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751411, "uuid": "82b19538-ddfb-47c1-b5ee-eab5c373a2b3", "comment": "Malware payload (RedLineStealer)", "value": "923ece71f765a3bb14333bde5e4b3f7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751411, "uuid": "1208e12a-47fd-416e-8d62-bfc598a8dc59", "comment": "Malware payload (RedLineStealer)", "value": "d0aacf60a429e3b86c609261273ee1c3dab21edef085535d1120bdbd153077d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751411, "uuid": "a15724e5-9bc5-4ae4-ae8a-5620b836d643", "comment": "Malware payload (RedLineStealer)", "value": "1f356ec1fc8586a988668296178bef2eb0368c94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675751411, "uuid": "f5fcd75a-d979-4ed1-96d3-3f78a99e513d", "comment": "Malware payload (RedLineStealer)", "value": "14b7ba9e515ddf39051a7f8f02584aa7f4c774f0c3b24d8bab57089b74756c8305cc47b94fcfafb8fd4e77e05d230ab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751411, "uuid": "271f6b64-6732-4c62-9f1a-104bf84e8674", "value": "T1B164F12236A0C031C5A75578A930AB7C6BBE74B11579C90FBB9417BE5F303E0A639357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751411, "uuid": "f0cab2d1-af94-4fad-8b4d-d958548c414c", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751411, "uuid": "cb4a0ea2-b986-4ede-8574-b7ebe1fd9773", "value": "6144:9zWufHNqELTtfHEE6g8JjObP/1NDAoX3mXkT:9zWIHNqEftfj8Vone", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675751411, "uuid": "618581c3-bf2e-4a13-a3df-e53b7eccb5f0", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675751411, "uuid": "fec1778a-d02e-42d4-bff1-737c152e2762", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675751411, "uuid": "2b017382-a41f-49cd-a375-0f09631b49ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b2dfb5-a71e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675798313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798313, "uuid": "4468ecc1-308f-4f46-bf99-9f36c9248843", "comment": "Malware payload (Smoke Loader)", "value": "ae7f078dc5ac494c26426b2cd3e9b9d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798313, "uuid": "e39cd89f-3170-4ad2-90b1-fd18ce1a1219", "comment": "Malware payload (Smoke Loader)", "value": "d0d8bc6731a022cb86e16e9956b5b1da0d15fbe00bfb342455fb0c2f4ed22ccf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798313, "uuid": "5b12a87b-ef25-4117-9ff4-1dc6b1d01dda", "comment": "Malware payload (Smoke Loader)", "value": "78d6fbf737b2c450b05883444e124c101f6059e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675798313, "uuid": "35e73a96-b5a3-435b-8ebb-2ec8bddfba77", "comment": "Malware payload (Smoke Loader)", "value": "ccaf9e8e350609790ac23bc661905a05a851dcb22761263dc22c237a1a4d5a4ae6351455e3d13369a2f58bd2781fa4cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798313, "uuid": "fc7fdff5-730a-48e7-b009-070f7ce177c3", "value": "T10014CF323A90C072C52B55705C60DFA57BBFB93046788D6B7B6813AD4F316C16A3A39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798313, "uuid": "6f8dd4ca-d55a-4b21-93f1-408f39f46b59", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798313, "uuid": "23b51ab4-48ed-4e80-bfd1-521babcff0fe", "value": "3072:8JDOvUxENNqMv4Lqk1W85bAL135Z+PhGK8lLeX58lY9U8:8JDp894Lx15AR3XM4Lc+W9U8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675798313, "uuid": "36b07b43-3379-4fdf-9c7a-c86650c55f65", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675798313, "uuid": "b7f8d845-741f-4215-982e-b93aef2285be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675798313, "uuid": "80e8121a-b7bf-4d43-8bc6-6ca3f27946d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cd8a49-a6e0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675771819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771819, "uuid": "cc6d72ba-8e71-4491-bb6a-a994949bb8b3", "comment": "Malware payload (RemcosRAT)", "value": "edf34e47835acb25fee82453f86861a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771819, "uuid": "2dcbdf15-276f-4dd3-8de2-6db54512dd68", "comment": "Malware payload (RemcosRAT)", "value": "d17ccb455ee24cc30f0bb0bdbfe244a388444b82ec069bb0766870b243f03695", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771819, "uuid": "19fd7609-b083-44b1-a0ac-c91ebe1d68d9", "comment": "Malware payload (RemcosRAT)", "value": "642a050f9e7a034a758a1792fbe52cf2d9995011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675771819, "uuid": "5ed28923-a597-4b30-8c04-af92a2401d1d", "comment": "Malware payload (RemcosRAT)", "value": "e93f97d766cc3a0a4daa1ddab03024250b29a95fc42be9854b7d6c216e87c106ed6b2c506707a5dca0c9867fa5cc6f8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771819, "uuid": "cec4d4d9-5000-4750-a1d4-083764081c25", "value": "T1EC25CF12B1F290A3F58745B29025BECD2C3C7123B6D4E61766793A9063058BBFBD4FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771819, "uuid": "b81a2b24-8ab6-40c1-b45f-dfba46d87efd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771819, "uuid": "78890b52-9e28-4190-9515-271eb41583f1", "value": "24576:g/gJQO12IZyVJ3YdoAx0o9JYqvljL2df3l31cconBuOhjSX:zP1ik0Kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675771819, "uuid": "49a0e1b3-a417-4ba7-a0b1-8052eeb73217", "value": 1049600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675771819, "uuid": "17827efa-14ab-469c-95a1-27d70ae8596f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675771819, "uuid": "179eca11-f501-441a-99b7-b0404416176d", "value": "d17ccb455ee24cc30f0bb0bdbfe244a388444b82ec069bb0766870b243f03695", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b78389-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675756790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756790, "uuid": "496b05bb-cc2b-40a5-9155-df263bc1f2ad", "comment": "Malware payload (RemcosRAT)", "value": "a2c8392f47662eb08f743b75912fe84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756790, "uuid": "6f3c1988-8d57-482b-b7b9-77fb5299241d", "comment": "Malware payload (RemcosRAT)", "value": "d1937bc0326abde4ce4a9f3cac4fac05de2926bfec9be2ea40200b9682bebe30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756790, "uuid": "c6812224-acd7-43ba-b0d5-60b67388c6f4", "comment": "Malware payload (RemcosRAT)", "value": "6c15b308b41065a646bff69ce629efe8b673e6cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756790, "uuid": "fa630fc0-6721-4d8e-afd3-30691161413a", "comment": "Malware payload (RemcosRAT)", "value": "8cb7266378e5cdffacada270a54adf2ab9178d8b6674736de858e7fc54e658451283c9b5900eedc6be66b6279957da32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756790, "uuid": "8e7c99b9-535d-4441-ac5b-debc54d53b6a", "value": "T13794013278D0D0B2C5A358345924D7A13ABEB6311E7CD647376D16BA6FB23E1123A31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756790, "uuid": "c5bfe306-421c-4e10-821f-a67764601ae0", "value": "fe0b55a75647240d63e8d2d6140a4c09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756790, "uuid": "fb9b7ba3-dca3-4c16-8f5d-e3b88ca66852", "value": "12288:olUMX5Lyl/bvlQkJYJTN9Z+pcHFx5kjIKhP7:ohLq/bvlQkJYJBzYcHFxGd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756790, "uuid": "5cd04d77-bae9-4cfd-b28e-c44a4ac60701", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756790, "uuid": "80b130b0-dca4-4995-a03f-785ba178f08e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756790, "uuid": "ce9471a5-6238-4929-a077-59146d353cdb", "value": "a2c8392f47662eb08f743b75912fe84a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00dc8cf-a71b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675797314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797314, "uuid": "80440bbe-7349-4147-aeed-e254421db925", "comment": "Malware payload (Amadey)", "value": "2ecbf9cac46689deebcd44b0c2acdff3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797314, "uuid": "cd1970d8-e9de-4a8a-80ed-a88146a0c0af", "comment": "Malware payload (Amadey)", "value": "d253e8853dc3cd8006e71d8cd8f1618f6187ac0880ea7aaa69aa7718126b1d3f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797314, "uuid": "e52dc3af-88f3-44c5-865f-c25e20fdf492", "comment": "Malware payload (Amadey)", "value": "22b42657737e27edc28b6904a69ec8e79d4ad7ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675797314, "uuid": "a1ee500f-a3f6-4aef-b799-684f235d42b2", "comment": "Malware payload (Amadey)", "value": "30d1670526ca275b662a5d5a063bc73be9bbf6def4eb6723ea3dff872229fafe12c636135143922be3da0835e30a7f65", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797314, "uuid": "33156ffc-0502-412d-b96e-724ed5b0b050", "value": "T1EBB4021BA6DC8032E8B253B00DF743D30B367D619B78535B264B9C5A18B2674E63573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797314, "uuid": "39b2cca3-ccab-4ea7-984a-df157264993c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797314, "uuid": "c8b97997-7b87-49da-9ec2-bf841dd045c7", "value": "12288:+Mrjy90nnsovZLRrZ/moKIbHYuVtfY0h8:pyInXBNrZfbH1tfY06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675797314, "uuid": "19f5bd99-4974-49c9-9ef0-1c747ff944e1", "value": 536576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675797314, "uuid": "af9e0b32-1adf-4589-9d85-22a61bf24d30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675797314, "uuid": "f56ea241-fa96-4ee3-b9ad-fab0a74c0394", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5173dcf2-a68b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675735281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735281, "uuid": "02ceb7fe-f475-44cc-bbf0-9ee85d287032", "comment": "Malware payload (RedLineStealer)", "value": "90715db8fa66813b9741ee7f72f2e054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735281, "uuid": "f6928c7f-ac6f-441b-83c6-ee142271dbfb", "comment": "Malware payload (RedLineStealer)", "value": "d2e55df8aa884631689f6a5f977da500a2761ce7067d2db4eb7b6b9c37badf40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735281, "uuid": "7b035415-c884-4776-b976-d1833a7e0d5f", "comment": "Malware payload (RedLineStealer)", "value": "5f5bb986428a6cc72753e35840a1d199c9606da9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675735281, "uuid": "519d9a20-4279-4b23-b836-f8d54999493d", "comment": "Malware payload (RedLineStealer)", "value": "d17f50de204ff324333a453998aa1704eee7ef8026199ab8447d20a971fa61634397545c76d51eea43eb1ff517cfd391", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735281, "uuid": "145cbaac-631d-4211-bac6-5f0ffd5d0298", "value": "T16A848D4393E1BE40E9378B72DF1EC6E87A4DF9508E79777522189E9F16B0072E163610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735281, "uuid": "ca5ea36a-830a-449f-a3ad-9b77d326b17b", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735281, "uuid": "2782027a-3470-4a03-9616-e91e5e080195", "value": "6144:pSkLefg7Tsm/d1aImsfjxlVm5IU4GYrouQj9JIxa:wkiIPsm/qIvxDmCU4GYolji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675735281, "uuid": "b5bb4193-ceb4-4bbd-9ca6-69ddf6e53149", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675735281, "uuid": "d55d1514-ec4f-414b-8734-0d9686baee1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675735281, "uuid": "aabdb245-c67d-49ca-9eb4-97dd6f3c2bd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c186889-a6f4-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675780342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780342, "uuid": "f7cdb15a-48bd-4b98-bd2c-c69fdfc44430", "comment": "Malware payload (DCRat)", "value": "945492bca779f9802b45b0d9c7915aac", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780342, "uuid": "d7cb6565-abde-4259-a0ba-49748d5e01bb", "comment": "Malware payload (DCRat)", "value": "d34ec7ae7fd79326dc877938288b4a8e8031e076d28cb6023858a14d6588992f", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780342, "uuid": "b094db14-0ee5-40d3-9728-75d34c0db0bd", "comment": "Malware payload (DCRat)", "value": "3a89c393134508f240b4e69de3ce3909148bcf89", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780342, "uuid": "9c77b0f4-4878-42dd-af7b-50f20c6cd6f3", "comment": "Malware payload (DCRat)", "value": "2a38abe125cfebb5573926306867d816cd760eec46dee63ab5b88ffdf8b3e6ca65071e7ae55b7de0b17435af1ec23ada", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780342, "uuid": "6db7dac7-3217-448d-a7c8-59b82ae9f977", "value": "T15295BF01BE44CE11F0881A37D3EF45584BB0A9916AA6E31B7DBE376D16123A73C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780342, "uuid": "a11385ec-d067-45f5-af4c-8768099fa1e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780342, "uuid": "dfe0c869-4d8c-4593-8e89-f909307bef42", "value": "49152:9ndSiKG7Idc6Rm8sDJMSgkdEiVTpnjyv:9hURm8vSFVov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780342, "uuid": "94aa2fa0-67ca-4962-abb3-b4e87b7ff786", "value": 2045952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780342, "uuid": "669317f0-1f57-4500-ba66-b1c3b4c49385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780342, "uuid": "a0664030-6a35-48a5-8b65-c2055f295d26", "value": "d34ec7ae7fd79326dc877938288b4a8e8031e076d28cb6023858a14d6588992f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a648d4-a67e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675729891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729891, "uuid": "9ffb7625-efc1-4b10-884d-6bcc41957a1a", "comment": "Malware payload (RedLineStealer)", "value": "84c6b86e22aadcbb70bd642e4df19ddc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729891, "uuid": "b8ebcccb-0791-4288-b40d-5c6ee5390510", "comment": "Malware payload (RedLineStealer)", "value": "d397c7d3d12827981b96654666eeb5552e734caf3ca62ff9cb05efa785ce6168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729891, "uuid": "535cc735-0038-45f8-a7ef-ac367335fd69", "comment": "Malware payload (RedLineStealer)", "value": "9fd60a6110ffc99c6fdb3f5697b7ab84e7028537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675729891, "uuid": "41f6012f-4b20-46ed-806b-bca2a3114621", "comment": "Malware payload (RedLineStealer)", "value": "fdb7b4d898ec0161cd6164bd68d276d25589169058e44b019bbd889442b2a658fead6dad29721da8155df9dfbcf7b571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729891, "uuid": "0d1884e8-b30c-4513-bca1-387509910c3f", "value": "T1E4848E43DBE1BD40E926CB72DE1EC6E87A4EF5408EB9776532189EAF15B1072D173220", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729891, "uuid": "d12bcd31-5a82-45e7-b838-4a70c1ed7316", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729891, "uuid": "f9e5f1ef-d443-4166-a3bd-7d1375ac68ac", "value": "6144:B0pLZVLl8Xmf/9Xj1bpL4StxykCapzqsysuQj96a:GpFv8Xm9/tskCCPysljY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675729891, "uuid": "be8a9129-48a5-46cd-a311-9db9da9b3723", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675729891, "uuid": "932bc775-ab86-4d75-9792-0e77d8b9d433", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675729891, "uuid": "7d72310e-9ac8-41ce-96f2-35da5b9e724c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df448ee-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675758522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758522, "uuid": "c748f4eb-b204-4f17-a4ff-3cb5e9b2587b", "comment": "Malware payload (Smoke Loader)", "value": "96a2b720a8f958e912ed86f812686fe1", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758522, "uuid": "674fe285-26cc-464f-9e59-710c70a61982", "comment": "Malware payload (Smoke Loader)", "value": "d401b52ce129c7d8a9d548988b482d21597e4a93cf388b72a324e398907b9c6c", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758522, "uuid": "573e82d7-ba3d-4e93-9607-1959d35be837", "comment": "Malware payload (Smoke Loader)", "value": "4d4be4c7a8da0f7d8162115d6604ce7711119e47", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758522, "uuid": "3a50f779-bb7f-497d-8287-bdc29945699f", "comment": "Malware payload (Smoke Loader)", "value": "8ab72062b68911c9cd2aa94d69481d7ee539e03dde7d78977172762e7e6aef84185088569bd29ff4aa41268346f15a66", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758522, "uuid": "2b52d5c9-76ba-4356-92fd-cb0b765194ab", "value": "T140D4F103B160FE53D1218B745FA3C967975BBE466796A58730003B4E2FB32A2A5C732C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758522, "uuid": "c3a5cfb0-94ea-46ed-8f21-ea62ded4850c", "value": "12288:KaFiKXKEzBYMzBZ05/K6u/OotnHLS0gke7+ik:XLKoBRBm5/KTtnHorR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758522, "uuid": "dba8b38f-bed4-4048-bbc0-d66e3b1ead81", "value": 645120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758522, "uuid": "8c7405a3-d361-4adf-9cf1-65de9364babe", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758522, "uuid": "8f9a85eb-6f64-4a3a-a745-f700f9917286", "value": "PO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255a1bb1-a6ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675785029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785029, "uuid": "3d7ced34-fc49-4041-8d23-47a874567e24", "comment": "Malware payload (Rhadamanthys)", "value": "995f6273ea007ab79ed858d0b2fde1c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785029, "uuid": "ed788acc-b1cf-4957-9f91-1bfdd7d86100", "comment": "Malware payload (Rhadamanthys)", "value": "d531e47f8b4a9e98fc6db1f41f5f68b6e4b92e6a9213d80706c7c38ad00193fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785029, "uuid": "bdaf2912-90cc-4a8e-9b0b-0d45769ec1c1", "comment": "Malware payload (Rhadamanthys)", "value": "1eaf153c554a0b99c7d25072f45a2c342479678a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785029, "uuid": "cb695c37-489f-4f1e-b944-0c0e3a66f3c8", "comment": "Malware payload (Rhadamanthys)", "value": "594c43e59cbdf59d6bc51b7803baedd30e0ba28a3f8a7d804dc374c4738a4f6c38d127ead2611b02e12ee3367923eaf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785029, "uuid": "375cc166-602a-463a-a654-e9e9bb94760a", "value": "T19714F1797073C0B9DEE701765DA44BA65FF93D700364AB8B2E5CA4467EA02FD102A4B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785029, "uuid": "231d6169-e662-4dd6-82a7-b242ebc483c4", "value": "8ce2f6ebd6de22083d1cd29813b84025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785029, "uuid": "2a640c42-8568-4b0b-aee3-b5c600a7ade1", "value": "6144:uC1Y5jpr0602TzhldWqIk6jKSxPMkksMoK:uC18jpg60OCHNMBxoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675785029, "uuid": "abc8ebbe-a079-40d9-a28b-b9e34b0791fe", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675785029, "uuid": "55689baa-5ccc-48e5-b6f5-94ad9e9e2b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785029, "uuid": "85c3f301-7fb3-49dc-b7f1-880d1232c78c", "value": "995f6273ea007ab79ed858d0b2fde1c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75f14b5-a6b2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675752256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752256, "uuid": "b8a1faa7-789d-4959-9d26-605100230e3f", "comment": "Malware payload (RedLineStealer)", "value": "b7b56ea46e90274b9c8b54509744f0b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752256, "uuid": "740b4fc5-282b-4b07-b287-62e981b07b4f", "comment": "Malware payload (RedLineStealer)", "value": "d532452b8c9ff26781509fd33b4e2abdbe835b0d193a156354f04545b34e53f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752256, "uuid": "28327aa9-7be3-4edf-87d8-d29c32663477", "comment": "Malware payload (RedLineStealer)", "value": "d2e682dbb3aaf3468471390e4ff7f087087af240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675752256, "uuid": "e027a086-0d71-4b7c-8159-da7deb384533", "comment": "Malware payload (RedLineStealer)", "value": "22a0850c666eac39702ffac569b35cabad67925cdb4a61a70e7d9e22217e15a7dfcda916a57f96e98dc1bc3b3c897c87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752256, "uuid": "1ecf3dde-0b24-442f-b5ae-e3a9d325ebca", "value": "T11664F2323780C072C5ABD5345925EBA1ABBFF8331935864777A803AD9F706919A37387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752256, "uuid": "20e18334-647b-4048-885e-4eb3473278da", "value": "d76496b570328542e143db87692dabe6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752256, "uuid": "3ac9936d-a2e6-42f9-b08a-03ded68c05c8", "value": "6144:0jqAWLuCL3qJSYEyV8qyr1HyAFXGMDwL+UraYWew:0jqf6CLMEydyrJWMDdfDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675752256, "uuid": "d6e70364-8cb9-4398-89eb-b9ae36c56a95", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675752256, "uuid": "88188bd5-97d0-46fd-a9ef-33b991377a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675752256, "uuid": "72dc9674-b0e1-4592-84a5-96c6822fab11", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e67c4e-a6e9-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675775733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675775733, "uuid": "5bd092b7-2715-49df-a54a-a1d5207ded96", "comment": "Malware payload (DCRat)", "value": "06c14d547c368cba6a40c57e3cf4b87f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675775733, "uuid": "161c003d-0a90-430a-b020-252fda0b34d9", "comment": "Malware payload (DCRat)", "value": "d592f8176ed4a042fd64dcf37758beeb5e19b382d1b4929822935a0a7888a74a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675775733, "uuid": "619f8cb9-2adb-4c44-a7a9-029bfb93a2a7", "comment": "Malware payload (DCRat)", "value": "21accf7d9cb142a4091b5c65f4da08701dfac4b6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675775733, "uuid": "524fa248-a0d8-43ef-bba5-1f917ea4891f", "comment": "Malware payload (DCRat)", "value": "f92c3a761585c3c6edb0debe203237100d1e2de0a231c28be7da5c51fc7957e743d9512eb742b7475fd132a0e7ebe829", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675775733, "uuid": "964eb9ea-92f9-4160-9cc0-7e07a5590734", "value": "T1BC351712BA66DD02C0291A3BC9EF953487ACBD417B66D71A7E9F335D20123A74D0E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675775733, "uuid": "2f367576-5875-4cc6-ac12-42e5f910e1ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675775733, "uuid": "a850dff5-44ec-4285-a827-1013833a21a1", "value": "24576:yV+lj72d5fXFBv6ceSsxilIuLyssGKU/ALmE1+4:IDfXV9sxiOu6eE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675775733, "uuid": "db19483c-1dc5-4bdf-93f6-7637b44669fc", "value": 1116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675775733, "uuid": "83f1e5f4-0f9d-48c7-84ee-52c681e11c51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675775733, "uuid": "91c65373-6938-49ff-8bff-b7c7a5db0a2f", "value": "HEUR-Trojan-Spy.MSIL.Stealer.gen-d592f8176ed4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ff0880-a6e3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675773333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773333, "uuid": "0ff350ef-69c3-4557-a910-66189d291d82", "comment": "Malware payload (Smoke Loader)", "value": "c0d1bba3397fe005703753151dab9c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773333, "uuid": "14fa6b48-952f-4ee0-a808-3c192ddd4748", "comment": "Malware payload (Smoke Loader)", "value": "d5944f9bffd8cad91929489be3d18cfc334ab97956a629ff3abeaf126833e2b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773333, "uuid": "ca9d2fd9-2d67-4c24-9ffc-dafe3a703662", "comment": "Malware payload (Smoke Loader)", "value": "5bd798b62147c4cfb6411617f60871a33f21a58a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675773333, "uuid": "0d75fe04-ce5f-4e70-a66c-564653a279cc", "comment": "Malware payload (Smoke Loader)", "value": "e913832725f2cd060fca448ffb35b13f25479e3c3f925fabcca8c76822c5465e13922757f5a9730a8bc5b3b8788871b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773333, "uuid": "2320a6bb-2136-4e01-b430-c17fbb42176b", "value": "T16114DF3276D0C032C6BB5130D820DA656BBEB8F152B58A1B7B94076E5FF06C16A7734B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773333, "uuid": "6520a5af-5f9b-49a7-a16e-1698b8c69b49", "value": "af0a92fe52cf161a7b179d1f32aa9186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773333, "uuid": "a9a33364-0087-4115-a26d-c99e5197f9df", "value": "3072:9wmOslwWmguLBfQIWPQb5hYK5wUWIN/dE7GAZvOUPdAxbyjk0Not:9wmQhLNQINH5wIo7GAZvOUPdObyZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675773333, "uuid": "ab41a657-4c14-4e1e-a223-f43986b51170", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675773333, "uuid": "eb801a4b-5491-417e-9e68-92f536ad7539", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675773333, "uuid": "e4ff5038-2b40-4eb4-a297-ee6d01de5ee3", "value": "c0d1bba3397fe005703753151dab9c33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e1d9b1-a6b6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675753834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753834, "uuid": "f4560610-bee9-4a43-8fbc-e158b35d8644", "comment": "Malware payload (RedLineStealer)", "value": "309d580401ca76b21a6a49056294895b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753834, "uuid": "730857d8-8c4d-4ad3-8d31-901216f88868", "comment": "Malware payload (RedLineStealer)", "value": "d59d55ca65f1982ccae31dfd0b9d4910a33adcb209144ec41c7f928c14221eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753834, "uuid": "12a65ff1-1fc4-4f0f-a13e-3bef339e1f88", "comment": "Malware payload (RedLineStealer)", "value": "cb26e46b4f49666f1684a859c344a3209a776c60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675753834, "uuid": "63f615a8-edc4-4b6a-9b21-8bb995c9ce0e", "comment": "Malware payload (RedLineStealer)", "value": "0bf1e4d6dc97218c470fb17f2c9c74b9b210af6dcf2aafb75d60fae2c0c19328b5869997c0f5e1501ff8bf8d5623d115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753834, "uuid": "f1b2cf4d-27b5-419f-9141-6b0044ba4bfb", "value": "T19C64F1333A90D072D5A642705820D7E45FBE79316679CA4777A813EE9F322D0AB7630B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753834, "uuid": "9e188fc1-2de4-4a41-b9de-e9562f6aa444", "value": "01b655af6d395e5ede880ec579b9fddb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753834, "uuid": "0aeea818-331f-4763-8685-adf8e2f2a3c9", "value": "6144:DzGwAQLAp2KFKid5/7g30jB4xreF3kovWx8J:DzGwAQUp2KFKiz8EjB4EXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675753834, "uuid": "4a87c18d-83d3-4846-a78d-68a8a664f851", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675753834, "uuid": "f2bab44c-b1e8-4b69-8805-6a65659f90b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675753834, "uuid": "9ef55050-c93f-4eec-8000-e87d78ce4322", "value": "309d580401ca76b21a6a49056294895b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49684a41-a737-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675809141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809141, "uuid": "072dfe29-8631-4131-99d3-65d895141d2e", "comment": "Malware payload", "value": "9db9a74d05b38b0c46c1a830f5b0526d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809141, "uuid": "08719148-baf1-4e23-ac12-f291a769b5f1", "comment": "Malware payload", "value": "d5aa8817c0b7f2d8ed239ae5d04e9f7a6b024e6858fc7a0ad8901b1040e3e6b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809141, "uuid": "2f1079fd-d39d-49f5-85fa-3faf529845d4", "comment": "Malware payload", "value": "62a0266f4926c1becf181aec314c5c74aa502ccd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809141, "uuid": "f9853e71-69b0-4679-a3ff-cb9b5d27d6d3", "comment": "Malware payload", "value": "2b57aa6acbd7b757db917c2dbf16829509a0dfe7885fab6b6418f54b7a62f8392fd013d7e60cafa050379a7e158fdd04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809141, "uuid": "e25ff094-386c-4eee-b391-7bada2f803f3", "value": "T182B40207FBFD8462D97147B048F703C32A367EA16B388797368E6D6D08726A06631767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809141, "uuid": "718350ad-267c-48a6-9163-6ebed576379a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809141, "uuid": "a9d5bba3-27e1-4d69-aa04-247b45cb0a0c", "value": "12288:hMr6y90E0Zm4V+1Itr+sOIwnIUAwqLpt+9ln0ieu6:7yqtV+Mr+sOIGafixFeu6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675809141, "uuid": "2ae02844-a09b-4638-9972-d469a7edb299", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675809141, "uuid": "76c405d3-c841-4072-97dd-62b1545c694c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809141, "uuid": "652d80c1-1e9b-4adc-9d2e-fc4ab18687f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea65e4f2-a6b7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675754436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754436, "uuid": "7e416b6b-5de7-4829-b849-86e39d9139f0", "comment": "Malware payload (RedLineStealer)", "value": "d4158a37c8783345f1ac8bb4afecf7ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754436, "uuid": "e81adb7a-ed46-4e5e-accb-33f89be23d58", "comment": "Malware payload (RedLineStealer)", "value": "d5abe1bf7cc6986a8a6784afcf8013cd75c3963765ee576c19799b0d4916f826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754436, "uuid": "7057c9a5-19f3-49a1-a018-b199812317cf", "comment": "Malware payload (RedLineStealer)", "value": "b616676d4df62368c8db938922621550c8a7f7c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675754436, "uuid": "a7cc806c-f6f5-4dfb-8b78-3e3c59b955b5", "comment": "Malware payload (RedLineStealer)", "value": "f2ad18f8f0de82a1f8623b890342961547435932e2a4fc5129dc4ab38cb832abe0c52761804e81cf981050af94560459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754436, "uuid": "6d4ff2d2-fdb6-49f8-a114-3f9d2a81f2af", "value": "T186948D4393E1BDC0F9268B72DE0ECAE8768EB5908F7D776522589EDF18B1076D163210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754436, "uuid": "cd6124c5-3003-4e65-a1c0-e3d517420ac5", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754436, "uuid": "af61608e-ba8a-45c2-b29d-4a5237a73669", "value": "6144:VvUMLGU67m1j5BP1ceMNI6OnSqjZrcxFt/LSZbL7Q7paKW3uQj9+aL:dpC/65BCNOSiZrcTBOJL7qWlj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675754436, "uuid": "c78ee620-5198-4c78-b9bb-400fa9da4c2c", "value": 408064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675754436, "uuid": "20b5d2d4-6e9e-4e32-af15-37e9238061cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675754436, "uuid": "37858f0b-08f9-44bb-9329-d697d809bc5d", "value": "d4158a37c8783345f1ac8bb4afecf7ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad2dbbd-a6d4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675766731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766731, "uuid": "3b6dc62f-08b9-472c-96df-a8b72ea16de8", "comment": "Malware payload (Formbook)", "value": "5b24a676b61fa02b1778a19c3f11226d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766731, "uuid": "c3995a62-ee80-4d1f-b851-ae70f7171679", "comment": "Malware payload (Formbook)", "value": "d5b490c5f0f035c7b2b45fcb1c62a6ba66dedf3cbbaa5e678cace9537d89b35b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766731, "uuid": "0b11a168-6978-4b93-a192-16b030e5ac94", "comment": "Malware payload (Formbook)", "value": "5c5b3ec80e47691720275965552b6eab03c0f1da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675766731, "uuid": "e8ec8fc8-dfac-4a14-b19f-a623c32098d0", "comment": "Malware payload (Formbook)", "value": "0d220b00b0cc370a4e27cc0c142ef4c243757e64a7a5b5a6c2652a2d5827588b63eb66eb69ef2e485d3941feed200b13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766731, "uuid": "c569b57b-0de4-4554-9781-c85bd4fd9cb4", "value": "T125E42221B78793BBF529147140AF476103F6E7876233D92CF98C2269573370EEA85B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766731, "uuid": "ca2283db-4338-4f64-a4b7-94ba58e61588", "value": "12288:n/O+tpuYpDKxFUsPlr34IlcBwdVo4R++JeUfF+rZEA7pKpiCwELySdVKvNQPHl:m3F9lroIlcBOd9eUfF+N8pXw9SHik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675766731, "uuid": "36b377cc-c009-4918-83f5-b1299acb96c9", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675766731, "uuid": "34210434-9a90-4e9a-a015-09f7cd5c2002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675766731, "uuid": "6626c6b3-03ea-4af2-930a-ec4f53a2e6e4", "value": "shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b63495de-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757354, "uuid": "403e7550-640a-468b-86eb-90442298af48", "comment": "Malware payload (Gozi)", "value": "758e716d99702f5e91a982bc74b31c8d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757354, "uuid": "a7a51f7f-baa5-44f4-815d-54e27a8c77aa", "comment": "Malware payload (Gozi)", "value": "d63b0d5a087f4165051b34222a655e9e600a63e41e10de58807259214c75103e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757354, "uuid": "c539aa61-73f0-4555-8693-bb1b22e4b9ee", "comment": "Malware payload (Gozi)", "value": "2ed87aeddb2b19fd7b0a64d9f9dec84c3fe2d47c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757354, "uuid": "2c94a41e-451a-4f73-aea4-e6b9e4b3ce8e", "comment": "Malware payload (Gozi)", "value": "279933657f4055ce7c2e820f90cdf6bdc0a01e9331e067937313d77a8325ad1a5138ccca1bdeccaec78296177bb1488f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757354, "uuid": "4b79dfdf-9b97-4f83-a38e-2d0f620e864e", "value": "T16BE17C4F9DDBA41BA78041EFF6332D11FBA019BED9292204B5E1E70E6A6673B004166C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757354, "uuid": "2f35429a-0be4-4cd1-977d-aaeb7231c076", "value": "96:waFUD+LVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dI96V:r00U77rIKdn863jMM0OD9+VVF4GxikuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757354, "uuid": "8fb352b2-e195-49e3-923d-bbe197211302", "value": 7037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757354, "uuid": "920bccb4-a9d5-4562-a612-2dc9a5f36635", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757354, "uuid": "778dc58c-6f02-492c-bb35-3e04b2d0c172", "value": "azienda_13.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d094ae59-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758687, "uuid": "68bdc4d0-83ec-4105-ad37-018a7a397619", "comment": "Malware payload (Gozi)", "value": "abd7a8e8eb182b79428d3dc6ee126145", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758687, "uuid": "da79c236-e9b2-427c-bff6-93ff4de5bd83", "comment": "Malware payload (Gozi)", "value": "d658dc65749aaf7c549d273f1434c693a4bd5f8f6477bd62e3afa93e59794440", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758687, "uuid": "2771bdc4-41be-4d23-a339-ec230e972bc5", "comment": "Malware payload (Gozi)", "value": "abb41b629674dfce903371a70e7a232352793860", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758687, "uuid": "254e4e85-aca1-4df8-97a7-1407f8d27bec", "comment": "Malware payload (Gozi)", "value": "1d31dd3b5e10f341f9ecc8fa34bec0507d9dbd29ec932f77c80680c4bfdff346c193c8c3dacbd9b4603b9995c9d27ef0", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758687, "uuid": "ba6b184e-1196-4ab5-80cc-432b0ceaf811", "value": "T120A18DE2E04AAD10434B63F63457EA662C5BAED6087F66C29277816D90C983C923E1A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758687, "uuid": "5f4099bd-8798-42e4-b221-69d399b2b738", "value": "96:CEL8vsMtk+S6+3X2GI7ON3Nax/Y6UMjgi/3YaLUgM6icp5:lstk+S6cO7Uglz7gEo6LiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758687, "uuid": "bcdc63f5-8e24-4e21-a8de-71e138786d68", "value": 5079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758687, "uuid": "d7752ddd-eba3-428b-86c0-ecd9426525b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758687, "uuid": "fcba6b01-79dd-405d-a5ac-3a60485e78f4", "value": "azienda_30.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4c2a90e-a687-11ed-88f6-42010a9c006e", "comment": "Malware payload (Casbaneiro)", "timestamp": 1675733837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733837, "uuid": "45328ff9-e115-4f19-8fe0-f769adda96f9", "comment": "Malware payload (Casbaneiro)", "value": "eb87c1875a26d9bc43a2c178f5fe170e", "object_relation": "md5", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733837, "uuid": "afcd7245-9567-41ce-b6fd-6efd35cf7a2b", "comment": "Malware payload (Casbaneiro)", "value": "d67dc8b9e1a7228b30e66fe1cdf059b2e26d53c97c91561df371346b70af328a", "object_relation": "sha256", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733837, "uuid": "39a05e16-c1ba-4a17-9b34-b89825ab52dd", "comment": "Malware payload (Casbaneiro)", "value": "42b66452be8d1d016069e7968a15913478ffe127", "object_relation": "sha1", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675733837, "uuid": "817faaa7-04b8-44ee-a690-be7de2a2e15e", "comment": "Malware payload (Casbaneiro)", "value": "cd249ce89e4a03909b79149f75a21538c41c17b6a741135409ae3805e2ba3dde7ee633569cffe6e7e6d582c78fe4be08", "object_relation": "sha3-384", "Tag": [ { "name": "casbaneiro", "colour": "#29A76A", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733837, "uuid": "8a091d3f-9410-4c00-b8e9-115bf307bb6b", "value": "T1CF6733D718ABD571F88592B29C771FDC8770EB6587480BAB8BF2604CED8030B9CA51B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733837, "uuid": "eeb64323-5ca7-4cf3-b877-ad19a75ad9b6", "value": "786432:Hwpcw8mLTSvX9mvCLymrurtykhj/5rbcCjlokRU/CH:HwpcVA2FTJrEtdT5XNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675733837, "uuid": "afdf25b5-f5e2-484e-aad3-0215282dd11f", "value": 30578835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675733837, "uuid": "090906be-345e-4b0b-bada-e1dde09fa08b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675733837, "uuid": "de97482a-59de-4db6-8532-2ad45cd10094", "value": "mexico.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f1dc68-a741-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675813563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813563, "uuid": "e59524ba-a7c0-4c09-8188-d08cde66ba7b", "comment": "Malware payload", "value": "47682b43322abdc3e9b03b5acbbcff29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813563, "uuid": "ace49ffa-f75b-4a29-a841-60e5c1577dec", "comment": "Malware payload", "value": "d67f4875bae60b5ee0108f506b5d8d279d7a93507c7aa6ae47d9dba7aa43948c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813563, "uuid": "44406395-de4a-46c6-a9c0-78a47521a2ac", "comment": "Malware payload", "value": "5551450ef20dfae494ff18bb85e37da19fcd2a9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675813563, "uuid": "9045e4fb-4969-4d09-b48d-73006676092c", "comment": "Malware payload", "value": "8f8266b1a19833f808248052ab054af4b6fbbd988e6604266f592cf04b9ba579a0e660ea9061416e269edda5a7f2c753", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813563, "uuid": "8e627556-ec80-456e-8641-6663ecc28e78", "value": "T10EC5E00A1C94D0A7D2618F70C9CB6DF64C12EE6FE8BB009313143FFAB675245B85A979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813563, "uuid": "577cfdab-ce21-4fc8-bca9-7044e16b3356", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813563, "uuid": "33e28813-1b7b-4861-86d0-e9caf86c52aa", "value": "49152:wDgSNMs05xIFBb9x6zTPs/EQVOW7/a0eDfmhGQ/Zv79Ee+Fded5ELCgv2MR:+HNMs058BHGTQpnba0QmA8Zv7ue+Fdew", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675813563, "uuid": "8a6c34bc-8140-46fd-97a2-9be3110312f6", "value": 2690947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675813563, "uuid": "643a02bf-d6a8-4141-8295-2cf7e1927638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675813563, "uuid": "d03858ea-e2a7-49cd-932f-0c05128318be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a885390-a6bf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loda)", "timestamp": 1675757737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757737, "uuid": "7bb9c742-1acb-408d-b706-ecb2c5d143b5", "comment": "Malware payload (Loda)", "value": "c67902b44f30fa677c5720612e25075a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757737, "uuid": "ebdfac3d-eac7-4060-9ca3-8b0e58511271", "comment": "Malware payload (Loda)", "value": "d69131505014911dea45767a130e9ed4672a2d3fa1dae2f2ce4bcdea0ade093d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757737, "uuid": "9a50490a-6083-4bce-82c7-0745a49608c2", "comment": "Malware payload (Loda)", "value": "672720055d4e2923129b744658d66a49a78ac76c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757737, "uuid": "56df8982-6ae9-4fe7-bed7-662c2bcbb0a5", "comment": "Malware payload (Loda)", "value": "c00a665bbe710d34e82aa009851d38c19e5999f59ae2808d1c09f2968b2c4f5b411db7f78cc7b9b58714ad41e032707c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loda", "colour": "#D9F303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757737, "uuid": "4f6f45be-f729-47ba-8a28-ec2ba2ec1c48", "value": "T146A5F12273DDC361C7769273BF6977006EBB38614A30B95B2F880D7DA960171266C7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757737, "uuid": "c18d7657-3e79-40b1-a1b0-cd7cac1a583e", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757737, "uuid": "490f81a7-598a-4500-a67a-e07347d67f3e", "value": "49152:Pw80cTsjkWakLHZavDbq2BcdEDmYX0GpMkTuFHX9:o8sjkU5aDmdng5pMXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757737, "uuid": "5637bdc2-91e3-4b98-93df-8ee4a675c338", "value": 2114048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757737, "uuid": "1cdf0982-e8e9-4d19-b639-5ffa4d709d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757737, "uuid": "c639b073-a21c-416b-ad64-3fdaa7965390", "value": "c67902b44f30fa677c5720612e25075a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fad33f6-a6ca-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675762471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762471, "uuid": "99298a0d-7eff-4cd1-84c5-a51f55a36b0e", "comment": "Malware payload (SnakeKeylogger)", "value": "247980e6c8b5be662554a0ece7efc762", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762471, "uuid": "4c9a130e-f11c-48a4-a94c-85f2c4cb0a17", "comment": "Malware payload (SnakeKeylogger)", "value": "d6af4d738cb8ae43f17b65cd5799224b68a8691b7d3a6cd21543d39012b1def8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762471, "uuid": "bd5422bf-1c78-4570-b547-d10176179745", "comment": "Malware payload (SnakeKeylogger)", "value": "aad6ef9d9cc84aaf91b1dc7a19707ae4870d0754", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762471, "uuid": "ab0c5e63-d845-4101-b07d-266e5e4f7041", "comment": "Malware payload (SnakeKeylogger)", "value": "17b6690225c6951ca814280a347b66590622511744a4079cc6e00870ed78318798eb1aa2ec9713c2d2b717ad08d4226f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762471, "uuid": "ff36dccc-ce74-461b-a363-29db91822f5a", "value": "T190F422013369C660C87ECDF1FB787994137D6316A922DA6C8EFCA5CBE62172DD860253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762471, "uuid": "c17ce686-4663-4e88-b189-6b4970ea0c73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762471, "uuid": "a93010b3-28ab-48f7-955f-1a56189e120d", "value": "12288:XpkfPAEcXnyXx6q15dGy2jagh0jwL50s/PZr48hoPvqcQ3lIg9gahRZ5GX:UAE1NoyQCjw9jP9Jhsq7iS5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675762471, "uuid": "cdbcc0bb-8f04-458a-91b5-5b8c69ea164e", "value": 750592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675762471, "uuid": "03dbf941-de5d-4e58-a3a9-e91955abb32b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762471, "uuid": "f1b80e64-d908-4d39-ba15-4a714133417e", "value": "247980e6c8b5be662554a0ece7efc762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d8efd3-a728-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675802909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802909, "uuid": "906b3f55-b88c-485a-b571-8f71df57a839", "comment": "Malware payload", "value": "ec06cd9b89bb2bcaae7a7558af41326c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802909, "uuid": "758a5c69-d07f-4ebe-8c91-81bf660ebf61", "comment": "Malware payload", "value": "d71cf2311daef7501a8d9bbab5d72f2116c5a2caff145ab799ab4e38aa596ad0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802909, "uuid": "0ecc0cb7-9d6b-4187-b69a-1dd0521317dc", "comment": "Malware payload", "value": "cd1d632ac63d63aa37b56efc6ab2021eff850a60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675802909, "uuid": "9d452333-c0be-478d-994c-2ebfa463445b", "comment": "Malware payload", "value": "8199182e6b3b8bb34476490baec8b5c4278aaddbe445b7160ad5d70ce2079f62d783ee93c471cd283aeea5ba314f8e52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802909, "uuid": "90c6dbf9-4e29-45fb-8d6a-0104b02e79e5", "value": "T180736B03B5D18871E8B21D354871CAA05A2FBD214E258EBF639406BE4F781D1AE36F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802909, "uuid": "987ad939-18e8-4678-86b8-866313a03990", "value": "0250838747ac39ffb73de983353c0ffb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802909, "uuid": "94ba3546-6214-4e82-96a6-746fe75bd9e4", "value": "1536:AZmLkSdP02Qq8OZedFzaaHcdfDlqHJ19jXW/6acNYJ3LsWMM1cdmUiVRxeb:s2UKedNaUiDoH9jS6joiMEmUGRYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675802909, "uuid": "581a6b6b-09d1-47a7-a80b-428323b7db8b", "value": 77504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675802909, "uuid": "695f94a1-4a8d-495d-a7c1-b1a7154d0464", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675802909, "uuid": "adb8b912-40af-46d9-af81-05b6244c706f", "value": "SecuriteInfo.com.Heuristic.HEUR.AGEN.1213146.22272.8907", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54f5b45-a6e6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675774560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774560, "uuid": "3bc15ddb-b9ba-4b50-8739-de6661ca2d43", "comment": "Malware payload (RemcosRAT)", "value": "7d6670197ef854fb58915d4915a530fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774560, "uuid": "7daf3270-5454-4e51-adc5-1c62f314ff53", "comment": "Malware payload (RemcosRAT)", "value": "d735fd2abee0e57fd410a4d0978305703f8cfcb3b990e342df3b66d86a65d04d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774560, "uuid": "40a3d784-cdb1-4664-8e1c-b42668625b6f", "comment": "Malware payload (RemcosRAT)", "value": "1ed73e0789b94ae7e64d732ea1a08a084d3341ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675774560, "uuid": "ea8e3fbc-c7ae-4614-b1d6-a4c6ad7adc9f", "comment": "Malware payload (RemcosRAT)", "value": "8725e4aed6f0d966266d9f4de873f85c55b25b56f70187451f0f4f955a7f9593f01c9a64b7cdada95d7838aa3413102f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774560, "uuid": "880df747-03fc-4d58-8575-796f6cf5e395", "value": "T1E6B423D5BBE9CA27E4A15430267A05B6DEAFBF1022B9441B03B0380D7C71647DF2DB66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774560, "uuid": "29de82ab-bc46-458d-a552-342a330de87f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774560, "uuid": "7b57605c-7484-4825-973b-752cf73464e7", "value": "12288:vY2DZeRdO2biJGehPaSMYDsQmeaPvSHHEvset2rfqRKmh0/yBCRFC4iikcGdFA:vY2DZYvedaFYDbPa3SnmDk2K95RFC7iH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675774560, "uuid": "f294f997-2a63-4782-8045-4962d719123a", "value": 541974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675774560, "uuid": "0723b039-6911-4a43-b01b-bdfb3b607de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675774560, "uuid": "e53f7438-f738-4ebb-a557-15d71b5c1b27", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be53ed7-a703-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675786704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786704, "uuid": "0e16d351-76ec-405e-b48a-4acf978df3f2", "comment": "Malware payload", "value": "63b99d4e8dded68c245762ab968c04d1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786704, "uuid": "f6255f46-f188-4b7f-bfb1-e7f4b58694d0", "comment": "Malware payload", "value": "d79d60b4a41a12dbce791e815935b59c8731869d39ad2c0124341da400a3d204", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786704, "uuid": "4bf98952-548b-4a97-a16c-bf15215aa448", "comment": "Malware payload", "value": "2606e8825f9276c207cf36853bcc318b1d639b69", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675786704, "uuid": "3fda4c91-bfbc-4243-90a9-06f8f2c800ad", "comment": "Malware payload", "value": "39b74c75fcec7e31f14ee3637fe6e3f1567640c4d4a3afcc66013bef74b49c45dc0db167da94de900709497aeb424ffa", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786704, "uuid": "63c96e1c-e234-4e9b-bbe7-a78199453ea5", "value": "T10282E1D2B0EE8492CFB77975518E1BF487602924FC25E4AD5DA480189482F1FFC9EAE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786704, "uuid": "c1ece734-48db-4c07-86c8-1e22d1292b78", "value": "384:JRZvAoLpQi30L1W/Xhq3rUKbDiIZbehxIQ4cRiuq87tnxGSNINndI5mz6sBizo2:/nV306q3rUKbDiIwph7nvINdJjin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675786704, "uuid": "f90b3317-5ac2-4081-a27b-64a4df4a977f", "value": 18875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675786704, "uuid": "cae7a764-830b-47b0-9499-38e89d7f6a4e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675786704, "uuid": "9642f8ff-153a-4518-b638-790eecdba7fd", "value": "libcurlnew.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad6af2a-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758436, "uuid": "4f83d83b-0a40-435c-9c73-da61a378651f", "comment": "Malware payload (Gozi)", "value": "3d65d088cdcfb7fbeec3d7273c5293c5", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758436, "uuid": "f54d2ebd-8ff4-4990-bce0-6f4c33077409", "comment": "Malware payload (Gozi)", "value": "d7bb9f5e2bd933abfbbe76f122008911a1a8081080849158064c0fa3c5c401fe", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758436, "uuid": "540ba422-0e1f-48d6-9980-18650fb67bbc", "comment": "Malware payload (Gozi)", "value": "dc86c8d109244a5bd2dbf9767bc90d92d5a70238", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758436, "uuid": "04eecc81-ab1b-4005-8c05-e6db9df2b2f9", "comment": "Malware payload (Gozi)", "value": "d3c34a5f332b46a3923c6932c057e5ea3310b255bbcbb8f62120be898b42d20e7371f9f14470f29d6069ecc7510fc22e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758436, "uuid": "d29ec8ef-6cab-4980-a6da-2200acf4059e", "value": "T139E18E8EEDDB641BA74082EFF2333D10FB60597AD9292204B5E1F70E6A66727014165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758436, "uuid": "98f9f42c-4702-43d2-8874-440bdaf088f6", "value": "96:wFBPnLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4d296rh:IVU77rIKdn863jMM0OD9+VVF44xikuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758436, "uuid": "61f762a7-4f09-4287-871a-6fc1d0f4bdf2", "value": 6999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758436, "uuid": "64485189-fc3b-4873-862f-aef51e66dad9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758436, "uuid": "c92dd0e9-6a0f-45c7-a9c1-f1ef41c194e1", "value": "azienda_31.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab906a0-a6f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675781978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781978, "uuid": "e0f961bf-130c-4779-b91e-287690940c91", "comment": "Malware payload (Rhadamanthys)", "value": "6f7e78d6fa755e44b008a230436b42e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781978, "uuid": "6c661ecf-c3eb-4723-98f2-928d7b738381", "comment": "Malware payload (Rhadamanthys)", "value": "d85d8e7789de173ab6af6cddbd31fe5c024987627abfa8ae0f42f6e995d1f205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781978, "uuid": "fa3baa95-5e29-47de-87e6-f32ed6a802a5", "comment": "Malware payload (Rhadamanthys)", "value": "4dfea2a68e43b36c204991230e48f02fc7112ef4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675781978, "uuid": "d60f1ef0-ef04-4653-9812-ae06804cd04a", "comment": "Malware payload (Rhadamanthys)", "value": "5ca149f0e45666f0db0952897c96d3e961c3a0b72a92b0eb1159af247b7f65f633734be4d31de4165b736b4e885b4fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781978, "uuid": "1973e94f-123c-4b99-8e22-6060158c66a5", "value": "T13D44F13236F0C0B2C2BA24345824DBA56ABEB93166B5DD0B776487BE5F203C19779347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781978, "uuid": "9507e493-9376-4099-b7f9-cb1724cd44bd", "value": "cdb2dd381be56018fc9552ac3271a401", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781978, "uuid": "e640bef3-6b93-41db-baf9-6c5339e2ea4b", "value": "6144:lGGBqWhLq3j6D3YuXwg+Oxl6knNYqWWQYHIoJKjfNR:lGGAWhu3jnQwyxXWWQYHIoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675781978, "uuid": "171d7138-548d-4e26-800e-9770d883e3ae", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675781978, "uuid": "3161d07d-1c73-43c6-ae58-ac0e33fb2124", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675781978, "uuid": "95e19841-2b7f-4716-8478-04cbb2316ae9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0479fd80-a6fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675783256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783256, "uuid": "3037c647-deda-48d3-b436-abcc8681db94", "comment": "Malware payload (GuLoader)", "value": "e1f1c869069a506fbba24fe57af294d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783256, "uuid": "77c217df-947a-4349-9870-50df79cc471d", "comment": "Malware payload (GuLoader)", "value": "d8933e7d6e91c53200c334528a935434d1b0e2ce2286e9842e75911ea832b8c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783256, "uuid": "0c089582-e956-4d1a-9293-5e264bceb031", "comment": "Malware payload (GuLoader)", "value": "402cfe8ce3c76bc658bbdcc503e8b91d841c33b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675783256, "uuid": "90dccf33-b88c-4ee5-ac30-127c09b03f0d", "comment": "Malware payload (GuLoader)", "value": "9948831bc978573182b0ab206f687bd816148bd1ac3d42cc62f3792ae266ecdb23a8012ad079305c5d8fda9fe844c956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783256, "uuid": "87a185e1-e714-4993-9957-917cc13a102a", "value": "T11AD412913BA6C08BC50A0E795C73E976AF7B6F632D918A433B043F1E1935181B50B77A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783256, "uuid": "1498ee75-2853-4f89-88c2-addbad9cce76", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783256, "uuid": "c6aa7032-1e7a-4c2b-8dab-5445373156e6", "value": "12288:tgL+rDzX8+uSoJF6qmq+biBie2VlBvt4bgjoS9nOu2prh:M2ESofoqCDfnIooS9nL2pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675783256, "uuid": "1824bfcb-2340-4fee-abae-2214442053d3", "value": 604552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675783256, "uuid": "7d044969-0b59-4391-b8ed-72e3c24f7a3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675783256, "uuid": "949aed28-35cd-438d-84f7-357ea8c0e4bd", "value": "200333852-042536-sanlccjavap0004-4332.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d6a826-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758399, "uuid": "a68ca467-9048-4d1c-b613-0d04177af3b5", "comment": "Malware payload (Gozi)", "value": "e564bff42f2809a2988af9884140be91", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758399, "uuid": "f39bb1ea-19b7-484e-8ee7-092b5ae199ff", "comment": "Malware payload (Gozi)", "value": "d946a8d62b642ac3d4b4a1f5ef26e90a41fdf276c62e1df5a6187d2027e6debd", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758399, "uuid": "ed330ea1-801f-452a-acf5-57db31de5c31", "comment": "Malware payload (Gozi)", "value": "54dae0232e5bbceaed3ac7a2de205f1e86911ad7", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758399, "uuid": "2652354c-6271-4484-bb58-24ec8aa36088", "comment": "Malware payload (Gozi)", "value": "7f79015a001ed1ca170787f7ef35b6a84895402b3524ec07539740bfc6666adc29ecdb8bbf6fdf5ab84e01315bc2657a", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758399, "uuid": "b696099a-6b4b-4029-9c61-606176d6b703", "value": "T15BE17C4EDDDB642BA78181EFF2332D10FB6459BED9293204B5E2F30E6E62727014125C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758399, "uuid": "ee7d365a-31d8-47a7-a460-046ad4fdefa9", "value": "96:wcrBc/LVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dV968:xtkU77rIKdn863jMM0OD9+VVF43xYkuE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758399, "uuid": "40a93d2d-8e80-419f-b0ab-e2bbeb0545fe", "value": 7031, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758399, "uuid": "cb132bba-93cc-44ea-b7a6-a377d3c2eceb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758399, "uuid": "ab6283f1-b914-4ff6-9cd5-facebffecc17", "value": "azienda_24.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f9ab843-a699-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675741264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741264, "uuid": "563e0b36-d651-428f-8379-eacbaaf6c06e", "comment": "Malware payload", "value": "81d9db0901741c1fc718022e331121d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741264, "uuid": "150aacae-edb0-4726-a6e4-2b3fc8d4b5db", "comment": "Malware payload", "value": "d9aed284411e3a234bf1397b3a09f70a815162fb426132004a6a1ae97bdd313d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741264, "uuid": "677fc2ef-6764-4b52-bf88-3e596b507c11", "comment": "Malware payload", "value": "00858a2b0eeb3727c5b8587bc22062ba53da470c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675741264, "uuid": "37ecc69c-b7dc-40ad-a2dc-d9f7bb91adf1", "comment": "Malware payload", "value": "e1f7bc8e3635a81b2b6272e0f85437404c693a07fb9bfd247f64895cf3ead2a122e2ab57197dd5777e1231a32b158f34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741264, "uuid": "64b3fc1d-67ce-437f-89e5-6f708b3621b4", "value": "T1D6A3D025FAD1C133C49280B64834C2519ABFAD225BB19953379D0FAE5F207D2D77B31A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741264, "uuid": "91cc09d6-be9b-4b57-a076-4b0c407a888c", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741264, "uuid": "2e91f6c7-60b9-4e21-b7e7-081ad59fcbb6", "value": "1536:eRh5b6bBIArGFULSR592RmqK8sVo4eGNqNDT+FSG9FDHtd74vcl5F6q:elb6bBJLCaRmqps2VGUJISjvcAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675741264, "uuid": "fc262a30-3698-4b74-8f67-acc2959439b8", "value": 99320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675741264, "uuid": "7514306a-ba19-4957-9fb5-c5aabe417e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675741264, "uuid": "826781d0-9712-497e-83f1-3b78a1e80050", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55178468-a6ec-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675776948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675776948, "uuid": "3a471f09-47a2-4fcf-89a7-5d4385801358", "comment": "Malware payload (AgentTesla)", "value": "841bbf4960303d3ed33abd65f1406f7d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675776948, "uuid": "a64221fb-d352-48ea-90a8-0ecc2e41a687", "comment": "Malware payload (AgentTesla)", "value": "da7dc645a36cd5d85d5065ec12742f11b27c45334a5512ab3510c0b6725c2137", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675776948, "uuid": "6e27c305-0c61-4e07-b6c0-e3973df21865", "comment": "Malware payload (AgentTesla)", "value": "8290abc5b5eb0cee5d3d88702112983e7dd721e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675776948, "uuid": "efed00fd-dbf4-4b4d-b8e7-0feb7cd1d7f2", "comment": "Malware payload (AgentTesla)", "value": "9ee88ff0bf49490b1259c37612455b0b706741052168e0eccaf68e1177b781bc1809a61fbc72c26d47849ba51ec3c10a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675776948, "uuid": "72ce0278-8e46-40b5-9c31-efb96848a652", "value": "T131A4024171E8D756CDBA03F98C7815486BF47D866812E31E0FF7A0DA9AA0F454F1272B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675776948, "uuid": "c91aea04-959d-4701-b74a-bcf11296fc8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675776948, "uuid": "3860e899-758a-425d-b01f-51bbe1692dd8", "value": "12288:7dsa66BS8ONYX7NkY6YNtNt1B2BhiwzgXr:6aV9WYhgIN7wHLzgX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675776948, "uuid": "e15281bf-72dd-492d-b9ac-07f4b781ae13", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675776948, "uuid": "adfbf293-3e42-4fd0-8ccc-8f9db1336acf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675776948, "uuid": "a1c551ce-8ab5-41ee-9785-d33dacfcadd2", "value": "da7dc645a36cd5d85d5065ec12742f11b27c45334a5512ab3510c0b6725c2137", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48362593-a685-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gafgyt)", "timestamp": 1675732689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732689, "uuid": "46b4e05b-394e-45a6-b83b-68d1e4bbb563", "comment": "Malware payload (Gafgyt)", "value": "fd95a48ff0659d4ec8b8f6e6f27d9f73", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732689, "uuid": "04b1008b-b6ad-4311-bcc1-d8aa1a9d3cdb", "comment": "Malware payload (Gafgyt)", "value": "dab34691544f0a4419b735e0ba0f84d9491c262119943628c5f97755b1e4cdaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732689, "uuid": "a4bbdee9-eec0-4aa9-9971-9c6807241526", "comment": "Malware payload (Gafgyt)", "value": "1d1fab3e5e9af0504ab3ebb33d55f003228e6827", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675732689, "uuid": "b94a0eea-8561-49ec-b883-a79d46d23b1a", "comment": "Malware payload (Gafgyt)", "value": "ce5b5d8bb119f1d4c890222d887cf36a592c32e61afd5d1e631400d03f0f383a9afe85a2308c20096677079a7ae0b000", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732689, "uuid": "0a9c1f55-9e9e-4b5f-98c7-5db0732bbdbe", "value": "T1D7B3FA93F511D9B6F40AE7330CD78B247270F6A14F53192263177B6AEE362D4386AE42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732689, "uuid": "55626559-e4aa-45cb-b82f-91aef63cef4e", "value": "3072:LmAHQeqacWucW0JcWcBimqyJFNNZ8Z85RdqzzfYoInmmHqzTDqHDLN:ZHQeqacWucW0JcWcBfl/qZ85mzAocmm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675732689, "uuid": "b797b94a-03db-4716-b476-e97bf165f65a", "value": 109874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675732689, "uuid": "0f527e72-f707-42c7-97ad-13251e0c8473", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675732689, "uuid": "587c7737-eacc-4d20-a79d-89e2c5032236", "value": "fd95a48ff0659d4ec8b8f6e6f27d9f73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa0466c-a6cf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1675764636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675764636, "uuid": "c953e96a-f74d-4fda-8ca8-2d757f96fc4f", "comment": "Malware payload (RustyStealer)", "value": "aefe1a04a23dc05c87fed024d64ded2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675764636, "uuid": "c03c7563-1cf4-416c-8067-30dfdfb4560b", "comment": "Malware payload (RustyStealer)", "value": "daf934a98e9a6115a8af6c2f34d6b0691a5c65c5b96278002d6dcdeddedd64e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675764636, "uuid": "a1ef6887-9aa6-4a0a-9977-5333484b6559", "comment": "Malware payload (RustyStealer)", "value": "83b11d9fa35ed388c500080842d54f38f72e62c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675764636, "uuid": "827e0966-d8eb-4997-bcc4-c4c908622b27", "comment": "Malware payload (RustyStealer)", "value": "30a07b0058fdba3d0df7b32f5afac54b51548bf89191ff73b2746fb8a13a7a776c57b28bcf7e03399bf5ff39de5ddc74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675764636, "uuid": "6401b5a6-a22f-4cfa-8479-c53e67490d5c", "value": "T10056BF3708C3867CC2A9C3781CC10A9D1B9A783A7E7BDAC29785455AFF5E30739CA519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675764636, "uuid": "00886200-5f96-4931-8e4b-b2a42a4e283e", "value": "cbd78022b455a6c31705cb5836b561a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675764636, "uuid": "d89aa078-b822-4b59-9993-8053cd8ec341", "value": "98304:n6Wx8bw2JuUMDqJ0c6BgmHEwFlf/VwkKb7qiULU5sEECjaWWWWWWio57HR9erzdN:Jxlmle4WFlXfKb7qiUKTECoZHLerL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675764636, "uuid": "3c89f71a-edf5-4651-b415-9dd096c0edd7", "value": 6364231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675764636, "uuid": "bd2e0c60-8a3f-4b84-b10a-5cef44e78793", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675764636, "uuid": "e60c342c-041c-42a4-98af-007311b65f58", "value": "aefe1a04a23dc05c87fed024d64ded2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78c853d6-a6f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675782162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782162, "uuid": "a9c100df-dde2-4eb9-93d4-35689f85b789", "comment": "Malware payload (Mirai)", "value": "2f2b5c7c918add13e1749d6ae046815d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782162, "uuid": "26e1859a-769c-47a4-aefb-36a356b0fd48", "comment": "Malware payload (Mirai)", "value": "db1a7e9e54d7ac73306dcf9edd7ea55b75da56df2923fc7f7acfbdf622b4e6a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782162, "uuid": "32da0fa4-8991-44a7-b09b-56d1a14e6500", "comment": "Malware payload (Mirai)", "value": "1b3ce65fb083e34709926521b6fc1445f2a97527", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782162, "uuid": "d6e18837-ca3b-4b2b-981d-addf96c049e0", "comment": "Malware payload (Mirai)", "value": "a12151ba32e44e3aac036eb62c28c145050b1682a027f683bb8dd4e914ae415034e372e9b85cadbd06f64ce4dce7a6a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782162, "uuid": "37f29b02-29cb-4959-9262-9795c0e6bc6c", "value": "T1C2435C02B2280A47E5661AF0253F17E093BFEE9031F4B689695FDB5A8175E331187F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782162, "uuid": "1aab88c5-a423-437e-a302-242018a3474c", "value": "768:D0z3aEoDNRRVn5KwHQGBHNEvz+6EE04rIJYkwVVDWo64Lh0ISOR4q:47ahphHQ9J0J2V110IpRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675782162, "uuid": "dadf473f-2c3a-4c37-bfbe-66ff82847608", "value": 57140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675782162, "uuid": "f83b7e97-77dd-45f0-b0d7-4fa0ba209ce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782162, "uuid": "211f355e-0536-4aaf-87ce-08142ccc4647", "value": "2f2b5c7c918add13e1749d6ae046815d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71690a3-a716-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675795205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795205, "uuid": "c8ddd2c2-f350-43ff-a453-ee6af2d1950e", "comment": "Malware payload", "value": "e09d3bb4e977c8cf87f8a8632889fd38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795205, "uuid": "3057a971-ed66-4ab5-a5a0-1aaba79d7a10", "comment": "Malware payload", "value": "dc60913944263321904a7f33ceef24caf954bcaf5ae330d57204438a41e48aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795205, "uuid": "1b8caa5e-4453-42fc-86e9-d30e403ac39b", "comment": "Malware payload", "value": "8b1634d3f67c868db7a6fc6f43c64a9559f683d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675795205, "uuid": "b134a558-d016-4297-a6e7-8ce77158598b", "comment": "Malware payload", "value": "703c807f18450640d3a4da2c078d2410006ed584167c9c8a46d9ed22b8d4457e9cdc48d6e02b2930edc81c9ab7fca980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795205, "uuid": "59e67b3a-c6e2-4cda-a575-5a6e8cc31c34", "value": "T1F0D47C1275D68075E5B302B28E7DA715157EFD700B324ACBA3C40A5E9E74AC2AF32763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795205, "uuid": "82417fe6-5ab8-4d32-93b9-81c35788c614", "value": "d4c9910606949bec9d3a78923f55cc88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795205, "uuid": "5261908b-c97b-4cc1-8e02-97b18cf6c3e8", "value": "12288:+LwbrqtcdZ8JQogKLy1+NqX5K6Wrk/UnEymJUwCsHv7DxoBl0FVcPF0:+LYrqt6WEyqULKjDdgl0Da0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675795205, "uuid": "1a627da8-564d-4a24-8199-9446d0be7a4f", "value": 633608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675795205, "uuid": "c2e69867-a29e-4311-9354-25ed8e58d107", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675795205, "uuid": "5bdd232b-e92a-483d-a45a-55d26f668090", "value": "SecuriteInfo.com.suspected.of.Trojan.Downloader.gen.s.19297.552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2870f0bc-a701-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1675785893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785893, "uuid": "300ee596-e4b2-4fb8-9df3-3a8443f282eb", "comment": "Malware payload (AuroraStealer)", "value": "55785a4e81d58a8abfcdcf0f61fb006e", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "nvidia", "colour": "#4D47AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785893, "uuid": "3b766870-836b-4c8a-9d6b-d3380947f578", "comment": "Malware payload (AuroraStealer)", "value": "dc9e326cb0b61880faa6feb7569d91295a2b06eed4fe3613901039175666e065", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "nvidia", "colour": "#4D47AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785893, "uuid": "6ad388df-9736-4e48-91c2-004b6b69e09e", "comment": "Malware payload (AuroraStealer)", "value": "b77d1d42599d4c425f1a61e2c937e0014aba7ca2", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "nvidia", "colour": "#4D47AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675785893, "uuid": "c7ac5924-8fde-4f31-a9e8-15c6dbefe542", "comment": "Malware payload (AuroraStealer)", "value": "18ed70da6362f082ef658ebf393a194e6e4ef0b1aa257aa17e9c7e9864c686ecdf284f01c05ddc9c471e32765a6fbad0", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "nvidia", "colour": "#4D47AA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785893, "uuid": "0b8863ad-9e35-4ed5-8fe8-7ab66b15816d", "value": "T15A2633DEDAECEA24FB11703287F585ADEEC790394A04A631DF0B8C51226BD09575E8F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785893, "uuid": "ea5914b0-5e93-4482-b681-e76c165fca75", "value": "98304:ouOZzsKG2PtuMu63H1ECNndFv2bx+0wXpp8:UZq21uF63HuCNdFOkdpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675785893, "uuid": "31161f6f-489a-4204-94dd-207bb8b972e9", "value": 4476415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675785893, "uuid": "da2378e2-af6f-4a33-bc6d-2264f2af05c4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675785893, "uuid": "41ec0953-9411-4e12-95ba-1ec0d4aa27a3", "value": "install_win64-32.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f799f18-a739-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675810064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810064, "uuid": "81b5e67b-3855-49db-876f-d11e574f70d9", "comment": "Malware payload (RedLineStealer)", "value": "7b36da4da4db96852a59a1a428554a55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810064, "uuid": "53a9ee87-2136-4552-8936-8a21c2ffa523", "comment": "Malware payload (RedLineStealer)", "value": "dce05561ae5582a0a5e716dcd273ed4b9359eb5a2fb556d103c63dc75f03622e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810064, "uuid": "ec174bca-9cad-44a6-a322-ed12516924ca", "comment": "Malware payload (RedLineStealer)", "value": "9b5d0528b3f85f54f5aae5305a9f602e0a4ae834", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675810064, "uuid": "5a9cd8b6-f114-4363-906a-7e2436740962", "comment": "Malware payload (RedLineStealer)", "value": "24a7a8717fa19970b86c927da6ea4d2f6125cd673e36a649269e3fa22b832ec3a25b1681b2184a5d4cb48acec67837c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810064, "uuid": "b5dea795-3660-41e5-8548-4a49c01d7a56", "value": "T117553334EEA1062FF192163FB741412D5F6803416AD28AE818A057475DA0D97CBAFFAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810064, "uuid": "72da4528-d60a-4721-9de4-775f17ee0463", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810064, "uuid": "f53ba12d-4e3d-48cd-92a8-b617f2ea89d6", "value": "24576:R+DS4BrH+eG0G+dqeUh80qIMt6RvXWpBtnZ6Nk3:R+DS4BqeI+drIzRPmBtZyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675810064, "uuid": "73e3a03b-4912-487e-9cfc-dbc1c180569d", "value": 1319424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675810064, "uuid": "aa968662-7d66-46c4-9ce9-24a561c3e2b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675810064, "uuid": "0f742120-219a-4620-9db2-7d8cc37b5a95", "value": "7b36da4da4db96852a59a1a428554a55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e43acb3-a709-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675789285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789285, "uuid": "044004e1-95bb-4bc4-8403-ac01a44da445", "comment": "Malware payload (RemcosRAT)", "value": "cde82ace59727b5d5361188e05fa2666", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789285, "uuid": "beea2816-f8e3-40ab-93bd-a1856ba3c853", "comment": "Malware payload (RemcosRAT)", "value": "dcf86e816b98be53bf58186cbfc5c22b36efb1a6a4e41a4b27687795f03290d7", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789285, "uuid": "6c1af971-e011-412a-ad5f-edb2abc14aca", "comment": "Malware payload (RemcosRAT)", "value": "286c8341871455ab3e2a8f80a749c41fe8c169cb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789285, "uuid": "8170a62b-8c07-44db-93ba-b7db89ee94a5", "comment": "Malware payload (RemcosRAT)", "value": "ce474819a87b3014ad58adc3c403e374f4ffe52803d535c0dd0cc6caea914862e78f0716cfe51a03e5aee9767aa8d291", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789285, "uuid": "0e048378-6022-49b4-8f1f-f7f0f9e49455", "value": "T1B035F00BE673AD2BEE27C53CE89F148282169C39A914CA0D21C3732E97367F1593ED55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789285, "uuid": "b7b7fc18-ffc6-4ed0-a4ff-23eeb174de98", "value": "24576:sFeGTwX/7HFeQxhMdSEb7nsw7PFRcrtXumSp:QDspDhgbwydCQmSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789285, "uuid": "c27a99fc-2856-4328-be77-9ec8de5d969b", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789285, "uuid": "facd2c67-69f7-4813-9cb5-b03c84381997", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789285, "uuid": "bb50dc7f-6b48-43fc-a48b-ad644ed78fe1", "value": "fabric order 31-8.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed41706-a6f3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675780105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780105, "uuid": "613c084b-071d-434d-922d-a3d78e6a649d", "comment": "Malware payload", "value": "9a5791c9552e7c0ec9f4bd1e5df6665e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780105, "uuid": "cf5225a4-d2f3-43a7-a525-1bd35dc857fa", "comment": "Malware payload", "value": "dd67342f524d53f8893d10285c4a01fc45bf2bc7d5b3acaf008a46ef8e425cdf", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780105, "uuid": "4d7a4d92-0ba5-486c-95c3-74f8396ca64b", "comment": "Malware payload", "value": "dd70d77f0a915b8ed3b86c4b3fd019c055906eb1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675780105, "uuid": "47910a94-5eed-4d49-a5e9-5f130037889c", "comment": "Malware payload", "value": "d7157286a863f5cadda2abcac43580e511f912423d86c51b70ccb904a36e89ff2b07076cc7489a3f8801f83787bb8b81", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780105, "uuid": "a8e722f8-267b-49fe-9f1f-8598de3f2b7a", "value": "T1DDC41E87925AA6BF913011D087E41C4DED6445E029ED8E82F8E18CEB934CD37AFE6C75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780105, "uuid": "8ac761dc-56ec-48fc-9c64-5bd43493c1df", "value": "1536:ncmeB4NJyELiHcAhuNsoBAa7ZA3edlIKWzkyDyxlmost7oqd4pbFdXw+ODUsng2V:ct1XKWaWtY+gxfzeZUH+uoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675780105, "uuid": "19b77886-70cb-45b0-8b5f-2a5800c0761d", "value": 559586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675780105, "uuid": "a536c50c-fd93-4856-bc2a-e70259dbf6ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675780105, "uuid": "7420c7a1-c93c-4989-b062-6bf047f16408", "value": "CV Lyna Bentoumi.PDF..........................................................................................................................vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423f89b5-a737-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675809129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809129, "uuid": "a487900f-1718-4ce2-b10f-1d94f5c9769a", "comment": "Malware payload", "value": "4e86a9673a6474a976a2983aac9d2cdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809129, "uuid": "28f7ecbd-5890-47a8-b76f-8d9c401e3786", "comment": "Malware payload", "value": "dd81d05edaf588ddc7f4d7ba42d64700afc0cb82f1e27bd0770dd69e06f66c20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809129, "uuid": "136e3f07-8db2-4091-9df4-90fee5009deb", "comment": "Malware payload", "value": "8fb25be31fbeff95c7d3796f045927c095d95089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675809129, "uuid": "8038c01a-9bf5-4e9f-9df0-4f04945fd793", "comment": "Malware payload", "value": "4a22ad25043bff716a7b3ebfd13e5d3904878b1882678db59e1f6bb4ee1827986daf65991590ae60eaca35e30782a2f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809129, "uuid": "7fd29f60-370f-480c-b86b-238fb1a7db44", "value": "T14714D0323690C032C5BB59705C64EBA16ABE793096B48C7B77A817BE5F302D1673A347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809129, "uuid": "388f0806-84e7-4bbb-974d-ae676929701c", "value": "cb9ba01cd6f8f6d0e1e435171e7d102a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809129, "uuid": "388df134-f189-408f-92a8-57331a668cc3", "value": "3072:xWmO+raFULJSLrhyW9t5Ie0zm/ZVu3qhmWHOcrjPEjpRfcXAtwuC9gl:xWmQqSLlyUoev/ZVWqhmqv3EjPE0wu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675809129, "uuid": "9df27aa9-de36-4e8d-95ce-cd96ae11f93e", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675809129, "uuid": "6d97f82a-8675-4270-8365-f4402b64db28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675809129, "uuid": "f13249da-7282-4d5c-a072-2ef7191e1796", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be9b381-a6e2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675772611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772611, "uuid": "653ff143-e293-4c83-bf77-897b9e4e662e", "comment": "Malware payload (Formbook)", "value": "5ab12a2ef3dc68cdc6ac399b6fa8d3ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772611, "uuid": "4444720f-1703-4212-92e1-33e850b3b9e6", "comment": "Malware payload (Formbook)", "value": "ddf42d793f113c479e0b15862da47cf6ea2ad954b94232d580cb84f65e318005", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772611, "uuid": "fe4b1222-562a-4846-8661-e6ec9c2bff47", "comment": "Malware payload (Formbook)", "value": "cf85f12550b7583891184c149c2418e6ea5295bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675772611, "uuid": "92bfb074-414b-46af-a6ff-0723ee302f6e", "comment": "Malware payload (Formbook)", "value": "320ba17ae26cb63ba32d2bfec2a3eaa1c59e3e474a4058f51e1ecc0b718f076526228dd42284bc177c9a469a4a20bd8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772611, "uuid": "5706db0c-3bc9-4b1f-8ab1-4a3a8ff1c31a", "value": "T15105220D5FFE9B20D5AE0B7958B45A504736F8257623F32E4EE260E72D2BB610101BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772611, "uuid": "89b7b3c7-3092-4187-b5a4-ebefc434ed45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772611, "uuid": "ece01d99-743c-4a9e-b603-94fc2f4ec125", "value": "12288:3QawHRr/CB06KuLpjC9ZSy2LKXX8gdBQmL8tlkLHKbG5ro5ESvuibDDlG:3QawxO5de6yAKcwQmL8tQHKK5UEAfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675772611, "uuid": "003aafdb-90ed-4dd7-a602-a502bb4a702e", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675772611, "uuid": "be3b8a3a-3a2e-4d95-b1a5-312d8ccbc47d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675772611, "uuid": "d55d6860-b636-495a-8e9c-3cfe6a4d15c4", "value": "qR6O4gFTtQCXnYe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90fc73ad-a6ca-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675762446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762446, "uuid": "209ef6a3-7dfe-46e4-b8f0-ee63ff964d7c", "comment": "Malware payload", "value": "8257517f33fc1f861974623e50c31f7e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762446, "uuid": "fa437bea-7397-44a4-b9a8-3934bdb8d4b8", "comment": "Malware payload", "value": "de839a1a9ca181ef2f3925db0fb4d168989f6cca33aec4073ec954a077483383", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762446, "uuid": "17969cd0-a1ae-4fea-9803-ab35f9beba02", "comment": "Malware payload", "value": "8a60f5320c8740330bbd09d248eaa6738c503190", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675762446, "uuid": "9cb47d8b-1303-4d1e-83e2-e633cd0d469f", "comment": "Malware payload", "value": "71341f24950c2a95dd9bf9ca03e2aea154431cdf8753595ba6be0c622b55226774b3d71f01884ebd561610653fe86526", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762446, "uuid": "5a1869bf-0c53-40dc-baa7-095bf91d8760", "value": "T16737338D698853F28C63D3D0DF16C458C891C7BAE44B0F9B292D5B388523997F762E78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762446, "uuid": "6f59a39a-80d0-47e1-aa63-7d72e6f1a5ec", "value": "393216:4bd3t/A06gJ4VB7RdRFRgy1eu1xtfF6LjJrqC4fBjp7W+1WxL1M:4hd/vNJ4Jz/1IJ6fZp7WMwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675762446, "uuid": "96c25d85-166a-4464-8a6e-8fc1320b5456", "value": 23007263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675762446, "uuid": "69db5262-a9ef-44c5-9b1d-e587ec6edbe2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675762446, "uuid": "870e4712-8f3c-428c-9e02-cccd6527e2bc", "value": "8257517f33fc1f861974623e50c31f7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc5243b-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758441, "uuid": "f7e3b2af-d350-43fe-9fee-731facb06f3c", "comment": "Malware payload (Gozi)", "value": "ffade35e76e8bf651f0c4b58df70d645", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758441, "uuid": "3e3c2f68-cfae-4ba4-8e9d-d3f250e0c25d", "comment": "Malware payload (Gozi)", "value": "de978cc78b0ab9d06ea9cc4e75bef1228fe4aad12e8e1488fd54df8cfb01203d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758441, "uuid": "c230c505-f75d-4c9f-9f17-5f7283bd96f6", "comment": "Malware payload (Gozi)", "value": "8987375c6c622e5d6e95f985e57da90009653bc1", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758441, "uuid": "823f0058-2685-477c-b983-4451a05c2dc9", "comment": "Malware payload (Gozi)", "value": "c7f6cf137f2c7ce22ea95fb1cb753a7d122d1625d4976777922568c3ecad24a6ad027c9dbc076a2767362a2099269383", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758441, "uuid": "303cde7d-1123-4ea0-994f-f68f2dccfa80", "value": "T102E17C9E9DDB641BA78081FFF6333D10FB64197AD9292204B5E2E30E6A62767004165D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758441, "uuid": "ecf8ff32-667a-4dbd-b5c5-2308746a6cef", "value": "96:wcLgDLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4d296rh:uU77rIKdn863jMM0OD9+VVF44xikuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758441, "uuid": "ae197607-5d9f-47ed-97af-9e0a1f9ea44f", "value": 7018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758441, "uuid": "c906ee90-9e7e-49fa-9a2f-4d9e8f1c2866", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758441, "uuid": "c8b8f3dd-f235-4247-8acc-3e7a0a28aa3c", "value": "azienda_32.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65f5d9f-a6c1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675758643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758643, "uuid": "235d7570-69d4-4524-a6c5-0f8f9204c7a9", "comment": "Malware payload (Gozi)", "value": "2d3b51e1e99e3c5aa2c43cad6fc74be0", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758643, "uuid": "c929f732-ef7b-4d27-acc4-164c5039df93", "comment": "Malware payload (Gozi)", "value": "deeddde6a0e84f387be667d560eca3fe251b97f6a7a0637643ea6dfdb84f579d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758643, "uuid": "a320bea2-2dca-4c9d-a197-7d81204f3878", "comment": "Malware payload (Gozi)", "value": "ad54bf3383ba7ee5b7f5faef2bc6d01e6db63069", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675758643, "uuid": "4073f8fa-1730-49b8-b455-59a0b00e0742", "comment": "Malware payload (Gozi)", "value": "557a423e8dc284e364ed23e979bf30216361f53e0b6ccb89a854b8cf12ccb6e5fbc252fbadc08dc3f9c29ebd6ef55d5f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758643, "uuid": "24646b8a-b487-4d1f-83af-145f910b09ec", "value": "T15FA16CE7478FF26163960D31882AC998B0D02BB0D8720D55FFD14A1B641E79D9BBB742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758643, "uuid": "308f7f49-207f-48c6-83f6-92589c618c6a", "value": "96:RvEUiyoSvLzOOZlUs6ITqbCB9VVjH71dMiKZg0XbGsJ2ENZl+5g+VLqo9db:RviwvpLUuWAHjb1dL6gdC5N3MVRq4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675758643, "uuid": "5e3cfefe-85cd-4f7b-a137-14c852a9fc4b", "value": 5065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675758643, "uuid": "56728d9b-7632-4f7b-9e77-9ab1db56c346", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675758643, "uuid": "1750d70c-8c19-4a25-ad79-6521e647d8ed", "value": "azienda_22.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346db8ac-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675788919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788919, "uuid": "b783ff2d-e1f8-49db-8419-2bc56761d9ff", "comment": "Malware payload (AgentTesla)", "value": "1d261c332666240f0713f05e3b92de0d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788919, "uuid": "167a6778-85e3-4762-88aa-360755f15461", "comment": "Malware payload (AgentTesla)", "value": "dfa4b25bb9a1534192d30dc3f10acd6a72c21a36bfaecae14c5d7a22dff88fd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788919, "uuid": "4f33c404-c24f-4d78-9547-59442831bd71", "comment": "Malware payload (AgentTesla)", "value": "7f95ea4fbb56c5286d9016a4bcd156ba0425f814", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788919, "uuid": "c65a3f7e-78d8-4976-9ee4-48c516d36931", "comment": "Malware payload (AgentTesla)", "value": "f51238e626de564cf2a4b41aeff3304e238fba061c79e7e1161542b2e976c70e83f5cfc0e46dff830037822637461906", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788919, "uuid": "e97cefed-1d87-47eb-aba2-8fabb081c440", "value": "T1D7D1B721A3998733ED764BFA98B363830338E7809D63CF5D58C4521F6C02B694F61BA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788919, "uuid": "e740617a-8c16-4997-b6d7-a4d13604a385", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788919, "uuid": "96ef3441-110e-4f21-86e2-b5c5900f525d", "value": "96:JpG2OqkYgoVnGMDr0hZt2UJKtEk+Mx9JbFnU:1OfoVG5h1Kz+MrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788919, "uuid": "43502403-b447-4efb-8fd3-9aa668df3a2d", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788919, "uuid": "f4fd95f4-1c06-4bd5-b0cb-0d3561a87a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788919, "uuid": "b7ba7ac6-1c64-4524-b4b5-8f4b6a2fb9c3", "value": "Roqwnrsun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa6d811-a6bd-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675756914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756914, "uuid": "37d062d4-d064-4393-9077-99c8d4132daf", "comment": "Malware payload (SnakeKeylogger)", "value": "57bfcea7679658da748400b3083a5da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756914, "uuid": "96424df6-04fb-4e13-a873-64fe2df63891", "comment": "Malware payload (SnakeKeylogger)", "value": "dfce3d45a141a90bb1dda531b99447c1c8ce99be74c704d888af79f2a444c1d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756914, "uuid": "27e0b5cc-ea6f-44f4-8ac9-2ca56157e19d", "comment": "Malware payload (SnakeKeylogger)", "value": "4633782b2f25f3f9ecfa29a3ef1d1a6333baa0c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675756914, "uuid": "10f5ac5b-a79e-4120-a650-b3d1c3f81ddb", "comment": "Malware payload (SnakeKeylogger)", "value": "9c07c18345081f1311a3ccbea07d69e5b1a075cdbf5bfac2be7cf2bf88329587e6989063c5bded12f77ef7c7ad731260", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756914, "uuid": "2ff1aa4b-12f9-4f33-a112-48c1277c8fd2", "value": "T175F4221161BADA21C5BEECB0BBB4B5D46378A3107822ED5D8EBC10DEDA31F0AC954357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756914, "uuid": "fc7fd78a-739a-4bb1-b151-e7c1d17c2613", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756914, "uuid": "65847367-679f-45d2-987d-0938791b0bf3", "value": "12288:qqpkePALcxjF1Xsim8oAYXH6gEIExuMLsjA3jyxGPfsKcXnyXx6q16ahRZ5G9:9AQF9m84XzP9csjUjy2h1NMS5G9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675756914, "uuid": "fcef1637-5cef-4874-b8b3-3fbf230216be", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675756914, "uuid": "28349218-e261-40a3-8194-764326e8849e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675756914, "uuid": "4598c8b0-e7ee-4169-8a76-719a4e5d70a2", "value": "57bfcea7679658da748400b3083a5da4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e4da5d-a6f8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675782188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782188, "uuid": "c55b9358-d078-4897-bba7-acb35e4adfb9", "comment": "Malware payload (Mirai)", "value": "d25a4ba1016b4e4653d38a1a3b13b7f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782188, "uuid": "5142e594-3ff1-4b93-b495-0710027264ed", "comment": "Malware payload (Mirai)", "value": "dfd897e5ea5337473264271404db8ac2089d2dd5eb6f2cbdd7e0d52b324cdb97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782188, "uuid": "6831971e-431c-448e-8951-7244bc2ea330", "comment": "Malware payload (Mirai)", "value": "389c996e18e5abed4c551249b0577ee49bbc6864", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675782188, "uuid": "de31e395-43f0-4be6-9f6c-1f7a89c0bab1", "comment": "Malware payload (Mirai)", "value": "0bf143234afb3c3906d4dc86e9d3002082eb6130013778ed02c72cff5a7c0ea5fa25fb8acceeeae42f5a5503f40f5ba3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782188, "uuid": "4b268737-5789-4aac-aba7-0ce75daa2912", "value": "T1D7632A86F8518913C6D416FBB66E50C8375A43AAE1EF3343EC210F543AC694F1E33A96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782188, "uuid": "1dd3b153-a6df-4d3d-bd9e-bd61e5db3b41", "value": "768:+eDJDGeAXh5e4238+7FGrER5vHZ63nPfLuoxSWgNqFdkWUFG1ByYUJ/+vbs:TJD/Ah+7MKv8PzuWldk1OUsbs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675782188, "uuid": "de1a706a-8615-4ebf-9796-3688dcbd43de", "value": 71544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675782188, "uuid": "148b33e1-98c1-48bc-b0fb-89d9379297b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675782188, "uuid": "4a851600-c995-4f18-87de-b7a692baa1ef", "value": "d25a4ba1016b4e4653d38a1a3b13b7f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0be19669-a732-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675806890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806890, "uuid": "e09a6323-a664-4a85-9766-0cf892707a77", "comment": "Malware payload", "value": "6bbf02da5ab909f22365a750bcb17a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806890, "uuid": "3b1c8856-a7d3-48a2-9850-7d93a400107b", "comment": "Malware payload", "value": "e038ac3d9527548ba4276eb668a1941eddad4d878f2dd367f068f1200cddd693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806890, "uuid": "7da13250-91fd-4d89-962c-c5868a417b8d", "comment": "Malware payload", "value": "31623589571ab7410d34363ab70c5ce7a1a15a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675806890, "uuid": "b110e49f-046b-4770-ae4f-b4ccaace28d0", "comment": "Malware payload", "value": "68718c55d58c8c2b5a4caa26de1023a29f03bd9c6a33bc437975dc4ad166f4aee2183a8c8ca87b5c55ef09e79ed375dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806890, "uuid": "98cb24a2-027b-4c3d-ad70-e1650935ed7f", "value": "T1FF76330174D8D8BBFD810F339A2057A461B6B37447B2461BA7E9AD9EEF6DB84C107312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806890, "uuid": "9024ff0d-d2ea-4755-8ba3-3a32fcdceb8d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806890, "uuid": "08844a6f-6f4a-4468-9348-9e8ed2b9d114", "value": "196608:91OsomULkwzWki366vp/d7Cd9J+1TUwTmgEQtfkF9GRa:3OxRLkqGfd7Cd9g1IwTmgEQtfkFr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675806890, "uuid": "0c32b6e3-9f60-4efa-9652-2b6f64a426b9", "value": 7601798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675806890, "uuid": "30c570ee-c160-435d-bc8d-1283fcce0e24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675806890, "uuid": "3d65e71f-9a64-4dd0-bf53-9d30167a7de4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fe9aca-a68d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675736141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736141, "uuid": "4a2dd279-5a0a-4f26-8558-aa598541df06", "comment": "Malware payload (GCleaner)", "value": "c68df3404291e069a84e43bc3e5aeedb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736141, "uuid": "2659380f-7a5f-4ae4-87cf-738fffdb042c", "comment": "Malware payload (GCleaner)", "value": "e03e8f65b85849ec0db7a4c7f9e1c92d88daf3c8af978bddbfb3904f1e6a90dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736141, "uuid": "e1bc4c0b-cf98-4029-8d45-2dd66edf1a25", "comment": "Malware payload (GCleaner)", "value": "1ef1d73788ee129a69ab326a92d7962ac6cd0d29", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675736141, "uuid": "0870319b-3dba-4d48-ac39-bed18c5236d4", "comment": "Malware payload (GCleaner)", "value": "a03d715e24510764882e2ec256b0d95c76525d5abfe40ee84723c1d9b87c82b3214ac44a328d95a1f3c109c53d3c7084", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675736141, "uuid": "596bf85e-51ae-4227-91b1-02f73050ceaf", "value": "T18DA523529660C5F6E3A2CFB6D82D48E8A5776C66E8F60113B50C7E5E3A733DD018E309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675736141, "uuid": "b6c59571-9e05-4165-816b-5ed71ed954ee", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675736141, "uuid": "16c8d40f-9612-4cfe-b740-46c4eb02c42e", "value": "49152:nZiXqnTpFaxaCEro41CfZNUb9gLCgv2MR:ZtndWe+U9Iv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675736141, "uuid": "384fd86f-50f8-4ca5-9e7d-b38b7f376075", "value": 2073975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675736141, "uuid": "fe8de426-bc05-4faf-bfe9-528039b2755e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675736141, "uuid": "d576055a-54a3-471c-8969-45aeb9201c2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236ca2c8-a740-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675812943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812943, "uuid": "3c3dbfd4-17dc-491e-83d6-4cc5b28c31b8", "comment": "Malware payload", "value": "2ccad9255d841bf1b152975c29a47d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812943, "uuid": "bdf16f4d-873a-4372-bc53-fc10a3f20b5a", "comment": "Malware payload", "value": "e05a7bd021cc7ec74535bdb37202562fcf30328541b2617bb87eab3fa68822cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812943, "uuid": "e8d500cb-54a1-43a7-be7b-c4c6d6a46605", "comment": "Malware payload", "value": "cacb34d6a7d83f06dc8c30d8aa2994dafe7c62ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675812943, "uuid": "01b3fe1c-4708-4887-afca-7c6653f34047", "comment": "Malware payload", "value": "089c57b488199f5f741aa4da406f1f0fe5e6d7211d1e8c99ffe75f0fe40d558c52c53fdad89b1de9aac86298756ba694", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812943, "uuid": "6e4ee9e3-b43b-41c5-aa0c-0fa282a0c055", "value": "T11CB40217F7E89036E86147304CF203D30A36BEA19B38D7AB635B6C991871974A23576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812943, "uuid": "4e0f553c-2bcb-4493-bd70-4f61e9b6826b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812943, "uuid": "a469433f-1149-416a-a4dc-6b24d27f6af0", "value": "12288:TMrEy90MWSH+VBCk+uW5Rs58a6gOwEh5QUj8ldMJsOs:vyhWSeV4kgRsV6gOwEz/QAJsx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675812943, "uuid": "1e59312e-2012-4c86-b5a1-69b7e8652357", "value": 537600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675812943, "uuid": "eb5e5dde-a8f5-419b-9971-eac34af25513", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675812943, "uuid": "c8c06a57-6a94-446a-946a-551ed59df2b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63756cf4-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675789857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789857, "uuid": "0421cd89-18fb-4be4-b03f-8fb918017dd7", "comment": "Malware payload (Loki)", "value": "fcb423ac4af9801d133374c802e4a078", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789857, "uuid": "149e1f1f-b435-482a-ad21-ea1b843adebb", "comment": "Malware payload (Loki)", "value": "e14a5a244a1e4db82ccb8da0be57d841442851ede8cba912df309d3f033530b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789857, "uuid": "53ed5bc5-819b-4ca2-8027-dd4969592186", "comment": "Malware payload (Loki)", "value": "a955322df787c658ae72eb9e4ea3c41117dfd346", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789857, "uuid": "a6b365dc-3535-4447-b0c9-6956295c4923", "comment": "Malware payload (Loki)", "value": "9214ef75117231bd0562ef9eda229c15c69eeb87dbcf49db3aba29839a513f580758f6c0e2429347d9ac8a5d3b2102d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789857, "uuid": "8b4f6bb2-c559-49a6-9fdd-6477f5cc92bd", "value": "T13D74BFC0D99CFDC1E87209F568BA5916353BEC3F94B64C6A6566B0141833883B4BBE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789857, "uuid": "7ba165e7-e984-4767-85ba-f388df356b5b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789857, "uuid": "3f06b205-c86c-4c3b-ae46-639441a1547e", "value": "6144:8Ya6O4eRhQ9sVnQxU1vgT8m4ayccQrV/aXGGaoiNv5ZlG1arcEv7fCJ:8Y1eRh3nWUJgTsl5QrMWJ1RZvrc4fCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789857, "uuid": "e57630da-b225-4780-b9ae-9bcb797b28f6", "value": 352796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789857, "uuid": "0e65f3cf-01ef-4f37-a39d-93401473b7af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789857, "uuid": "29a944e5-4e64-4d2f-ae53-9d5e8aa2058c", "value": "HSBC PAYMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8abb6bc1-a70a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675789923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789923, "uuid": "931b483b-2795-4a94-8cbe-69db8b0a36c0", "comment": "Malware payload (AgentTesla)", "value": "e0bad0c2a1f176d5a376ceeea0afa575", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789923, "uuid": "c01d7fe6-05b1-48a7-86c7-c47951f2d58b", "comment": "Malware payload (AgentTesla)", "value": "e1a52de9fb816479c60d9eca5990330d983682ef3c32134a8df8951cb2b85816", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789923, "uuid": "c4fd2b4b-2b2a-46c6-9030-bd87f3fc310a", "comment": "Malware payload (AgentTesla)", "value": "ad6b180504805ee01044afe3b4bc670667e1ef34", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675789923, "uuid": "0d4b19e8-9cfa-4c4b-afc4-904b866c9c83", "comment": "Malware payload (AgentTesla)", "value": "f3a5d055d3a3ecfb161b62927452e02b4a2ac66fcbc706e9c4d467ed2ae331351044a263e676e20423ce1be536808d5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789923, "uuid": "cc661fe9-d603-4e5a-96ea-75152f4524e9", "value": "T1EA455C8171B1C893F45B09B068297CA83579BD4F9AD8400FA976BB1963F3362F0DDE16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789923, "uuid": "87eaeeca-ac7f-4829-b2b6-026a0feff23a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789923, "uuid": "dfe0fa32-84a9-41a1-8ce3-fe26ebbcb16e", "value": "24576:xp1+YGDkjwJsoGlWbc6xgHz7WUcNGytnM7C4X3:xpgY5UsoGlGAWYAgC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675789923, "uuid": "8219d1e7-8647-40c5-8940-39da93b5108b", "value": 1262080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675789923, "uuid": "51df0489-3163-4bfd-8170-48347febbfad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675789923, "uuid": "01152dfb-664a-4445-bec7-21cc2c61a5a4", "value": "12220173387_20230207_13363111_Hesap0zeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24671e8-a706-11ed-88f6-42010a9c006e", "comment": "Malware payload (CobaltStrike)", "timestamp": 1675788272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788272, "uuid": "619608fb-6bd9-4451-bb8a-c3859cc01abc", "comment": "Malware payload (CobaltStrike)", "value": "198b2d78455bb164978c5467b544f16f", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788272, "uuid": "caba474e-b7af-42fc-87e8-9c61ff2a9241", "comment": "Malware payload (CobaltStrike)", "value": "e258c0f68a750b8906fa1a3409f76fcff3df9b9d878fe9148aa9768102e240b6", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788272, "uuid": "bb6b55d7-1568-41ac-ad26-2388cea2feb7", "comment": "Malware payload (CobaltStrike)", "value": "792513125f5b57237fa63dadc18e89c55e4c5ff7", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788272, "uuid": "7641d5c0-9470-4730-a032-5bc9869b87cd", "comment": "Malware payload (CobaltStrike)", "value": "098572498305ac6baf2d3fce34a787af42fac70faabf4e8c586a5f520ad3c632c2f32a289ccfb1a49998d9d405e9d1fc", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788272, "uuid": "aefed369-0068-40ff-9e8e-d710188c953f", "value": "T1429633487A512AA6E8A71039D8724212C673B4576B62C9CFC7F096900F27BF15E3BFD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788272, "uuid": "b2440951-e921-4d1a-b3bd-7e12d41bc539", "value": "a6cec5b1a631d592d80900ab7e1de8df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788272, "uuid": "3bb9c467-e4f3-4a4e-bcfe-d68596388c99", "value": "196608:ksD95x0MXCpazL2Vmd6+DKJVAzDaku99lEOSE9M5mj:ZZbXCp6L2Vmd6mKJVAzDakAii9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788272, "uuid": "8fa82724-6806-41a4-9cc2-1c249531dd93", "value": 8970314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788272, "uuid": "51b1a305-3c87-4605-92b8-785a5a938815", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788272, "uuid": "6df87603-f26a-458b-93ad-176771cc6fa4", "value": "198b2d78455bb164978c5467b544f16f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5aac57c-a682-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675731637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731637, "uuid": "0297abf5-2d1f-49ff-b1f0-e57209822aa9", "comment": "Malware payload (Amadey)", "value": "29fe836ac1649014371f5a4ab5c1a395", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731637, "uuid": "a482ce7e-8377-488b-acf4-d992fb550801", "comment": "Malware payload (Amadey)", "value": "e2a698f4f065cf70a6b4b7e15fc78fbcce302a4f624aff1194824d2b50aafb8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731637, "uuid": "32c43f40-b8dd-449e-bf77-0fb9952e425c", "comment": "Malware payload (Amadey)", "value": "96afea34a8a796bf8911733dd4db5894ea0457b7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675731637, "uuid": "1bbf40c8-a42b-4df5-843b-556ef1654028", "comment": "Malware payload (Amadey)", "value": "a5f68c652e994235ef5b06285348cfca30dd19c9bdd325dddf13827a0b77f971048b62e8357d86e5f5b360381c4f9179", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731637, "uuid": "5c91c1c5-ed8c-4db5-8e5e-aa7515177654", "value": "T1EB644C4393E1BD40E92B8B76DE1EC6E87A4EF9408E797765321ABEDF10B0072D163614", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731637, "uuid": "9d94009e-77e4-4b9e-b1a9-e5375ab72725", "value": "f6c13c36e64eade6a67b9da9bdf097fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731637, "uuid": "175220fe-8ed7-429f-a248-549710281ac7", "value": "3072:O9b6bsgz9ILRrrRm5W8GSJO8SgE3+OLoY0lKH0zy5lqVuQjiMTE5w2+Ha5hN:8jyIL1Y86S85Y0n+zyuQj9H1HaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675731637, "uuid": "3df9a78c-d4a0-45d1-8b3f-e52336cdb8b2", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675731637, "uuid": "99fb5839-eee4-4d59-b6e6-66fa45ae7a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675731637, "uuid": "7701b945-cdac-4234-a8bc-e1d255d1ca22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db42b8c6-a718-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675796071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796071, "uuid": "623c8946-7e36-46d5-aec5-02cbbe5b82b7", "comment": "Malware payload (Amadey)", "value": "16755b75334b8655bc2357553a9fdab4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796071, "uuid": "0f4c7a52-38de-4f99-ba7c-4d31fbaceff9", "comment": "Malware payload (Amadey)", "value": "e2b454a6a774a94abfde2acec235fde33da717943ab9e2c5c51b8428df0f9253", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796071, "uuid": "0a9400b0-1f28-4b9a-9664-d2ed89c3f037", "comment": "Malware payload (Amadey)", "value": "5705cf96e5337cd165fce107d5d11c020a69fe4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675796071, "uuid": "84bf563e-9b0d-4316-9483-df157949a590", "comment": "Malware payload (Amadey)", "value": "3ed618bddf408ebd05b66fc4af9af1c16681cc5b98a350e5797a9dca7c8fc4faad4efab337dc3ca5696cb121acd537dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796071, "uuid": "7c4dfad4-2047-4e46-b6e8-9f00cde8dec7", "value": "T13DB40207D6EC8022D4F557B019F343C3063B7EA15B7893AB224D9C5A1D73AA4A6713BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796071, "uuid": "fab41748-f20d-419e-b8eb-737265ee9dd8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796071, "uuid": "c2486721-883d-41df-9d5a-9e03467db07a", "value": "6144:Kky+bnr+Pp0yN90QEDJ1o6Su5TojNCee1utRhD8r8yDdTIfDYt6EeYwPmSNVzAwE:0MrPy9066SuO/pyhTIb7Y4VtukFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675796071, "uuid": "a7a10e58-451a-48f8-a41d-a484face365b", "value": 537088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675796071, "uuid": "a238e6f0-e981-471a-b5ea-858a55545311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675796071, "uuid": "82b0c236-7792-4b34-ab23-6971cd0b61dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1a156b-a6be-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675757227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757227, "uuid": "c177b996-1f3e-4107-9ce8-d31f18d61eec", "comment": "Malware payload (Gozi)", "value": "50b5ef57167285f6371d0db027e02577", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757227, "uuid": "a838fb35-aa60-495e-b3a7-a0204dcba379", "comment": "Malware payload (Gozi)", "value": "e2b821df42f23de975eeab128f82e4386f3864cc15bacb60a4840c3123ac6fb5", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757227, "uuid": "e6805ef9-dfa2-4b78-9422-cf5a6283b537", "comment": "Malware payload (Gozi)", "value": "65bcdcc02d233997560c0f2a7abd248194e119c7", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675757227, "uuid": "43b9d924-ad45-4a7d-a8a9-558cbf8da324", "comment": "Malware payload (Gozi)", "value": "a8b43ed6d081df3410aef942c23e793457b90ca0329b282cd3f9241daa95f22eb8048daef60243fcf32b656215b26e92", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757227, "uuid": "653d402e-7eee-423f-a7d0-2ed84e5f614c", "value": "T1EAE17C8EDDDBA41BA74082EFF2733D10FB64157ED92A7204B5E5E30E6A62727018165C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757227, "uuid": "8b6a5593-bcac-469e-b53f-85192a5100b9", "value": "96:wSSBMLVTUoPg2pwTEeD4b7KdaO3iOaLt3M8Mn3XTPMJsb0ODcFE+Voq3V4dj296f:M6U77rIKdn863jMM0OD9+VVF48xYkuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675757227, "uuid": "8d86854e-47ae-4131-869f-04259a638461", "value": 6970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675757227, "uuid": "88362ceb-0973-491c-aa14-0ece9abd748e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675757227, "uuid": "678676d5-5361-48bb-a3b8-8c907c34ff91", "value": "azienda_04.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da95c15-a708-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675788908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788908, "uuid": "33f320d2-c789-48dd-a3c1-939cfe42d8d3", "comment": "Malware payload (SnakeKeylogger)", "value": "7885ed87f74b72cc8c6f5b008b188e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788908, "uuid": "aade8792-48e9-4573-8df8-75fb614091b3", "comment": "Malware payload (SnakeKeylogger)", "value": "e30c45dc7edb811fdae05224c51fcc50228b0fe0efa69a1c315c6b470bc24b38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788908, "uuid": "f72b9720-2e36-44ff-8486-ea72c45ea78a", "comment": "Malware payload (SnakeKeylogger)", "value": "ce386b5080c92483882c5b822d7179438dd5271c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675788908, "uuid": "b0c7abb4-4d91-47e9-9876-65d49da30dab", "comment": "Malware payload (SnakeKeylogger)", "value": "60892a048eb0b962680a89dab86b62fa58c6d31d0c004feee1ecd0c01e35629a563410a7e84180484490c0a4644d0ba4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788908, "uuid": "1c40bc4e-7db4-411d-94b7-28382adf5fe8", "value": "T1D1B4F194BC54C8DFD4AD1A719EA2F6791224AC3018E89D433E663F1D79B2306281D7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788908, "uuid": "1d3843a1-b244-4d06-9c33-0d0dabf36bd2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788908, "uuid": "cce2290c-cfec-4b8f-bcec-1b84b2fa50a9", "value": "6144:OYa6HN3UhCj6cR8k88FUF/mjcUxBD1ZoHUlWq6lgwA0b/azm31Unx+x+0oTsdtZ+:OYQMTy/BU/DMHUlm3Gm3gxULZF7W3fCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675788908, "uuid": "5ba89d6e-e097-465d-af1d-72eeb8e3a946", "value": 501845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675788908, "uuid": "5f074453-2a8c-4963-a58c-d558fd34e414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675788908, "uuid": "edbe8b64-fe38-4881-9321-7f6398afefcc", "value": "Quotation_20230207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa73c34c-a721-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675799855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799855, "uuid": "4d93fc32-6cbe-45aa-92ef-daa62909670c", "comment": "Malware payload (Amadey)", "value": "2abb3b0b211a47cc9d34ec843f9ff162", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799855, "uuid": "90adaa5e-a67d-4af2-8ce4-2be61cc404da", "comment": "Malware payload (Amadey)", "value": "e37cbeaf79489b971f344d21fb78ea23dc2afd05c50b3fcd413e14ea04ebd4af", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675799855, "uuid": "a3994cf4-da04-47a1-9fa7-87b0bf9e61bb", "comment": "Malware payload (Amadey)", "value": "c08f3516cdd5b02e80b39f8c9e5a8c58ebd3c224", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true