{ "Event": { "published": true, "date": "2022-02-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-02-14", "timestamp": 1644883381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d69b2de6-f2d0-48e3-9908-d7b8b21f376b", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf5ab9b-8da3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644849598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849598, "uuid": "ad30a5b1-eac0-4c67-b74e-e98bdc966031", "comment": "Malware payload (AgentTesla)", "value": "c0ee5afa4e3950c119ee626ad0258f3b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849598, "uuid": "1a6b4161-bbcb-43ad-8b65-bf9e72cde322", "comment": "Malware payload (AgentTesla)", "value": "0009426a08a10891a3268af4b4e133bdc9ab5c5ae4dd8bdba69b6af77294dc09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849598, "uuid": "c6f04959-c895-4219-8076-e7e656fd3c4f", "comment": "Malware payload (AgentTesla)", "value": "cc5823f4ff77075e8febfc25133ff24692cdc6b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849598, "uuid": "11caf127-f103-4af1-bc51-bb4fd0491f4b", "comment": "Malware payload (AgentTesla)", "value": "40773105ea38464542eb7945be54480aa9e8a586a4f5d00264f7ff75c87930835eaf74708b0f2ad67982af6c9bdca673", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849598, "uuid": "8c4b8f17-f7e7-4c65-babd-37ca5a44ddf4", "value": "T15715020177AAAB23C5AB0E7BE8A243415770E94E9517D77B68C133EC1C4B3A84F72179", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849598, "uuid": "3b2cd2ac-8905-4244-a97e-eed2f4519fc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849598, "uuid": "d002f4e1-6744-4d5e-9ce9-0082c90eecec", "value": "12288:CPnXFN3E4cXbQH3Y1Mv7o5mXBhV4QymE19Frdl+Ma/PX2DtjO5gBVSyy83Q/PKSm:CtLZ3QMz14QQ/FLzaHmhbBVSJ8AQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849598, "uuid": "791673a1-df0b-42f0-a41c-4cf9884f0f52", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849598, "uuid": "9d9eda18-248f-4171-b8ed-6cfbd711c4f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849598, "uuid": "7621bdd9-4814-4b23-95cb-21a179c50d78", "value": "RFQ_15254.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f2ce56-8dae-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644853991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853991, "uuid": "55fbaf05-fc11-4615-b5a2-211d415095cf", "comment": "Malware payload (Formbook)", "value": "b800504be883e3cda511a86d7c16ee3d", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853991, "uuid": "029c1910-933a-4a71-b29a-4accfb2b4a6e", "comment": "Malware payload (Formbook)", "value": "00a6ef981cfb0915c42062fc29892b2c55408f5fabbb77ac528cd85428578cc0", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853991, "uuid": "a95c390f-4e1b-47b6-a7bf-8f8dedf9c63e", "comment": "Malware payload (Formbook)", "value": "8197d4eacefd0e77f5599846468432961c9a0706", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853991, "uuid": "65764e24-0a83-4bea-a0d8-2bda6ffa4428", "comment": "Malware payload (Formbook)", "value": "a01bca79ec5dc6b10f05fd4722be5b2f1c3eb88b932508142445e82f5b951c12a4b972d405893a09e0f41569ab9d1e7b", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853991, "uuid": "4b91c810-5cf3-478c-9b9d-08500ca619ee", "value": "T1E77423671A57B52A7818FEE01E397A266E6B3128F828303E67DFD731937C4448C4D6D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853991, "uuid": "836dd2ec-0dff-4540-8ccf-ea58852e24a5", "value": "6144:IhWLuzvLMYZeUa32WIXhDNScYyfNGNBNIq2qAhgFAV9cqrVt:IW6DoUmIRpScYyVGN41q6rV9N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644853991, "uuid": "53a1f5ad-8faf-4e20-9b7a-b79bac6bf353", "value": 339921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644853991, "uuid": "b76f1abc-dcae-4152-92ba-46fe6f2abea0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853991, "uuid": "4ea20057-8d67-4050-9a14-d6d5ef55b318", "value": "Shipment Document BL,INV and packing list.jpg.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad4c5a9-8d94-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1644843073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644843073, "uuid": "6618d847-f197-498b-bee1-c3d223b221f8", "comment": "Malware payload (njrat)", "value": "c01bf8e34586a739f6af844361f82b22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644843073, "uuid": "5d66ea0c-cca5-4090-b99c-ba780eab3506", "comment": "Malware payload (njrat)", "value": "0118c478a14f4aaca063a96f857bb3f64c1799939e1af5c0e8a44df72e6de1c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644843073, "uuid": "00dc9048-4eaf-451f-8619-690b0f9174fb", "comment": "Malware payload (njrat)", "value": "d7965054d018056a27a62fe5514291899af58a3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644843073, "uuid": "d39b02c1-a203-46d7-ae2c-03298537a606", "comment": "Malware payload (njrat)", "value": "ca424fc3b53ebad2beeed6c4cb13021b9cf548580f7f00dc9893b9afaea20d070fbc86099b34bc54378161c77ae3c6e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644843073, "uuid": "f20bdf7a-70d1-424e-a03a-45c5af8abef4", "value": "T128E2F8467BB54216C6BC1AFC8CB313114772E3838472EB6F5CDC48CA5BA76D04245EEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644843073, "uuid": "02df7891-15eb-4242-a9f5-6fa0bde04906", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644843073, "uuid": "4232fbea-f8ae-4afc-a787-5ea2a2ebbfe4", "value": "384:T0bUe5XB4e0XOOVlIQgYbr9pqWTdtTUFQqz9eObbB:AT9BuN/IQVbJLAbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644843073, "uuid": "5aee7648-251d-43d6-b9e7-c7bf33734a46", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644843073, "uuid": "3d3dfacb-1ef0-463b-8a23-3deb125923ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644843073, "uuid": "23fdf2d9-e815-4628-9056-43039e231662", "value": "c01bf8e34586a739f6af844361f82b22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdf7638-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644821869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821869, "uuid": "8fc92e36-2589-42bf-a115-cb0612a9b373", "comment": "Malware payload (SnakeKeylogger)", "value": "2001efe4eb01c8a83a8bbc08df56a7b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821869, "uuid": "e526206b-fa2f-4752-be74-d95d1cf625ef", "comment": "Malware payload (SnakeKeylogger)", "value": "01450b210e781f8031c221af6548d3e188894ee5c89a08a781fe9e953c1e7641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821869, "uuid": "008cc5da-f21f-4f30-921e-7b00654e3579", "comment": "Malware payload (SnakeKeylogger)", "value": "1a9eaff97736a9f195e96e90b10309be72d2c8e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821869, "uuid": "11528460-65c5-4243-9107-312bc648fd63", "comment": "Malware payload (SnakeKeylogger)", "value": "19f581642e3754adcbdb4448d43778894bec0ac3ef4d3cba29b52a74c3ed40a8e4f6ade8c9931363ce1ac245b30028b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821869, "uuid": "54ae70ca-86bc-4dca-b832-939f9af52750", "value": "T1E5051219BBA2D619C6B50BFAD8A142406B30EE1F410BD7BB705C3DDD2FA73664932532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821869, "uuid": "bf9d5e33-e8c8-4c00-8ee0-03b6b29f1d5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821869, "uuid": "d21a9f34-c8b6-4ddf-9395-8fb3e48588e9", "value": "24576:p0qaOxZz9LZzIe7ZX+MmFCheIcnFvEBXzkCV+jKim:pCOxZz9tXZX+MmFCAIcnF+4CcjKim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821869, "uuid": "a913d743-d6b8-4112-8c33-e40e1510e67c", "value": 863232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821869, "uuid": "aef43bcc-15d2-4b9a-a36d-3101b078fd8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821869, "uuid": "c52419f5-7bb0-4795-9eb0-255a6aa36a25", "value": "Dekont pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef91dbf2-8d75-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644829821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829821, "uuid": "dc37c5e3-d7f3-4eac-b085-586e35ce6d43", "comment": "Malware payload (AgentTesla)", "value": "93dca85b28c182a4be1f48f56faab6f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829821, "uuid": "e19af0de-62dc-4598-88af-8c4680bb45a5", "comment": "Malware payload (AgentTesla)", "value": "01b7ecba4c040bd3c352b2023e1f7f38c2b2ef741f23a91301153f03760d3505", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829821, "uuid": "52589015-5008-4f2f-8621-ef0dae8a64c1", "comment": "Malware payload (AgentTesla)", "value": "bfa259ab204d7ee21371f7f6555a5196def7343d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829821, "uuid": "37024941-4e0d-4c51-bad9-574f64e7e824", "comment": "Malware payload (AgentTesla)", "value": "dec14b533aa0a3b997a78817247637a8b6da1842702ca126576a80042c2cd80c43563adab9198289ea7481229bde99dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829821, "uuid": "78bfb0bb-3b63-4024-aa30-8281394c0419", "value": "T11825020077A66A23C57B0FBFD4E241021770E90A551BE73FA89536BD5C8F3690E7227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829821, "uuid": "536648d4-86b2-4206-8200-f17cb508b16b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829821, "uuid": "e1b8ed7d-f916-4ad9-963a-599d89a9ab2b", "value": "24576:nQPgnNQCRZOmCkRwomR2OWLi6u87eA/tAUjac+E:QPgn6gZOmcYOWxmU7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644829821, "uuid": "5f5f96a3-d7a5-49c1-9800-e564d67df678", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644829821, "uuid": "eedc1fd0-ae1c-4098-a0e1-6449a51a16a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829821, "uuid": "4a272a6d-134d-4aec-bc0d-77ecd3761a69", "value": "93dca85b28c182a4be1f48f56faab6f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aaafaab-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644861864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861864, "uuid": "c4f8277c-4ae5-4c74-bfe5-42dd9fdc1724", "comment": "Malware payload", "value": "5086cb1613eccbf862eebbf840661c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861864, "uuid": "9049a06f-8962-482e-b1ae-10db9a5f870a", "comment": "Malware payload", "value": "01ce496e53ddf9dacd4f7781f7162d20f4dcaf5095a3c42a4325039fe0d146d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861864, "uuid": "04870ec9-aff4-4c68-9c86-a93f87f1335e", "comment": "Malware payload", "value": "841c7ad848df2bd7e7dce2f364f383d6011e8ce9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861864, "uuid": "0603b9a6-3759-4acb-be89-9217b23148c4", "comment": "Malware payload", "value": "e62b511c03860824188f6c572daedb35391636b7b59b92716b73140cffd22414675fc7a4514019dbd3a27770e096d29f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861864, "uuid": "4b9b364f-7866-42ee-89a4-daa4531d0138", "value": "T142E53329B1D1C7ADCFF90D7C9918401C3706ACB9529294D5BF79B0A0294D2B03BF77AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861864, "uuid": "f24d1320-c89a-4ccb-9970-e96e439a278a", "value": "49152:i0PsUoH2JPHOtEvbfmCTTFRTWAea0z07zzlpI5TibdBdpbICAEs6I+p930zB8d9c:dF+cPHOsfmaDh3Y0nE+dxbICAEVI+Pkp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861864, "uuid": "b9ce97c6-3255-4b99-951c-2578696d7564", "value": 3078291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861864, "uuid": "6fd6ada3-decc-49da-87f2-12b2bffd3472", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861864, "uuid": "904d8fe6-895d-4108-99f1-4eeb11174ea6", "value": "5086cb1613eccbf862eebbf840661c68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3ea0ab-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846106, "uuid": "aeac37a0-07b0-4953-9407-7e40eba72495", "comment": "Malware payload (Mirai)", "value": "d4072c6c7405cf61949d820c1158c3aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846106, "uuid": "d9977d7e-1cc9-48b5-8ec1-99d4de28eaa1", "comment": "Malware payload (Mirai)", "value": "023f4e383ac7ee05dc9cedb7a3cc2a679ee34358c73c04f2527316b43e72079a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846106, "uuid": "2899d169-77ea-4105-950a-7c9f1384558a", "comment": "Malware payload (Mirai)", "value": "2a2c66dd6891581a9b01b614b447341e6548104a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846106, "uuid": "d34ac425-4436-4c5e-94aa-1e291fa4321d", "comment": "Malware payload (Mirai)", "value": "419e9b38002018d3bdaf3353b40baeaa2da972c64e34d4b1044c0960f844d6e36586ae798b30c4cc33232e0906957645", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846106, "uuid": "b721cf27-7c33-4995-8f2c-104771bb4da2", "value": "T181932C86E642DAF3C4430BF5129FAA1A0632FD2A4E3B8EA6F71C7DF49B125C43115791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846106, "uuid": "b4e8ee47-f22b-4892-bd5e-8b1b902c856c", "value": "1536:2TEao37JOl3Y9SpgwKWwCwyIZWDq1S3u805hBlFvD+Wshe0QzUzJYQ2Wk:MoAl3YEpjdwyIZWDq1jn5hBlp+WUe0Ql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846106, "uuid": "0376dc7f-db4b-49f0-a742-8437ede8d11c", "value": 91535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846106, "uuid": "e18df149-e2b2-4332-8eb7-45fd391149ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846106, "uuid": "f569dbce-27fc-4dd8-a434-db3368401ea7", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5682abb-8d75-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644829804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829804, "uuid": "b3b6a4c7-14b9-444c-a35b-1232230bd94a", "comment": "Malware payload (Mirai)", "value": "4857fc461fdf493bf0ec6ad9a1f5e7c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829804, "uuid": "d4918450-042e-473a-a09c-22cb7fa11f1a", "comment": "Malware payload (Mirai)", "value": "027b24b20a9a7585c1e6cf2bc5c2c5299d6ab1e3f0d4385e3e7e6c588bec3412", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829804, "uuid": "695adf1a-db31-4083-9d0c-0f8a5cd260c8", "comment": "Malware payload (Mirai)", "value": "1486ea9f2984b2e8cb1af88a63ce471882dafdea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829804, "uuid": "f6239d27-af6d-48c4-ba6c-1e048f7d6f3c", "comment": "Malware payload (Mirai)", "value": "b62ad56892690e6e127e7ba9505e4fdd955495719202cee98ba7c39ef7354c7ae86c35d2cf446ef1ecee6aa2f68e54a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829804, "uuid": "626450d9-a622-47ef-8112-c52fd7529b4e", "value": "T1B073B70A7E329FACFBA9523447F78E11AA5833D527E1C685D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829804, "uuid": "97c16b19-fd95-406d-9588-39bc03e83a15", "value": "1536:3IHb8FMv77EKQHlyBR1Fa6yBm3froxvdeEOPFal:Y78ivnEKMyNFa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644829804, "uuid": "a7402f48-d3a6-4947-bb48-3f048c5013da", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644829804, "uuid": "5ab723fd-d744-47a3-9731-869489ce508e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829804, "uuid": "10ac94e7-72e3-4cdf-a963-7eae214fd928", "value": "4857fc461fdf493bf0ec6ad9a1f5e7c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb7a0f9a-8d9e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644847423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847423, "uuid": "597ec7be-9637-407f-86ee-89ea3d5d4f92", "comment": "Malware payload (AgentTesla)", "value": "b2601f677dfcf787b21f29dacf46e00e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847423, "uuid": "a43f625e-8308-4524-9169-f003bce3e0ac", "comment": "Malware payload (AgentTesla)", "value": "02db2ed6d4c73c4544d4c1033125a2a84387a81101302bd6614cf61f2431534d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847423, "uuid": "1ba92497-697b-4f72-a0e3-e9065e77c39a", "comment": "Malware payload (AgentTesla)", "value": "828ba09ee3884b918584a9a7856a0299288b0d5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847423, "uuid": "c2f72e2d-1490-4ec4-9f36-bf7d12d121e6", "comment": "Malware payload (AgentTesla)", "value": "1fad0d2856324509316d9522119110114e18f41368ace8fbcfb3d1f9add8db3960c56f15e6d51a7035277e17b8622732", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847423, "uuid": "3ec665c8-9545-4cfb-9bd4-69f515df3153", "value": "T1ACA43E1C3A710F62ED2D91305D320AF4BB660B2B72849DD727DB15C88B8EC67DE469D8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847423, "uuid": "21b889df-70c2-404c-a68e-7b85a271c256", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847423, "uuid": "e6c7aad7-f6ec-4660-a196-087935452024", "value": "6144:ypIQPO9BRQy0o9QTr6ZcSsUBAqif/5tpxxsJCSegmcggL201X+8:yiP9Q3APsUOfxSC6/TX+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644847423, "uuid": "aba5aa03-b87c-4156-a0d9-7b974f8aea0c", "value": 482816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644847423, "uuid": "b34d4f08-ec64-4870-9fc0-f79d2a5231eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847423, "uuid": "019899cd-6f58-4727-9c8b-ea2bc1bb1039", "value": "OFSE 2022 0265 Rev 4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f311389c-8d6c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644825961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825961, "uuid": "8946540c-0c47-4d51-af37-9d29bb91450f", "comment": "Malware payload (Loki)", "value": "6ede0998fa67e1942a728274fd6a037f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825961, "uuid": "1b62c798-ae4b-49f8-8ea2-eeee7a73e429", "comment": "Malware payload (Loki)", "value": "03735ed519d86a5d8456393b63d97be01c426c4b441c49efd2fd010c5faf78ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825961, "uuid": "2c5c7820-b3e9-4e92-8747-85064ac21fb7", "comment": "Malware payload (Loki)", "value": "b1fc76abcefea2794731f538e7f87835efa41933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825961, "uuid": "7f97281f-c1d7-4cc7-9f71-5ad1f169a451", "comment": "Malware payload (Loki)", "value": "d9a84db049643dfc7edb5a0ff5a6705306ecf810e0336658f7e846e780a0c21b05060dafa120715845d8f104edbef413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825961, "uuid": "212626c7-a363-48fc-8041-eb1aa2b5a592", "value": "T1F005F101B7ABAB13C5BB0F7BD8A241515770E64A611BD73FA4D136EC5C8B7280E72236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825961, "uuid": "a540f4b3-dcc7-43a3-91a4-6952e303d2b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825961, "uuid": "9009c282-1f05-4270-b156-6fb37e9716d0", "value": "24576:zrhMlnHDaE7oerjvlUsk668P9Ua8bQBMwNi6n:pYjr7TPvlUsk6TX8bQBMwNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644825961, "uuid": "186582d7-77df-4efe-8c75-d0eb031f0b7a", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644825961, "uuid": "cc0154ff-67cc-4f7a-b713-c94de470591f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825961, "uuid": "abbb8623-b4d6-427c-be01-06b96fd5e300", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ca27e7-8d9f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644847571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847571, "uuid": "d785aa15-1c6c-4d35-89fa-f9f8cfcd8686", "comment": "Malware payload (Loki)", "value": "44ae3608fdd6079ce8db58b5e78706d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847571, "uuid": "1dc750bf-a3c1-441b-89c1-31f1ff5c2a0c", "comment": "Malware payload (Loki)", "value": "03c51749fc40014ef7b1ed2b6bca0d543ae1e901ef72c4c38457f7e225d72a65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847571, "uuid": "6862bfe1-98ed-4796-a025-cdb7bc7d117d", "comment": "Malware payload (Loki)", "value": "3b07f3206def9bca85597249d454d88b01206a88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847571, "uuid": "30de20b1-7069-41da-807e-844a2c9ee59f", "comment": "Malware payload (Loki)", "value": "6acd170e23d37036b8ab3a642b7c226e5af16197bcb531d0747f1eac02618a5a309fcd4f3b714a351c8af84cefadb7f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847571, "uuid": "926636c8-2262-4bf4-87c6-c6df48f87d2b", "value": "T169648E40BBA0C03DE1B712F8787683AD652E7DA15B2455CB62D53AEE1A347D0EC7131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847571, "uuid": "2a1724a4-eee7-4f4d-8ac4-c17a74e8e6fa", "value": "318349caf1d96b45a02e10e8be9a2be1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847571, "uuid": "ecebc881-c371-463a-8beb-12fac57065de", "value": "6144:QqCjb3aElY/htEpppn+Fq9Z0G2urzyGS8n2r8fnF:he3vuptEzMq9Z0f38jP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644847571, "uuid": "5782033c-f0eb-4617-ae00-2ff2019396e0", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644847571, "uuid": "0c76c8d8-191e-439f-8117-97e08122c4ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847571, "uuid": "cbf9a580-3857-4dd2-baa3-cf70a0bae598", "value": "22build-12022-02-1414-50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf0b029d-8d87-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644837470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837470, "uuid": "60c34130-255f-4ab8-a21b-9fc3cb414d24", "comment": "Malware payload (Formbook)", "value": "79033e7882fbecfeeac2d1b299e7f204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837470, "uuid": "a0a91904-26dc-4174-b2c6-643207066947", "comment": "Malware payload (Formbook)", "value": "042f30c975b4bd5dea77d4d2427497546cc03f0fd7db1ed8857279ed07180483", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837470, "uuid": "9f0f470c-7833-4fb9-8913-c3c7c1f8b7af", "comment": "Malware payload (Formbook)", "value": "8e3354d5fb20cbfb12f113a33d257c1c3a5422a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837470, "uuid": "c8620965-d950-4d3e-b68d-63f997d583d5", "comment": "Malware payload (Formbook)", "value": "bfe832c3f65aa5aa280af031dea9c2e09fdd1fb7da95cff90047b9dd63fa7e33e961f22094ff41b287d58d0c1a508a38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837470, "uuid": "1cb5206e-2a1b-4a08-bcc0-20455b7dc15d", "value": "T12F8401D2A1A44496ED6747B209778E2912B3FC7ABEF1D10F57AEBABA1B730D20005507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837470, "uuid": "2c9a1ef4-442a-4df3-bdb5-af90b1134937", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837470, "uuid": "51f3b730-bf4d-4e7b-853f-cb6b4bf0f264", "value": "6144:lw5HwmpnTqzkxg9pU1tIBIcP0SEVuDgD/CdRlMCbw7L0:o3pTI2g9CiRPUVPD/CdjMCb00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644837470, "uuid": "c4f95653-c782-4215-a367-342ad20342c7", "value": 406020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644837470, "uuid": "fb79bc46-9c29-4733-868f-e610e1b5ae1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837470, "uuid": "0ec07549-f1ae-40bb-a149-fb75a7d70761", "value": "PMT402200318.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78017f42-8d31-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644800414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800414, "uuid": "d05c2179-9882-4d2b-934a-33ed65afcda3", "comment": "Malware payload (Heodo)", "value": "d094f81230cb89815e5de07916f4f50d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800414, "uuid": "25396346-e3e5-43cc-b19c-a79fc0ba3872", "comment": "Malware payload (Heodo)", "value": "0504efbd8716d561d5409deb3e2b4510216bbde1998c01b527435cabde0bbc96", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800414, "uuid": "34e9ccc8-5a65-45bd-b28a-48ba2130b0ec", "comment": "Malware payload (Heodo)", "value": "0d0749fe1659ce7b1f1c1bf97cfd0c0e8e3c1993", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800414, "uuid": "a5262a31-55d2-48c8-af34-6c92bde69b21", "comment": "Malware payload (Heodo)", "value": "d0094c5a0af1a636e8592280629eb2abd9c08ba42d4454a0e6180f3b88350b375593023935715cbfac532bdfd1057e08", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644800414, "uuid": "1d7d038b-b2f5-4949-9873-07eb65c4b63b", "value": "T129D38D6ABA48CA0BD94953314EE7CBF67336BC819F5297473295B72E1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644800414, "uuid": "dc1276dc-b285-4cff-a0bf-73624743bf3f", "value": "3072:tcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3X:tcKoSsxzNDZLDZjlbR868O8KlVH3skeC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644800414, "uuid": "5c57e351-da2c-418f-a17d-5e51994dca13", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644800414, "uuid": "0041c939-6470-436a-971c-14cc4bd20122", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644800414, "uuid": "37287aa6-de35-4b80-a9b0-b41a522a2128", "value": "tmp2i71zdeo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "672c8295-8de3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644876836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876836, "uuid": "a44a4372-e7df-4c33-b8e8-b159a01c4d58", "comment": "Malware payload", "value": "9f094ac8d4dff1fbaa072946da71ee12", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876836, "uuid": "856ed7f6-a2e4-483a-b21f-6644eb2c66e7", "comment": "Malware payload", "value": "050d1e2d231518eaff1615e7ef68e8f617aaf15965799a26aecf104f8802c14e", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876836, "uuid": "54663967-560a-4bc2-bf22-0733f4f9fcd0", "comment": "Malware payload", "value": "32c24aced0e2a2bf20efe5dfef2212239626fb7f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876836, "uuid": "a8f77aaf-3296-408f-966e-134d79caefa9", "comment": "Malware payload", "value": "99f342cc9981e574d42ba00c55c754be78cd28e4e460f0a4224eb80e899ab7bd12370a11f81b1f306054559abe8abcbb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876836, "uuid": "3ded6111-aaba-4288-af28-6184c480b6cf", "value": "T1444402564900D722FD09AE3DE89659CEBE34186F7011642F4C65AB83CBFF5431FE9226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876836, "uuid": "58bb7580-c33f-4758-bc2d-0b5cc633d09a", "value": "3072:xwGEpaPSSOtJOM8NpvCEbOQCkICXgNeyD7+ndIhZKF2UxTp+SZFM60EpPtuq0hG:xobO0e2k7Xg4yD7HZexUERpPt3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644876836, "uuid": "63dd40f0-9f2d-4b47-9278-b899753af2b6", "value": 264749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644876836, "uuid": "816e7709-a39b-4b1c-84a6-bcb3275245a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876836, "uuid": "09d32d48-7dbd-4c5f-b934-0de525e6e2f8", "value": "FH-1886410462.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "714fb5d6-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822737, "uuid": "7aa948e0-13ab-4242-bf22-845c217af01c", "comment": "Malware payload (Formbook)", "value": "839148c3b8534ab9c99be0976001b46a", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822737, "uuid": "33bdbafa-07e2-4b3a-a467-d7f693725057", "comment": "Malware payload (Formbook)", "value": "05a8b223ebaf0e223aeb9d8cbae7f4bbe68350b50691f39091f68e7a0e3450b8", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822737, "uuid": "375b39ae-7ad8-46bf-8689-463f0eaff0f1", "comment": "Malware payload (Formbook)", "value": "adc0ad3eb2fd2e5bcd52f235028c8a91e74f1853", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822737, "uuid": "66a817fc-0ec3-4286-a135-33c9f45480ad", "comment": "Malware payload (Formbook)", "value": "1c582931592b10cc82ade261d2b059ab576f88d31d58c9b7704816b947899f2bded7528cf8052d9244c930b3cb2a0677", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822737, "uuid": "014f5e89-3a18-4473-991f-0c9020b24c0d", "value": "T192541226B0D185E3E8B7993229B2777766B9B30627A9904F2FE01F7B3C31992C535107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822737, "uuid": "350d3f67-e4b5-46aa-9b9e-8a7da6a8cdd7", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822737, "uuid": "52afbef4-6c89-4767-ada6-ec3984730f2f", "value": "6144:owZDf1zZYMoOCn4xGQrv3L+rXmxZh4y1RZ/u6OY6BIg:h1ZJoOCnhYKrXmxZhj1RNp96BJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822737, "uuid": "eab18da5-55c4-4f46-b16c-a574ce6fea22", "value": 296113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822737, "uuid": "81f191c2-57a9-42e6-949f-270c428e7f0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822737, "uuid": "bfe0fe4b-7724-4f4d-88aa-932e7a5992d1", "value": "Zahlung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963f19a9-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644822799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822799, "uuid": "ca316ac6-6646-4563-ada0-244753a281e9", "comment": "Malware payload", "value": "0c326ad3ee910df1c4cda95844c8af68", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822799, "uuid": "8b42f3d6-0400-40df-9e13-89bca9290b14", "comment": "Malware payload", "value": "05cf3a5a236ef847503fdc9bcb14ec4302a1f317e43639d7f012a2b8f6f68426", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822799, "uuid": "bb9db130-0768-4b4a-8d4a-042f1ef7019e", "comment": "Malware payload", "value": "24471551bf75b3f805adc41d358fd5928241e2fc", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822799, "uuid": "c812be9c-0d39-402c-b02a-2f8a88b0326c", "comment": "Malware payload", "value": "e13b52d3c0e37909a50ee5b95cdc5c2b68b99171ef45f6488072e0c8a63d58e69cb6c1c2cd50147a07c3646aa3a60024", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822799, "uuid": "be1ddc2c-bb0a-458c-b052-8549788f0c5a", "value": "T1A0A31294367E667FE28F8D38845A330BEB910545A9067CE64DA9B14F785C8E30302F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822799, "uuid": "80c547c4-8ee4-4a2e-a00d-90c22a1ec23c", "value": "3072:qJOKZu86S3Roy9uFwZlsaFPOHYonHBxqPZB4U:qsYuS/IwZltFPgYonHBxqPZGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822799, "uuid": "8da0d692-d845-4b57-bc16-41d378d746af", "value": 104602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822799, "uuid": "ecd18a97-21d3-487b-b606-f92209050ed8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822799, "uuid": "e7bb0b1f-0510-4b49-a634-8b71bbcf59e1", "value": "7705221205.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae33cbd-8d85-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644836551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836551, "uuid": "3873134d-abe5-4fcf-8224-3445a0aa4bca", "comment": "Malware payload (GuLoader)", "value": "d9c934512268b08f37fe7cf90a5b2d46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836551, "uuid": "0f560b02-ee85-4d68-a2aa-6ce2f829486d", "comment": "Malware payload (GuLoader)", "value": "05d4b6fb977b10ac13de1711ff83419415b730c99fc463d7159111418b64b702", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836551, "uuid": "3f76d940-d28d-4f19-8ec7-68d9d3fcd599", "comment": "Malware payload (GuLoader)", "value": "d809b236d5261fa59011035140c6caf84ef6e4b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836551, "uuid": "81250b62-b4bb-4c04-9ea7-0b534a8120f5", "comment": "Malware payload (GuLoader)", "value": "541a3bd2a9d5ee6736ef5a6e63894127d16dd6ef1ef667369771ff320b18efd61e00d3a992226ef81c4525afec262277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836551, "uuid": "f8697729-ec56-4699-b633-9afb7e8898d6", "value": "T11314F222BBD08E53D072423918269E768FBAD9351951DF4713127F893FF7241DA2E236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836551, "uuid": "2a8e3856-08df-4fde-b8e4-61ea7f7f74ca", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836551, "uuid": "c5035440-af0e-410d-897d-9a515ccc3800", "value": "3072:/bG7N2kDTHUpouuC2HXrBUPblI6Ay6MBFmi38360yVy0wAvTUn7LnZGQiIqqb5bP:/bE/HUGfXraO6ARE709AAnZMIqqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644836551, "uuid": "f325e3dc-bf50-4277-8999-add4cc68da26", "value": 196312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644836551, "uuid": "94d6ad0b-791c-4a42-b7b0-0ad611ed8909", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836551, "uuid": "6c418a9f-1eb9-4a52-b627-29bb70955bc1", "value": "SecuriteInfo.com.W32.AIDetect.malware2.9999.29318", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fcbeb90-8d8f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644840612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840612, "uuid": "8889f2ee-a5e7-42ea-819e-f121895102f1", "comment": "Malware payload", "value": "18a1d5f50d6726cd73a27ac113f22866", "object_relation": "md5", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840612, "uuid": "e6dbc5b5-5de4-41bc-beb0-2b7992093162", "comment": "Malware payload", "value": "05d8bc12d167cf6d1f56bfa8060b10f92c5688f960a2a34e2983be4739e60808", "object_relation": "sha256", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840612, "uuid": "244114d9-460d-47da-957d-b49b07f57e57", "comment": "Malware payload", "value": "84fb28b36973c34d49c7ee17a0823127ce707121", "object_relation": "sha1", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840612, "uuid": "140d7b61-fcf7-4262-98e8-be2f70778671", "comment": "Malware payload", "value": "3c39feeed81abedf2701d99965e7f0e26951629c62adcd9b67ea3c33c1213a5f58a12b640ff336717ec4152193d53349", "object_relation": "sha3-384", "Tag": [ { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840612, "uuid": "76da604f-a77b-43c4-9e7f-5d43ceb48d11", "value": "T1E1530116232B555B01EB4778F8C4E4A79281D9F48F509216B06C4C2A7F28EEDD0A6FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840612, "uuid": "7fefa959-eb52-4af8-ab2a-14d52af56659", "value": "1536:ELRqyInDBClgcBEtSK0u4VXBj5rcWJihXhBf7:EL4ymB3cB0Lz4Pj36z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644840612, "uuid": "893d22a5-7629-49c5-a669-1c3776d5478d", "value": 62544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644840612, "uuid": "190b9cfe-a4f4-487f-907f-b3679507b6b3", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840612, "uuid": "927ba57e-e607-46a0-994a-346df39ce0a3", "value": "05d8bc12d167cf6d1f56bfa8060b10f92c5688f960a2a34e2983be4739e60808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6edeaa6a-8db8-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1644858381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858381, "uuid": "1ff59629-83e9-4074-83fc-43a9041da90b", "comment": "Malware payload (NetWire)", "value": "4a44c4c20d9454950da4811566de3ed3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858381, "uuid": "5f82648a-9b41-4d25-a52c-5947817d9f16", "comment": "Malware payload (NetWire)", "value": "060231c7729f65f39c1cc05fbe097d9c872dabd9391cc20eaf60c8d3c3cb0b5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858381, "uuid": "3c6034dd-5a53-413d-bc2e-3c0038b47004", "comment": "Malware payload (NetWire)", "value": "fb375153a206160152ba0d184fab55861532731e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858381, "uuid": "7bd5e0d8-6788-4b5f-8831-d073a0f23f8d", "comment": "Malware payload (NetWire)", "value": "2d4c573f2e28ce371949d3aa61db2e252b012246f68f420543b180a5bc4383acf2d31606d08d6c088fa66dd204a68de3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858381, "uuid": "27ebbd12-13f6-40ac-8d41-2f84f9893839", "value": "T15A15093EFBCBFAA4D01344B13A2592AEC5AA343518098456FF0CF933BC99BD5519E90D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858381, "uuid": "c0142c4e-92b9-4db1-b89b-52a68b44d549", "value": "fee1c088a65223ae580889fd50c484c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858381, "uuid": "9281988a-2ebd-467d-b24b-3e74328949d3", "value": "12288:4UHupvCDbZPNiUd1bZaIyGvZqOiLgC3fwbXKNnfHfWfD7/wB20W7eEcoEiFcejVp:fuZCRl1XbZaQjiLgCvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644858381, "uuid": "89f75e4a-e798-4afd-b13b-3cf24850200f", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644858381, "uuid": "236e6232-5668-4940-8ea4-fd01f60d59a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858381, "uuid": "c0763360-daf3-4eb2-8631-b5a5e9f7414a", "value": "060231C7729F65F39C1CC05FBE097D9C872DABD9391CC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d20124-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644854420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854420, "uuid": "5ee0b388-a9f6-4fe9-9f7b-100c66ffc4dd", "comment": "Malware payload (AgentTesla)", "value": "67c99189a09a9fea0268a5d36809a90f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854420, "uuid": "36496b5c-b298-4bf3-a3a1-55b949390792", "comment": "Malware payload (AgentTesla)", "value": "076f4d63dfe0a6da12ac7c24ad1820e4f721acacdbb34b7adb2ad3f2d05cca2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854420, "uuid": "1e537f13-14a2-4172-8b6c-c3738db2d679", "comment": "Malware payload (AgentTesla)", "value": "711fcbdaecb30fa645e31c9068866cf75cd39f83", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854420, "uuid": "c2c04db9-9d99-43ed-915e-19d199e1b891", "comment": "Malware payload (AgentTesla)", "value": "5d6c553028f595c745a0a1302e5f8dbabdb229d262c8c1508487116773fe7497a2092ca562c300dd9aabb9ce9e4fcafd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854420, "uuid": "fac703a1-a197-412f-b1b5-6e1b1a89ee39", "value": "T19C35D04D7761B28FC863C9768D645C60AB60A96A530F8373B05B2ADDAF0E157CF314B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854420, "uuid": "fec01225-56bf-48e6-bb67-2009ad350edf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854420, "uuid": "b03649f4-246f-4b1d-987b-66b1b95c5b6e", "value": "24576:MkJNxLZA+cp1heFGMj0nZpCLl7n1Beqy7ajugI:j3tA+q+GOUZ4vNy7aygI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854420, "uuid": "01fd117b-926e-4038-91b1-efe2eedb0d63", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854420, "uuid": "2de583fd-c05b-40e0-962c-c2fc3c5ed456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854420, "uuid": "b776b506-945a-45dd-bfbb-c27e870dbc97", "value": "Draft HBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e89f1c-8db7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644858094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858094, "uuid": "31053cf1-8238-4553-9857-62e5a9d78be2", "comment": "Malware payload", "value": "d612c78a346f55e794c7b0f1a6f402ba", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858094, "uuid": "fc8f4316-ab3f-4299-8520-1ebc94e0973a", "comment": "Malware payload", "value": "078346655a64d1f53b34713bae824b732dea6e41478e3978441fa875d7c912d4", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858094, "uuid": "77a495d6-2d0f-4cc5-ac84-a5e8daa301d6", "comment": "Malware payload", "value": "0a1085b32683049c131dafad6bb832aace2ec152", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858094, "uuid": "d26993a8-bb20-46aa-8c5c-bc60d952cf46", "comment": "Malware payload", "value": "75c64c40ab939a8c5c4c26de80ffe637ae609fe87fc840052bb6aece5166e122703ed9f5819ae4ddb09cddc0edf5b373", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858094, "uuid": "57927c6f-dd07-47fa-9921-96bcfa3586bf", "value": "T19985331D68343851FB2E47F812106413E4E7FA69E8369E83D4205FFAD263189BBC687D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858094, "uuid": "094bc016-34b2-4ac5-9f77-165ca5b94ff2", "value": "24576:DZC4HVxlLOofAzr0JB8NvFzxPWk1KMbd6ZKsdcDivDzsQJGGoQf10LrH+rC:V/nlszqYvFskkId6gDirzsQuy10Lym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644858094, "uuid": "fae8df04-e2f4-41d8-8a76-c29b75487da3", "value": 1844728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644858094, "uuid": "f503041d-554c-4cd0-9a6b-84b12d8732d3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858094, "uuid": "37c8a757-fe93-4e1b-a9a8-778055a3b768", "value": "y2n19ck4_Receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb471a0d-8dab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644852926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852926, "uuid": "61a714d6-f387-49e3-82bd-0f33ced66f95", "comment": "Malware payload", "value": "e04b632a88ea36b96c2406d1df5e83a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852926, "uuid": "7e82246e-f8ca-4c36-910e-1ce4d1f12577", "comment": "Malware payload", "value": "07963b87269781169a923b2dd8188374e7b04cfe517f76b9f76e1541ad50e8c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852926, "uuid": "a36e365e-065f-4dbe-8962-816334cfeb7d", "comment": "Malware payload", "value": "1e6643d756c5530abc0ee7cda1b263c308fbdf07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852926, "uuid": "320d0703-74a0-4c21-8b81-f269df7e67fa", "comment": "Malware payload", "value": "d113f984b04acb179e15c3be51d5a8ff97f45c5419ac7d07ca27dfbfe9c0de1838bc12f052578fe3eb1d83f1b6836658", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852926, "uuid": "8640efcb-73ce-450d-a728-025f63fa802f", "value": "T1EA03F14453D03833DDB9DD76B2F6C551F2FA87E68D8531A249108A687EE396E3BB0203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852926, "uuid": "aa7b17de-ae88-4297-bf9c-75ac95f57495", "value": "768://NTAzDZ7i0sw38zineCaHOAIW1Nh7FdUF1/AHwPJm7/3UuMirUPmcTp:/FTaZm0XCCOOAh1N5FdUE+m7SPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852926, "uuid": "6ccf015c-aa75-421d-8ac1-b6e3544ac4f9", "value": 41196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852926, "uuid": "5141163e-6672-4fd0-bbe4-606ec376287b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852926, "uuid": "437c9008-01ad-4980-8ba1-81e20414476f", "value": "e04b632a88ea36b96c2406d1df5e83a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c9afd8-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1644855056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855056, "uuid": "e13e1436-6a63-444a-9241-358bb8ea6f5e", "comment": "Malware payload (Smoke Loader)", "value": "21f60a6eb01232b2b632119d0e780a64", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855056, "uuid": "b8882513-3d2e-4e91-99ad-6228d707dc5a", "comment": "Malware payload (Smoke Loader)", "value": "07cfb6b285785e234989d0a0d94945a518b31af4a1fe8a37238fb61910a62bdc", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855056, "uuid": "c74ff733-7139-48f3-a4be-c20cc048a382", "comment": "Malware payload (Smoke Loader)", "value": "cb4eac4a578c291cab95c80c489c496d19c3bc31", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855056, "uuid": "af336bdc-b6a2-4a65-a5d8-3c5d4ff81557", "comment": "Malware payload (Smoke Loader)", "value": "7b01736651b259dfe954c59b940960b6dde014c91b099712d6e5292cdeb5495c2368e32c4c76e99764feaf54e98d4d42", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855056, "uuid": "59c1c24f-9600-4e3f-b613-a57c17978e89", "value": "T1E005CE03B7AE9B2EC66A0E76B4B182315670DF075016DB3AB4D0FEAC0CA635D1A711F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855056, "uuid": "296b4491-07fb-40b7-bf0b-5a54f48ce7cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855056, "uuid": "f6fe4534-0a83-4d9f-80f5-98bb8ad61134", "value": "12288:CJRYS0X6XwUDGMHdOTji/XUC0K3QMZCYTSJfBcN6Cx3wakBsP:cRYCXwwGkEXKUC0K3QZhB63MA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855056, "uuid": "88e10b1d-9e70-4090-a1c3-c7c8250df5f8", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855056, "uuid": "049f2843-1a00-4537-a912-ca6c312106fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855056, "uuid": "b857f570-1b99-43b8-bbf4-c14f58df715e", "value": "shipment_detail_DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bf39bf-8d79-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644831494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831494, "uuid": "f87f4a28-56fc-4b3a-bd56-d36d4f46c672", "comment": "Malware payload", "value": "933e6a7544a64debb8d6a321b450e7b8", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831494, "uuid": "4ef34cf1-8379-4dce-a0da-484d8057d5c7", "comment": "Malware payload", "value": "09e1d0a15b758c7377f398c938b8a6530cf3f13025266494e7dc593c96cde90a", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831494, "uuid": "8ae7b8fa-966a-4876-bd59-8fec1960a952", "comment": "Malware payload", "value": "777ac544670b0d6fea48d69b4f2cce8004e8b991", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831494, "uuid": "1ef7a478-e5ae-4f0e-a549-fb8261016c31", "comment": "Malware payload", "value": "080dcdf325af29779a0c95e4d6c95b67fb1e08b50c838bf17b6938f9d24bd6612899227d6030dff67734c6dd5bc1ef69", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831494, "uuid": "d129fb77-582a-4161-82ce-91e200fed7d2", "value": "T15013BF1CC1037416C677B93ED83D98E128A78D075115498FD1EA798F07A8EEA3B4EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831494, "uuid": "7bcc0ae3-d6d3-4cf6-afbe-3777f86ac918", "value": "768:0aRD4S0JS00SneSnjS0yS03S0IMS0bS02SPfX8J/BKyFGksK+JjfQTmlW3xdS1A0:0oWQLC3cAJ/1/K8NytsRA4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644831494, "uuid": "31f9cc04-5bfe-4c15-8763-220103abdb94", "value": 43575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644831494, "uuid": "4c157c36-6391-4210-a8b8-2e6c942a17bd", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831494, "uuid": "4caf7c16-2346-44f2-a113-dc84a58f6e68", "value": "PO.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c634af-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644823011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823011, "uuid": "4d5fc7ec-8df4-4a59-9f88-a6885a6c1de1", "comment": "Malware payload (Formbook)", "value": "48651544b7fb391d678ee448c67ce81a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823011, "uuid": "ade7c452-4d4f-43e3-9dfe-a8ac7f1da163", "comment": "Malware payload (Formbook)", "value": "0a4ebd7a3922a03ec0c6db580671714e2318e997af1f6613ede7471d4d81f0ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823011, "uuid": "deeac482-0ec3-435f-b50e-3d3e9bb87782", "comment": "Malware payload (Formbook)", "value": "121225c8d8ff1acfb30c224bc6b083ddd12a165e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823011, "uuid": "dc17c870-62be-458c-a1f7-5e428429cf22", "comment": "Malware payload (Formbook)", "value": "abcc23ea359ebd8e4a606883ce896b388c56ceaf944525b9e1b89dd7d62cb711202bb0fee1d67644c2dfcc564ded837f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823011, "uuid": "639ee4a9-099f-4e49-9e38-1ddedf098bf6", "value": "T11C840123FD071416EA040A39A6F3B7162774AB66CAD3C50799952BBE0C0B735FD426EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823011, "uuid": "0065871e-5fc5-45f7-8e0b-30ddbdbffcc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823011, "uuid": "6500c6a0-b5bb-4794-b835-2e15cdfc0b6b", "value": "6144:vveSUgh06pCoIDxJr3ylrXZDtxvHt8ulMwN1Lxj11AIxoRTPBlWsbhLW:vvhpuuVWMnLxriPQsbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823011, "uuid": "81ed9e7c-3587-408b-860d-d8d7e228c8e6", "value": 390144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823011, "uuid": "f43b2a0a-2d00-4549-9fcb-1405ebc84333", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823011, "uuid": "5facea9b-a4a4-4690-8c7c-399407bf3ede", "value": "48651544b7fb391d678ee448c67ce81a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce206ff6-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644822463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822463, "uuid": "62feb5c1-2e37-4e3c-89a0-03b43015c8c3", "comment": "Malware payload (Loki)", "value": "bb3e685e44ac0e7acf0d74412864b35b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822463, "uuid": "b50c76d4-f496-4f7a-96d1-990b5e79a274", "comment": "Malware payload (Loki)", "value": "0ae2fb6b2972fb0008e662322729a712ba9456cad88713ca44732968aa1fb0e7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822463, "uuid": "857e83a0-003c-4eea-a2ca-ca483d7ec180", "comment": "Malware payload (Loki)", "value": "159a4395eb97fe3da814627c424834bf6ec69bfb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822463, "uuid": "e634a8e5-8495-4bf8-b047-64e7318d45c2", "comment": "Malware payload (Loki)", "value": "07283e47209555671141e0f17ccf4a4e479e653d20f2d792454fafd863210d75df257aec3f8ae50b1cbb5c0c0bac78ab", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822463, "uuid": "3fc0845a-0601-4656-8109-a58b695a30b7", "value": "T1D51412596BE1746FFA9B6A390E1FAE2C940ADC3D1DE8875B8D16336913B040C085D6F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822463, "uuid": "4185d737-9517-4a75-99e1-ebc321477d39", "value": "3072:wEawdO9bGNqbDkmiWSb/VaVfUA1T+XXaNkgC5nXbN5k8WN:IwdO9bqqbYmbW/VKUAF+XKygClGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822463, "uuid": "76903e80-871c-4df2-a471-65a1e32afe85", "value": 191608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822463, "uuid": "da58af6c-c2d9-4452-bd11-be5ecca26286", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822463, "uuid": "91ff4cc2-e9ac-45eb-afbb-0157e8448c31", "value": "scanned copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29b62cb-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845207, "uuid": "454872b6-31de-4a34-877b-e4d804326b24", "comment": "Malware payload (Gafgyt)", "value": "45bc01c52c983ac177e19d93d11c0eca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845207, "uuid": "6d0420f7-2f8f-4b0d-911b-eede4f1258a0", "comment": "Malware payload (Gafgyt)", "value": "0b476ab985d64e5b3b80aa9f30ec971dafc96e45e6f69febe9e28fec36da31ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845207, "uuid": "b6c2fcfb-fc27-4f04-9772-2d4db7e5d35b", "comment": "Malware payload (Gafgyt)", "value": "d4538648e04008caa83064fa4a09ffe1d038a2b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845207, "uuid": "e611a957-6e18-4e63-a16e-40af569e9abe", "comment": "Malware payload (Gafgyt)", "value": "e9faf7bed530346b88c62d359962d0ef931abedcb8d401ca72f19fad9cd84305106dc9fce9ee09df58324cb20dce41da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845207, "uuid": "edb7428a-09ca-44be-99f6-e19790b231f6", "value": "T186C2F831BD5E69B8D07C04F8244332241AE68329979973D3E0DE052EEFE0A186D7BF91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845207, "uuid": "246484ac-44f8-412d-bcef-ee009c3524e9", "value": "384:rjD6+j+wIaeVYMGUJp9Upt/Xjk5bmMsWAkb:rCzwIFKMGxvvMZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845207, "uuid": "953649f0-d3da-4d41-abbd-dc0e0a061b68", "value": 26576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845207, "uuid": "c1d9c04a-d077-45b1-935e-f8a31f29e85d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845207, "uuid": "431942cc-80a4-463b-a852-c9b32154ce77", "value": "pop.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2ca11a-8da0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644848233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848233, "uuid": "44bf01ba-8ac4-4b24-b88d-3db8c4de0f1a", "comment": "Malware payload", "value": "d2078e9b3008522adae7876d4086162f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848233, "uuid": "912f45d5-01c2-4b42-9323-fbbd14fb59c6", "comment": "Malware payload", "value": "0bd7846422b31c85b3828c45257233f0264c2867690fe884be749d0c776858c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848233, "uuid": "96b35e04-dcc8-4324-ba0f-e2a5b63cc444", "comment": "Malware payload", "value": "6812deb5be637d2cfba99ca30fca66995fde0b8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848233, "uuid": "8816c333-6e2e-4048-967a-f8a4b9a0804d", "comment": "Malware payload", "value": "7b24c749f4b25890448f2d1e5ef61292e47fa8043dc36f7ae238e49a9f25787862864a2b91fe6d053ee812e8aabef4d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848233, "uuid": "bec0f48a-7a46-45a7-ab6e-1cc572955af7", "value": "T1B315010177EA9B13C17A0F7BD4B682116771E94A5157E73FA8E432BC0C8B3591E3227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848233, "uuid": "10b5cd92-2f9a-4310-9323-6ffcc45ce141", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848233, "uuid": "f3779ee0-f556-4863-b569-ccd195610f1a", "value": "24576:ZFl0/AX9st+fHdVgobH81qj5Qjo5Ghj5grumQzuUZZe:Zd9lfUZ45BSNnmQzTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644848233, "uuid": "19cc4c88-6cb1-42db-b9b5-54c946cb9307", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644848233, "uuid": "d91bdeb7-b4f2-4be7-9ae0-5eeba12464fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848233, "uuid": "7c144cfb-c744-4cca-8bde-8b31264be25b", "value": "1WomspVz9503kU6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd43c08-8d6f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644827184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827184, "uuid": "f59bfa33-db00-4b7d-9617-2dbd6b3f830f", "comment": "Malware payload (Loki)", "value": "0834c215bb6f3b709f3b85f13f86a584", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827184, "uuid": "ad38281b-e28e-42ec-8b6a-be2d4cd61d8f", "comment": "Malware payload (Loki)", "value": "0c0e718359a6545defeab0907b962fe5bb184e43628edafc02037e2e9dc57b6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827184, "uuid": "2afbff61-08f6-40f9-b2ca-ef8b98b3e4e6", "comment": "Malware payload (Loki)", "value": "9f4a662dd99d8456da6e1b9c55782952a12986bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827184, "uuid": "efd53c60-2bc1-4189-bd84-0b35150eebab", "comment": "Malware payload (Loki)", "value": "1bf1c8997348899d9f39993e113f1a047730c97f2fbf9c65a961905e5d593fea62d4c54b436f2ebb739c33832aad8d78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827184, "uuid": "743dc031-3a9a-4a0b-87a9-e14f5a77059a", "value": "T11105F101B7E76A23C57B0FBBE4E2421193B0E91A6107D77BA4D536EC5C8B3684E71236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827184, "uuid": "cdfe0192-6a95-4216-a453-82916695fe40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827184, "uuid": "585d78cb-a52f-467f-857c-21cf8f3d2c44", "value": "12288:b29IXbfNjuXavHTQL/Mt979m501Aeg/v1bEd0PRbejilL4JxoQmWlak/X:b2yfNjkavMTON9FAPv3NzlL4JxGWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644827184, "uuid": "dc1fbf6e-371d-4974-8a5b-d07598c3a27f", "value": 845824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644827184, "uuid": "56652e84-73a2-4609-b2ac-a89c0b3decb7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827184, "uuid": "72a7db64-3ad8-49a9-b4a5-702d23dbb5b6", "value": "SI_DRAFT_SCAN_PO346314_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc74601e-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845680, "uuid": "a3734d8f-2f4a-4496-94f4-89dedbee8215", "comment": "Malware payload (Gafgyt)", "value": "79829d27d99833aff4b2a3fbf6dcf9cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845680, "uuid": "8a09e115-9b16-4605-b8f7-4f5a1247ebe2", "comment": "Malware payload (Gafgyt)", "value": "0c3d223dfbe40f7be6c20710130a254b8a67a0a1ef0792367e9107308e3f9001", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845680, "uuid": "5f326142-7ac2-4ec5-85e5-a589e9a98cd3", "comment": "Malware payload (Gafgyt)", "value": "5fac52dfea512aaf05a90aa945e5b5f21eb66f11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845680, "uuid": "b672dfdc-af79-4e71-95f2-6afeef06bb8e", "comment": "Malware payload (Gafgyt)", "value": "2a8023089ca6562e6e24aa43e4e2352a6e808b15217c5bd64d42f0ca39cca300146032cfe0dcda677d8e6759e353ffef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845680, "uuid": "59cd0444-1782-42aa-8e2c-e54da6ce9f26", "value": "T104B31905D5508757C2D227BAFB9F829D33232B64979B33125A247FB82BC2B9D1E39121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845680, "uuid": "6f77aaf7-e5e5-4286-8b1a-9e4f41580c86", "value": "3072:yQOFSa5uOgXkY3MeYCkE2HLFXLmsQ+1gX7ye:tQSa5uOgYCkE2HBLmsQ+127ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845680, "uuid": "4b30519d-0ee2-458f-99d7-9fa248dfd696", "value": 115975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845680, "uuid": "3a2e0363-4d55-444d-be61-08107b3f87a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845680, "uuid": "78ff7cc1-d193-43be-8f19-033b5e288e25", "value": "qbot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133a20d2-8d87-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644837182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837182, "uuid": "c513d5fb-2fac-4a38-a863-e895c00c60cc", "comment": "Malware payload (Quakbot)", "value": "9cbf924257cdba34b24097f3ec82dd1f", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837182, "uuid": "227867f8-4f04-475d-a5c7-b4f58552d3d3", "comment": "Malware payload (Quakbot)", "value": "0cafd8010a738e305ab12f7c4bedd28bc1bcef37b7d5d1b075a303f7e0eed00b", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837182, "uuid": "647754f5-b8a3-4a01-a2c3-4acd04e8149f", "comment": "Malware payload (Quakbot)", "value": "340aa0da92817337d518693214a7181f94727955", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837182, "uuid": "e8c33954-f623-4555-9fc6-6701b3436bad", "comment": "Malware payload (Quakbot)", "value": "8ae6fb4d3f36a11fefb702dc931c3d473eb1bb3af26054f5ae521d3ac6b3e4d0bce16e0b46a4be285e9524a96a5d42cd", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837182, "uuid": "9ca71bd3-3db8-47fd-aa2c-f3ddf807a1d4", "value": "T12634029FF2CC691EC39FB53A827958AB5B85441FCFD2202E128577811D7857B0E4EA0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837182, "uuid": "e05c336d-3ef1-46ad-a75a-745b957313ca", "value": "6144:7bT98S2VO5qcLLQ6014NGa1sWZcMIFtspIIK:HqS2k5TLc601RAcJFpIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644837182, "uuid": "2021cc9f-cf43-469c-9b53-6f2b4cb9fe93", "value": 234993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644837182, "uuid": "09abfea4-f0e8-4cb8-9c7a-8185d8249217", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837182, "uuid": "ea952f2c-eb60-4bd4-bc54-196204e304e0", "value": "PH-1625965191.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646cca8a-8db9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644858793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858793, "uuid": "875a6ac1-129e-4c79-ad31-d2082438a0d4", "comment": "Malware payload (AgentTesla)", "value": "9fa8dce947a52303100c6ee877485dd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858793, "uuid": "273f7a49-76db-40c7-8f15-d415c8e8c632", "comment": "Malware payload (AgentTesla)", "value": "0d2f5a5790325e621487a38d4de576bf2e959c6b261b430ecf793851853d4dfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858793, "uuid": "20f19a50-010e-4bc8-917f-fb019c39bbf2", "comment": "Malware payload (AgentTesla)", "value": "6803c3eb89eb05f197d84af697884b1460a7ca9e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858793, "uuid": "2bfb04e9-bc89-430f-b214-795a8aec258e", "comment": "Malware payload (AgentTesla)", "value": "51fbdbca11b1a4e2efc6edb2eec87fe38f5db28af2a1af63dac020f2e8d44d67e276381536e98f44e717dbc3e27ceb22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858793, "uuid": "6514139e-2679-4718-9b33-cbf89c7a8700", "value": "T1FDC4499C71A231FEC85BC4BBE9A85C68AF64F87B830B9297501311BD995C997CF140B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858793, "uuid": "3c77d382-2988-48e7-a489-f8fdc57dc65c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858793, "uuid": "7b57a1e7-49e4-4a7a-9037-93666d6f31cd", "value": "12288:YLWcUUCY6MlFgxvjx7I70A2yLIX00PjUlnMXNlTWpvwT31xRAuB1QXAD3GasV:YqrUCoqVU772yLIX0EjUlnws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644858793, "uuid": "9babc123-b699-460a-bc9d-474bf13adb2d", "value": 551424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644858793, "uuid": "4e648a36-8954-4704-b2b1-900e71217ad2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858793, "uuid": "7c7e4df0-5728-499a-87b7-fd64dba6c566", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdcfbb7-8d7d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644833170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833170, "uuid": "44e4abb5-1e15-48c2-a65d-32ad454b5f5b", "comment": "Malware payload", "value": "a16fb49dd9567df8377a415162ced4f6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833170, "uuid": "5beaf0e3-4979-483d-a4c4-ec8a6cff0210", "comment": "Malware payload", "value": "102922875f9fd767c6dd985c2f54baaba13e0420afbc0a42d45d5e80e3aca2b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833170, "uuid": "a7a38e75-7d44-413c-97fa-299f5ba2971e", "comment": "Malware payload", "value": "5731c8663b05683d7e7bd6f81820459d992dcfd4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833170, "uuid": "6dafd556-cc3e-4e78-9502-ba22d4bb5d59", "comment": "Malware payload", "value": "0d7401f35bbc48edd2b215865e610d523ca7edf559fd9e7442088a500c621a1780de9fb28df3c7e3921812e31497520a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833170, "uuid": "612e151d-b1c3-4030-b978-f85e7c5f94a1", "value": "T1B7F05983E4C0A2AA4642125A8B75805CEFB957DFF1D08A1DFDCD42224F12BDA92832A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833170, "uuid": "39361475-6845-434f-a523-5a22612e6265", "value": "6:TMVBdItOMn7BC1MKdE1OpvzsVt2q74eq7uheZKyUDKGMKdKFbFPOWtA7VIE3WYVZ:TMHdIHF4dEL2qm710yodSh8//umdJrHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644833170, "uuid": "50a5fb02-cd93-42ac-999f-b1855fdb75ab", "value": 580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644833170, "uuid": "17ef24cb-1165-4118-b8e4-0243bbd2a388", "value": "text/xml", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833170, "uuid": "ae95082c-f161-4181-8b86-10e62fb85ad2", "value": "IMG_5736097004354..jnlp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bb0f44-8dac-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644853218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853218, "uuid": "f890ed2a-391c-4471-95f8-03e5f9d78a2a", "comment": "Malware payload (AveMariaRAT)", "value": "06dc1a37e64c57347b2b42ecb7ff7c8a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853218, "uuid": "f121b3ae-bb9e-469b-8d91-5f2c86dd2dd2", "comment": "Malware payload (AveMariaRAT)", "value": "10d284e43b908d69b18afdc797b0ba38674de3176cce923bed31c978f71aefbf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853218, "uuid": "8e58976a-a10d-4af4-95e5-a1c0ab74966d", "comment": "Malware payload (AveMariaRAT)", "value": "0e17cbe756a14e59f90ac6759f3bb78738d72072", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853218, "uuid": "74bb46df-207d-4e31-bcfe-bdc778d1aa69", "comment": "Malware payload (AveMariaRAT)", "value": "4f5aec329b0eae082208f4e915f482aad175e22b988ea0ff58a5cc7e82af5995f4e2ab94aea885bbade94ee28ccccd3b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853218, "uuid": "ae36e05f-f04b-41df-ba02-db664d30a848", "value": "T10CE42302EB38A01F0C0FE65BA5729D97DDE4C19B7EC290F295F129BC39859C7A11A44F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853218, "uuid": "f34589ef-ce49-46e2-8188-fe50cfeb5cf2", "value": "12288:CQOX/iR97ousRZlg7voqImbYl+3gLvI5YY7oAFQH09q:CQTR9UVzg7vnImbi6WI5Y79Hyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644853218, "uuid": "6107b27c-171c-47e4-a246-7babca4f3de8", "value": 677052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644853218, "uuid": "e87c09e9-a610-4bc2-ab2d-d69bec888f77", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853218, "uuid": "8b5b8bea-3626-497d-a903-d4b46cbd5131", "value": "RFQ#JDM-P14-22 ASTM A36.jpeg.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1482b1c-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844722, "uuid": "e6b6c765-5d69-4bcc-9839-21a3203e60ff", "comment": "Malware payload (Gafgyt)", "value": "743d08255972c8af319ff46a9e4ad97c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844722, "uuid": "0df3ce39-92c5-4b54-bea0-66a4d74837e7", "comment": "Malware payload (Gafgyt)", "value": "111f05d14bbc7c5481a6d8649129a400113ccb8f5e7d6361aec3e7891005e127", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844722, "uuid": "14ef171f-ea38-443f-b06d-67d6bb65b59d", "comment": "Malware payload (Gafgyt)", "value": "e0ee93e3d1c99f238723afc7e8463e9e88eee93a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844722, "uuid": "a7bb2049-a876-49b9-835c-2d5976c5b002", "comment": "Malware payload (Gafgyt)", "value": "a430bfd8870e182505ef19d4719d0ed56ff0a3f9f4d628082b40eec9db4df2cafe689840a689ca8924acbd09b3db6f0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844722, "uuid": "562196fd-a328-44d0-8c7f-46a2343d5821", "value": "T13B933B41F9418B17C2C327BAFBDF439D37366A5897D7330169297EB42BC67891E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844722, "uuid": "4d11055e-2c01-46ea-b6cc-f89089c3cb01", "value": "1536:HzDBmIByJZIlhOPx5O8vQTsGYP+CvsUOStVNXLqZ1mkgmQAE+dAXDfj:H1BSZPjQkBsUO2WLmkgmQAEUAXDfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844722, "uuid": "059eba19-a9e1-4396-9646-f4d31dcc7963", "value": 91819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844722, "uuid": "466c79fa-7538-49b2-aa6c-0bee61119837", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844722, "uuid": "df9265ae-8438-424f-a155-f4d8f271cd97", "value": "Demon.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3cdb01d-8dad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644853772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853772, "uuid": "c25d2691-7804-4435-b66f-1304643f1b99", "comment": "Malware payload", "value": "c1bfc12afcdedc06c8b27db19db3aa3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853772, "uuid": "15484cec-b4ab-41d9-8d50-dc9f56092ccf", "comment": "Malware payload", "value": "113271b9121ec54b2ce970af3990e8bc8099bd21ce09e4aaeca7896ddeb1e0da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853772, "uuid": "9ad918b4-e544-410e-a3d3-15633735f961", "comment": "Malware payload", "value": "d8798347801a873930230da36adc79d38376b977", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853772, "uuid": "3399749c-8563-4858-bdaa-11fa1e4804a0", "comment": "Malware payload", "value": "f613c202ada2552166e8627a98e0817905db98a7240ef45b14848392496c23d108786b8b7530dd3dffe42364e500f8f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853772, "uuid": "ddb9b02d-526d-439e-aa34-8f0b1d354d91", "value": "T1AE03F1A1D3F3DE9EC05C46722AA6B58F5C11770D91C45EFCEACE55B90098B84E62C22B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853772, "uuid": "282c4baf-c915-4fdf-bb69-1e53a6ee7f45", "value": "768:f8wzXipqJA2uk8cun1re8g/5MBAAGf+RR9EAR/nbcuyD7UryqWjkB9IT:Uu/78cunxepJfUReAZnouy8mqWk9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644853772, "uuid": "def640ab-8af6-4c39-8136-c184a8457f52", "value": 38344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644853772, "uuid": "8f095967-3a03-4351-9912-0cc38bce91ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853772, "uuid": "52ddb897-8677-4f9e-af7a-df4d7236609c", "value": "c1bfc12afcdedc06c8b27db19db3aa3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1c4a44-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644822431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822431, "uuid": "0efdacd0-7a51-454b-8da2-ddbac9b38e0c", "comment": "Malware payload (RemcosRAT)", "value": "96208cf61842e1949fc26f963378c48d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822431, "uuid": "17bfc969-99a9-45df-a36e-7718477254a3", "comment": "Malware payload (RemcosRAT)", "value": "116db06e41c6e22c8e5f9866cbcea9db1c4012ce610cf202f6a0672a94450af9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822431, "uuid": "84af495e-1dc6-4c04-a857-0e6128900884", "comment": "Malware payload (RemcosRAT)", "value": "5c19eaaddd9fb8c2d2727d3678164c77f561f79d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822431, "uuid": "9357781d-4249-4243-b4e8-93ee0deb9873", "comment": "Malware payload (RemcosRAT)", "value": "55853a587d61f794ddd0181954eb4e9edf5cd8c62d3b399f676c6005f47003c48d4a16c785f5eb76619b40f70d6d15f2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822431, "uuid": "3f3ceb52-e8b2-4159-8851-bb0d4982a211", "value": "T1181401873BAA3CA8EF6257360D178C1E13C1AD06E9478CBDA084FB65DE7D9719853270", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822431, "uuid": "09d698f7-cd59-4957-8cd5-e4b277884e2b", "value": "3072:zn3UAOv5qM+oN2TfLutVJpnt2kmquG8GbZU4hqfF7mpc+w0dP+BFQhn7jXgbwXh5:7UaM+HTuN2fGyo8iVfdUgnPgbwPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822431, "uuid": "993a61a0-0d6e-4f12-9440-1b78c76b676e", "value": 192088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822431, "uuid": "5634315b-8840-468b-9062-a2c931ac7f71", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822431, "uuid": "d164adf8-bc7c-499c-9b6e-a2052ddabea5", "value": "Order Request & specifications.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c270ec19-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822444, "uuid": "21638800-5042-4a4c-8735-1090dcafc8f7", "comment": "Malware payload (Formbook)", "value": "58e1b7d879a23956e6612da611834ee3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822444, "uuid": "77bca642-c6f3-4faf-b063-defba19167a3", "comment": "Malware payload (Formbook)", "value": "125234cd945b324a4a334d19481f830c02b90927c5a827ab3fd42a9182f1b6dd", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822444, "uuid": "b5248b53-4be6-420c-85f8-c5db7084160a", "comment": "Malware payload (Formbook)", "value": "2e25c3957c349cf7a3998cce4cb691940f7edc9f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822444, "uuid": "f3c22309-ce96-4d36-874e-55bb8feb7db7", "comment": "Malware payload (Formbook)", "value": "743c250d1e168bf6869f3c80db9ed28f981c93dc359c02e5cf89b706cd310f49ca465b84f072a84a2847fb0dc42c69ba", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822444, "uuid": "8b5fc597-5433-4152-808e-a5f3a871f4ba", "value": "T17C1412123185B2F4FA25AB336957ED7144DA7E0B55A32EFF4944B90CB0F350A9892F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822444, "uuid": "f84f7936-d69f-4dbc-91d1-20de9fdf6f4b", "value": "3072:N2q5JCXCLS9gk3sI+W3rBf8oTBTQN0844gA8MwQe+2CYKpbWMnO6q6hg:BJECLS998I3rtllTmgZieGYmE3og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822444, "uuid": "0027b175-a8a9-4e7f-9711-2b076ecfdb4d", "value": 191944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822444, "uuid": "ca61b94e-f61e-4ffe-86b1-fb5c85d753da", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822444, "uuid": "1215ddd6-c653-4937-9ef5-1746787334a7", "value": "SNO150222.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20cf8f9-8d6f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644827114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827114, "uuid": "2b5599d9-6371-45c5-bee7-c42ba739bd46", "comment": "Malware payload (Loki)", "value": "91e5a61bf27b96f94153e89e4356eb1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827114, "uuid": "78228bdf-f356-4a4e-8e67-bed87465e5b1", "comment": "Malware payload (Loki)", "value": "12f56e0170dd0bd765e935c0709c11a32cf916a9f1f12028e9af123c0a23b8a4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827114, "uuid": "16ec9df6-d281-4089-99bd-2e17f5556467", "comment": "Malware payload (Loki)", "value": "f1a0cda1b81d858d4e630b6faac2447225acce09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827114, "uuid": "426d747e-ce3e-460f-851f-9d33fdaf0f60", "comment": "Malware payload (Loki)", "value": "166b4855b4a48557ab7f953b30bc5c538d26ad8dab8d8f6e30811b5bc2a289b43d226c59e8470d3004863a9fe2c67fdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827114, "uuid": "54c75bfc-8b47-416f-b1ca-7c8dd697516c", "value": "T1AD050105BBA3E501C5760FB9E8A042405B30ED2E964BD7BF709D3ADD3F9636A4832536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827114, "uuid": "cc769e3f-9e78-4b1e-9f80-2e88b81543a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827114, "uuid": "7a169a18-5f4e-47f5-a361-e63f78dd666f", "value": "24576:REsLFnxLZGZXsTY9lbhHUJ27fh3LIFi7Q3:ZLFnxtKXX9lbOJ2l3mi7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644827114, "uuid": "410a16b6-44db-4345-8dc1-1c76ae181277", "value": 847360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644827114, "uuid": "bfc09931-b860-4da8-bf01-6e72a35eccbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827114, "uuid": "0ad060de-41e4-4b11-9550-259dd7e2af17", "value": "91e5a61bf27b96f94153e89e4356eb1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797681e0-8d77-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644830482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830482, "uuid": "f54010a7-2a9a-4e5b-acb2-d4e3278cec3c", "comment": "Malware payload (Mirai)", "value": "000ae0901364e9ba6a0ef5e4b4b79635", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830482, "uuid": "c60a8543-743e-43c7-9920-8154e41f4cef", "comment": "Malware payload (Mirai)", "value": "131b17d286f0c60c9363a6bcf93f0078892d23ecbe632b66752cb1b270a1bfe5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830482, "uuid": "b4c1c8dc-737a-4b32-b087-355c1d926171", "comment": "Malware payload (Mirai)", "value": "921ea6dee2bfc2375b9b5c21f776cb089e43d170", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830482, "uuid": "b9b3d108-8e89-4e57-b733-a1af4396f2b6", "comment": "Malware payload (Mirai)", "value": "a3b96ece41f5f7cc105b1fd2f8da9e62dd26b14e750a468fe34c83f0c0e021f8a0872596e07a42c1722e687f0d0ca457", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830482, "uuid": "ed03f93e-2fae-4c2a-9c80-b096eb17e9ad", "value": "T111B3D40ABF610FF7E8ABEC3745A92B05249D514B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830482, "uuid": "7f545923-4adb-433d-93a5-cbcc4bf7b02b", "value": "1536:g9DYWFx+xx+AaEPilMR2jk2EkZ+BzYjjKoOvDBgplbngVZ14hvG:gqWFx+xUA0OR2hEkZ+BYpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644830482, "uuid": "18db7112-0e51-46b2-9c4e-d9216aab7128", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644830482, "uuid": "0810df94-8fe9-41eb-95f8-0301c6dd5452", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830482, "uuid": "995c53c2-66f2-4a7e-b59c-fa69f83292fc", "value": "000ae0901364e9ba6a0ef5e4b4b79635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc8a018-8d5e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644819829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819829, "uuid": "b9cbd972-96b3-4d43-9cdb-aaaf89a2661e", "comment": "Malware payload (AgentTesla)", "value": "091fd2a1b80b3f1e0f9d4e4bfe929aa8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819829, "uuid": "9b6d5562-b7da-4381-9cbc-338698d664ff", "comment": "Malware payload (AgentTesla)", "value": "131bf024b13ea69fc362ebf6b121246e58f0f4df2335d468f3a3eb6f51aacc42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819829, "uuid": "e131daed-1efc-403d-a559-9279322db844", "comment": "Malware payload (AgentTesla)", "value": "11ff0feb08aae1553110f00444830cacc63285a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819829, "uuid": "caee573d-b0f4-4880-a222-d5a92f5b9dec", "comment": "Malware payload (AgentTesla)", "value": "c4bdc19e6ed4a366c71ffe60e8782ab6abb4c46ed5aab4567c1844022b5c63b8d7bb40af0e182d27761803723bee5646", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819829, "uuid": "1cbd57e4-80d5-4a39-81ff-803498e05c38", "value": "T110151219D677B940D57A06F8E0A181844FB85B1E915ADBBF70AF3CC83F963878A31136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819829, "uuid": "19b273d1-51ea-45fa-beed-592be5c05eba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819829, "uuid": "5c5ae90c-ad30-426f-a5da-2eb655ee46b7", "value": "24576:+l+oyVDDDDdwavymS0LZ+ml6it9ELiYvH79UtB+pC10:DhVDDDDdwavymS0tdU89ELiqH79UtMb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819829, "uuid": "e81c0e30-beff-451d-858e-b291b6f220fd", "value": 909312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819829, "uuid": "c47d50b7-9f31-4555-ad1a-3a7a67fe27a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819829, "uuid": "35c1e5e1-8593-4b2e-9017-ac6156c46ee2", "value": "order conformation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c6333c-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644822419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822419, "uuid": "29bd2014-3649-41c5-92ec-c7a557d2c977", "comment": "Malware payload (Loki)", "value": "ab6fac4b4568123a6a9e0b2dacc5a9d6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822419, "uuid": "a174a7db-4336-4dd6-8415-3eccde737863", "comment": "Malware payload (Loki)", "value": "13fb1bb6fe575e7b42a89cb8f1dbe211a31998947b348b98ab9fac46e4b85c02", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822419, "uuid": "05a03db5-1b32-41cb-acd3-3f1b56c18a69", "comment": "Malware payload (Loki)", "value": "db0a6488a294c2896972c4d13705359d9eb73d73", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822419, "uuid": "6f6c01a5-71c8-4ad6-a811-93674ba15b21", "comment": "Malware payload (Loki)", "value": "171a950423797747ad2964ade38ce12b0706f69640058f10256109a2cad11f65b766e69c0ce80548442c649292b98a60", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822419, "uuid": "16cd79de-c1d1-4c79-ab47-638935bd9994", "value": "T10B141231392141C1F6EAF7365924C418DFF9FCB87B2A5688320A752A4AF0D9E54F4E39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822419, "uuid": "1519170f-5431-4b5d-92f2-d1318f4bbea0", "value": "3072:CZ1YBG1UXl0IHQtmJOH10rQHS71ksjd2Tyk/2ANSrfMy2EmZgA6vBcv3F/J9yuRh:8lQ6Ism0u8y71nps/72YJ+Apv3FRQqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822419, "uuid": "f21cea02-1dac-4b10-ae3c-a30d87d99a02", "value": 192152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822419, "uuid": "9076b799-0ea6-40ac-9c51-f314d320a141", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822419, "uuid": "ec49f967-cf34-4bbb-b485-2b5ebaab7b3b", "value": "AOC0114595 PO.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e91935a4-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644844842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844842, "uuid": "f2db5e7a-7ab3-4a89-b868-e0cefc850303", "comment": "Malware payload (Mirai)", "value": "44e1dcbf9a1d15a13075754d8053d2b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844842, "uuid": "b300b29a-b8f0-4c7e-919c-607b27ac937d", "comment": "Malware payload (Mirai)", "value": "14415a44cf2e99a2fcd89be803846319b806128112fab20cd3c0d7c6f00ad46a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844842, "uuid": "43c2fc39-11ec-4719-bfae-d79882e2a522", "comment": "Malware payload (Mirai)", "value": "014bcab98deb251fd7b7bd0ab43ab53fb4dcd6ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844842, "uuid": "1b6fde9c-eed8-4b73-8477-5939a24600ce", "comment": "Malware payload (Mirai)", "value": "8db09bf4b386e4593cbcdd05f523c77ccc2926ebc11e28379e0bc53dca703fab6eaacd590fcce07f86fb4adce04ca0a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844842, "uuid": "88edcf98-defc-4b35-9920-062ad323d8fe", "value": "T13FF2E1CA40DE064FC6EF503188FB37969908C94CA76584E7F6E8363F09D6B158516BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844842, "uuid": "185e6952-3e7c-4612-b23a-331eda62d3c4", "value": "768:H0zT2Xv8oj00megS2P8bOCquGrG/37ILvj1U4D796y4nbcuyD7UHQRj8:Hm2Uoj0/eDCCQrG/3ivRUk5Ynouy8Hyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844842, "uuid": "0680aa8d-dce3-4b41-92d7-42f6be4ea99b", "value": 36112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844842, "uuid": "ec85d394-3b80-459e-83fd-68487b63a940", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844842, "uuid": "0be75345-39f5-484a-8cec-a9709034bcae", "value": "44e1dcbf9a1d15a13075754d8053d2b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c172294-8d8d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644839774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839774, "uuid": "2b27511d-0a88-4426-94fd-61c8156ed1e3", "comment": "Malware payload (AgentTesla)", "value": "9e4917d138fd9095df5f98414fd024e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839774, "uuid": "c26e6682-2dc2-4530-8e64-f907b6e3143e", "comment": "Malware payload (AgentTesla)", "value": "1453a2126951fe19d83a2cb25154c699173d3ccb09962e55715b3c47a08b08dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839774, "uuid": "7d7bc4d9-c88b-426c-a2e8-f9cdef077fa8", "comment": "Malware payload (AgentTesla)", "value": "34807a138721f088f5264dfb4cd5ccf2f3fe592b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839774, "uuid": "b8295dd4-16ff-4d2a-8ffc-2fa2616c9b0f", "comment": "Malware payload (AgentTesla)", "value": "178af9863299451f9e933367e075bbe712882e4f5442b7672dda713cb7b46922f9e1bd6c2eaaf2d4de5ac6c700a50e8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839774, "uuid": "3cf50c96-01b6-4206-b8d6-66f45518e45d", "value": "T1B02501017BEAAB23C57A0E77D8F1410117B0E54E511BE77FA8D532AC1C8B3685E7227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839774, "uuid": "67397eab-1adf-478e-95d3-4138461fd77d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839774, "uuid": "cafe47f9-4010-471f-8349-3e4eb513e05a", "value": "24576:8mGb5bY5huY5NiNu1GrmLJLHqSn2CVRptU+UPqGeF:+bY57iN20i79jU+UPqGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644839774, "uuid": "f579cbb8-2a64-4aeb-877d-8938ee6f1f2b", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644839774, "uuid": "108b4202-37eb-4e7d-beca-2bdecdd1a1d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839774, "uuid": "f7838bd8-4eb4-4c86-8416-dfdfd0be7e76", "value": "pedido 14022022 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bcf1e17-8d79-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644831344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831344, "uuid": "8d532c2b-7802-4e3f-bf09-a37fa8bf1d0a", "comment": "Malware payload (Formbook)", "value": "a6a545193afc33f8b40475f6b9c7f1de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831344, "uuid": "429692cc-035a-42ce-9bfb-74cfc0bd16fb", "comment": "Malware payload (Formbook)", "value": "14f417212aefc7dabfcb9585ffcf24081ae68584c68732c69e4bf6ebc1a9aeff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831344, "uuid": "231da536-1a58-4235-b818-eb8b1f98a038", "comment": "Malware payload (Formbook)", "value": "8dbb05130a73e896c250a78845bf52c52ffc4468", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831344, "uuid": "5eccb582-47f7-4d72-b8b7-55ee55ff5cea", "comment": "Malware payload (Formbook)", "value": "c25e649cc01c0d668d29b08e7bc5e1becb059501c4a31b45053370350c1b65202f4770d0218f4c727b7422df3513a223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831344, "uuid": "f4c6b8d1-2cc2-4210-ac08-ad347507b7dd", "value": "T1F4B4BEE2E24409E5ED2B26B56A3B9D25163BBE7ED474690E209F75601EB33D31037C0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831344, "uuid": "8c6b93fc-2431-4c4f-8565-368ba0b8cd38", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831344, "uuid": "bc2af26d-b5ee-42d3-bd1b-3ada359bb307", "value": "6144:Ewys+c1fV/ovDlka96SXoLu+jk/o6tkH5wmIoN2i5N1r1shlM/RPYITDdIZjiHVR:MGfV6fLXoyGkQ6t2rBTYloYITDme5384", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644831344, "uuid": "0105b635-7a8b-4303-9625-f6469c1aa701", "value": 499485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644831344, "uuid": "5c2781ff-7aeb-439c-a6b0-b341e1a9c1a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831344, "uuid": "0eb2a4ed-ad6c-4746-8ad1-18c35590b5b0", "value": "HSBC Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39d03d6-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644822472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822472, "uuid": "c49aee18-1ac5-4d07-aafb-2e2e1d080ed9", "comment": "Malware payload", "value": "a302b90b65e547a495cc407d03084a2c", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822472, "uuid": "3be6363a-bf49-4146-9313-c2143b985ef8", "comment": "Malware payload", "value": "15fb47a5f38bd664dec189588aef80ff0e999098d4c3b1a5e47ac079f78eedcf", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822472, "uuid": "9b8e617a-eeb0-4b5f-b01b-2e738ee43857", "comment": "Malware payload", "value": "5a8ee8f79985496b3f5087cb29c0dd9fc7b72bb9", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822472, "uuid": "baa63047-654c-43de-b71f-b9dbbab5353b", "comment": "Malware payload", "value": "ddde6a7c4d706b2e9c5be48f89a3a6ae6ba130d8cda8412fb30b14066b0bb92de79b49d4bdfd88828974cd01ae90ae50", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822472, "uuid": "3fd6556a-a4fa-4039-bf69-f1b53305d7b0", "value": "T1541412A57CB39075C5FE41BB4053E2EE284FEE8574B2D4076444BB2DAA378805F4E639", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822472, "uuid": "c12c6bef-e714-46aa-9db9-07852507c78b", "value": "3072:1FQO1KPxv264ZU4lN5peIO18tgKi7rY8azwQyLAmzuUg4qoEjiHUwpqG3BYDgGZk:PyZv26835peIO18ErY8a1UveTSH9YDlY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822472, "uuid": "e56b0cff-171c-4165-84e4-49efeceb2048", "value": 191864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822472, "uuid": "718ada86-39ed-4cd2-bc06-9fe26a462eaa", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822472, "uuid": "71c9b39a-9df0-445d-afa0-3b8dea9b21dd", "value": "STATEMENT OF JANUARY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195c4b0a-8d4d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644812281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812281, "uuid": "7773038b-3255-4a93-97c8-205e6de4ce89", "comment": "Malware payload (Formbook)", "value": "3a222e1e4da308de3c425389ed5d9f7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812281, "uuid": "727bf9e4-b14c-4e53-905f-1e8b65a34a97", "comment": "Malware payload (Formbook)", "value": "1640c66b8dbdc48e383ac370417542c6b5e5f7da5dd2b526c6f3f4c0f37b37c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812281, "uuid": "96c07ae1-c23f-49e5-bb69-88274753e394", "comment": "Malware payload (Formbook)", "value": "3b8a8ce8aed69eeafd01819b71b05120747fcda8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812281, "uuid": "83e1b4e8-2ab6-4475-a314-f3eaa4f6bdab", "comment": "Malware payload (Formbook)", "value": "d4a4f463ee29beb353f867372c6e704720111e94b4cd20aa493d53a8592416bccf659925ba14a78367a3291a6bdff521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812281, "uuid": "557e18d4-d925-4f2a-b564-6a63f8e989fd", "value": "T18B5423641AC5CC77ED568B30160FD3B797BE220036094B17BFA6AF58B8632E1CC2655E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812281, "uuid": "f8ec0fea-7aa2-408f-b934-fdc177e003e1", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812281, "uuid": "d57269b7-ea17-46fa-9403-a1255131a1f9", "value": "6144:owZM2zZIV5r0eC/KAq0l5inqI3FvYDUdyLPB5D4k3KfexCUPDCuuX1IGb:q2dIV5YlKv0lo3VQDFLLDLgexoR7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644812281, "uuid": "18584a96-c3bc-4fad-b56d-f6b27a8fbe01", "value": 301348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644812281, "uuid": "016445b8-b8a9-408e-9e8f-0a23cfe3cc43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812281, "uuid": "28245f2d-a039-4b1e-a22c-663172a9d329", "value": "order payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9a800d3-8d75-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644829811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829811, "uuid": "812d46f5-be4e-45d2-8ff6-c6b727f30feb", "comment": "Malware payload (Mirai)", "value": "d6f3d15b988ca33cbaaa4bd39c655895", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829811, "uuid": "204d4279-1be4-4945-a736-0f3694b172f7", "comment": "Malware payload (Mirai)", "value": "166d292787d9318f235b7a1a7ff79673c4520f0672021b9feecec8bbc5a345a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829811, "uuid": "7dbf1c30-f737-4fe0-b1c6-3f02fe30a4df", "comment": "Malware payload (Mirai)", "value": "7f958b5b728f00ef7bce9a58652e37a1b4a6b395", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829811, "uuid": "3cb9825b-a59c-460d-9e6b-aa0e47913497", "comment": "Malware payload (Mirai)", "value": "439f5bca280c80aa38f91e825d02cf733138024b5102ee9d557e77e1ef8a94d54d3242941c1286d0401ced8095fbd9eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829811, "uuid": "de1e4f18-ea8b-4b77-9154-a801eb0e89d4", "value": "T102932986BC419A11C6C61677FE2F108E331257ECE2ED73138D245B707B8B91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829811, "uuid": "516e66b0-8272-47b2-88dd-7c5ac08d8f78", "value": "1536:XhnRcUWoXufJ4Au8YKzvVTJ5zVMcOYaUl9aFmLbRMIiEg188Qxc/5SYG:EUW+lAuGVhMRV0awg188Qxc/E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644829811, "uuid": "b5ddf01a-8ba0-4e8f-864b-b277824d643c", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644829811, "uuid": "0aedae24-4ece-4e97-9dbd-3e78ef337457", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829811, "uuid": "c961e9b8-54f1-4957-a9e3-22a48e19d297", "value": "d6f3d15b988ca33cbaaa4bd39c655895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9571578e-8d69-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644824515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824515, "uuid": "43a0454f-33b8-4642-bab6-96763f3a4de8", "comment": "Malware payload (Heodo)", "value": "8ccc6361fbb0faf043bd21779747d27e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824515, "uuid": "8e6d7024-d3f5-41f6-97ac-8c5f2f2dc3f7", "comment": "Malware payload (Heodo)", "value": "166f4ac3369a67e48024d8ccc725e6dbf05f7b6190e4eea8768a85bd626b7a6f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824515, "uuid": "057f2b7d-25c7-4c2e-a200-5897c474c95e", "comment": "Malware payload (Heodo)", "value": "33370ea05f40dd6f96f74c0e1f8dd676e2af90bc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824515, "uuid": "3abc5b1a-f79b-40f8-953d-042e1de5fac8", "comment": "Malware payload (Heodo)", "value": "d9ebca6352f48a0b666e240df0e57c6aa2b0542770c6a41b75815fe0013edac0d710709d6ae9fa885d8e58dcbd5ea0e4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824515, "uuid": "c6648abb-468c-4ac3-8223-cf3bbb3febd0", "value": "T1D625AD41A95A80A5F607243D106AE3B60FED6D1247F0C8CBDFC5EC6B7F52CC246794AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824515, "uuid": "17c7a22e-cbe2-47bd-a5ff-4c6640ab25a5", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824515, "uuid": "ba63f168-dfd5-4ef2-b261-b9b5ba49c0ef", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxrfFIIm2m42:1ZsYB7vLsnZI1Hb9DuFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644824515, "uuid": "2e572d49-5a88-4fd6-9c6d-1d755596c4db", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644824515, "uuid": "01a05ad8-b011-49b4-851c-ade45d7f4ba0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824515, "uuid": "56d6f3d6-995d-4a4f-a783-b9dc810b53fb", "value": "emod.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f8a6fd-8dbb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644859727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859727, "uuid": "e73dd62a-228e-4f40-b189-3e64202793fd", "comment": "Malware payload", "value": "e8a7887ba94a258b3b97f4f93fb7798d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859727, "uuid": "20ccdfcb-9c65-4d2f-b5f5-0772c158df43", "comment": "Malware payload", "value": "168c81bef22a8be953384a3a6b6895a9105728eb3f42d18d22e342729800dc34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859727, "uuid": "4065c4f9-4a56-463b-a872-2fbdc2bcc511", "comment": "Malware payload", "value": "fe56fa5844eb579ff43a653bd293814902dba8a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859727, "uuid": "1712eb95-a179-4f06-856a-a44b91f56256", "comment": "Malware payload", "value": "aa699f21c4861fd58f608c696604bec2d1154020a417b4e529d30f6c190c606192636e9c7f6df80c285f75775c7946fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859727, "uuid": "0f18f29f-1cdd-40a8-a0d9-cdb637ca0e74", "value": "T14D653315B9E1C785D3E4ABFADCD13138E409D2A7B101B73B640C62E74A1E913DBC7A22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859727, "uuid": "4c97e30e-cf8e-4331-8638-422cba6fd815", "value": "24576:TMHSrFcPkNtb+cgr4Krnbq+B3UABc1/as3je34+HYW1vwVStd+k:5rFSkNpI4KnTVaSs3joRHYKv9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644859727, "uuid": "1f3ba875-0584-48ac-bbc3-77e5d1eee708", "value": 1412008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644859727, "uuid": "1d50cc4e-8a08-4b46-a090-eb3c8080d8dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859727, "uuid": "6c043266-ea8b-4ad8-a02a-b12902210a2d", "value": "e8a7887ba94a258b3b97f4f93fb7798d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7597afc6-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851950, "uuid": "3e9b6a50-aa28-4dd0-99f7-ebd5f1100151", "comment": "Malware payload (Gafgyt)", "value": "af51e20504775c3f448062a83b8b0a50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851950, "uuid": "320f88d5-3da1-47b7-94db-02d432ae811b", "comment": "Malware payload (Gafgyt)", "value": "16b0443a91e24cd9af85b79efc84ed8ac49c8230ce36307655561071c34e65ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851950, "uuid": "d250bf84-b9ca-4635-9942-f94c2d4a9e9a", "comment": "Malware payload (Gafgyt)", "value": "9efa5859f818b405ca6b9f325510328b1a721e85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851950, "uuid": "f80c2100-4fa3-465f-b0df-5c6835db5243", "comment": "Malware payload (Gafgyt)", "value": "cdef0686ee767e014350475333758e085e04da4935eec23687c7bea013dd4ffe92dd3f6d404546b24e42dbbe279e021a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851950, "uuid": "4693130a-4c9e-4798-ac9e-afc0831ae9be", "value": "T12CB31901E9408767C2D327B6E79F439C3B365E59A7D7331169257EB02BF2B981E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851950, "uuid": "2d1dfb6c-8772-4131-9e0e-b85f612b6853", "value": "1536:x/jeKJ45cjR2lwH00MjRsQ4AueRWIOHOvPlG43WceBo4aMmglVUQuKWeavQk8v:ZJAaclwH0l3RrA43VymyVUQuKXWQk8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851950, "uuid": "2a55d3f9-9b85-4607-9f82-b0c08465d30d", "value": 110328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851950, "uuid": "07c368ea-6842-40ce-afda-6f0bcf7b5c9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851950, "uuid": "6996b4f5-b411-4668-89fb-afc5567dcb7a", "value": "cc9dss", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8556288-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846049, "uuid": "22d3d6d0-d99d-4e4b-805c-80b6b2f2a792", "comment": "Malware payload (Mirai)", "value": "6fda4129b237d611d24916d6094d97af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846049, "uuid": "461fd5e0-533f-46a9-a71d-d7ce43871b98", "comment": "Malware payload (Mirai)", "value": "16c0569103d0dde03bb40b118feecb01f093f32ca4685a2cea4ee3f7fe49b263", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846049, "uuid": "5c352d6d-6448-4800-940e-a804906c3b11", "comment": "Malware payload (Mirai)", "value": "3668355dfafbdc790c2a57adccb7df11b73ebc64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846049, "uuid": "25298d68-98e9-4c8c-91ae-aa1ce1e789cb", "comment": "Malware payload (Mirai)", "value": "bc2ec8ee5bca451f5e2df945f9869a21ad0c052d82977a35705ed642c4daaa02bc629f3a9590b66c472a95f4b2abc5f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846049, "uuid": "78ea6322-c57b-44cb-aad2-a1734abcc836", "value": "T1A6833A829641DAB3D1531AF512AB9B150132FE3F1E2BDEA2F31C3CF08B125857265BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846049, "uuid": "65a8c07d-f92d-4751-b214-795040531b94", "value": "1536:X4XEAbUgUENUzorrMopIOvXceEQ9E3+MKA3O5hyYAdhN7she0QzUzJYQ2Wk:IXTUgVUcvM9OvseE6E31C5hyYcN7Ue0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846049, "uuid": "dd546048-7c5f-4e9e-b734-efc3564fb75e", "value": 87855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846049, "uuid": "6bcd3a72-0032-4835-9a65-c6c195edf045", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846049, "uuid": "df9089bc-f1e7-4717-81b0-3697b8fdf238", "value": "ftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65ac6508-8d69-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644824435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824435, "uuid": "de19df05-a889-483e-8658-192c8f40ae1c", "comment": "Malware payload (Formbook)", "value": "a26a214250e0c18c54651da72c7c4139", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824435, "uuid": "ef8524a9-abe6-4c89-80de-4292c78cac60", "comment": "Malware payload (Formbook)", "value": "177b480007813a30ee6c8e267b76848fe9f66b11557eb3e7422e680b46368b03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824435, "uuid": "5a205c86-54c8-4bb1-8c5c-1bf8a9c74d21", "comment": "Malware payload (Formbook)", "value": "115c758864006aed9e324c8f85e2cbaf8f685768", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824435, "uuid": "21ad03bc-1bac-45e9-89eb-166f6bf319e5", "comment": "Malware payload (Formbook)", "value": "7d37c3ae120f7253e04b26454be549bffe481f533bfa7f10baf2b8aae32c9e477352c1497399393221bb3e9d5e6d9b93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824435, "uuid": "ee910413-39b6-4640-8cfa-ffdfab2c9259", "value": "T133F48D22B6E485F6E11F2A749C1AB3A9882D7E112D186C4B7ED73F4C6F39640703529F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824435, "uuid": "9a279028-5b7d-4c66-a576-40503e200efd", "value": "50e822ed4b7a82a71d116b8c7e2396d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824435, "uuid": "49b31138-ffbc-4f59-ba3e-6fc53c4ac693", "value": "12288:FlZjc75hO32cpuG7NVM1/vcDy50eVmZyqGz2PASl0i1K2KbJr:3iz2puG7NVM1/kcVNqGzqFX1KbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644824435, "uuid": "6570c3b8-ef73-4c6d-8789-aaacb7fcffea", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644824435, "uuid": "6372b0ed-27b6-4498-be10-9ea42179ebeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824435, "uuid": "d550fb52-d403-4eba-a290-c04de9954c8c", "value": "P_O Specified_XSWG211103 XSWG211-14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0552df9e-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851761, "uuid": "b7934062-76c1-4316-9da2-bb4f7eb8888a", "comment": "Malware payload (Gafgyt)", "value": "2e7ec0412cec28a4d96a3e973a149e7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851761, "uuid": "b52aa00c-50b5-44f7-a0eb-f778e001df65", "comment": "Malware payload (Gafgyt)", "value": "17817a0dad5f52e5e4765f643fb0e3fc954a498e5611f5eef66afdb9bef5a056", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851761, "uuid": "7cc0123f-9a42-4c65-b2fc-28876874a72d", "comment": "Malware payload (Gafgyt)", "value": "a19ef04bfdc0e44c4d74681f477273d1c6bb84f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851761, "uuid": "95c239f4-f5f1-4771-a260-dd0b73451ff5", "comment": "Malware payload (Gafgyt)", "value": "cd1991c14f85680c1535ddaefe34ffdf27c66186e7fe0d945994e346a859c307a7876cb8aabbc46247bd4858632724bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851761, "uuid": "d180bc43-0305-4fd4-ba7e-75ad5f3c8c7e", "value": "T1C9835B23A651CA7BC0C75BF51BDB89A14423B83D1B37320A73D87DBA2F269D85D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851761, "uuid": "e6531476-5d68-448a-ac0f-cf9d146af775", "value": "1536:lK7dCvBRajgmeD+HPiaaXDsLFhAKn3xbhcKmoIYuOVje+ZNne:l8yRaj9vHP4TAzAK3xbhfmrYuOVy+ZNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851761, "uuid": "b6cbc2be-bac9-48e4-b0cc-1db51af6f69d", "value": 85515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851761, "uuid": "7e13cf98-4a79-40c3-995a-ad749bfd6593", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851761, "uuid": "0be73ac9-f321-4680-836b-c999a8597258", "value": "x-8.6-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "027fd4be-8dab-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644852616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852616, "uuid": "e7ebf8c1-926b-475c-8150-ea8482056834", "comment": "Malware payload (NanoCore)", "value": "cbe0a9d211631707b6d99e0404fea76c", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852616, "uuid": "4d75d342-c67a-4798-b2a0-a42e89cafc5f", "comment": "Malware payload (NanoCore)", "value": "182f5fb66c1d197cf13be4324918baa714818cb523b173dba364ddf6848e4b02", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852616, "uuid": "1ca41f7c-3502-4105-9cc0-939ab4dc417c", "comment": "Malware payload (NanoCore)", "value": "452dd348b5339ace0894bf6a917455e9910e699f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852616, "uuid": "6ac80150-86fb-4c02-9215-4bf6d0384e0a", "comment": "Malware payload (NanoCore)", "value": "4df722fbf0a6848334fdfde12d2ab205af8f67493d699f32c22c8af44039207652f278e15e784ebd4d5d43bbdf71b62e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852616, "uuid": "34459ce9-4f41-440c-971e-6dc2847cf5c0", "value": "T1C4F4333617C6692C3BD0B86DC087CDD509A650411156F2D3A942FB1F66F05EE0E3A6BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852616, "uuid": "45be042e-de00-48ee-b5d5-9e4f91f2b282", "value": "12288:UnBb55we/rmwfjk8lmAcrlR1F4RP28N4ldTpo6cTy59lZRltxu4i1xJar5K3q:Up55wUrmwL9lmAKlRQ4ldTpHU4ZRC1xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852616, "uuid": "617dc5a3-4221-40d2-bf93-94d81a448345", "value": 779127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852616, "uuid": "f9cc5a16-d8aa-49c6-bf53-6ba659d704e4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852616, "uuid": "7e3d8430-318b-4f37-85c5-f3b37e175784", "value": "New Order.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a12772-8da1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644848405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848405, "uuid": "7e119bfa-4f57-4239-9eb7-fdc35f30e747", "comment": "Malware payload (AgentTesla)", "value": "70770826a5820c42c51f439ac4d20b88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848405, "uuid": "a34ae8b2-b39a-4e48-a4db-307a4fa7388b", "comment": "Malware payload (AgentTesla)", "value": "193d47939de193b131b009fe43a69d84b849cb237c55e0618edd4fc527a8eb6a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848405, "uuid": "880d6808-9bc6-48cb-b584-41bd29d766e2", "comment": "Malware payload (AgentTesla)", "value": "5ad9d1fbf1594ea8cfd2399b70039eb8eb4a5003", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848405, "uuid": "7eca9330-009c-437b-a9d3-0ca922c282cb", "comment": "Malware payload (AgentTesla)", "value": "2c64b26f36ec3c00adad5d66aa503827280faccfb15a455f3e110ce56098f020aa1fd0bccaa1c9397eb7d35327f67304", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848405, "uuid": "232a786c-7915-4170-a1c0-655edaab185e", "value": "T1CCA4CF6851F75075D9A987FFF8A2D64C2F68FE2F9413B2FA0048213C04BDA9446C6A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848405, "uuid": "33963d0a-4202-43b9-8a2a-a0911034adc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848405, "uuid": "f4d1b514-2451-4c3b-8874-392e367b2b6f", "value": "12288:/I2asVZ7R+ysMUFTLL4Gp4fgKlPUuWBHTY//n5LVGt:/IrsLN+y/UuGpe3UuKzQnpVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644848405, "uuid": "8adb5b70-2cc3-4cf0-baf1-6c577a8c291d", "value": 459264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644848405, "uuid": "b99427ec-4b26-45c2-bd68-bf1d5e158d1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848405, "uuid": "4a99de2a-b0b4-4c56-b618-dc23c591b6d8", "value": "SOA - Outstanding Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb42c3ea-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644855181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855181, "uuid": "5671230b-7d24-448b-a86a-0293e0907d34", "comment": "Malware payload", "value": "70e3ea705a2510aec33b07a3cf840cea", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855181, "uuid": "6e15dc7c-3be8-4889-ab13-7a8e06b45531", "comment": "Malware payload", "value": "196cd8a5f45d4a28e6e72d0d82cae8ce04fa2b286ddda2ecc5dc0b063ef75199", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855181, "uuid": "9e9b10ba-cfc2-45f4-ac52-cb4356c48d22", "comment": "Malware payload", "value": "67125e07853b3688d05769c4ca54d1a90f74b6a7", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855181, "uuid": "03bc0cd2-2d4a-482f-b800-96a6e2083b2b", "comment": "Malware payload", "value": "ef5006f011b3745db97ba5a69de72ec3b72706541578b2a15f64cc23ab5c89ea4838a4a2d7269b54d99a6ea25539be29", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855181, "uuid": "ef48cfbf-7b27-4a2d-96fc-ea916888959a", "value": "T19F03AF08C1036416C6B3B93ED87998E12CA68C179115499FD1D7BD8B07A4DEB3B4FBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855181, "uuid": "6692e3d6-3835-4582-a5d7-bb3016cbadd3", "value": "768:0aRD4S0JS00SneSnjS0yS03S0IMS0bS02SPfX8J/BKyFGksK+JjfQTmlW3xdS1A4:0oWQLC3cAh1/K8NytsRAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855181, "uuid": "47c10a24-b72a-4aae-9367-4710ccab292f", "value": 37963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855181, "uuid": "90ef37f2-cc27-4173-be1a-486059db1052", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855181, "uuid": "f4a77162-ce7b-46a6-8916-ea8ca7ad7744", "value": "PO.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e8cc1e4-8d46-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644809498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809498, "uuid": "b99663df-cf68-4bd7-8a84-ae7ac8464e95", "comment": "Malware payload (AgentTesla)", "value": "76ca41cb9530fa0eae14ff63aca6db62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809498, "uuid": "0bef1516-928d-417a-ad91-6bce0e5e7cca", "comment": "Malware payload (AgentTesla)", "value": "1af161b44f20382babf11537c96e5ab4d1583e23b90b29de93f4e801f774e73b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809498, "uuid": "a9940886-ce87-4634-aa6a-fb9e5f718da6", "comment": "Malware payload (AgentTesla)", "value": "ed54a926a8674299cdc4672e07570a8e222cc415", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809498, "uuid": "ea154ad5-4943-4ce9-8812-e55db4f8224b", "comment": "Malware payload (AgentTesla)", "value": "3f134d35c8f78e69f94379f5a4d49b589642593d6d59d530059ffbe6c58c9aebd3a34e068a66874167a6eb4f5586c45a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809498, "uuid": "62daee1c-b16f-4a76-b4f9-1a6ddbb910fb", "value": "T1EC150205BBA2E959C0B50BBAECA041505B70EE5E5503D7BF706E3ECD3B9B3A90532532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809498, "uuid": "8f01f740-c07a-4d58-bcc8-3ce525f06f6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809498, "uuid": "066beb2c-d264-4309-bdd8-102143aae632", "value": "24576:eqSWW0NLZ+4RPnQNssUMsx6ZLfL7yry1adlQ40SF:8WW0Nt+MPnQ+TMKML6rdJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644809498, "uuid": "6a030df5-c0d9-4da5-b50d-83ce0dcb79d2", "value": 937472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644809498, "uuid": "43b2c0a7-80ec-4e14-8da0-20f5c6f87105", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809498, "uuid": "a3c247bf-a4ce-47f3-a467-b07192029e63", "value": "erPAAvf8J2bJDmN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6d21f9-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851938, "uuid": "6eb6cfc4-2ccc-430f-9817-73133637a2e6", "comment": "Malware payload (Gafgyt)", "value": "b5dfaf039b5aed1133fb5584228ffa24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851938, "uuid": "a58cacb2-5651-4c28-bff8-f33aed1e569f", "comment": "Malware payload (Gafgyt)", "value": "1c1a8e25f1d108f9877a987aa228bc6d03ad264b84c584705d2a26d6279a449d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851938, "uuid": "27938b0e-927d-49f0-bc22-b31b47221dad", "comment": "Malware payload (Gafgyt)", "value": "830fb95ec93600fcd67ffc72569bb8b585b3bda6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851938, "uuid": "4de7e42c-3a82-403a-9d2d-92bf384585f2", "comment": "Malware payload (Gafgyt)", "value": "15352a775fb262918eee0447a3bccbff653a40bf49f7a9e96da3bc3396488c14183a61200da16277be791ac80805a6ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851938, "uuid": "7d46b854-ea25-4bd8-b78c-9db9bcf3c238", "value": "T150B309277B274E63C0CA147112E30332AAB5DF5938BA5397B9D03DAC6F36A8434167D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851938, "uuid": "b409209b-ad51-469e-acf1-2539af18a19e", "value": "1536:6etv3rULgkN95Gtjt9GQ1RyKpoedkmt1Yyfm7ypwYOjl2IHMYv:txkNPQaydYyfm2pwYOx2IsYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851938, "uuid": "8f34149d-0e9d-4012-9b38-57c830b8920d", "value": 108956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851938, "uuid": "b85576ac-8e4d-494e-bddc-190807333aa3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851938, "uuid": "4969cf45-129e-44b8-9e00-07571b562219", "value": "cc9adc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f323041-8d79-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644831270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831270, "uuid": "773bd08a-3f63-404a-a736-7ad37bc9a0a3", "comment": "Malware payload", "value": "2194cc1e6869560199e3380f9f8efc63", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831270, "uuid": "7759ce98-5ef4-4a56-b793-90cfafbe622d", "comment": "Malware payload", "value": "1c7f28b4f9c72f06e4df20e75c82d34386d2f1fa245673a57221007032efeae5", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831270, "uuid": "0cd036ff-a098-4989-98e8-8847edbae571", "comment": "Malware payload", "value": "2056bceb81383707cdd20a1ec797f34afc6f86ba", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831270, "uuid": "7028ed3a-2553-40d7-b92e-c5b4c46be687", "comment": "Malware payload", "value": "70e47629dd846ed5b3c15fd00b6718f0e55b1d43975c2396edbb4fa5f1d3b2386c3e779b5c8a0a6cf969c4f918802da4", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831270, "uuid": "33875baa-2aaf-402d-bff6-8b0b00d38206", "value": "T1D914124D37664F2FE28910735170DAE3547DFEBE9958F19C9A02B780EAB13134E648AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831270, "uuid": "74d7360c-d493-4e1d-84f9-eccaf3ade696", "value": "3072:zq+07+6vg0IhYqRhOaFIks5nUGBKbz93r/eRS8KQxvNDi8GplJlCmBbxe:uI041RxmkuUGBKbdrgS8KQto5DX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644831270, "uuid": "908611c3-c935-446c-97a0-3f1369466111", "value": 191608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644831270, "uuid": "431667af-a12e-4a86-ab8f-7b25531fdd26", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831270, "uuid": "9fa1dcf8-fb7c-4926-9fc2-76075bc6ce3b", "value": "Purchase Order No. 917240406AA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f650a2e9-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845723, "uuid": "42aef8ac-eaaf-4894-86f7-586fa45575f8", "comment": "Malware payload (Gafgyt)", "value": "0ed4db210ef9f27bbff914113ffaec62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845723, "uuid": "87eee41b-e75f-494b-af64-a33bd5c39baa", "comment": "Malware payload (Gafgyt)", "value": "1d6839f6daf704b79a99be37829b2dacf6e68c0c7d256f35a68ce5de125db6b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845723, "uuid": "7f8322c0-71b6-4014-ac19-e85549b9b5a8", "comment": "Malware payload (Gafgyt)", "value": "b07f705acd8cc7af9dacb943c7acb4d73cb832d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845723, "uuid": "2f48b4d6-87bc-4686-b1f1-84c3b641fd2f", "comment": "Malware payload (Gafgyt)", "value": "3614e6cae7b4d17ecf563af757a24fa426dc4b75e7db89720791fce705828d4d71363e8a69e55de3b24f5655fa523152", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845723, "uuid": "3f33d05f-ba0c-4d62-b245-61cbeeaba686", "value": "T198A319377B270E63C0CA507112E30331A7B6DB5938B94397B9E06EAC2F16AC439567D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845723, "uuid": "36b64846-8251-41de-85e2-c28544b330f7", "value": "1536:xAlQciqN95NSt/tZSsOtzn9TmN33FUUPcubv2T:x/lqNPNIH1Szn9TmJ3FUUUubv2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845723, "uuid": "b9160505-3e16-40af-9283-192f04206292", "value": 99791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845723, "uuid": "9ba53a10-bd37-49d2-9c5a-e5c0ec066263", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845723, "uuid": "e7b6b333-e597-4331-8312-5e287212ef93", "value": "qbot.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cac59aad-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644861971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861971, "uuid": "ab58accb-a2a1-41fa-b8b0-6996e233f18e", "comment": "Malware payload (NanoCore)", "value": "3eee9093feec1def7f02a403154addfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861971, "uuid": "80e2d08c-5af1-41ba-bbeb-e0b3296e2e35", "comment": "Malware payload (NanoCore)", "value": "1e1a5e02f16d2de4fc019293ec69d92462378dd08fdf6cfb787440f3034b79e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861971, "uuid": "213bb970-7ea3-41ac-acab-2f1b76a98893", "comment": "Malware payload (NanoCore)", "value": "f779583dc2739baa03d45c33b2e2aed4b7922015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861971, "uuid": "05287ea2-84de-4cc7-b42e-41ca48e5082e", "comment": "Malware payload (NanoCore)", "value": "03c5865b0ee43524b3033b1ce09c33f91edbf8ffe357062437c88875ec3bbd1351aa96b9fc9785fadbc27f77be8f7ca4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861971, "uuid": "b2b42198-4aea-49ba-8b41-01eb2ca26016", "value": "T1F0E44BA67003045DC80963B5092BC4C0B57A1FCA7A959E1D71BEB20C6E31D9BDF35EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861971, "uuid": "d353dab8-d168-468b-8e66-fd12ec6f1945", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861971, "uuid": "b42383b9-a5d8-470d-b67e-95cccca8f881", "value": "6144:2aSrBvqUZ2YmLwE7yZZdyUYu1I9GlXOBafxXC/09GOLb6BiTYkauIelnt+jfx6VM:+B1I9GlPxXCcgAfEXKUK7GB9ay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861971, "uuid": "33520dff-6c23-4f5a-b4d0-6ab8a9a3b671", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861971, "uuid": "daff6cc3-4a47-4a8d-9754-6a96f1a36468", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861971, "uuid": "302a8c84-916c-4638-ac93-dc473fddd9c4", "value": "1E1A5E02F16D2DE4FC019293EC69D92462378DD08FDF6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b7dc84-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644861880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861880, "uuid": "ccb9e127-0061-446b-854c-4c0ec3787672", "comment": "Malware payload", "value": "86374dac2a3e21cbe9206a89e3f83438", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861880, "uuid": "f2c81c97-8233-433e-bcb9-c73aca3d6eb6", "comment": "Malware payload", "value": "1e41383ccc92d267c5264f204fd0ccdb4794b3cba4767d47bc7852942b58f1cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861880, "uuid": "1c07a052-441b-4b2f-808c-c8fe4036c7f7", "comment": "Malware payload", "value": "6462a11b80bf84f55e7049b67fdaea4459c34c78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861880, "uuid": "888b5755-d7ea-4973-97a8-89ef54e5228b", "comment": "Malware payload", "value": "92b1b18399a7fd2e166bd5b1864049e230e0c880428e0824a05a07ee037442c8d0683d79d6066a19bbc94c06d17ee4f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861880, "uuid": "b520fb53-33c4-495c-be8a-0e3891fbf994", "value": "T152A5EF7C256E6E4CF794947CB1758EFF27A2BC2F01AB74F3901CA1D70AA9BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861880, "uuid": "84b6c00c-9e6d-4a60-abd6-2d48abc3f7de", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861880, "uuid": "c52faeee-2183-442f-b7ef-7146180c61e2", "value": "49152:XpEuW1sPapJLiNnscG9EONjeSpsZ5Ruh4c7tPOFi:XpEdtLiNZG93jfpSP1atPIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861880, "uuid": "c39cb6f7-f1e0-4d41-aa6f-e547b9e42230", "value": 2119672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861880, "uuid": "ef43a121-9c72-49f8-b447-6b9571cf76d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861880, "uuid": "a69b33dc-df88-4c41-8637-86d83a8b6479", "value": "86374dac2a3e21cbe9206a89e3f83438.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767ea9d2-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822746, "uuid": "8342fe6b-16fd-42c8-87da-fae04912ac0c", "comment": "Malware payload (Formbook)", "value": "e50bcaf965720bd9c41535e7e8ea19ca", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822746, "uuid": "fd9af904-07a1-4761-8d4c-b0067ea9a05e", "comment": "Malware payload (Formbook)", "value": "1eb4790d6bde96e2486580793a9f6759241f0bde48e6b7f1df0e9a1e62e6a1e5", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822746, "uuid": "44a4d76a-5d8d-4c4a-8d09-8494125fa24c", "comment": "Malware payload (Formbook)", "value": "1902f2e50f1db2c099f7320e5a6f0f886e42a8a2", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822746, "uuid": "8e35bfd5-a303-4ea2-900d-0a38afb209fc", "comment": "Malware payload (Formbook)", "value": "13d1afffe38648fa48bf752d91c695aa2bedb1e844f0fd9f50f837c904d92d176510571252797853a11dc40f7d81c7d2", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822746, "uuid": "bd15351d-c5de-4071-bb28-2e2a75667700", "value": "T11754237E6AD8DC9BD5570C7207BBA2EEE6B6A3011315CE6B87301B9176811C34D363E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822746, "uuid": "d44abe42-07e5-49d7-85f7-55f40b9b2a66", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822746, "uuid": "f4b0eea8-f2a1-436f-9fd1-272a068d39d4", "value": "6144:ow0MnEur+r/RKyoCSeVe+pfd76mn9VqbnkNl08a5YbNNl:QMExr5rceBfdmy9VDXao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822746, "uuid": "21fbfcd5-ba85-4d70-8a65-0364a625c1cf", "value": 296917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822746, "uuid": "d97ed64f-08fe-4ec4-9ca8-c74e9f6cd08b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822746, "uuid": "239c8d76-e394-4b20-8ed8-8220b532fbab", "value": "Rechnung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0ec725-8d8a-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644838571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838571, "uuid": "a97008b9-0cd1-451a-8b29-55d061c0557b", "comment": "Malware payload (NanoCore)", "value": "5dd78651a7d71b2b8136bc950f9a7396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838571, "uuid": "191e6c10-a597-43ee-bd97-d16c6a020222", "comment": "Malware payload (NanoCore)", "value": "1f5eb736d84ae41a3ca7920d3d0930f49e67e597c546cd6e6260c99d7c4ba183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838571, "uuid": "ae5962c7-ebd4-4c7e-b83e-cf3f76dd9f16", "comment": "Malware payload (NanoCore)", "value": "ca4dc5110e8fc5e0317b88bda5b064491868d82f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838571, "uuid": "96c097e3-26f8-4699-a997-0ce4043c1658", "comment": "Malware payload (NanoCore)", "value": "b9051091199a931574c779a14bd357b001c840d5694172b1d55b9275abbe3d61e9b9572a539178059fd2444dde71ee67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838571, "uuid": "c81c8a2e-94d0-4f1a-bc9b-8acf3b518d62", "value": "T1FAB4DF2951F341B1D9A886FFF462D54C1F79FE2F8157F2FA0488603C087DA9886D6A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838571, "uuid": "7c128aff-0d0f-4833-b6f4-91f33bf3aa6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838571, "uuid": "2f766658-d8d2-4d3e-a08c-4169d9c23380", "value": "12288:0HasVEF0GPQXKJf4vPz3XA8OoXWqqom8kd0VJbfB:06su6GPAKMXVGd8q0Tz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644838571, "uuid": "e6418969-c7da-4d22-b8cf-7011c008c4b9", "value": 497152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644838571, "uuid": "219bae87-bdc1-4625-b9c4-6b3c3d378fa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838571, "uuid": "bbf7efd7-29dc-432c-b672-e8213db1c61a", "value": "Quotation Request.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a3fc55-8d47-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644809775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809775, "uuid": "de0a6ba9-f66a-46fa-822b-ede07fed39d5", "comment": "Malware payload (AgentTesla)", "value": "139eba3107901b752d244f7851fb45e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809775, "uuid": "872a7d80-36b1-495f-9107-0c7fc4f54292", "comment": "Malware payload (AgentTesla)", "value": "208ed96080b1bdc06686c5546c64e3f108b01f59dbfc0d261ea69d6abb151beb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809775, "uuid": "f28541cb-f9ad-415c-8b7c-ea08c7c1d007", "comment": "Malware payload (AgentTesla)", "value": "2919dd04083c459f3fb55dbb2d5a04b1c8462067", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809775, "uuid": "95c0cfc7-fa6f-46c7-941e-b486a1db1a43", "comment": "Malware payload (AgentTesla)", "value": "7c93cf1f0691d10c0b89c0b8a0d075007403d1eac3144c4fe40e29140bcf0361985dcca8a2464cb7a6008b21450e0889", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809775, "uuid": "0ad58530-7a9e-4c72-8b41-4be5115f9961", "value": "T1F8151219A773A524CAB903FDE46580500BBD8E5DA186D7BB716E3CCD2FB73824A31136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809775, "uuid": "77ecbf2f-bd1a-4720-89d5-7f8bfd3eb972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809775, "uuid": "fe308a83-fc2c-4d90-bb17-bb4934cb6ffb", "value": "24576:QllXWLZn9NLXUoOFemq4gQLSbRIdZzSmn5Li:mXWtn/bUremyQ+bRIjB5Li", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644809775, "uuid": "4e5cf24b-5f62-45a1-a142-d78a922b7ecc", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644809775, "uuid": "53567c26-8a1a-4955-b850-76beb5ed0470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809775, "uuid": "29c57a0d-e3a9-4482-9b77-801d61a2d14c", "value": "AN__DXBC00319700_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee43c71e-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845710, "uuid": "b330803c-f015-4995-8581-ee6dc0e2d43a", "comment": "Malware payload (Gafgyt)", "value": "83f522c0efa261ec69f3abec3c7df0f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845710, "uuid": "9dc04891-9eec-4fea-8d5e-7600e424bc05", "comment": "Malware payload (Gafgyt)", "value": "219231a714e175105ec1f834b27641cc2cb92be893393e13051efe36036dd092", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845710, "uuid": "446ea0b5-c3f8-4f78-8112-4ba8a42c8f07", "comment": "Malware payload (Gafgyt)", "value": "40bee6d47d21600bdecf05121409913d9496bdcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845710, "uuid": "769a3dca-3192-4fb6-a684-a61d21fa39e9", "comment": "Malware payload (Gafgyt)", "value": "b970dc6366491bb3ae3bc58693b8f4d38f1fad07b5bff062d96a41391fc5ca0b8a4d9cc8f49821cd0c6015158e4b2182", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845710, "uuid": "726e8dba-a18c-40f7-8877-3dd513e47901", "value": "T188C39517AB619FB7DC1FCD330AAE4601108DA55A12E96B6FB2B4D95CE78B84F08D3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845710, "uuid": "9a829764-62e2-491e-b9b7-b356683e68b3", "value": "1536:Q3eTnfX5XxpDyOkIBFTvEyvqZh70ha7l01OcAGtVWy4vhsmF4DKFBJNkiST:Q0PvECqE80OJn5smFkKFBJNkiST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845710, "uuid": "fdcb531b-1cd0-4989-a480-963b7b4d7b10", "value": 118665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845710, "uuid": "1f432d60-85f9-4a23-9bfc-cd98a8431070", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845710, "uuid": "66b482e3-4cc8-4cec-9519-dab49f6a7cc4", "value": "qbot.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318ce35b-8d37-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644802873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802873, "uuid": "7cbcedc1-08cf-41f2-9da8-5fe9ba15dc37", "comment": "Malware payload (RemcosRAT)", "value": "a6dc075da7708333b80de62a17e59ebb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802873, "uuid": "e7694edd-fbee-44bc-8151-34a7c8f8b471", "comment": "Malware payload (RemcosRAT)", "value": "21f77531815c568a9ac16580443fdfa19a9630c1ccdcc3abae12a8fc0f3b4092", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802873, "uuid": "dcc77386-ba3c-4ab9-91bf-3b4faff202c6", "comment": "Malware payload (RemcosRAT)", "value": "fcdd72034ab7f0a708e666a2b2c97e8b542e143d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802873, "uuid": "d49ea59c-c430-4249-94c5-64e68be315cc", "comment": "Malware payload (RemcosRAT)", "value": "a056d9cd61595447e6f59534e807c6ecde168e0b030f3a48be9ec6f5b3243324221c8c4ee24e91240d2b0c7144fbcd25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802873, "uuid": "8f516f10-76f5-4837-91d9-7cec6905d934", "value": "T13695334783D0764AF9E7B7764ADBF5950A66AC04238A7791F1B44C2E0F2876AC8C3317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802873, "uuid": "7c746153-05ec-4ac5-b245-5a79f359f265", "value": "7c41f72bf6fb35e879e68ca7c8a07a6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802873, "uuid": "7779f2ba-221d-4b4c-bb73-99bca1d36f4d", "value": "49152:jdk0Ojd7OJl8N5jO+YGSa8xL3AxhgzRAOm0:j2B7OL8N5jOZGSaam0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644802873, "uuid": "b516e56c-20b2-41d8-81c7-c05e7ce9b5f5", "value": 1972128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644802873, "uuid": "0d4e478b-9f89-41b7-8ca2-cf7ec3810234", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802873, "uuid": "ef56b8e5-e680-476d-a008-807fcab98ff9", "value": "HSBC BANK.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f87e81e-8db9-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644858865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858865, "uuid": "52b1e84a-a1e4-47b9-ad6b-3a367caa1c00", "comment": "Malware payload (Quakbot)", "value": "775c5d7c669b04a24ac9eeb8e58dd382", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858865, "uuid": "c8cda4aa-cee5-49de-a64a-0cab9cdabc2b", "comment": "Malware payload (Quakbot)", "value": "224b3d58500a108f6e4eaaf685bfe9c7d01e4a7e6d29cd271938ef2471ea963a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858865, "uuid": "40b7895c-a036-4513-9db8-eaf7aff5976c", "comment": "Malware payload (Quakbot)", "value": "1b341708f0f16b4d69fd2564e2fbbb982693749a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858865, "uuid": "f2180718-63c2-4298-b3d3-c6bc2c3daf7d", "comment": "Malware payload (Quakbot)", "value": "ceefe840dbedd05527c8fd587445f6cec40c4ca729436a9d26b1177ed8533c36c862daa7c943c830a22fcc05cfbd2ef1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858865, "uuid": "00fc55cb-0886-4b6d-9ce5-daac3a2b6f82", "value": "T1A1050A9DA3D01ACEF1DA28BC761823D90F960FF10A7EA073E1132C8516B51F94E66B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858865, "uuid": "a8da2e71-fae7-4e4b-9655-b2b28dab1d60", "value": "d8b6fe98d2b0a8d6f73ca1ea92363dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858865, "uuid": "e41a8def-7e4d-4c5a-9b43-6f61102b530c", "value": "24576:g74I8i4ZOpi+cQcFRnb9lgo+1TAaKBsXg:5i4ZYi+cQcFRb4o+1TAaKBsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644858865, "uuid": "e781841c-7d63-4453-950f-84d523f69de5", "value": 826952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644858865, "uuid": "d689ee3b-be1a-46e1-8b4e-9857480a2f07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858865, "uuid": "9a4ae4db-cef5-4eae-ada4-cfb9ef15822f", "value": "224b3d58500a108f6e4eaaf685bfe9c7d01e4a7e6d29cd271938ef2471ea963a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a4831e-8dbe-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644861161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861161, "uuid": "0f32134b-5772-4378-82f4-2d73eba4adbe", "comment": "Malware payload", "value": "0cf603ad8381f171fe13adb42be64790", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861161, "uuid": "199d6de9-1a9a-4da8-acb8-efcffef7344b", "comment": "Malware payload", "value": "230c78f374de6fae34705b7fcec643b09689aa0af58252c1589e5ab2814c13bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861161, "uuid": "54b4cc23-bfc2-4b5e-855e-a60ed9993ee2", "comment": "Malware payload", "value": "3339bbb5dce5b54bc1d6a87cc062496fe62af266", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861161, "uuid": "48dfcaad-0be2-47b2-b4fd-051449320503", "comment": "Malware payload", "value": "1780d8e18534cc2614d5ad3cbb33e6e3a509f0230f27d57bf19ceeb0ef576c92b076c1cbe35207b3b7d771d4e2bd2d06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861161, "uuid": "d700b0f5-4d67-42e4-88f9-d9979fb8755b", "value": "T181C36C73F1D08872D0B10E7C9D5AE6D8663EFE202C251657B6E94E4C2D3B2C2296D6C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861161, "uuid": "6a808dd6-0357-4021-a8de-c344c06b2868", "value": "557f0c64436e04f97f66ceeb0911cbf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861161, "uuid": "0850655f-05b3-4484-a891-49a6c9316e60", "value": "3072:Qx7p5EJTJv/DL5nr0Z2fgnXKSxN07IXauEed0Kj6+9:Qx781v/DJ0Z2fjgrEeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861161, "uuid": "7350e2c5-df51-4ec5-a247-875dd8d908c6", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861161, "uuid": "e12c3006-2cb3-42c3-b23e-5a4e8d64f845", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861161, "uuid": "ee37e60c-2efe-4046-993f-ea3534bef78c", "value": "0cf603ad8381f171fe13adb42be64790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8581bca9-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851977, "uuid": "555d5dd0-4d36-4105-8f7e-64c6e9b3e698", "comment": "Malware payload (Gafgyt)", "value": "06ca5eaa7f00ec42607f66f8574c419a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851977, "uuid": "45d04462-7b1c-4af1-a3a7-decc63dd1d6f", "comment": "Malware payload (Gafgyt)", "value": "237be4ef61ffede58e36b38b96f54aa225c5e968c340aa222dbdc46a7ebd5a2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851977, "uuid": "9273bfde-c896-4e9c-9e35-bbf231a7ef0a", "comment": "Malware payload (Gafgyt)", "value": "8d2b24333b88ff9440f5a59cc96488e25e3329ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851977, "uuid": "e4be854e-9add-473c-bb8c-944b73390bf4", "comment": "Malware payload (Gafgyt)", "value": "a958a2f49c16cec89fb6bf6e7aed2cc9298998bc7be23a85bb1aea942acb52646a9673252e450a8ee2f99ea98b158ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851977, "uuid": "038a4794-f000-4b78-8c0d-354e463c6fb1", "value": "T18CA33A43A71D0B87C45B5AF02DF737F087AABD7112A75284A10EBFC45772AB42026FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851977, "uuid": "248e6d87-872c-4a58-bc4f-e3aefeda76d7", "value": "1536:zZzmWnj/2Ilg70klDC0CYXFp3bu0ZtvNKxYUR6Vr5tm7ypgYMj20IADv:lyOO80l2IVpLuuUqt5tm2pgYMi0IADv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851977, "uuid": "d68fcb9e-3f25-485b-953f-9e7a2084517a", "value": 98704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851977, "uuid": "00197ae5-16a1-4e5c-92e6-d9e680fefd20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851977, "uuid": "5380cc45-ec0b-4851-8918-97d363198e33", "value": "cc9ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "997e6f08-8d3a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644804336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644804336, "uuid": "01c4053d-eb21-438e-aa33-85f5a4d7b121", "comment": "Malware payload (Loki)", "value": "519eb55ce54f181ba3fb3e088e8fcc56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SAXONIZATION", "colour": "#5CFFB4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644804336, "uuid": "724619d7-e12f-467f-b835-806b8bfad4fa", "comment": "Malware payload (Loki)", "value": "23b5df2d469238921bc4292d4ad2f179d57b19eba17a93c37af5d3ccae03f1c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SAXONIZATION", "colour": "#5CFFB4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644804336, "uuid": "013301d6-07ca-466e-818d-30844de647b1", "comment": "Malware payload (Loki)", "value": "7c3c3e0ba11f0d2b95daa1d5879ce3da33007b36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SAXONIZATION", "colour": "#5CFFB4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644804336, "uuid": "ddcba1fc-dab0-41c7-9517-94e551755eb9", "comment": "Malware payload (Loki)", "value": "b0dffccc8a69a5f260deeb17503d63a439ad854bd40300492501137144ae907917796f09ddf1c7f8fc89019b10a7eaea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "SAXONIZATION", "colour": "#5CFFB4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644804336, "uuid": "5c1f8ca8-425e-4af6-8ec6-39c6622923e7", "value": "T117A4C03D073CC856F0B02DFC5822DBA97EFC5E21626DF9A753206CD718F5292968909B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644804336, "uuid": "717a2b7d-940b-46e0-a035-c093e49924bf", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644804336, "uuid": "eb286a01-c116-421e-9703-a59a6558e973", "value": "6144:RbE/HUsqtSe9KEPCTNX5fjVrH76Brup88h8h+843ggbxfNSXNISJSdIX3khROS:RbwqhUTNJfjVrH7pv1bxfUdIOCx/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644804336, "uuid": "996cba32-da39-4b64-9109-1cdd600f7e19", "value": 457480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644804336, "uuid": "e27570ad-5d50-4219-9a70-073429e0a4bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644804336, "uuid": "da532319-cecd-4e52-b86e-e3789bd81477", "value": "Invitation to Quote 14-02-2022\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c91f9f-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644823280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823280, "uuid": "8f4a304d-0a86-4c79-b8c0-1e06c97208c3", "comment": "Malware payload", "value": "58943d65a829cb057b7c845ca0cb3db9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823280, "uuid": "cd43ed84-d664-4760-ade9-bb7a5766c1a6", "comment": "Malware payload", "value": "253ff7ae96df0024eb5847c0c31bc1ecdc1e2b9a151c9035b69435b70861d3d2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823280, "uuid": "39ff22bf-70c5-41a6-8d58-8555b1a3d4b3", "comment": "Malware payload", "value": "db8c67a474d363b4325902805b9a4a5b7f1105e5", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823280, "uuid": "95271971-2f24-49c5-89a5-0038fd1b9bfb", "comment": "Malware payload", "value": "47f1b4d24468e4f1df4930b2e7e5b905238f9dee5c55a5bb1d573e4bfb3b0a2d974ec899a878896632838248f878373f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823280, "uuid": "d0db9d63-1bb2-45dc-977c-7750d27fba08", "value": "T14294BE3B7DCDC579E62390759005942FA92DD0CC928AE56B5EF6144A2C20DFB2B03BDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823280, "uuid": "9585805b-e995-415e-80e1-e7fe3413a356", "value": "12288:CK/WqTnfaSjCMu3sIMESSzkBgyFKq5Zr/wlkGu4RWFy:C+/Ty4fu3sIMwcXKq5ZcXu4RF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823280, "uuid": "5b5a7fd0-0e82-4dcd-8b8d-97517e2bd236", "value": 446344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823280, "uuid": "16afb12a-e36f-471c-b386-9b8b1ac461dc", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823280, "uuid": "208fa780-23df-48f4-bcd6-ad0780ce4770", "value": "core-mod.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3f14dc-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822408, "uuid": "7f213fbd-7c5a-4f67-b211-da4afa2ec9f5", "comment": "Malware payload (Formbook)", "value": "922c06537a882aeaff3128b05bc81e8d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822408, "uuid": "e4c5d4ac-9f0c-4f83-9b11-3dd9d8fcc3e4", "comment": "Malware payload (Formbook)", "value": "257a5f4935daf01ede297a7a17717a5bd1c866a96ef707b07b2c7a2ba5fa6266", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822408, "uuid": "3fc6417d-1e7f-4b1b-8eda-ede5b764182e", "comment": "Malware payload (Formbook)", "value": "c648d34d6bd0bdfd909fba1af77465d42081af42", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822408, "uuid": "6b6ea414-ecea-4a73-857c-df1abde73a93", "comment": "Malware payload (Formbook)", "value": "23bf52014f4e1b33ee54f17680f47ec1f62703fd8a0321de538e7ef8f387393554d62793d7439dca992a5b7178f23cf3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822408, "uuid": "217c6745-7dba-498d-b537-0199a5ef85c0", "value": "T10514125E7B9D9C33E10713F2FB66E11C38AAED481DDA36D912687D29107BC4A4C3E621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822408, "uuid": "2a1f99ad-61f6-4acf-9e71-fceb5993220d", "value": "3072:oGQEw4TGG6/rPvl6V5yqxL2mMMRtHwuvn3gWjhj9L1r865sfQAo+3ygiwqg12Wv:xIJ6bxM+tQ4ppb56QA1Viwqgg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822408, "uuid": "b9077b1b-ac18-438b-a7a1-a65bf3e019e6", "value": 192056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822408, "uuid": "1b928189-6ac9-4013-aa51-36657d6a4b13", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822408, "uuid": "4ac4efb1-aeef-40ab-9191-991ad7b6e4df", "value": "Shipping Document BL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04583a78-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644854766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854766, "uuid": "351b32ca-b78b-4950-ac6a-be9356d6c506", "comment": "Malware payload", "value": "708682fb54416afd5fe9c76aa57a54df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854766, "uuid": "262aeca8-3e80-4b7e-bd22-30b523b236fc", "comment": "Malware payload", "value": "25edda50ba9f239d1ab6cd2f5fd8f1736b11ef9cbcd7029f5ffde8442da4497b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854766, "uuid": "59e7548a-5d23-4a59-a57c-99f83d6cb3b4", "comment": "Malware payload", "value": "a4e00331ae804a147a9c21ec169310aea8c35f44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854766, "uuid": "a8d5175d-0a82-4e56-951e-7e88636e9bdb", "comment": "Malware payload", "value": "b324983ec9973002b4f2758b1f672f9f416d8fd62ac2b9748eada9288a4e70e990d3500e4b8abee4ba2a4638e97ce396", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854766, "uuid": "c3df6a3e-54c3-4301-9700-7802f07c0cd0", "value": "T1E4F41204BB37B3B8D47007B999A1A23B26F85F1C1067DFBBA87730DA046336619754B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854766, "uuid": "f3b1716e-1527-4aad-b6d2-1634946f1201", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854766, "uuid": "1d167909-aba2-4eec-8348-dfacb5c46a6f", "value": "12288:DakgsYVTveJ/JDrq7t8CR7vyU5QzgU8LJ5+BNZuLYqTlavK75AtfaBVa:RgsYVTWJ/FsbR7JQMPWE9JavY5agVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854766, "uuid": "8f968f35-bbae-4903-8ff2-89b08cefc950", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854766, "uuid": "c1a5d46d-a1d0-4dbc-a058-87a68636ccd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854766, "uuid": "71c41e5f-4804-4e5b-8761-7768cd202469", "value": "razy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9483618c-8dd8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644872188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644872188, "uuid": "bd4d1588-71da-420d-a36a-fc65bd1eca18", "comment": "Malware payload", "value": "a868693e7dbd1717cccfdd791b087168", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644872188, "uuid": "602429ec-1902-4875-87c4-1a263d08f002", "comment": "Malware payload", "value": "2611cbdb42c4bcff5f9d1027c2b72e38ac6dd5fc76712ebd7d56d833077072ff", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644872188, "uuid": "8934c391-2f9f-4589-a988-01ceb67ddf9f", "comment": "Malware payload", "value": "c77fbdc964856ef9f973815f5fa06cff01a6a277", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644872188, "uuid": "57645e54-0a25-44fe-9d82-fc6cdfc10cf2", "comment": "Malware payload", "value": "7af640316aafa9ca49abcfcd7f89be7209a069217d0ef283f2e0ab633d02df91bd222bfc02fa35b7eaa53937ba22754e", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644872188, "uuid": "32f5b722-230b-4115-81e5-6fcc20e73c2d", "value": "T1012633C7C3487370CAEA1578789B1DD8A03D2C35A0AC5282F9BA558569CC37986FC7ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644872188, "uuid": "dff0419c-7a78-4bb2-9c0c-f43ba93dc2ad", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644872188, "uuid": "8325deef-f1f9-4f4e-956d-15b3be95eac2", "value": "98304:aAe4EjOdYZy/luN09FvgHnVvwLDfcO5ZJz8AW4/EaqOURIjLwRuj:aTjPy/lf9K5wLgOFF9/7qOUvcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644872188, "uuid": "031debb7-0a0f-47ad-b589-f9e27d33ce92", "value": 4542464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644872188, "uuid": "438b6a8b-42f3-4f63-8b38-8329ae7a84bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644872188, "uuid": "30b566de-9bb1-41ed-b6d9-dbb4fb730cf1", "value": "HeroGame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18e8131a-8d3e-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644805838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644805838, "uuid": "575ca23c-e7b1-420a-b585-a863092fcfdc", "comment": "Malware payload (NanoCore)", "value": "9ca4c4d5ef68fc0cb4942809dbb8d4ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644805838, "uuid": "633840a7-e627-4a36-9b0c-14e6997488bc", "comment": "Malware payload (NanoCore)", "value": "263565e9f77b5ee48474855d471315dd56d1bcabe4d037fb380d404b3afcd14e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644805838, "uuid": "7c9ae210-7d6a-47b8-874d-37f296a4ebc8", "comment": "Malware payload (NanoCore)", "value": "16145a9a2d272d7fafe41d1f38704d58d5cb45b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644805838, "uuid": "661fd5c9-f070-466c-a6c7-2922f2eae42d", "comment": "Malware payload (NanoCore)", "value": "561a89ff1e159214941234ef2fc6b044383464adea2431593a77766a636270fc2075a3eb8da2723191fa0998015cd8b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644805838, "uuid": "00f1a88b-c283-46f6-b21e-0a3ecca093db", "value": "T10F15120EE676A255C9B903B9E05184540BB88A1E9057D77F726F3CC93FA73838A3117B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644805838, "uuid": "48027458-6432-4e83-9196-017b80b08613", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644805838, "uuid": "c916a142-75e9-4a25-a7bc-91423032eb35", "value": "24576:6l1tqDDDDmLaKYP10LZ//4I5iNPAa0V2EU+//HhhoPY4cDN:wtqDDDDmLaKYP10t//4bT08EUU/HHoQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644805838, "uuid": "938f22e7-05ff-4889-a8c2-940d67349641", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644805838, "uuid": "adf5db0c-2ddf-4c7a-a60c-54d423da7003", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644805838, "uuid": "cb580ed6-7c47-4799-b24b-7ce77dad175c", "value": "ACHETS039847.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c981993b-8da7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644851232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851232, "uuid": "2552f09a-985c-4698-9689-1d5b9996f995", "comment": "Malware payload (Formbook)", "value": "78dc0d8257b22019cf044d2dfe07a37b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851232, "uuid": "3ecc190f-7e05-4993-943e-2066f35754b2", "comment": "Malware payload (Formbook)", "value": "268dd4d4d9dee456701fd4b39e43c1586ef38101b7f8dc54dff32b423c2a3698", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851232, "uuid": "df144089-9368-4190-958e-5be526b72611", "comment": "Malware payload (Formbook)", "value": "f2aa0e8ec09788bf43ec082b2077f16615acabe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851232, "uuid": "54679afd-a4ca-4e13-b810-20883ca9ab9c", "comment": "Malware payload (Formbook)", "value": "515a428ba86b11e9717ea92422925b9febf93d8cecba22daa37d065827d7420ca8fc33baf15baecf1790a97c375d6870", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851232, "uuid": "71d05d10-ad61-4531-8416-01ab61b61f04", "value": "T1101502017B96AB23C4BB0E7BE8E141025770E94F912BD77F649436E85C8B3791E7123A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851232, "uuid": "6e48bc71-a2d3-4503-b50f-5d2e5a9ba871", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851232, "uuid": "0ab3b7a5-a0e2-4f7b-a376-a2ff10054eec", "value": "12288:x8cbnzXGZt4C7mI8PJR25IvrpBQlDz0RcDmPd5ezpE2peHrJHGuX3qJOZI40fnaJ:CGrCUPm5qFBAX4xdEzpE2Uxqo+40fV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851232, "uuid": "7493ec34-918e-41b2-a751-6ace4357095e", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851232, "uuid": "146b8838-e6be-477d-a0ef-dca7595273b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851232, "uuid": "2609d370-27de-462f-843f-11cd70994ffe", "value": "item que precis\u00e1vamos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3c9163-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644842489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842489, "uuid": "62b8f04d-f660-48f8-898d-9c8ea05606af", "comment": "Malware payload", "value": "304bc629f63ef37d8ca5051dbabea1e6", "object_relation": "md5", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842489, "uuid": "7f434917-cf92-4e5e-bd21-400f991e2bcb", "comment": "Malware payload", "value": "277de7377c1761b5b38a6d246fbd468465565064cce252f8b3dd55a95a2d415d", "object_relation": "sha256", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842489, "uuid": "e3bbdbc2-cec5-4c8f-bf08-54e1665205d2", "comment": "Malware payload", "value": "7123e499f50e5573ec0b8a5f376200001d355413", "object_relation": "sha1", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842489, "uuid": "8c7ba9dc-a774-4976-896e-e6f2f44127d2", "comment": "Malware payload", "value": "5421f61c3e0d607a230619bafd4efaa66f4c0abd2ff32398133696745c629961a1feba90fc64fa4f845fdbb3636bf75b", "object_relation": "sha3-384", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842489, "uuid": "c905a08d-8df9-43d1-9faf-96f39908bef9", "value": "T1796423C666A66923EE55FC199444A3DF24080C7E4BDE77775CAA0D2E0040690CEFDF9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842489, "uuid": "7b9fc4c6-0085-425f-b610-d41d43deca5f", "value": "6144:mQt60MEuDGB48MnA8aywe8nQlmH9kC1+iALMmmv0fZU9+p:mQte3wZnQlK9F1+DLMR0fK9+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842489, "uuid": "d837b3c7-d122-4549-b5dd-79984f7946b9", "value": 327098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842489, "uuid": "8ddbd31e-a09f-4a37-8c1c-87c01194a238", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842489, "uuid": "d7549f15-540c-40d1-bfea-726d5c664f11", "value": "1644827301.Vfc11Ib63019M946047.dynamene_Comp Sets_Ship Documents-INV-P.LIST-AWB-HBL-CH.LIST.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb175f23-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846053, "uuid": "c38a3ec2-5d36-43a9-b317-3f93c989a7c6", "comment": "Malware payload (Mirai)", "value": "64fee196d7a7a2d1771bb1e6df74201d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846053, "uuid": "33a587ad-8726-42ae-9e6e-a77a9b77a0a2", "comment": "Malware payload (Mirai)", "value": "27b6aff6e9c02789e4a27f8bdc835e93b7ef44cde97aa8df21adde4ec9e08d2c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846053, "uuid": "165a281a-12a7-44bf-85aa-1cb2860661fd", "comment": "Malware payload (Mirai)", "value": "5fbe9697e1c5fd39bf5ab0ee1e102fffd1b270ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846053, "uuid": "11a3e960-8ef2-4ea5-82d7-fd314c8adff6", "comment": "Malware payload (Mirai)", "value": "97385dab1b01df0bda522df53dfbf0b4fa9d68da9790b6cc7faa570d71a3ae06484bb36b9c681d276a2703ebdfd34e6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846053, "uuid": "0b110039-afe4-45e6-bd1a-69676f44360f", "value": "T1E9D3B76A3E11AFFEE2A8863007F75F70939525932AA19781F26CD7085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846053, "uuid": "9aae4e64-3c37-4c4f-90ab-98bb8779c92c", "value": "3072:Lfp//iaI8sXbxZewIBjJaGjSQYdPeCB2oKmrCwlPrKnJ1m5h28xxxx8eB0CF3xeD:VKzK/m5h28xxxx8cF3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846053, "uuid": "9a9900d4-5de3-466e-9be1-ca423bace2c0", "value": 137912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846053, "uuid": "e10903c1-d2bc-4eb3-8300-294b9d9f6d6f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846053, "uuid": "ed2961d7-c40f-4714-8bc3-31fefa99beb6", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d2e1a9-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644861857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861857, "uuid": "cfe5e93e-553c-4c5c-8f41-c57fd698abcd", "comment": "Malware payload", "value": "ef6b23d5b4e697022db9d5b23daa2095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861857, "uuid": "31189f3c-ae41-4d57-b573-996d3e345627", "comment": "Malware payload", "value": "280a181eae2d790e6992653b19b216b9407a948f42d32db3ad78e81660ff1f8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861857, "uuid": "0c146adc-e227-4aba-ba93-c797236c69bc", "comment": "Malware payload", "value": "475927c05668c8d5ed45fab0666df17e54419926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861857, "uuid": "c9a896ca-ad5c-4dc4-9a3a-4fd57498259c", "comment": "Malware payload", "value": "7c0df98e27233323ef2ec0adca91a7ec2d55a86fc1dc6a58571137d1370e18ed7e7872c5916fd96a87ceeb1654596577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861857, "uuid": "56026529-0646-4e13-82df-463e2ab922ba", "value": "T1D215010173EAAA23C4BB0E77E5B141419770E94A945BE33BA4C036EC5C8B36D5E72736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861857, "uuid": "1163d46c-1dd2-4d5e-8900-194007ff8cfc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861857, "uuid": "9e33fb20-a1d5-4740-bee8-43e894725f58", "value": "24576:0/dKW4/18tfsZzDE41Blw7EIbY2LFJkdO:ljWtfstEqlw7EIk2ZSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861857, "uuid": "cd3f27d5-de79-4e1a-acc3-516c279d17aa", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861857, "uuid": "4eb9d625-bae9-417f-ad4a-094cb8f011dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861857, "uuid": "dc7bd7de-418d-456b-b675-918d43361f2a", "value": "ef6b23d5b4e697022db9d5b23daa2095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1978bb4-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851728, "uuid": "404a7b49-0167-4408-80e6-678956bf7355", "comment": "Malware payload (Gafgyt)", "value": "8d6f7dd932b09d827fb4e8e24e788295", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851728, "uuid": "3a516b6a-0dea-4a6a-a81d-5147833747bf", "comment": "Malware payload (Gafgyt)", "value": "284fe7cedda755cce46fc4d49bac7e998de77e2ec6f2d732ac138877a9cb3742", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851728, "uuid": "979af38d-2426-4b05-9f9a-cd1a3779f0eb", "comment": "Malware payload (Gafgyt)", "value": "eecab4d4f691a16effa36930d58af3f212266df6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851728, "uuid": "914811d2-544b-42d7-9282-ffdfba8f9b71", "comment": "Malware payload (Gafgyt)", "value": "52fd7da49fa64d4612d6ece1516f7bc83afea18196d569e815de13f8e1b99232c5ec4c801c4de9295cecf92471a51ec4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851728, "uuid": "2641e8de-02f6-4a36-8926-42bf83efaba0", "value": "T1A4930892B901EFB7F40ED77604D34724B270FBA24E532666731739A6AE322D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851728, "uuid": "0bd4c0e3-5e54-4cfb-ab90-d9a7ac9827c6", "value": "1536:o6HrOU8x8Mju8GIDdQmn729ke0L9fWIWeywJgxcTlzSTmQ9VqXjewf2Le:/HiU8djmIBTd71WIWeywJkymmQ9VqXy+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851728, "uuid": "25a805cc-21b0-4944-9cf0-085a9fa6a995", "value": 90903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851728, "uuid": "d964008f-603d-49ca-a05f-523871e5161a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851728, "uuid": "9facfa6c-8e5b-41ed-adf7-1c93a4649810", "value": "i-5.8-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e804cb9f-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644855148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855148, "uuid": "770fffe8-1111-4624-9a50-86bfce69e85d", "comment": "Malware payload (AgentTesla)", "value": "5976912772a3460c8d46fc469d97358d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855148, "uuid": "805bf470-52b5-4ffa-85a2-0b6a6cb86cad", "comment": "Malware payload (AgentTesla)", "value": "285a61210326ff7f555c101bd70e19297a0eae42d1cb60a054c9b3827476920a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855148, "uuid": "a2f54bd3-72da-468b-a191-21adb109a2a6", "comment": "Malware payload (AgentTesla)", "value": "f33813c3d44e101380f440b3032360dc1c15650c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855148, "uuid": "dddaac37-def5-4a17-8ce1-8e9710b1a9b7", "comment": "Malware payload (AgentTesla)", "value": "6a7c2349d4c45648f9feb9d6e649c3cf9ad037e1eb33dd20cbcb739dbc0d35aa0aadfd28479f49a5049db533ea89d17f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855148, "uuid": "786bd823-a5f2-451c-9674-aab33362f6c2", "value": "T190350101779AA613C0BB0E7B8CE152515770EC0A6517D73BE0D537EEAC9B3980E7223A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855148, "uuid": "83cfdce7-cc1c-44dc-ac5e-71748c0e7628", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855148, "uuid": "18551a99-a942-459a-95d4-c3603bf70548", "value": "24576:7MU84QSWspwhTuOjqM9b5EljcdAbB/pG/e//:h8hSWVEk9bOlOmOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855148, "uuid": "f4b33694-8d24-430b-a5de-4d7f5a9f56e9", "value": 1086464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855148, "uuid": "8fdb5e46-7a70-41f6-8572-be977ff3b516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855148, "uuid": "5b206c2f-1b4b-4766-bc79-a92eb3fc2bca", "value": "SAT\u0131NALMA SIPARI\u015eI-34002174,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6aa3c1d-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644821994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821994, "uuid": "9a7c629f-025d-47a2-961a-438440b6a2fb", "comment": "Malware payload (AveMariaRAT)", "value": "6d363778561b5d65e02b5d85ac8bb455", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821994, "uuid": "5898d889-2db0-4175-9104-e45e52522f32", "comment": "Malware payload (AveMariaRAT)", "value": "28afe7923ff1fefa3b52146e319bf89c2028865d826047df505905fb4eb758d8", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821994, "uuid": "c582fde6-6ea8-4c28-b7df-becd07d658bb", "comment": "Malware payload (AveMariaRAT)", "value": "18fb5a24d29bd3cd371f6f1aab72c4bd3cd28f59", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821994, "uuid": "b6085b06-8ac9-43ef-b2f8-243233a2f356", "comment": "Malware payload (AveMariaRAT)", "value": "e08b6ecde1c341e007954792b0af345263182c10168ea47420d6f1620fed814d8590fabac5307807d04f3fef76969b46", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821994, "uuid": "2a77a280-a612-4eb8-8799-33024b54d47e", "value": "T1DE24C8B4694F0872C709DC1E25A8B655AE79FEE374C154B223AFE034CF5AAF29EC4540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821994, "uuid": "638f1d14-92e4-45ce-9a82-44aaacd4cfbb", "value": "1536:ie/fan01fow7vz4vnMWoNf9s4Qc59UzMVXdzFz76mAg5eeVhMDw5wfLU:iUvLdzFtr5RDAw5wfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821994, "uuid": "27aefe3e-903d-4611-92c1-9b5b7cf06fdb", "value": 222833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821994, "uuid": "6403f8f6-9fe5-45a1-afc8-76aa92263ec6", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821994, "uuid": "ced27cde-4b1d-4e55-ba22-a837c741f1a0", "value": "ORDER NUMBER_10130177-1 from AMIX.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49f5b66-8db1-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644855492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855492, "uuid": "7837992f-d66e-4d3d-aa7f-e00349738b28", "comment": "Malware payload (Amadey)", "value": "fe264349c7f70b4bed661cb815a27464", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855492, "uuid": "8824be9f-d5ad-451e-a94c-2310367ef10a", "comment": "Malware payload (Amadey)", "value": "28cde8bb4d2992dc507ad09b8b34385ec6fc42478b75bb4391db43747afae16a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855492, "uuid": "893dd668-7a25-4d7d-b09e-2ef2acd494f4", "comment": "Malware payload (Amadey)", "value": "8ec310836555706ca3cd5dce65a930e002c5cf24", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855492, "uuid": "95fba20e-cdf2-4841-81df-613b8d7e086e", "comment": "Malware payload (Amadey)", "value": "f9dd761a619ec89c8538551085f1cddec63d3c44a6257d64fb255c64dfc1cba1f3ffb12c0999b1e3e4b4f3366854857a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855492, "uuid": "54aef345-99d5-4753-84ac-50e51dcdb59d", "value": "T186658E01F101A136F8B340BBCEFE552DDA68AA61130954E773D85A4F8BA2EF27D32157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855492, "uuid": "ec1544ff-dd50-4081-a1ae-2af47f501917", "value": "0465747311fe70402943db309d0266f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855492, "uuid": "8aec5cf4-86a4-4f9e-a47b-d44b96b2964c", "value": "24576:41DwfHlGOADy7Kq1H1GV328e82fhjlDP97PJf8T1p+uX3i:41DwvlGOADy7RGV3Xe82ZjhP97V8TysS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855492, "uuid": "5982c890-adc0-40a7-9068-b3bcbf616b7b", "value": 1464768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855492, "uuid": "60ee7df9-af0c-4944-bd85-d47dc43c6387", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855492, "uuid": "281d8df1-df98-40bf-a8da-ae7954302221", "value": "Thunderbird Setup 91.6.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34172e00-8d48-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644810179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644810179, "uuid": "f03af28f-da99-460f-94c7-6d6026d43a17", "comment": "Malware payload (Formbook)", "value": "fcb30fe73764cd5562940e39c1e55746", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644810179, "uuid": "e8f7bd49-0b3e-427d-96bf-d17c050000ef", "comment": "Malware payload (Formbook)", "value": "294065651ac215df9a1ff1039eb04dda34e143797bad91a4befacd9021dfdf64", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644810179, "uuid": "4364e9d0-04d0-464b-92db-b8746eb1654e", "comment": "Malware payload (Formbook)", "value": "14e0d9158d58d9581c13bf48dd2a3a44e2ad6f9e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644810179, "uuid": "aaf07598-3683-4ebd-a49e-10c6a902b6b7", "comment": "Malware payload (Formbook)", "value": "142774d4db1edb250e57c84348224177ab01f251ed50ee8af535932506f5ff9aa75dbcb85b75c2b02a130116ba7778c0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644810179, "uuid": "0486f636-6a89-4891-8f95-acb2a48a5a0b", "value": "T13E54232D89E28D23D758B414FE868265624494E5CC9F4C23BE5F2E87580E8F550E7FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644810179, "uuid": "6ab9ff9d-7d83-4bb7-a8a3-ea52ce23cbe1", "value": "6144:zcJ7H2HdJKlldKya42xOXyK0MSn31EkZnBC/6maytHhwdWAVddy:zcJDIWASSnFDQ/xaytHmXddy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644810179, "uuid": "c35b8740-6947-4a74-807c-85fd24e14a57", "value": 284743, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644810179, "uuid": "44d1c7af-c8e6-488f-a19c-8555609cae8c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644810179, "uuid": "72f90f05-86bd-481b-9e0f-684183474ff9", "value": "1644805610.Vfc11Ib60717M433973.dynamene_DHL Shipment_xlsx.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fa31c1-8dad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644853804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853804, "uuid": "9a06270d-5d04-4c35-80f2-930189100757", "comment": "Malware payload", "value": "e35f6758f84741ea9cdd81c77ce163fc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853804, "uuid": "b5eb864c-3502-4b2d-9033-fb6e58ee12fd", "comment": "Malware payload", "value": "29b93417f29f41b856b9be058c7b82b89c28010ad87c38260a170e95b2c1f086", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853804, "uuid": "350888fa-e5ea-4818-8877-9461ceed37df", "comment": "Malware payload", "value": "8e58cde9f04757a821ddb86fd37ce602513d2ba0", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853804, "uuid": "04a2cb62-c399-400e-bcf2-70c61518d613", "comment": "Malware payload", "value": "dee42e7080d15cda5c48aa81e568c73a76f7c2e37d0359e2fab46d3145b14ae73d81df5e16125b9f26b6ba48c461d554", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853804, "uuid": "3d2a34ec-39c6-4b8d-bdc6-be65f1144120", "value": "T16FE2E10CE0C89A5FE1B13F71A85E4D8D6F173C160306396B2211BA95D8A7517AE0F7B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853804, "uuid": "2a53f2f3-df5c-402a-ad0f-73b6f2a6ff91", "value": "768:IxN9llSz9grhY+cZ7f8CXXEIyS4crKA1Mc7v54jtzv:IfpnNY+cWHIyNcrKm5gtzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644853804, "uuid": "9ff40e56-fad0-4cbf-8d94-df785b797b7b", "value": 31932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644853804, "uuid": "c7e43498-c4cc-4eac-b140-35276d4bfcb6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853804, "uuid": "3800202e-5eb5-4ad8-bc34-0545a19040a3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d276f42-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822676, "uuid": "901a47b8-e222-46ae-a1ee-58b74b87608b", "comment": "Malware payload (Formbook)", "value": "1f05c4fe505d798e57a409f494f3b3c5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822676, "uuid": "e3431f11-5408-470f-b4c1-ec93e7b71967", "comment": "Malware payload (Formbook)", "value": "2a170cc5086a00b41ce8ff4bcf8fce45f85aef342d4cf4d08f018943cc5221ac", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822676, "uuid": "cbadd4cc-ce89-4d2f-9adc-8012646e690d", "comment": "Malware payload (Formbook)", "value": "faf7ab8e478cb203a11fd1de53974a3224a9670e", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822676, "uuid": "8e427dce-40ee-4317-b9d8-6b1297217ef0", "comment": "Malware payload (Formbook)", "value": "3027fa284105a5b8d694de965fc37de0be4b5ecbdda739ca828a45d7574967779652af9375bcffe4624485f9844ff335", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822676, "uuid": "f8c9b2fe-1545-474b-b5db-267fd5cfb673", "value": "T10194E02940F380B5D8A996FFF892C64C2F78EA6F9457F6FA0448603C047DBD546C6A63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822676, "uuid": "13f8758f-a5b3-4fa0-921f-ca8b587c0929", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822676, "uuid": "1ffd86d7-a1d4-49ec-92a8-9329b11f8f21", "value": "12288:j+asVwdxv0p83jEhZqOXAsrp9gTbC4DLZLmT:jTsePvl3IqqAsr4T+QNqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822676, "uuid": "1e12eb72-74f3-470a-b009-3a5c63faa38f", "value": 433152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822676, "uuid": "2d5bcef2-bf1c-456d-bcc5-55b3e490e2e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822676, "uuid": "0998d4c0-c9f3-4117-a0a0-efe508c07c0d", "value": "DHL DELIVERY DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf29825-8dae-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644854001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854001, "uuid": "6920cf05-3691-4337-a34c-67a056dae56b", "comment": "Malware payload (Formbook)", "value": "ccc275e20e7a597a5d681dd27a2569cf", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854001, "uuid": "7143a783-4142-4b93-a21a-77b0ac7e2fbf", "comment": "Malware payload (Formbook)", "value": "2af06422e62704ac3eb70a7ce1b5fa08d5a2f0f0bb71b604298aedc24e256f56", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854001, "uuid": "1da082c2-86a6-46ba-9b89-fe48d08d590d", "comment": "Malware payload (Formbook)", "value": "712d5f2a2ec9f5e3bbeed27480e0f8c9c0d9a7a2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854001, "uuid": "ecac36b3-849f-4950-8e2e-849a78cf3a6d", "comment": "Malware payload (Formbook)", "value": "6637f822c48e884223aa2059d3b239a88bae972b0fdd56c5dac0cac5734bb594de0a34f6f019957192e825869bc31284", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854001, "uuid": "240e46e3-df1f-485a-959a-c2da2fb0b581", "value": "T1148402537E23CA12E4258A35EFF3E7043FA1A9B5B9C3C543251614BC8D6ABA27D512CC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854001, "uuid": "d96aeaf4-67bf-48c0-9ec9-6db41dadcb51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854001, "uuid": "08d314d0-eda8-409a-aa4f-be85be5ceffd", "value": "6144:zwMCI7WN9/19Ow66G3rJ+15oGxuRfC7UoM3VT+wz6J+uCwczXwGzvzPSHNCi8YYg:zwMCI7uX9OH6qrgjutC7jMPz6Jh+w27U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854001, "uuid": "790c22c7-8e4e-48d1-a60b-353f6fd8e254", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854001, "uuid": "71274ef0-768d-47f0-8701-aa8759f09c11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854001, "uuid": "cb19dd79-530c-4aec-8a2a-33f58985eaea", "value": "Shipment Document BL,INV and packing list.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d42a37-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845694, "uuid": "85d3ee48-fde1-425f-8e2e-71a800d09461", "comment": "Malware payload (Gafgyt)", "value": "12ab494506acbaf7fec799540fd6f28e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845694, "uuid": "13c207b7-fe83-4cfc-9bb9-ee76229fc986", "comment": "Malware payload (Gafgyt)", "value": "2b6dee62ea7111571a342f55f9a8fe8de5dbe4a33b2e831155968833c87bbdde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845694, "uuid": "780e199e-5f73-4a96-aa9a-faea1bb35fcf", "comment": "Malware payload (Gafgyt)", "value": "8721247799b4d1d68534327547356a848846a1f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845694, "uuid": "b39937a0-9abc-4969-991a-0d6db0f1d766", "comment": "Malware payload (Gafgyt)", "value": "b9a2a63d239ac0054dd88956060bd48eed5ecce6d5d221183f67d261693626fc5df6b3ba745accf9b5c22149badd2d5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845694, "uuid": "bd44b992-4200-4beb-9bc3-493249fe00a6", "value": "T168732A46EB43CAF7C4830BF506AB96AA4531F92A1E269F85F31C7CF85F129C87116361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845694, "uuid": "e892c7e5-77d4-47b5-b25a-8f519f3c1006", "value": "1536:NPA87Wqc/qg06Po+VjwW/g1qPw2ZW9s80tCHkEXRSejfXIQgHmCEmd7eVg3Pfsb+:97W//qg06Po+VjwW/qva8sUkEXRSOFgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845694, "uuid": "92d7db6b-83d5-45be-b157-668e81ce9e4e", "value": 77325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845694, "uuid": "0903299f-5682-4808-929b-b06e02c6ef12", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845694, "uuid": "742187d4-c074-4f75-a1b7-a886193d1c85", "value": "qbot.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f77a5c3-8d79-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644831324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831324, "uuid": "db26c35d-683b-45bf-a0bb-990eb7f7a30b", "comment": "Malware payload (AgentTesla)", "value": "a118f8178d0b197d214e1370b176ddc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831324, "uuid": "58305c69-0374-4a83-9925-25f28297907e", "comment": "Malware payload (AgentTesla)", "value": "2bdd4101f8e038054ae6a169fde832f151b5f9902aac72e62e83416b023963ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831324, "uuid": "a5922e62-a3e0-4222-99c2-e892648f756a", "comment": "Malware payload (AgentTesla)", "value": "78a61c6ce4e4022f7c508387800a6310ddfe8398", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831324, "uuid": "3578b4af-1d3e-413b-a9e2-56a5714afd5f", "comment": "Malware payload (AgentTesla)", "value": "88f83522e80802ee606550944e64dcfad06e8ceeaa4e87663e5dc19a97de5ace6b8116f891d7a36ffb6307ab54e77cc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831324, "uuid": "8455aafb-b7e5-4bd4-aa5a-1fd376884e43", "value": "T1C5F3F2152B50C47BE05787714C369BE7AFBAEA2111A10EC71790BE6D3D23792AF2E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831324, "uuid": "a91c2580-9e59-4880-b6e8-5c0d5c15237c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831324, "uuid": "f357354f-978d-40c4-b18c-ae00f0d58ad6", "value": "3072:JbG7N2kDTHUpouDT/FjbOarJtIYhch4eUhr7Ey0tACPf:JbE/HU//5OAJet4pt093", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644831324, "uuid": "126c37f4-885b-499c-88f0-061c1925d6a2", "value": 161832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644831324, "uuid": "ac8a45dc-8869-41d0-977d-db607e3d8ec4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831324, "uuid": "ecc1fb68-5f1c-435d-9871-3d55e0a22faa", "value": "Factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd91455d-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644822489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822489, "uuid": "7fe2fb06-2bdb-4611-89ad-a99804e273de", "comment": "Malware payload", "value": "b98429402fec219b9910734d36c27cd5", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822489, "uuid": "ee2a1df0-ea1b-4748-bd49-17e0fc6c5a94", "comment": "Malware payload", "value": "2c2eb19d34a3623f1e6bf60bcfd9b21081294a0a13a11ce526d5d68283a680a1", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822489, "uuid": "22890723-8582-4fa3-b2da-5da565372854", "comment": "Malware payload", "value": "2660244df6b8d3ac32ebe66657ccb5144b096df6", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822489, "uuid": "d6acb714-d4b6-442e-ae62-4ac0c5ae4216", "comment": "Malware payload", "value": "050d0c6f9e3943a6dd79ae75988929bda6271e91ec4ff1e8e850b43f5d3db364b15d70de33d50b727aaa8802c34d0cb9", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822489, "uuid": "3d64d22b-aa6c-404e-b5fa-65c3af1b9b30", "value": "T12D141202F4D2D769E815027B499BE294AABBCDCA4D58805F1BC232032777107BDA9B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822489, "uuid": "78f3621d-be2e-4239-a524-21f6bfa5d501", "value": "3072:Eb/XpA4/s0qPXMKfZNaBXHmdjXSf3m8fwoOCi2i99jDQMlD76rtCtFda9MHjeHU:W/SiMPbZNaBXHEXc/fw8iDCtCtFQ9ie0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822489, "uuid": "c2dccf60-b758-4555-bd2a-751889a31d75", "value": 191928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822489, "uuid": "28505c8a-b6ed-4c5b-ad11-c3cc2c2d98e4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822489, "uuid": "feb05278-e089-443a-ae99-db903a3d7f3d", "value": "PURCHASE ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c728372c-8db8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644858529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858529, "uuid": "493997d7-0cc7-442b-a214-cf35d6873ea7", "comment": "Malware payload (AgentTesla)", "value": "d30a4adad685f4b76fcd4996111dbbec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858529, "uuid": "4d3f214a-49bb-4362-9ffc-f9ae1c7c0f58", "comment": "Malware payload (AgentTesla)", "value": "2de7824f180b44cb2d2dda8ce99480abe6144f5f039322a919417c7ebe2abe68", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858529, "uuid": "8219382c-487c-4471-b419-04a6373d9227", "comment": "Malware payload (AgentTesla)", "value": "42a2f5e100fdc721f64efa13b1bbf46ff61f88ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858529, "uuid": "7ff01ffc-c4b6-4b0a-b53f-a3843bb609cb", "comment": "Malware payload (AgentTesla)", "value": "a9b47fb3f81932f9a5776f289286f2371a9626924ef4fabe9d6b02f79a518c00c938e311090902ccb2157331c958b5f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858529, "uuid": "a4021b1d-5d17-48cf-92ec-04cd64460850", "value": "T154352200B733B279C87507F189E2847A26F46E8C5469EE7BD9B372DE02732A25175933", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858529, "uuid": "ebdd3fd5-d6a0-4f5a-9cb1-b10949cce36d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858529, "uuid": "ca654cbe-2110-4598-9235-a6e14119ddc3", "value": "24576:gngCuKRbWDPIxsVO1py20cT/LKhHcH/yj5MfMO2zuG4fB2:gngCuKI6QO1pp0YK8aj5MF2zCJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644858529, "uuid": "76782690-bdfe-4513-8adc-e880473e0147", "value": 1130496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644858529, "uuid": "cd574390-1330-48cd-8b88-95f2cadc2599", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858529, "uuid": "e5417d19-3121-4255-bbeb-8a46f87b0504", "value": "Cotizaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82189ad-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845700, "uuid": "13ca9765-c60f-4638-bf4c-40e146276cc3", "comment": "Malware payload (Gafgyt)", "value": "8dde36f4f3bfa0ca0b624539a17b9116", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845700, "uuid": "471f25dc-2ccb-4904-8708-d80f4eb0214e", "comment": "Malware payload (Gafgyt)", "value": "2f88aa901ccdb41be8656f730220956f37fb46d30413779f219aac313a6c1215", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845700, "uuid": "e0368d09-b20c-4852-b697-907149a6ac0d", "comment": "Malware payload (Gafgyt)", "value": "60ad5452d4959702ba952f21692a60f6a5a3af22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845700, "uuid": "f8e03d11-5bc5-4a07-b314-461a1be85e0c", "comment": "Malware payload (Gafgyt)", "value": "54b5453de6fd1bd9aa05ffcc32f806309a4253ae5d5372682536764f6d1db28edf7a34aade2daadaf9c4fa22fa3ba931", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845700, "uuid": "2641b7e3-a27b-44c3-9ac7-2d9acabefcd8", "value": "T1A69309A2B801EF67F40AE77605D34B247270FB654E931A22731B79A6DE362D43827F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845700, "uuid": "d6a90e41-75ac-4f00-ab29-0cff23c336c9", "value": "1536:KTC9+wEY8FHS4jRPlHm2/n1FjpLZR76EyVofSgcvEa7Jk1mN33VUiPcubVxT:KT4BEbS0P91lVR76EyVofSguERmJ3VUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845700, "uuid": "99497b9d-c080-416f-b4ef-ff7eb5a767ad", "value": 94560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845700, "uuid": "3eb8ceae-de5d-4e3e-893d-205615a440ea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845700, "uuid": "ae4b4f04-30f3-46c1-993f-57bc38434a3b", "value": "qbot.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571f47a4-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644854905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854905, "uuid": "799320c7-fad0-41da-8dc8-17d7191a082a", "comment": "Malware payload (Formbook)", "value": "98dada216714b7a1984e574ab802404c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854905, "uuid": "ef18d818-d073-480b-8c52-5e8b04afe56b", "comment": "Malware payload (Formbook)", "value": "2fd3db9eb65d7a120e24e7245a73e4e88d4b2a7998d82986e8b2e2f20af1d932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854905, "uuid": "4725c821-a02a-4a4b-8c00-0134b32a7f75", "comment": "Malware payload (Formbook)", "value": "614b15a9f514bf12c87967626eac1a9ceeb86ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854905, "uuid": "702fa7e4-7576-470e-bae6-53b0ba66278a", "comment": "Malware payload (Formbook)", "value": "10e3acd58fda2907f042937ffc22900089fea52511af44fd6a6338a27d3a0850872051611d07ba1741d229ba40314573", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854905, "uuid": "201a4374-36c7-4a21-b0b7-f2f6b2721096", "value": "T16E351200B737F3B8C4B117FA88B1D4BA1BF89D5D0526EDBAA93371D426363A54874836", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854905, "uuid": "5e515706-31f1-4bfb-ba0f-5dc206ae7049", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854905, "uuid": "cce0c212-dfc2-43db-88b8-02c330ad5623", "value": "24576:6g678/Iik4WGG0rMGCiTw/XQQbKby93/opzWHHC:6gN/IhGG54TYr3/+WHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854905, "uuid": "838d5c90-e674-4e35-82e5-7cd6a1b047b2", "value": 1066496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854905, "uuid": "b7c5a524-b64b-4921-9c95-8475bbdeb433", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854905, "uuid": "52815afe-0591-4cef-b226-32defb005993", "value": "pounds Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f59575-8d7d-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644833006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833006, "uuid": "688fb99a-9955-4c93-8c07-440d55ba3e39", "comment": "Malware payload (AveMariaRAT)", "value": "d8b4a21a8a3b1dbdd302d2443a24f738", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833006, "uuid": "fba11879-35e5-47af-b745-01e9e476588c", "comment": "Malware payload (AveMariaRAT)", "value": "30ed32134aaf3ad076a403bad159aaa68b18dcee2f1a3fe574d2eda43a85964f", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833006, "uuid": "46297774-0b2d-416a-800f-aba24bff320c", "comment": "Malware payload (AveMariaRAT)", "value": "62b8e2cf695b5c05255deaddd2bd871fc059bff7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833006, "uuid": "ded21446-d287-409a-ba77-b751657ee30a", "comment": "Malware payload (AveMariaRAT)", "value": "676bc4df5e26ce77e7ad0ea69fccf89a9f9885fbe50863d1d79477b32d5b660f05a850f8f6231dc20aa1c4fe7939715e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833006, "uuid": "73c54a58-a9ee-436c-ae6a-c5d99fb80137", "value": "T1AC64127574D1C5BBD84A46709CF78BF2E1B46E001186164FB7627F9B307B1A3E03A6A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833006, "uuid": "d27d1705-f765-45a3-8439-48b543464f19", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833006, "uuid": "c25e9367-93f0-4153-a441-19adf01a8f40", "value": "6144:/wekOYizw6HTW9DMum2kUzCZwwI/b6xQkOB5MverfLHi:CpN6zW9DMXXLIT6ygmrLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644833006, "uuid": "d174e05e-4077-44cb-a651-67e8c81e4ed1", "value": 312055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644833006, "uuid": "965e08ef-06a0-400d-9bc1-40c4f609a4da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833006, "uuid": "ca6f9ba2-030e-4f23-9af1-7dacd84ecb4c", "value": "Nowe zam\u00f3wienie _WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ef3a26-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844750, "uuid": "9f4e26c3-90f3-4be8-a6aa-627bceab3381", "comment": "Malware payload (Gafgyt)", "value": "8f722f8510066b28d992f1df3a5c6c2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844750, "uuid": "646d687e-4910-466c-9065-ea066d19569a", "comment": "Malware payload (Gafgyt)", "value": "314311e7670b25c8e5045d3b56dbadd377471e077e3db9be141afd4d92eb29ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844750, "uuid": "ebb96517-559d-470a-8af2-75430e6e1d41", "comment": "Malware payload (Gafgyt)", "value": "400b37dcc581b43e10df7afe40094f5a38d335d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844750, "uuid": "733f5eae-9029-408a-89d0-586cdc8a1492", "comment": "Malware payload (Gafgyt)", "value": "795df4dd666e57a6a68a07bf1f600b288479d096c2c7ab7aaa7c9991352056a3f7c456d03de493dba3d9bd4d2b505fad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844750, "uuid": "93f65dcb-39cb-4ca0-9fbc-50cc75a02ff4", "value": "T113830797B901EEB3F40ED67644D74B247230FB624E931A32731779A6AE362D43826F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844750, "uuid": "2e2ec6c0-ddb5-4532-96e5-c08bdc969816", "value": "1536:umEF0MVJxW/93584AWzab0y79N1xK19OTetUvZRJifUImzS02q2/cOfBgj:JmP4/Nnzab0y79NPI9+RJemu02q2EOfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844750, "uuid": "24fb9e68-43b1-410b-a707-baac9d9d2a93", "value": 86519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844750, "uuid": "353ec92a-0a3c-42b8-ba27-f6cbfa758a30", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844750, "uuid": "df4e140c-92a8-4d01-8a00-d597338117a5", "value": "Demon.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57996b0-8dda-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644873129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644873129, "uuid": "90975b92-75f0-4c8a-be98-bd579d411efe", "comment": "Malware payload", "value": "3aa15c7d96e47ed362192823e2d4bdc1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644873129, "uuid": "575ce7ad-74e8-4f58-974b-7c2ce060503e", "comment": "Malware payload", "value": "3270c8cf18c8db3ddca05816f85a0526576856c6e28b1eeac2b4557cf878f124", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644873129, "uuid": "b9fa6548-3ef9-4aa4-a6ff-dfaca3161f5b", "comment": "Malware payload", "value": "2f4f0eee3f009119fd378fc22b9d241780d02dc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644873129, "uuid": "15d2469d-49d7-4ce8-a044-c62c9e9fd873", "comment": "Malware payload", "value": "4cb15e48c96f504b3b8033909e4ccd52b4294b5886c3ad1878c18dace5f1ee640bc06ca6a14b0db8b0b239a9bab1e208", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644873129, "uuid": "76a85b14-2ff6-4dc0-a2a7-d191e5c30879", "value": "T1FF41349AB8D3D6CD6763AFB21C7A44CAF01798957E48808BE002FC81B810D21D8D977D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644873129, "uuid": "0735e397-914d-4a09-8d11-cdc01634524b", "value": "24:hPVSTlFE82Cg5d5Xtm3eDZDpOv1U3eZAM1yIwRdvfVWOks7aTeXDakLY9yVDJ7wP:toJgBtRDpvISdlwQNaAjVNiNGBhN0yC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644873129, "uuid": "c2863c06-3d6e-455e-9537-b86240bfbf34", "value": 1960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644873129, "uuid": "aef5d50e-42d2-4e4e-ba49-4c3ee685bf50", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644873129, "uuid": "e66ede05-a146-4bc9-974e-3d3d6a65cb9d", "value": "23.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fc6a31-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851758, "uuid": "ad6d2729-fc79-4c73-a66b-6e4de4a79a36", "comment": "Malware payload (Gafgyt)", "value": "6670f81cbb22ff607189ee7b839de4c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851758, "uuid": "5c42323d-97bb-4afc-be16-73a3abeed12a", "comment": "Malware payload (Gafgyt)", "value": "32aed8d5f645bfba357f69bc5ce993871d4a3e3096ee6502d36569687376cb21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851758, "uuid": "19393544-a1f5-4f2a-bddb-bb14e28f61f4", "comment": "Malware payload (Gafgyt)", "value": "bb001464244f8b9ace743ef27539c7619bc4561d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851758, "uuid": "de90dac0-92b7-45c0-a94e-53a466c95f4b", "comment": "Malware payload (Gafgyt)", "value": "40147f01bf8db30c4187d34ccec79c475e4c0cba098e6c047c599385fb90479d5d361691b4ae9674d301c229d1a5c53c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851758, "uuid": "4e51c458-6d00-47ad-bf33-517066d3c22c", "value": "T16C733A02E742CBB3C8830BB6069B5A290A31FD2A5E2B9F5AF31D7DF49B124C87157355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851758, "uuid": "92f7b63e-6dbb-4a88-936c-833e183e1297", "value": "1536:rFrJBnPHLeWtaiUMgZOrxQDeBqNnNNpBW9mLI2VOCjXUfJRk:1nnPHL4nMgZO1QqcN7MmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851758, "uuid": "6e3e14ad-b2b7-461d-bf9d-37d5ddb10ada", "value": 73576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851758, "uuid": "bcd3c729-c6ce-4c4f-bd36-415143e2ab49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851758, "uuid": "f92bf93f-bc24-4bba-b0bf-8f2d3cc18645", "value": "x-3.2-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "495e3012-8d50-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644813650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644813650, "uuid": "2f08c5c0-c8bf-42ef-a05e-504e92ef06f8", "comment": "Malware payload (Loki)", "value": "be483c32c8c17ee8f9966d66be445805", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644813650, "uuid": "1b7f2c3b-30a0-4240-a8ca-a6682abc8ee4", "comment": "Malware payload (Loki)", "value": "32c63a9d1cee41eac6f20e8661fdcf296058c8012938746fa73e7bf903e05e66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644813650, "uuid": "c8b8a69e-f904-4413-8914-13d25969629a", "comment": "Malware payload (Loki)", "value": "6030389ba55ddef38241af802d595c3d227e6afe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644813650, "uuid": "1d978cf8-db0e-4703-b1b3-10c5eb886cae", "comment": "Malware payload (Loki)", "value": "56ddb82f8d2199014ed70400e892eec6a1494ab7e67564aca218cd8871f58bef98443bef2f5fa66ea4834a8aaaa58ee7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644813650, "uuid": "08e1f804-94ce-406e-88be-c8492dfd6349", "value": "T176B402383FC8D586C1845CF46B7AC5A9D8B2AE156D710A4BF7507F2E843D3E89D982C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644813650, "uuid": "2507830e-6679-4e17-b214-6a1aab862f92", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644813650, "uuid": "2a4dcfeb-fd57-435f-b31f-9a058bf15bc8", "value": "12288:SkjHBlftirU8NSII686tvZD5WqLiQfDj1MNkJtk:SjrU8NI6lDILNkJC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644813650, "uuid": "178e068e-c005-469a-b7e1-43a9a1aee594", "value": 506903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644813650, "uuid": "dd9f029f-ec5f-42aa-92ad-60ffecf8c3bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644813650, "uuid": "8299c420-3d8d-4717-91bc-3c804a3ed481", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "636acdf5-8d6f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644827009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827009, "uuid": "5356c90b-5170-423b-8fb9-b258a26570e4", "comment": "Malware payload", "value": "c70301374b2f49840ce60441d64f9402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827009, "uuid": "3da64fed-5832-4f20-abed-7baca447ded6", "comment": "Malware payload", "value": "33732606f34603c7f039a69a57e3dc422665f5d8eb6fd802a0a780acf75078a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827009, "uuid": "d4631400-fd4a-42ff-b293-8c785e5ebc70", "comment": "Malware payload", "value": "8a78e94d2627c21c09b402d40afe2cd3ece1373e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827009, "uuid": "11ced411-79c3-41de-a9f3-2f941dae9d50", "comment": "Malware payload", "value": "a0948037a41d3f2fdbfa07cd900acd71f1d4e9c621ba60d9ce184fe35d6e4c69f4e0e3a14bf36a052afae3605a25600b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827009, "uuid": "6c18f701-414f-4df4-9a81-13907fe7c7e9", "value": "T176F15341A3EC0776EDF70772BCB396404A7ABA1D9D26DB5D2488D60F1A219004963B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827009, "uuid": "df508eca-c82b-4be8-a89a-815c9afbb0dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827009, "uuid": "40e5d3ab-c529-4c13-b0a3-070ec84c86c4", "value": "96:a4/vpiF2PytxY7DLYowwROVMwsO4JdjK/og0q7CMBKqW0zNt:iF22YXwmBlJJLgTCMBKb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644827009, "uuid": "b23e45db-7247-4958-8b20-95e1095bc9db", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644827009, "uuid": "a42e7fff-83d1-47ac-8df6-8939823cc7f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827009, "uuid": "2da32ada-6af6-4bd5-960f-585250a96af1", "value": "new order 000398586866 02142022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d89cf4-8db1-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644855494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855494, "uuid": "57439276-667a-4bb9-9004-ff6b1d255d42", "comment": "Malware payload (GuLoader)", "value": "1af50d1592ef3c604997cddfe6d6e6c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855494, "uuid": "1e2c44f1-fe1c-48f8-8021-55ae7a581cb8", "comment": "Malware payload (GuLoader)", "value": "338ee076a3641ab7a652189d830ee26334743a6b1c66925d12d54b755a2421b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855494, "uuid": "dfd9a229-af0d-475c-bffc-505cdd92a8e7", "comment": "Malware payload (GuLoader)", "value": "5cf38889c804881d338f69244c0a2d9844e68d52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855494, "uuid": "e9c538a9-cd3a-4a40-936c-0c76c06ce2e1", "comment": "Malware payload (GuLoader)", "value": "aef5ac6ffcf7e4544bb4104b70e621bfbb684dbe73ef4d8bd884e74414f0005654a3859905d0a18f995594c2c8be474e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "NLD", "colour": "#3D7617", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855494, "uuid": "618976bb-8910-4135-941c-fb56b092adf3", "value": "T178A4CF2D073CC856F0A02DFC6822DBB97EFC5F21621DB96753202CD758F12939A8A197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855494, "uuid": "79d1f8c9-48f5-4e07-9d30-2d5df68586d0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855494, "uuid": "6a2cae12-ab6c-42af-b719-e58e8fccb0c0", "value": "6144:ObE/HUsqaHjErV0UjVrH76Brup88h8h+843ggbxfNSXNISJSdIX3b4Ff:ObwqprVDjVrH7pv1bxfUdIOCc4Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855494, "uuid": "6ba93b91-f08f-41ee-8ad8-814d56fa397b", "value": 458384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855494, "uuid": "2d3c8656-5f44-4f84-a94d-e44979b94177", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855494, "uuid": "9225aa9b-6403-4553-9992-a035f99cf64a", "value": "Offerteaanvraag 14-02-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eafb13e-8dbc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644860018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644860018, "uuid": "a49df8d5-271f-451b-bd9d-528c99d77166", "comment": "Malware payload", "value": "980e10687ccab0bab291dc3347f0753b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644860018, "uuid": "842ef3f6-f2ec-4d0a-8130-07e98ac45e9a", "comment": "Malware payload", "value": "33e0fcb502ca6dd48933ae4708beb6fc418eacfc0d864769334830b40763b8bc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644860018, "uuid": "7d42852d-8d4b-4b8d-9921-5819788cf3cc", "comment": "Malware payload", "value": "09e6f2e3a8100f317606dbc8d07b98730007719f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644860018, "uuid": "36d96604-ca71-40cd-85c9-839e225484f4", "comment": "Malware payload", "value": "e63294cd07ac9c75701ca7c07ae0eea7a74a6b955c6712319598eac54a5d127141afee416840ff8bb858f30f45a30f3c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644860018, "uuid": "8c860f26-d7b2-433d-a864-f16e940adefd", "value": "T150F4CD1AFAC340A8336966437A5BF9F2D2FE3094563B295CF0852D8B06D10746572BEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644860018, "uuid": "30fdd6a1-f0e5-4bd0-b7bd-68485af9306d", "value": "96:PUQPDP6VhY2Q0TBZyuQh90FXuZGxhbWtD1q0HYN5Ipl5SQWeN1qdW:PU4D6k0j3FXfhbwJjLPN1qdW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644860018, "uuid": "8ee88b21-dbb5-4242-a26c-4c6902747286", "value": 749592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644860018, "uuid": "a0fafaae-ce96-475a-bd61-8cbc913f1070", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644860018, "uuid": "89967306-32c8-47c6-9c7c-3aaca2ddc8da", "value": "Details.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437158cb-8dab-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1644852725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852725, "uuid": "bdba808a-73d4-432b-a387-19c2b16f2291", "comment": "Malware payload (IcedID)", "value": "c1a448a72b62bcda177c78349386de14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852725, "uuid": "16530662-0a36-4211-8866-665b03f759fc", "comment": "Malware payload (IcedID)", "value": "3496c7d3f8e8d52a634144d3347e1d4a13c34fba01634bcc6e88e477cc3db6f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852725, "uuid": "64a3b643-392e-4d29-b188-6711766f4a13", "comment": "Malware payload (IcedID)", "value": "fc8fbef65f4965bd02714c370ba7ef66c809f1cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852725, "uuid": "5fc881c8-7d80-46ff-9bf0-cd8d67a0685a", "comment": "Malware payload (IcedID)", "value": "48e31d36df478db94c549039153efbcc6ec7c9c94035499f0f5f580762aa46409ceea04a9a18ba93e00a97d892447a7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852725, "uuid": "726f557f-0923-4418-ac34-2f812ab5d1b3", "value": "T113D4AF39636507B5E0739434C9734943C6F17CB117B095EBA3A1325A0E3BFE5A63AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852725, "uuid": "198da6a9-d2ec-43b1-ac1e-f156363e2458", "value": "01f87ec9e1e36146b71b7ffce4fd5fa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852725, "uuid": "d0b1a47c-ab24-4daa-b543-6d8a0be1d4cf", "value": "12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852725, "uuid": "26bbac54-8fb7-4181-a21c-29e48261c252", "value": 627787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852725, "uuid": "0114d094-5591-441c-8003-0274d1ef24ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852725, "uuid": "89179215-1b96-4dbf-a40b-2dc1a27a3016", "value": "3496c7d3f8e8d52a634144d3347e1d4a13c34fba01634bcc6e88e477cc3db6f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73d91a6-8dad-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644853805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853805, "uuid": "55c36eb7-8dbf-4df1-a79e-9a8c10d954fe", "comment": "Malware payload (AgentTesla)", "value": "30eb416d1b2ad989c8f34ccd027efda0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853805, "uuid": "f8651b40-9193-44bc-be9f-2dadd9fe0867", "comment": "Malware payload (AgentTesla)", "value": "34f3444a5fc9763ff3768e66dda0ca99e757dcbb44952270e3b00079d88bd9dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853805, "uuid": "5a0b06fd-3b05-40d8-b30f-ea605660e962", "comment": "Malware payload (AgentTesla)", "value": "037f5b7a4308de9cfb757d358010b8d57b9529c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853805, "uuid": "c1257772-9294-4f4c-bda6-8c1a26eeb1ce", "comment": "Malware payload (AgentTesla)", "value": "89a8709041333213770e54e61160bdf507707118e2bf2097a4981b91ccf64f90b270dd0cf9f60479ae92ed28b2bf86a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853805, "uuid": "3b81fbf5-abd1-4777-aff6-31ecc63bd1e6", "value": "T1DF150200BBEBAA23C5BB0FBBD4A141415771EA0A9517D77F68C136EC1C8B3591E72239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853805, "uuid": "c013cd97-051f-4f1d-a923-c664745930e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853805, "uuid": "1e36cbfe-fbf9-4a13-96c5-89959726715f", "value": "24576:Ui24dHL/G9VdiOXoMrQrrRXfjj9EmCAKP:Uizp4di6onrlbJTCAQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644853805, "uuid": "70910f62-530e-473f-abd8-30d1f83292df", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644853805, "uuid": "5f07c4d7-a616-40dc-b5bc-7b4853828a00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853805, "uuid": "c9d4e1cc-166b-4475-9864-20fc18c56bf0", "value": "7is9PJPFs2JB8PN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd05dca-8dad-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644853839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853839, "uuid": "80b5a4d6-2176-4999-8d70-de7ecaee83d2", "comment": "Malware payload (Formbook)", "value": "31bfb86c7a01db79c1612059e95234b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853839, "uuid": "7ac5bacb-e4f2-444b-9673-bd68470523e5", "comment": "Malware payload (Formbook)", "value": "35c8631e608c2dea5c2969f9f59a0c85317bba6af71f2e56063b8efef57a3e05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853839, "uuid": "7116334e-d827-48fa-9bd5-7f86254f555b", "comment": "Malware payload (Formbook)", "value": "bb04e1025626922369e6d02ed877f10b4336707b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853839, "uuid": "dcf50eab-2486-4592-9305-a099dc1d08f8", "comment": "Malware payload (Formbook)", "value": "a3f4f06d5216dd2b02285691c47658e4573dabd32fa2ac23467173f8d1d4c8b88ed0e0d87b70a3aa8d024c9ba74d062e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853839, "uuid": "f9feaf42-85de-421f-a716-4c7b7dff4902", "value": "T14D150101BBF6AB13C57B0F7BE8A002411770E98B9167E77B549532EC5C8B3681D7227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853839, "uuid": "42880775-c630-4a69-a464-5d87b8e7a741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853839, "uuid": "cc6ff727-c7fb-484f-88ae-66ad8e079d41", "value": "12288:ooX0LClXMWZprcYpgFHD2cuEvkueWDdOpl/3i2c8T4V9E817jl+TQp0WQuBPakEX:o6SWZpw+g2SFrAXMU4bE81nuaXX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644853839, "uuid": "ac3013c7-d4e6-4dee-be2b-7a2aa5ac1156", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644853839, "uuid": "9d63f4aa-da95-4e1a-94fb-87f19de55aab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853839, "uuid": "637c805a-08ea-42cc-877e-d91cbdce445f", "value": "Novo Pedido de Compra n\u00a7 532022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1c1cb6-8d75-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644829817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829817, "uuid": "62b684a4-7663-4350-b31b-3989fda182d2", "comment": "Malware payload (Mirai)", "value": "7ecb2c3f5e5767caff1b44074a367776", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829817, "uuid": "e9ae2bf8-a6f9-462a-89cf-c403e33b5fa2", "comment": "Malware payload (Mirai)", "value": "35cd6cc7e2e63a7ef207cdea84c9f2aaac092eb7db42c5c1cd57539df07b4ca0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829817, "uuid": "c82988f8-e6eb-46dc-a3b6-ffbdf9646c40", "comment": "Malware payload (Mirai)", "value": "9192886beddd964ac81324efe33e6880f485ca9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829817, "uuid": "8921048e-8ec3-43be-9c80-65b5b9e513ba", "comment": "Malware payload (Mirai)", "value": "78bce5a02bdde3079ac96dda5b103efaa4bc4f1fe768e628f23a354e2480e4b5d0d3885c6dd7e7a4552d78012922f815", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829817, "uuid": "ffd1e345-d3d8-4550-885c-06e765227cc0", "value": "T1DE53E781BC41A629C7D11777FD9F559E3700A3C9E2E932178C240BA07A8F94B0D5BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829817, "uuid": "079529c8-a743-4899-8b97-81d26a1e482d", "value": "1536:GogI5uRJ7lshCKotdsVKQCdsy33eZtQqQotp:GogI5uRJCQssKy3w3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644829817, "uuid": "33587e79-d275-4c86-a76b-0a75d6159507", "value": 62900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644829817, "uuid": "cb8d3d5e-7bb5-42f7-bd85-bdabd2c33fbc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829817, "uuid": "af0f731a-6d93-43d4-b96b-2563b24e2de3", "value": "7ecb2c3f5e5767caff1b44074a367776", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d687ac24-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644861991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861991, "uuid": "1951b87e-8813-4577-975d-6bd5d77ab9aa", "comment": "Malware payload (Formbook)", "value": "a6c356fda6bb331beae67127b54e0205", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861991, "uuid": "7a83ab58-ac0b-4129-8175-6d2c14250352", "comment": "Malware payload (Formbook)", "value": "35d9792701d7e60dff3464570fe8020c9136e86cffe8f19a4220b61b8eeb5e04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861991, "uuid": "59c5a2f8-da7a-4c1b-a271-6a658f06884e", "comment": "Malware payload (Formbook)", "value": "7e3aa8db09fe1b653a953bfc86f152bf788cd2d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861991, "uuid": "b042130e-b65b-4c2d-9b73-8a3e0c67bdaa", "comment": "Malware payload (Formbook)", "value": "ad7f87b705f79ff294d32bfab76ea06d869e6293ae70273ebfc12a43b50fe0222da95a7cab5f7489ecf3f884c103829d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861991, "uuid": "d16fd8ab-3516-4609-88be-ff789d30d667", "value": "T181A405812046B769DA160B71B79AC11E8F7759BAA9C2850F36D47DFEB7AC00DD30312B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861991, "uuid": "78c331cd-083b-4afa-9756-d638faf59092", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861991, "uuid": "907fc9d8-d1d8-4527-8305-62ddc1b02d30", "value": "6144:nw82uaAJScHj0N86PEN4dTT/e1jaKFqaLIzx4l0UEKKOtohUXyG4Mv3uQUszsXW:284dTTW1uKdM4SUA+yG4Mve40W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861991, "uuid": "5ffafa83-5fc1-4596-b1af-7e09f2d7ef6d", "value": 472257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861991, "uuid": "67f19464-afb8-40f4-bdeb-ff207ca23059", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861991, "uuid": "72da3cd1-08b8-4b95-b624-c6f1c13279e2", "value": "a6c356fda6bb331beae67127b54e0205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5224db8-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844755, "uuid": "7c4bcb24-1a9d-4aa2-8760-bc40604043fb", "comment": "Malware payload (Gafgyt)", "value": "ce67be961642f440639ef5a6bbd09ef3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844755, "uuid": "32d7be33-8a13-4c5f-a98a-e37daeebffec", "comment": "Malware payload (Gafgyt)", "value": "3613129646a5a8844ad821303e1d627925403338fef091b46d5d43b638504c2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844755, "uuid": "8b7a4ccc-949e-46cc-a229-9902971ac107", "comment": "Malware payload (Gafgyt)", "value": "a99364142fc17fab4cd335e6b3eb87bec9d11b90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844755, "uuid": "2598876e-6a1c-48db-8d48-4f89a91e8d36", "comment": "Malware payload (Gafgyt)", "value": "1888392982be533fd9d4337de8aa6c8a7407baa21a0d1071264268b0ba90b3ff64f3ecfc41623cbd15161663fd2ff8ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844755, "uuid": "fc490af6-4af1-4c42-8c5b-8ccb3d5960ec", "value": "T15CA3842A3E21EFFFE568863107F35E7097D5629226A19386F25CEB181F6128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844755, "uuid": "357b3e20-6954-4e9b-b0ad-3e28e91d1150", "value": "1536:S7j+1TfCq+LzIfK2rKIfmaHy6rfV2D3nen2bS1jxlrimW+zWBSirHzai:VR/fymd2D3m2bS19pimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844755, "uuid": "5006d64e-c608-43a0-975e-c84228f69347", "value": 104712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844755, "uuid": "fc6fc645-0d73-4376-9945-756cd8fc6f58", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844755, "uuid": "8938ff7e-38a1-40f3-b316-5cb59677d712", "value": "Demon.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b200e7-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644851458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851458, "uuid": "02750acb-3359-4c9c-a586-e98a764dfb1d", "comment": "Malware payload (GuLoader)", "value": "b56181fd70c88089199b3998d1df63a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851458, "uuid": "02791393-0111-4731-94c7-6d948cf6a014", "comment": "Malware payload (GuLoader)", "value": "36270bcb438f8ba61f564e255cee66ee55bb44ed797aca70810e534691785618", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851458, "uuid": "713fb236-6a4c-47d0-abfd-c494681dd69d", "comment": "Malware payload (GuLoader)", "value": "2d01553a4a32b24a36e32261f366bf27d71f3322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851458, "uuid": "1cfc13fd-18c0-4db6-bffa-a26218e164b5", "comment": "Malware payload (GuLoader)", "value": "e6d997d29710057fb7f66b3ff504092d936f1f751748654a1b1e9b7f8b9068ae58503a8a24c8f74dddae7401eb41955b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851458, "uuid": "6c8484ab-bea0-4c43-b077-85b770a48b4c", "value": "T15024F1157F41DD93D4760A790C68D7B689F6AF112228CC878390BE2CAD333E0DB2A756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851458, "uuid": "7fde8ab3-3020-46f7-af39-1e4ca15c2693", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851458, "uuid": "b7047c18-3d98-4e55-a83f-0b930ac93313", "value": "6144:ebE/HUVuMG1AOaBgGNdAJ0voIAvqZlOEiZn:ebJuMG1AOsgGNCn5klOEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851458, "uuid": "37f12502-ae1e-4dc0-8c30-306fc3f93f8e", "value": 229848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851458, "uuid": "13b633a8-c979-43dc-af83-a65460810db8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851458, "uuid": "6e8f094d-f34a-42e9-9fe7-4cc5024c5c2c", "value": "098765345678909876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01808f6-8dad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644853766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853766, "uuid": "ac9de95f-36f7-40c1-9e0b-0ffa75fce4bd", "comment": "Malware payload", "value": "44025f5f227a1f4405f907b4867e7ea0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853766, "uuid": "7546cccc-08c3-4257-bd0e-9463ad6ce8aa", "comment": "Malware payload", "value": "36f2d793b10293fb6fe344acc0645b1f0022c80633d06388dec0b69e214734a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853766, "uuid": "2fb44ccb-062c-407e-a1f5-98cbb747f1c0", "comment": "Malware payload", "value": "c46fe3b1759dcf4b64c7a963ba0f20ba6555de72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853766, "uuid": "659aa7c8-e3ad-49a7-85fb-d88c8000f4af", "comment": "Malware payload", "value": "9cf646bbec4ee8368639d8d0dfde514e3434581eb23230800fcc7342e4a073e36c4835d6fc7b9c0b0887b56ea18f8324", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853766, "uuid": "fa8faba6-e15a-447e-ab70-f3c0d2b3188e", "value": "T19C03F1147A8A8D92E7DFD7B01B2D8AE0B334488C2911C690A24FEF537AB58F35316CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853766, "uuid": "af5327f9-62aa-4726-b955-2384fbee5142", "value": "768:sK4W4G5JVM1YYpPqazIW1Oe17qlsr9EGvo4KOFXg4uVcqgw02NWXS9ZEzd+pDhZ4:sK4W9H61YY0p7cx3oZyXg4u+qgw06WXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644853766, "uuid": "daf13002-dff7-4216-acfd-eeaa0fd8b105", "value": 38200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644853766, "uuid": "8da7f0f2-9392-414b-8610-75382bd6297e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853766, "uuid": "2d1838af-49aa-4135-9773-589dbf18dfe6", "value": "44025f5f227a1f4405f907b4867e7ea0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc96ba2b-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644855129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855129, "uuid": "60043e9c-a36e-4a66-a82d-f267a4134b45", "comment": "Malware payload (Formbook)", "value": "646cb3ad1fe8996def617c6a4f5f1b36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855129, "uuid": "4d52cc56-91fa-46ae-80b5-a11ef8d3ba39", "comment": "Malware payload (Formbook)", "value": "37a33a9a958fee18155dbe436b263dd70ad2494a8cf46abaea59aff017fa0384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855129, "uuid": "fa5bee20-00d7-4cbd-93b0-33a60e448a5b", "comment": "Malware payload (Formbook)", "value": "42bbb094662b2d84aea78e77dc0d1ccf3945584a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855129, "uuid": "adb4d991-cd2c-4713-9acf-437dd3d3e50a", "comment": "Malware payload (Formbook)", "value": "647dfd2ad87ba932b88bb8c48a8b4d62db7fc3aab9568c135c26d28a4fe16bbe61423711c9b61b63a0d4d06b80d14605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855129, "uuid": "10911cf0-9658-4654-aafe-3ae2fc19d88c", "value": "T1FA54231A76D1AAE7F023023255974723E3BEFC101657228B97C2AF6EF1211D3D99E643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855129, "uuid": "483353d0-a971-4e54-847d-1dcd5cb2693c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855129, "uuid": "dff695d1-1681-43a4-bad8-e482c955d0dd", "value": "6144:ow47Fhf/8asT4+2GqlgYxI4t6tqWoK27qnPNiCp:Ep9/8ass+dqGKL6aqnPNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855129, "uuid": "0c739018-2899-4555-8091-9025ccb608f1", "value": 300480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855129, "uuid": "7673c7f7-e7fc-448b-9e13-9e6acaae2900", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855129, "uuid": "daccad87-8870-4ebe-a362-f4771d7d7466", "value": "Dekont - 140222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e338f714-8db1-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644855570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855570, "uuid": "30e7a916-4d09-4d82-a79e-b98e8bcb4c05", "comment": "Malware payload (Amadey)", "value": "d2efa752795f3f95572c05e4072350b1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855570, "uuid": "57cd8dfe-9ed4-4e68-bc5d-ce1cb91cdd72", "comment": "Malware payload (Amadey)", "value": "385a1d06223e4d1469f1b9b7438d7219f57dbb13042750b16df81c72bcc664bd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855570, "uuid": "be9e6a0c-508f-45e9-9aa1-245e22623eb0", "comment": "Malware payload (Amadey)", "value": "a044f05dcae9abd3cc6ead9b44c27c852c75dccf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855570, "uuid": "b51d6726-199f-44ab-9dc0-32f21bca6614", "comment": "Malware payload (Amadey)", "value": "600ee5e8fe2d5ec19d12011f529f9e72dcbee83ac001361346423a5273c0c44fb59ea03f3c524faf015efc1785ff761e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855570, "uuid": "255f5b31-3361-4b91-9ec6-2752e17ec38f", "value": "T194659D01F102A136F8F340BBCEFE592DD658AA61130954E773D85A4F8BA2EF27932157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855570, "uuid": "4033de55-ad01-48f1-ad5c-493941358711", "value": "70afed20bacc09511480acc840f7b84f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855570, "uuid": "2033b6d7-e5ff-4a08-995f-2d3995997b4b", "value": "24576:nF0q+DFRuQf1iIVjZAU95z73oSqCfFS2gr/75DPxTkXrC:nF0qUDuQf1zfAUH3VqaFS2Y7tPxTkXG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855570, "uuid": "70be40d6-a33d-48ae-8985-a20aa880ec64", "value": 1464768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855570, "uuid": "74bba309-6a62-4f3d-a419-9b79003f645f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855570, "uuid": "2d0ff153-6ebb-4292-8d60-8a6367ad337b", "value": "LuminarAISetup_144033_4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ee17b1-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851712, "uuid": "63b5f3c2-bb02-493c-a8cc-fb8647307d0b", "comment": "Malware payload (Gafgyt)", "value": "9d91075944240fa2dce582344f637962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851712, "uuid": "c1ca98a2-2269-43c4-8602-38cf850b6cde", "comment": "Malware payload (Gafgyt)", "value": "386aa4f8fd47b24a67282b79256f1bc614fadd110ec46cfc8a4f797b3c4c4aa6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851712, "uuid": "76235a78-81ef-433b-bfcb-6ae4597e7cb7", "comment": "Malware payload (Gafgyt)", "value": "7e3971bddff7ad3c25ca39d9a5757865cd7dd83c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851712, "uuid": "0e2b7483-0a86-4929-bbdd-f92ae073b856", "comment": "Malware payload (Gafgyt)", "value": "fd989c565f8d9f22a74b84e0eb7d1403032533e1cca05b7fd3d5dad35edc5c2b0619e230bb4c18359c7ba37189e2fad4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851712, "uuid": "2d4ced5e-f79b-4239-b4b3-bdae8f48fd87", "value": "T166931A41F9458B17C2D327BAE7CF435D77356A54ABD73301AA346EB42FC27892E2A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851712, "uuid": "5cbf510f-c6f4-4133-ba64-bb92f0c8fcba", "value": "1536:bRv0B8PnMuSjKfkimuCkKB3K+xEO9CePXdYZ9lmREqQ4b/X7XSee:a87S9GCy+SePXdYVmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851712, "uuid": "7b346881-9c81-4cae-81a8-bdef2c199e44", "value": 90584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851712, "uuid": "e495d622-c6c4-47f8-9ba0-f66cd8f05268", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851712, "uuid": "55324758-8a06-41e2-8cb0-4b054986563d", "value": "a-r.m-5.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e639df9-8d8f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644840610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840610, "uuid": "cb970761-e98a-4347-9800-1cc22ff4b759", "comment": "Malware payload (AgentTesla)", "value": "44769eddfb08be54d5ed3a286142c80e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840610, "uuid": "b57a6ae8-e3a1-444e-b533-54a1ac4ab05c", "comment": "Malware payload (AgentTesla)", "value": "38af3b771bb1ce162dc33562ab4a63ec814338471287e8f30cb9676bb75252e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840610, "uuid": "a7f606a3-e7d8-4d0d-8a26-b69b756f8738", "comment": "Malware payload (AgentTesla)", "value": "c1ca301683fa56f229e8ba6bbeaea023eed7e4f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840610, "uuid": "14cc738c-6df4-4ada-ba07-cc5a94c09826", "comment": "Malware payload (AgentTesla)", "value": "4285e0558709902de6081119796ec2c29204ae37ab564e54c430ba32a1855a11e08773d09f5836b453f561191cc7cc5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840610, "uuid": "2e169348-288b-44c9-bfd5-3a34ebbed181", "value": "T1E515020177EBAF23C47A0EBBD8A191005770E649924BD77F68E436BC1C8B3691E71276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840610, "uuid": "4f5cac8e-4fb6-4dc9-8158-f13891616527", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840610, "uuid": "445f6e78-f91a-4f67-8369-59d3cea2f041", "value": "12288:IvT/XYXuoezRZcP7WogC0R6yDwaBGYc2JxLowu8VkU8U8LeRZtpTZtzVMGOlyUuP:IcXutZgXgPRndVxLj18Uj/lZtzeuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644840610, "uuid": "6318f4d7-8ad9-4588-996b-329cee1da69e", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644840610, "uuid": "8ef3e9aa-5fd3-4504-84b3-53db9fc08722", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840610, "uuid": "de04ce83-4117-4fff-ae16-87ca9aec2af6", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdad7eac-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846058, "uuid": "097456d3-1fe8-4f23-8234-b7e275f9a3c7", "comment": "Malware payload (Mirai)", "value": "889d6f021ac23282b20ddc78db1cf70f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846058, "uuid": "75d73edc-89a5-44bd-8967-a823a159c39a", "comment": "Malware payload (Mirai)", "value": "392656eed8d4788314c7d101452f92cd23acaa851eb7ed2f356d05756f4fe4d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846058, "uuid": "c97a9cdd-6167-42aa-a09c-02084f86e773", "comment": "Malware payload (Mirai)", "value": "2730629f2eea4923879d86a21b734890f7dfbe64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846058, "uuid": "5df0403f-bd13-40d7-9e6d-226d4cb4415f", "comment": "Malware payload (Mirai)", "value": "55d4642e6093d4334c8db6d1e2d287dca9d24a96823119655de3df6fabdc11737dceee8585e6d104d8cdca0ad5e3d837", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846058, "uuid": "5a03398d-461d-4381-8271-4a186db66b11", "value": "T1AD934B0358615FB3C045ADB125FB19340B67BE260F4F1E9A752CAAF4474B8CEB41EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846058, "uuid": "a0fa4067-c7d1-40d9-8e10-3bfdff0fb2ba", "value": "1536:nkpIk8LoETkzbPKTbH71xuZ8kDC5xZvCE5h8PyAsEMnhR090jUeQfXm:WuyfST7uZ8zvl5h8EEMhR090QeQfXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846058, "uuid": "44babf62-f282-4490-85c6-ba3d629d10d5", "value": 95916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846058, "uuid": "c93558d4-e61a-4266-9b86-171e6f230a29", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846058, "uuid": "5408644b-8242-4f17-aacc-b970d7136e9b", "value": "openssh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ad543a5-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644842537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842537, "uuid": "b758701f-34cb-4a10-b2a0-a9b6c7e54df8", "comment": "Malware payload (Mirai)", "value": "ddc7ca808c47ea0b6b2cd9dc154c50f9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842537, "uuid": "00fe9a2d-1d00-4372-a642-43a51f709b8f", "comment": "Malware payload (Mirai)", "value": "39361274468b290d9d2ce1a0db4a02d6546dc1af850d68bfa61970f409da7964", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842537, "uuid": "39322de0-67fc-4147-aced-dd59550d1123", "comment": "Malware payload (Mirai)", "value": "8b5c5085b22544c65554a1aa4de2834e8c3fa823", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842537, "uuid": "0ccd1cc5-e2dd-4ae8-ad63-00eed0a31f6d", "comment": "Malware payload (Mirai)", "value": "4e9595f1a1546300f067280430cfb351ab79e739b5d01786242fc0b27dabbfa2e76374fe02c09d846c3052dd8d7ab4ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842537, "uuid": "ae41aa1e-4b5e-4feb-a62d-09d872a9575a", "value": "T186B2B689D959237FC7E1B3BFDB99428E323A5B8873EB75368134419437C83987620A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842537, "uuid": "35f91d43-4593-4532-9f43-9051e0165299", "value": "768:R9ID3SWWefoSkN+av9bfGDt0C8Mh3/HcnDD2:nID3L8jN+Ynu3/HcnDD2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842537, "uuid": "31bc6eb5-47b5-415d-837d-c23a7f44bbf2", "value": 25443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842537, "uuid": "0b245700-7f31-4fd3-9900-579005acb532", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842537, "uuid": "afe9bfa0-4b4c-48f9-a694-1dcd5b1f9b38", "value": "ahsok.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2221e8-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1644861977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861977, "uuid": "14ce6e1a-22ba-4ea0-a2b5-986701ca96a0", "comment": "Malware payload (CoinMiner)", "value": "3d65603d81bb5ccdb6965743e5fd5355", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861977, "uuid": "3292cdc8-9f6b-4821-be99-1d5f86f4f20f", "comment": "Malware payload (CoinMiner)", "value": "39a5592307e15f1f09859534419c0c6ea0b6c052b45a22b2df0acef1c1bc77d4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861977, "uuid": "f770c54c-511c-4c95-ac6e-ee526cddf9a4", "comment": "Malware payload (CoinMiner)", "value": "7eefb6c68015a13abf828e0caafe29944022fdf4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861977, "uuid": "88829669-74d8-49da-ab38-0e1b87718ef9", "comment": "Malware payload (CoinMiner)", "value": "2e46174e4e7ddccdd99f74179bfa8a2198f1da16ec18613fe1d09539b458d75b146c8f47ef48a8cfcc42d8ee9ecb240f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861977, "uuid": "ae30514e-6fee-4400-badd-3470e45d33de", "value": "T19E8733826B969617CC26493FC033C9F854E06BCE1F81DC9B5E4A78936906B2BF74F164", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861977, "uuid": "e03fe24d-dd22-47cf-a40f-9069d30accba", "value": "ab6770b0a8635b9d92a5838920cfe770", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861977, "uuid": "47bfcfe3-2827-4f19-9668-8ab2cdb58348", "value": "786432:Yp5yPF8CK/TZVMzitvZUcipWFgVjKDcSe4SX93Q9w3a42ZtQpXjzl5542x4:Yp4PF8P/Si3OWyVwJehtC4MQZjzl/42K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861977, "uuid": "1bc0c42e-6aaa-43d8-a5c7-13a5f76e937b", "value": 37557944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861977, "uuid": "29c4b7a9-b306-4d6b-bdc1-7083fe7383ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861977, "uuid": "9d5f4bc3-ccf7-483d-b751-01ffea08dfd7", "value": "39A5592307E15F1F09859534419C0C6EA0B6C052B45A2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ef2869-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822993, "uuid": "66b79e77-a399-49cd-b8ed-84db2d48db9c", "comment": "Malware payload (Formbook)", "value": "05c8263d7b1ee1dc92c3bd2bb83d8db6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822993, "uuid": "757306a6-768c-48c1-8e07-ac1e4ff3799c", "comment": "Malware payload (Formbook)", "value": "3b0ea9fb4bcc9cebe136e3d53d6da997fcbc00ac690f5ec9381d75941be38875", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822993, "uuid": "44065d3a-03b0-4974-8b4a-6d5389b0fbf2", "comment": "Malware payload (Formbook)", "value": "6f851fb750160dd21f49d1dddc6952a901312295", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822993, "uuid": "1b750dfa-e66a-4f54-a084-4ece6c53f530", "comment": "Malware payload (Formbook)", "value": "4c7cae4808aca9e026dca691321f7ccb4dd46fac733bc168bc56de1c31ca06e33d721da433610ab7f0b412699b996fa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822993, "uuid": "53846efc-707b-4553-ab76-2d41ed6f43d4", "value": "T182A40595204AB769D6150B71BB99C01E4F7719BAAAC2850F32D57EFEB7AC00CD31312B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822993, "uuid": "b06b170c-08ee-41d0-8ebd-1d5276642c01", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822993, "uuid": "7ec38f50-51f9-4774-8080-d315de224802", "value": "6144:nw82uaAJScHj0N86PEN7Rhx6S2VwUkSN6djKeZupvOZQAq1JYF1i984dkkF65eHj:287OVwUkzzupvOJqb84160I8sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822993, "uuid": "bde59508-28b6-4cc2-8468-532545f9b573", "value": 470418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822993, "uuid": "23ff6b1a-229e-4ec2-8106-e8370dc31b9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822993, "uuid": "391b5516-cc0b-4f0d-acde-d6968a52180b", "value": "05c8263d7b1ee1dc92c3bd2bb83d8db6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f26c61-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644854720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854720, "uuid": "c0d0a1af-ddc6-4970-90a4-9c7e7ceaabb4", "comment": "Malware payload", "value": "83473b31c451698df4d2264a6c0271fc", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854720, "uuid": "4673bab2-4423-4a75-b1a2-9e589e8a3712", "comment": "Malware payload", "value": "3b1fad417984d51ae5c74996abec1d525df4054bfca02ef824873aac048dd0f1", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854720, "uuid": "69be278c-8b95-42c9-87a2-85e896e89d3a", "comment": "Malware payload", "value": "2b3e0fa0d8568b90870ea098dbfaa8bbb77ce7c7", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854720, "uuid": "6933f28d-1f86-4c5e-abca-2c1d0b58ad33", "comment": "Malware payload", "value": "9479061f74824c2748c9672c288665f2820913f3c25b255e436ac0ee8a40c47906dc92f5363314925fe26d5b4518ff0c", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854720, "uuid": "2e4bb363-43f6-4907-80a2-1b470fa14853", "value": "T137425C3DF7488F96CB4BB2F4B715BA15005C796413C5E5F67EBCB7702B822AB560A410", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854720, "uuid": "0667fdcc-b2f8-498a-a521-48f887d3080a", "value": "192:Yd6mSGRBgmJGQB1FwDr2JqyZUYWo0cq33GyviXmbLxmQU8zV4goRFAShLz:Y7PAKGQBbWQq33GyqWbL0N8zVHobxtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854720, "uuid": "639d626f-ea67-4fbc-9343-451d9ed62f77", "value": 12090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854720, "uuid": "f2554314-2896-436e-9712-5e193f3c1d20", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854720, "uuid": "dcfbeac5-9246-4b9e-92da-a5118ab0e65f", "value": "settlement swift865755688.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5431ae7b-8da7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644851035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851035, "uuid": "c319d3c5-d62d-4edb-8ad7-c6a28c822458", "comment": "Malware payload", "value": "0f32c7dd5bb3006e80fae2d5d5523909", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851035, "uuid": "128a8cd2-305f-44e8-8efb-f13969556ff7", "comment": "Malware payload", "value": "3ca3218a88bc561481dc50c742f71982d904338673e317407b5d50ec71919a33", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851035, "uuid": "89bc4de0-88ba-48d2-ad04-89203d8efd4e", "comment": "Malware payload", "value": "467eaf23c7a061f2d4278a02e896f86c709c1c2f", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851035, "uuid": "03d7e338-1249-4514-861e-6d6d62ca092d", "comment": "Malware payload", "value": "993ec43bc0a0c7891e3812017a9b9cf716ee69aa8289d30a3d720708760e3251e5cd03bf0e3ae685a1d685046a6cd9f9", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851035, "uuid": "233bc8a8-26f8-4b41-af55-61d07e60dfd4", "value": "T1F29533BC639E3120E428577F0709AE14FDE36CE72D6F2EE85237A86198D4C6F4686570", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851035, "uuid": "d6d31036-0755-4cf0-826f-0faaef5a34dc", "value": "49152:4Dq78csAcIMNUL3nZSFkU7+7vj22Z/OWeilAUMhriMi:X7a8RLJYkU27ZmwVMhm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851035, "uuid": "492b24d8-f742-446e-b177-77a7b0aa9761", "value": 1911371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851035, "uuid": "fb69b3a3-437f-49ab-8c32-8a93c62876ae", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851035, "uuid": "0a0960cf-43c8-4fd1-b97d-eb8c37a70005", "value": "vema8v63_Receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5127dcd1-8d8a-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1644838574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838574, "uuid": "779f3e3e-b6b2-4607-87d7-bf92173a0043", "comment": "Malware payload (NetWire)", "value": "7934a1e6470b0899d4637b3642ddd64f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838574, "uuid": "681e7eec-6681-4a7d-869e-fb5b8e278183", "comment": "Malware payload (NetWire)", "value": "3cc9ec44e7516c0db0a27794c540fcc5a0c6d322821debaee8bd4d0a1231b4df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838574, "uuid": "88725f1d-dff1-4a8e-b189-4d7b01db45ee", "comment": "Malware payload (NetWire)", "value": "c513b783ec46bda7dfec62dc38039464105a28c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838574, "uuid": "930d0e48-4ba3-41ed-bf19-f6129ded3f9f", "comment": "Malware payload (NetWire)", "value": "7db81b966305684a00c42b799f7b5abfc3cdca5ba5f9dc0094d6c316dc1f973080020286037fda069913189f3b8c4ce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838574, "uuid": "227da000-91df-4378-9fea-029453258ba2", "value": "T14FA4EF2950F341B5E4A987FFF861C94C1F79FA2F916BF2FA0044243844BDA954AC6A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838574, "uuid": "90d2d290-9e2c-487d-94fb-5c8722007837", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838574, "uuid": "63513793-cda0-4391-a25f-e60f5c9877ae", "value": "6144:EMasZHvtEI3n2y4nD33uRZmpqNJA6H59TnpCTgvn+mpFwob7F/kwNu3ITv3/S1kS:EMasVCs2/+vDCwn+UN6Y36ey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644838574, "uuid": "1761d961-204e-495a-9833-c8434b3da0c7", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644838574, "uuid": "d2d23347-fce3-4df8-997d-1cd364c8178a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838574, "uuid": "7ead08cd-a16e-4923-a39d-ff1a386a33e3", "value": "Quotation Request.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947c7d3f-8dbf-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644861451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861451, "uuid": "7fab0821-12e7-4f32-b06b-11881f68f3ad", "comment": "Malware payload (Formbook)", "value": "55d290d4ee1551cbd5d950604d91046a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861451, "uuid": "9a2ed6b1-393b-403f-bacd-d5b8cee18da2", "comment": "Malware payload (Formbook)", "value": "3d174736215fe6e473a00315a499b908cb5975b351366dda0601345e516f7e5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861451, "uuid": "e715a817-e907-4fa1-9cbc-c3eef8168609", "comment": "Malware payload (Formbook)", "value": "0bff7d07a50f9accc2315b09f7403ebacce28254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861451, "uuid": "241bb29d-b952-4eed-839b-28328dd48d2f", "comment": "Malware payload (Formbook)", "value": "e76a36e0e700f42c93710d20e12c65156b456de51a1a10a1bf713e2ebfc5049e4fbb774578428cca11852656b7178851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861451, "uuid": "66285b3c-4f4e-42bd-b49f-881f96a7ae57", "value": "T1B71502017BE6AA27C47B0F7BD5E1420197B0ED49915BD73BA8C532EC4C8B3685A72339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861451, "uuid": "b488c5cd-620a-41a6-8239-ac0182de0cdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861451, "uuid": "fc31b6a5-3088-4c8e-9ceb-1a8daa82045f", "value": "12288:eRPKyeZsTizXoR2qXDTSX82VpSEMFqBLlwpIMF2jvT7J7MFZakF5BjCmz0cGipPx:ed9WE5vSX8iwFoLGpzIfSF5BmMGipP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861451, "uuid": "b4799882-452a-4bcb-aad7-e5157194fdeb", "value": 904704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861451, "uuid": "94cba1ba-d12d-4f70-b569-145c380b236a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861451, "uuid": "e6de903c-adc3-46a4-8708-936853f998a5", "value": "itens necess\u00e1rios.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0c37b1-8d73-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644828605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828605, "uuid": "2ed364a6-3696-45b7-a179-d3005eef2697", "comment": "Malware payload (Mirai)", "value": "19a8ea080bd16fbb63d70ec16a8f4543", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828605, "uuid": "87f0a66f-0963-418c-a38d-492ad4a639f1", "comment": "Malware payload (Mirai)", "value": "3e4f387d1303d1e3d9d3dfa9c321c1bc2daab8648be63a93b7d4bb2eed49351c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828605, "uuid": "194fcbbe-9bb3-474a-9cff-24bfb56420ce", "comment": "Malware payload (Mirai)", "value": "b9f8ef04c67e1a43471ebb60ae2f33e9a1269906", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828605, "uuid": "95bb672e-c747-4340-a2ce-dd17dc7607c2", "comment": "Malware payload (Mirai)", "value": "dd6fae41a520aa227bff9327d24f161a0b6fc05d51fd646ee4cc060fb07869e2d31f2be4f84b37dd0a7430f7dbe09daf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828605, "uuid": "c0ad4f04-6c56-49e5-ae72-b6405e85c690", "value": "T169832981FC41A622C7C11677FE5F018E371593D8E2EA32079C285FA03A9F95B0D67A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828605, "uuid": "6d6c4f89-dd94-48ba-a954-ce3128ce6f54", "value": "1536:NySHwrZKkRozEsK3afU33eZtU5SWmXPeTriW/SnvL:NySQ9Koi83w9XPe31KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644828605, "uuid": "dc43f25c-a0a5-411d-87d5-faca8b5b04be", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644828605, "uuid": "8a02e370-bf0c-4b9a-8fbf-42a6c3c82dd7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828605, "uuid": "2341fd61-f8fd-420b-9be6-36388fe9f8af", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ca277a-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644842525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842525, "uuid": "0bf5d81b-6963-4719-9197-3840b9074b8b", "comment": "Malware payload (Mirai)", "value": "7b0d407d0087312d86271aecfe6db466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842525, "uuid": "93dfd874-c710-4d5c-8494-8931350e651d", "comment": "Malware payload (Mirai)", "value": "3e61db15ace719a2912a6988fb3e1760c6d8b007989d8ee55f79829411de6629", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842525, "uuid": "d42af2df-7169-4ba5-a3b1-24f631263d23", "comment": "Malware payload (Mirai)", "value": "ec2e4c935155787d325d6d45a33cfc9c5f65e204", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842525, "uuid": "5274729b-6777-48fa-a49a-4cabb67c89c3", "comment": "Malware payload (Mirai)", "value": "e42ffcc6e5802c0f6f5e22431de3017a5ac87dcd697cbcbf740158bfc4d949eb97d8438985e527151e205adfb1982b33", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842525, "uuid": "5c7b130b-0872-484d-9ef6-8e4800f11e64", "value": "T18C333B95FD819B17C6D12137FB1E43893B2B0358E2EB73039A2A6F60378B5960E3E515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842525, "uuid": "87a3351c-d92c-458e-b508-e1cd995e4b9d", "value": "1536:1fnUKixrkXQXd+HkMPYc+u+EIpcRkOF2vCn:1fUDxUQXhugcAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842525, "uuid": "7ce0a638-b8aa-4a49-aa83-7c8a75b1ecbc", "value": 54600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842525, "uuid": "9a8458ec-a4c1-45d4-bce2-cb4bf1f92d52", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842525, "uuid": "262d8c3b-badc-4da1-b328-c24378d26f87", "value": "ahsok.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7770df3-8dbe-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644861187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861187, "uuid": "605b837b-cf88-4806-825c-c2532f7253fe", "comment": "Malware payload (AgentTesla)", "value": "b6ab35f7b409ea8f9ca093ef929036b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861187, "uuid": "c1896262-ab51-4cf4-bfd8-1e11845074b0", "comment": "Malware payload (AgentTesla)", "value": "3f2272f054cad149c4a29c0d59042a2b70ef4088d9a63e40f17808a9499c7be4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861187, "uuid": "5d10b609-fc0c-4cbf-b9d8-9642c77ab58f", "comment": "Malware payload (AgentTesla)", "value": "c4613eeff878e24736034b3112adc0130dd5768d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861187, "uuid": "b06ee101-d4b9-4797-9d27-e6f3fbdb7250", "comment": "Malware payload (AgentTesla)", "value": "40c849dbfce37d36542a894540c97dba7ec1d0b5015a674166967b6448c22538e291d10c413bacac29284ca1c45ee7e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861187, "uuid": "2dc246d3-1b98-42f2-bce9-265f87f80740", "value": "T15B94DF6940F341B5D9A897FFF862D54C2F74FA3F9527B2FA0084613804BCB954A96A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861187, "uuid": "9979a9e3-53a1-48ef-b9b4-265d19f77324", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861187, "uuid": "5650b27d-5e4d-47dd-8db6-f51724b5721b", "value": "12288:LBRasV2RRdj80z/LJnDx1gT991duWuw3zjes:LB4ssRdjrZx12LuWuAzys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861187, "uuid": "13b1a92f-0a57-454a-aa04-7fe41c502fca", "value": 439296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861187, "uuid": "66de46cd-399a-49a1-8fc4-4d731b346cef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861187, "uuid": "b7468cd3-10ad-4fb3-995c-b4f2015268ce", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8dbe5df-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845728, "uuid": "4ccb9757-f104-451a-8fd3-0e063f29078c", "comment": "Malware payload (Gafgyt)", "value": "73e5bccde0863dc98747b0e03316555c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845728, "uuid": "09e42145-495a-4ac1-a2cc-065a3ec75a17", "comment": "Malware payload (Gafgyt)", "value": "40a746f4f689055047c22bb04455a5396341b784c8c394aa81518d8a5f4ca6b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845728, "uuid": "0dc2c721-b280-436a-a06a-d7000d6b248f", "comment": "Malware payload (Gafgyt)", "value": "53a7e3a0ddeaf6ed49439ad2bdc00c5142abca33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845728, "uuid": "2ae87e32-ff30-4bfd-a002-4acbb9c30331", "comment": "Malware payload (Gafgyt)", "value": "e0ddc56e08d1c48c9315ec6de5949e5bca6cb0f79697c2246e437c5784e9c51a25ce76403d2e840b36698d732ddbfaff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845728, "uuid": "38cbb0f0-83ee-4653-883d-9a00e7b1b5fc", "value": "T188933B2356A1C67FC0C756F92BDB86658823B4390F32720973D8BDAA2F25DC86D5D312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845728, "uuid": "ddceae45-6e7d-46cd-918c-b5c26db07aa3", "value": "1536:Hu0Z4TZYVO3B39a3ceyPedfKdVbcL3P/gVXGwjSxma7SWgCPcgNozT:O0Z7OB9a3ceMeAdVgjP/gVzWxmYSWgC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845728, "uuid": "d315d828-0025-4135-a331-1a5e1ebb27ad", "value": 88936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845728, "uuid": "3114a819-2743-4a5b-a5d0-c79f0ab25a62", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845728, "uuid": "04f71e63-fe5b-49e6-b332-e429f8988777", "value": "qbot.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef575278-8d77-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644830679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830679, "uuid": "a14d6f92-b932-48bd-9c9d-ef9c75d8f2e4", "comment": "Malware payload", "value": "07a5f670c6fe1ed9abd738cd8bb6d9fc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830679, "uuid": "70b70420-b8ef-4765-b2ab-d6f171bfd846", "comment": "Malware payload", "value": "40c20a4c010b8d6e3996a15649a3d74c7399c28b2f46ee4e0653987e8abac406", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830679, "uuid": "7c1d9aa6-7b1a-4cda-b26d-2c8dbb574600", "comment": "Malware payload", "value": "f8255286494f3a29e5f6fa7584e81d4ca1552be1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830679, "uuid": "d7766b64-2d5e-4101-bc2d-a9b55a0c9c98", "comment": "Malware payload", "value": "7a1994d2ea97ce0922f6e941bafb9023b63ee8e5e03f9da6dadd05e64bc893e0be4858ff86f764188e2d9bcd7ea7b0d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830679, "uuid": "506db7b9-d308-40dc-b385-fb74ac7ae592", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830679, "uuid": "f26974b0-8f4d-42c4-a201-bf26d7f526d5", "value": "3::", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644830679, "uuid": "965aa7ee-b218-4f87-8128-0ead6b7a0242", "value": 364544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644830679, "uuid": "7cefc9e1-dc50-4674-b75e-89a3f7cd0ffc", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830679, "uuid": "36b327f6-a06f-4cc9-8565-798081cd4196", "value": "SKM-201200001.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac78487-8d54-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644815451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815451, "uuid": "a08ad36b-17ee-49bb-b44f-0aac94710ddd", "comment": "Malware payload (AsyncRAT)", "value": "afe82f228dc79fb9ba3f819ea237413a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815451, "uuid": "407c6a78-3dd4-45b3-9412-47ca8d86c60e", "comment": "Malware payload (AsyncRAT)", "value": "40c935ce8104afa8a498a4bde6146fb548e202370212ebbb7851ed443b3af510", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815451, "uuid": "6c319a3a-42f4-4e4d-866d-22e2c7e84998", "comment": "Malware payload (AsyncRAT)", "value": "02745772a2fa58f222d16e70a190d3850b14d1a0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815451, "uuid": "4b8fb69a-560f-4e9d-adac-1cf56a14d9d2", "comment": "Malware payload (AsyncRAT)", "value": "bd48853f46012178b996989b7c327e7d77e6318b7e3c0778d0b9f083f4c74af08015310d21bb3527bfb430c96bd6155a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815451, "uuid": "d6295056-0f06-43a4-aa39-2dada3cad91c", "value": "T1C105AC37EFD28D0DC1E58A75947C0DF0B663B93A8D86877AB059298B2AB33D60535037", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815451, "uuid": "bdb8e4a5-0968-44f1-91f1-516bd6be958b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815451, "uuid": "3f3fb063-8b53-4ad0-86f5-bc15eeb6f2a3", "value": "24576:ZqzZIKLZygwr5Ubd8fUYLLSFauC0XGpN:cZIKtyPUkJLWe0Wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644815451, "uuid": "62f469f4-aea3-4906-a674-677ada2fbd61", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644815451, "uuid": "34ee6dea-9211-478a-80ff-1cd87146a6f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815451, "uuid": "73582616-a8d2-4c9b-9cc5-bfcc8ff68643", "value": "IMAGE00933.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08090ebf-8db1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644855202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855202, "uuid": "72dd623a-ac96-4960-a5f5-6f9f792006b5", "comment": "Malware payload (Formbook)", "value": "f7918d4a953248d4878f0332bd235a53", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855202, "uuid": "e3360d9a-64a3-493f-9b82-70c1b740d81e", "comment": "Malware payload (Formbook)", "value": "4109efb7c98f3ead5d49711ab77ffc4af944d4e1891f203ec19b2027e401cbd1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855202, "uuid": "16bee300-c226-46a5-bddf-08724df40b7d", "comment": "Malware payload (Formbook)", "value": "9b3b366b1270a9a2bee971233185c9faa185e994", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855202, "uuid": "7edacf98-a271-43a8-b8cc-5523d88e93bd", "comment": "Malware payload (Formbook)", "value": "bc2c798b6ed5b544f96871ac1d9c403ad4cba3e4f8f78ffc1d32fd384c01bf163cab2c6f8bf36e1c5982332359493a00", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855202, "uuid": "cba62669-dc39-4012-a38e-8128739556e3", "value": "T10941546E39A7B664D6233EF7ED8B4C1DD96065467638C680770C87C50C250EE6782D4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855202, "uuid": "51e42c41-ab37-4d35-995e-209e925a897d", "value": "48:r6h2/jSNm7eEBmUcPTIMArTnQPAcgOIzm2rd+LL7XEyKn:2XNmNAPTIVTnQATL4LLLE3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855202, "uuid": "a516b9ca-89db-413d-b315-bb2bbeaa8ec2", "value": 2420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855202, "uuid": "a7f06573-08c6-4a87-b32c-7b8ec64ce4d2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855202, "uuid": "a2f40bc8-abe7-44ee-a3ce-63589ab6f7ef", "value": "\ud55c\ub77c\uc0b0\uc5c5\uac1c\ubc1c(2022.02.14).pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cdf32b-8d69-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644824415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824415, "uuid": "b86be28f-6bf2-4270-adb3-0e980577f2d3", "comment": "Malware payload (Heodo)", "value": "1f775992567c55d812fc3c5d2e7cdff0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824415, "uuid": "21afd73f-c219-4f5e-aa5c-9f7ce2fc6544", "comment": "Malware payload (Heodo)", "value": "42dc0192bc1d6d9734b77a0dade69942b4bee2b21b53169e7f814650f65a906d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824415, "uuid": "7798d6e0-65bd-4678-8a5b-21438a34767f", "comment": "Malware payload (Heodo)", "value": "698f00dfa2b388449cbfa79be6a90a2191f54390", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824415, "uuid": "52abe6e3-c2f3-4da6-acb0-005752a6a1be", "comment": "Malware payload (Heodo)", "value": "0986e1763b16eb03c55d80530d1e91c0fb4f208f5988ddbaeb359dbabcc0fbfb8edfa6b1ffdf2deb56c2325e5ee71342", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824415, "uuid": "7ea48650-e5b0-479b-ba3e-08462d65df38", "value": "T1B025BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824415, "uuid": "6e68c7f7-04ca-46a4-a641-f56513c1d9d7", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824415, "uuid": "54fe88c3-be8e-460e-b52f-64163f46ee80", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2ghFIIm2mlg:kBiaa4powXiolDS2ghFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644824415, "uuid": "b01805ea-978f-4276-8c1a-a5f0513da31d", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644824415, "uuid": "41673dcf-702a-4322-9a98-8ef6b5944cfd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824415, "uuid": "459dd563-91fc-47a0-beff-34a4f4e36cca", "value": "emoa.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec3c66e-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851724, "uuid": "635938d1-79fc-4b64-82ad-fa5d42c48f50", "comment": "Malware payload (Gafgyt)", "value": "25b1145199b04b74139e91c4943f2a18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851724, "uuid": "d3beec44-1317-4499-b254-f33955536fb7", "comment": "Malware payload (Gafgyt)", "value": "435473f85883ba3dd8eac557e5610ba0446470d3d5ef5e77959adf17ea06dbd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851724, "uuid": "08a80e0f-73c4-4671-8412-651e5447f4e5", "comment": "Malware payload (Gafgyt)", "value": "1e913028410c4725a7e21804152605f7c5dffe61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851724, "uuid": "39ba2568-d4b5-41c8-bd62-fb24544ccf07", "comment": "Malware payload (Gafgyt)", "value": "2c129a1bcf97da33635228fb78d8e8c7597d7442e4696046b0c06571b00106eba48e80aacbf4a75e40b57009de409b42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851724, "uuid": "e4d07914-ca68-4742-937b-42a4244dcf6d", "value": "T127833903B71D0B43C49B6EF12DF727F0876AB9A116A36580A10EFFC45772AB02512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851724, "uuid": "57eda29c-e90f-47b8-a853-53f40c90fc77", "value": "1536:dOQmbY2NzheR8/cNm3rroRUVgfpqGrrBEmQ9VqXjtWf2Xe:dOFfwwcNm3wLLrrBEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851724, "uuid": "6d567010-5c38-491c-a78a-5bfc31c82073", "value": 84692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851724, "uuid": "028694bb-6d4c-4edf-ae09-cb22f5a734ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851724, "uuid": "96749747-b92d-487f-92a2-b9302d5a0f99", "value": "a-r.m-7.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77399ef7-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644854530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854530, "uuid": "cee67706-a9b0-4e60-805e-8de82cdca5f9", "comment": "Malware payload (SnakeKeylogger)", "value": "6769d5cf50a7af84090017bd0d30d53f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854530, "uuid": "ea4d6bdf-a24f-4ce7-9aea-ef2d73eeb17d", "comment": "Malware payload (SnakeKeylogger)", "value": "43b68beee5436ba3af6c92c7a6ef60dc02d2b57aa5520ba007ba8b84d71c7d3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854530, "uuid": "dc9c1961-a326-4e1e-bd48-10c2d0ecb7c8", "comment": "Malware payload (SnakeKeylogger)", "value": "965dfc4780eb08ea45a1beccbe4c5c221d01c262", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854530, "uuid": "c8fb8506-d33d-441d-b8e4-16d7d2ea5b40", "comment": "Malware payload (SnakeKeylogger)", "value": "5c8d5e4dec57a9781367e7e253201267827d905ca86feb9a5bd87233438ea7923e02cfb9528ade1fa63893d77058eaa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854530, "uuid": "ab89295f-5909-4c2a-9740-5b0cf7810a4e", "value": "T17505020173EAAB23C5BB0F7BE4B242016370E94A1107D73B688536FD5C4B3A91E72676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854530, "uuid": "9cddd540-8d24-4c78-a6bb-964e096b06f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854530, "uuid": "f2e228e0-c8a6-4507-a3a0-e924a6a4fb02", "value": "12288:C36CqDXz8o7T7R+PBDAvY2jFOPJatXhVb1u507KQU/mHjj+VAoLJakKX:+6738QgV3H2XhVb12a5H/+3Lf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854530, "uuid": "80979b32-1fac-4934-8b22-48cf16280943", "value": 841216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854530, "uuid": "c410f944-50bb-4779-a5ff-5362e55807cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854530, "uuid": "af008125-58fc-4eea-854d-0e24a5afd483", "value": "Dekont,jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce24f093-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644822893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822893, "uuid": "5d9a0b7f-63b8-4c71-bad8-9099d64921b0", "comment": "Malware payload", "value": "1704dada103f993dd2af85cea6e10be4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822893, "uuid": "8581b232-bee1-4784-8528-c070e5566b43", "comment": "Malware payload", "value": "463d267e2c13c1272437b5f11650364db854353d392e0ff90866025007403a7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822893, "uuid": "e637ebc5-ed88-486a-8305-765954b182cb", "comment": "Malware payload", "value": "77e70f227318cf956baf00f3e91f882dbcfda723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822893, "uuid": "0937a535-949e-4176-8b63-5c606f10d5b6", "comment": "Malware payload", "value": "bc592531a2289bc12210ee95b6b957abef837db2e2cb0fc47a9b9678046177dbb7a0ad718be1e308632ac3a905db7505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822893, "uuid": "f98e8516-50c5-4790-baaa-9ab1a17733b3", "value": "T11BA6A05250899B169708B12F3D2D4499F08A6E3DB72AB3497243FC0E5E722F99F3D136", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822893, "uuid": "acc2dd12-4da8-45f4-8602-82c262999f16", "value": "f052f84efefe84f64ac7fab273eb8464", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822893, "uuid": "f3e6b55a-70f3-4b0b-a7a7-da03551f976a", "value": "196608:Sx09Mu4q1TKDaoGwS8CxBNwPwx1bW6waCpj9KZJCxjjeey:Sx0hF1T+afTBNBNWOkj9Kiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822893, "uuid": "91b42506-6d92-46d3-8704-f630c1a5059f", "value": 9929947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822893, "uuid": "829927f6-ca04-46e4-addb-c488144e8bcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822893, "uuid": "6370398e-b7e0-418a-84f7-11f3fb46334e", "value": "PL23XX-M_LogoDriver_Setup_v400_20211229.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf59ced4-8db2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644855939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855939, "uuid": "2af9b822-6675-4893-bf4b-07f438c279ec", "comment": "Malware payload (AgentTesla)", "value": "bdc44684da5c43f4f556bf89cae8cc0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855939, "uuid": "4ef6daf2-d1c3-4a77-b6f5-340e5fba04bb", "comment": "Malware payload (AgentTesla)", "value": "464eb99146f85d892ba73c3da832dbd36d93466be670b8524aaeb554d5e40419", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855939, "uuid": "88cfefba-fb6c-4d4e-845e-f6a6e3e4128e", "comment": "Malware payload (AgentTesla)", "value": "88a1aed012de3266d05a7d7112cdbfa849f93307", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855939, "uuid": "0b4c38b9-9478-4203-bdd1-ec6db36e0724", "comment": "Malware payload (AgentTesla)", "value": "e7a5f915826a47457e59dc706055a008254524873651664f93ea644c02d40bd505281defd045c35d719dd864c3cc1956", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855939, "uuid": "c835e501-66ad-4f2a-96b6-b25a1fcaba8a", "value": "T1CBC29301F6D8C371E3A647B778DDB14CE2AA9C2D1617D99AE8943D9C0A712C02DF653C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855939, "uuid": "5f96a9f5-ca17-4e81-a136-b4a413527ae9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855939, "uuid": "72924363-ac79-42ad-b779-7cad4ff21917", "value": "192:jgVet4PeTY5U66tMHeKZhlbYexDxzmNR3uBDjhA9AQuIeJanF4mGEvNesGA2:UVoq6KeKvpjxDBTxxVAqmtvNesN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855939, "uuid": "28104f19-5797-4fb0-89d7-fd031dbb1edb", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855939, "uuid": "362b69a4-d60f-40d9-a885-904c2fda2e62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855939, "uuid": "194f1423-dab1-4d70-92dc-c5cbfc0bb9f7", "value": "Platobnu kopiu_Tatra Banka_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1cfa62-8dec-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644880685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644880685, "uuid": "7c7f2355-7dc1-42ee-aac8-0f512b2396a9", "comment": "Malware payload (AgentTesla)", "value": "e9cad02e20b04140931455a17d202575", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644880685, "uuid": "8b4eabe2-91de-4fe5-947b-88a3b7cb0d83", "comment": "Malware payload (AgentTesla)", "value": "471ec3688166a04e35d8627c9d9f2420f2439dd9a551d0b9fe8be216c4b3a7eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644880685, "uuid": "fdd34d9d-b3bc-445a-9ae0-30a488b98529", "comment": "Malware payload (AgentTesla)", "value": "61323c832a49595139e065002c314d98339925d3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644880685, "uuid": "a10d29f3-9964-4b6e-be9b-315c4c182a39", "comment": "Malware payload (AgentTesla)", "value": "f36305ac5d7216ed02f2cf83c1308380e3eb751c6567e19ac8978ab6a82f9d0f62db3d494104f6d704c5d415f94f2900", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644880685, "uuid": "b6e98b80-dc91-4600-a453-f80691f1cd7b", "value": "T1F41502017BEBAB23C5BE0E77D5A2424153B0EA5A511BE73F54D032E86C8B3694D32277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644880685, "uuid": "9d82d86e-c434-4e4b-8663-5af8b7db8a5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644880685, "uuid": "15271076-05b8-42c0-9186-24ba09f20ebb", "value": "12288:a78i7XzvgTUzoVuxCi6BsTUUe6yMGimEW8m8tD+XRmDsnoy4a3gakFX:a7NIozC0Z6IUh6yMGMWX8t+XRmOoc38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644880685, "uuid": "aceb3b4c-b673-4e7a-a25d-307c1df8716c", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644880685, "uuid": "cf986675-6dbc-4cd3-9ff7-1bea71794973", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644880685, "uuid": "3d0296ab-0f7e-40db-ac6b-10b7c5f1462f", "value": "PAYMENT RECEIPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca54d9d-8d5d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644819159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819159, "uuid": "2049e112-6fbc-4d89-b71a-9e0e94fcf6dc", "comment": "Malware payload", "value": "918adc7734b9420078318d37e305cb82", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819159, "uuid": "32b25742-6b31-415b-87aa-6a5bbcb8e53c", "comment": "Malware payload", "value": "47269bacafebadef663021c2735050dd1bac0183d68b10e0e86abdf18de74ddc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819159, "uuid": "e12e0fe7-07d0-4411-98c5-b21c43d26719", "comment": "Malware payload", "value": "3bef288eb6ee42982306cb5b04a2cba0508c8e98", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819159, "uuid": "ecddc1ed-c430-41f3-8a8f-9dbc091aaded", "comment": "Malware payload", "value": "d7cbc5cd60a1cffd7e0c23bd533cd95f8659d89c97be1c920b21ecc501f4ade0f35d19f06f901d0585a6ba54988631e1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819159, "uuid": "72f4ba54-a437-4c7a-adc9-a82b8a57b699", "value": "T1A3226D7CDA584FFDCF88B2F856053D2951AC7DA0A3D9E4E2793C7B502B922ACA217400", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819159, "uuid": "01872389-dbf2-4f1f-b1ae-895482dcb524", "value": "192:80C+9b+aLCLNENooTW+QjgTZk9rmDez1LCSCjSzFTRLF3cAtsY3AnFGC7f9gzpCr:80dMo2NEsvrD1rzZ/uY3YGC7WNCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819159, "uuid": "539929e5-a2ad-4e25-946b-884bc2ea1744", "value": 10872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819159, "uuid": "94ccd07e-06c6-4348-8163-53f1a19731e2", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819159, "uuid": "16774435-69c5-4ac2-b276-e04fa72d5448", "value": "1154632PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e14c9210-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644849983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849983, "uuid": "feb1d6d1-131f-4aad-8e0a-9c5e1d6349e2", "comment": "Malware payload", "value": "d8ce77f623788028395a4b4a400fb342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wwlib.dll", "colour": "#AE1686", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849983, "uuid": "36a294fd-84b8-4161-b78d-740164fbc8f8", "comment": "Malware payload", "value": "48966256d576dcfc5a61e9536c6075b2410449d249043024d256872d8b147159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wwlib.dll", "colour": "#AE1686", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849983, "uuid": "4daa1efe-fabd-4111-ab7c-ec26fc4865d9", "comment": "Malware payload", "value": "c817f4318d2acd84eadb346c33b437fb3bbf0ea1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wwlib.dll", "colour": "#AE1686", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849983, "uuid": "ffc38dc0-53d2-4bcb-93b6-9873fdc2373a", "comment": "Malware payload", "value": "b4cc5b7f2fef0249c198bfe83802fd6b3e96d448a0a362c13ca4a9c6c1c0dfc4159ca7d5591105882c6a643f36644a61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "wwlib.dll", "colour": "#AE1686", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849983, "uuid": "b07e9e19-b959-4fee-a8e6-ed9a613c728c", "value": "T18B934A5F72A504ABE4724638C8A31E1AE772F85116258F2F03A4065E2F273D25D3AF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849983, "uuid": "8f8bf3dc-4355-4bf8-b0e6-3ca11b4e57cd", "value": "3c83d284fb967294261664c3716f7ff0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849983, "uuid": "ff030c67-ed45-41ab-b151-ab644eac9ed6", "value": "1536:PZcW8CDogE/yMx2YBS3lFa5CAfVXa4RfJlg6sW4tAd09dlQ0YVeBcp0:hcW8YogcUUOlFaEAdXaIbgzcM6ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849983, "uuid": "01798e25-4666-4f51-bd22-5eca448e1146", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849983, "uuid": "d591df55-bbdb-42e2-80d5-a8c30825b64d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849983, "uuid": "229d4b89-6e93-46dd-b8d3-0ac7c5e22f99", "value": "wwlib.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396fdbe3-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644823073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823073, "uuid": "6f639c2e-8288-4b10-988a-f338037ed8e7", "comment": "Malware payload", "value": "9a6043227b21c5fa4b15d34bdcb3fc96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823073, "uuid": "8597744d-1199-45c5-b97a-6fa69231ac2c", "comment": "Malware payload", "value": "4929384205ec52cbb31a186733c0430da2967426a7e75e73603f7c36301e94d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823073, "uuid": "3dce9ce2-1398-4340-8deb-5f00981295c4", "comment": "Malware payload", "value": "3de65cb328a8ff9763d397317b9c699f965dd736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823073, "uuid": "536d4270-3456-46d7-82d8-698273785505", "comment": "Malware payload", "value": "ee2ad0ce02af68fc73ff446cb3b9c795c0778b7fbea668bf4f1cd4ec539a8a1f11c49b2bf562a03915e97e14448b5ff9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823073, "uuid": "660e0bd9-a10e-45f0-acd6-76298e61db39", "value": "T13CE5F0BC266E6E4CF794947CB1794EFF17A2BC2F05A774F3900CA1D70AA9BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823073, "uuid": "0b8414a6-50f0-401b-a009-c0716b68efe5", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823073, "uuid": "7d7a7f6f-16d7-405d-920c-b07a0ee684d8", "value": "49152:XpEuW1sPapJLiNnscG9EONjeSpsZ5Ruh4c7tPOFlu6JJ2O+AsE+Ere:XpEdtLiNZG93jfpSP1atPI/nRl+We", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823073, "uuid": "5ecfb3aa-62a1-4371-ac57-0978e0057875", "value": 3028600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823073, "uuid": "6b717fba-8077-4613-bc95-48ec1f46c223", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823073, "uuid": "0c44dc21-8e58-4da5-99fd-12811839ceef", "value": "9a6043227b21c5fa4b15d34bdcb3fc96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e335740-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851964, "uuid": "53c2352e-f4b2-41e9-ac63-eee9e0f7a774", "comment": "Malware payload (Gafgyt)", "value": "4109085e2a1c0b9cbdefcda8083c00cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851964, "uuid": "83375935-c5b8-4e1f-8ace-ad369cc5baf6", "comment": "Malware payload (Gafgyt)", "value": "4a7d4079f6a9fe6fec45f270bc6272db2cc00cb647eedec7e7bb9b2c8f99b6a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851964, "uuid": "fa88fa19-1f5f-4212-b701-f73073f5bd84", "comment": "Malware payload (Gafgyt)", "value": "270280160d8f5ca0e19f62cd8537dceee5a09c75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851964, "uuid": "f4129e07-0b31-4097-80ca-82474cac159b", "comment": "Malware payload (Gafgyt)", "value": "443b05fcbc4e87001c349dfa88c76ffaab88e85758f82908404ec361f4c81ed72b050e2c1d2d5e3e0fcb0e6c8870ddc8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851964, "uuid": "3698d715-f1c1-4a6e-a43d-9f417627e832", "value": "T1A5A30892F901DFB6F40AEA7604D34B247230BF664E531662B31739A6AE362D43837F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851964, "uuid": "df4a7ccb-24ce-4d9b-b87c-cd0b19dde1a6", "value": "3072:x7n0z/VAxRAQFKAwjyKtxpNGlm2pgYMx2IAfv:xzCAxRAQ+yKfpklm2pgYMx2IAfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851964, "uuid": "95b800ef-f074-4a6e-992d-27ae7d3809bc", "value": 102209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851964, "uuid": "b302a2fc-d57c-4152-80a3-c0a5f684845c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851964, "uuid": "3eaeb108-df11-4b29-8fd7-c1bae2679594", "value": "cc9m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbea9b2-8d6f-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644827103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827103, "uuid": "5378fe36-a09e-4496-98ef-cffcc57b98a7", "comment": "Malware payload (AveMariaRAT)", "value": "1dbd7d18666bf391f7fa4613ef7bb6d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827103, "uuid": "a34cf195-d52d-482f-9252-63abe5755e7e", "comment": "Malware payload (AveMariaRAT)", "value": "4abee8ed31d31112c7338025f2bd96f0d6232a36db9711e6e45ee9e7f1f9c461", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827103, "uuid": "e4e39a51-01cf-4853-a6d4-9f1a1e2defcd", "comment": "Malware payload (AveMariaRAT)", "value": "81bd8efe5b2096978beefab90c9030f412a6041d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827103, "uuid": "3e92e055-34e8-488b-bb7e-abb143899f0d", "comment": "Malware payload (AveMariaRAT)", "value": "5855083cedaafb3375706183baf3c1add4519001a3784e0149b1a44cc57a5777356fe7f7493a0d7c8e04399ffa8e02fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827103, "uuid": "115ca6ed-45e5-4568-877e-ced52e8d94b0", "value": "T16CF48D22B2E086F6D12A69785D1AB7B8981DBE112D189C477EE72F0C5F3D740343629F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827103, "uuid": "33af5571-3aa8-43e7-8d02-9e79c5cc4565", "value": "50e822ed4b7a82a71d116b8c7e2396d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827103, "uuid": "0a94670d-8977-430c-ac80-749fdedc4c86", "value": "12288:FlZjc75hO32cpuG7NVM1/vcDy50eVmZyqGz2PASl0i1K2K+Jr:3iz2puG7NVM1/kcVNqGzqFX1K+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644827103, "uuid": "10f4a903-9158-4aec-bcba-88065924e6b5", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644827103, "uuid": "3de9acf0-a0b4-4fda-a9ef-addf4331de39", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827103, "uuid": "a7c1a36b-09ae-4d64-a008-9f390b680b20", "value": "1dbd7d18666bf391f7fa4613ef7bb6d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c42503-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845675, "uuid": "db75be34-572b-4d8a-8921-6325c0ea098c", "comment": "Malware payload (Gafgyt)", "value": "270af5df1e93fae80869e73ff18eebed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845675, "uuid": "4cdf957e-2bde-455d-bfba-685a8bde9503", "comment": "Malware payload (Gafgyt)", "value": "4b3cbad5acd03b87f0c169aa53cd9a033f5d6dbbe5aefd449945e37f2a904809", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845675, "uuid": "7a65cba6-144e-4bee-bfe5-8c53d193b20b", "comment": "Malware payload (Gafgyt)", "value": "9acee729e194285d37507ff82f430f38552f369c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845675, "uuid": "9be2cebe-3355-4c27-b496-8caedffaf3f3", "comment": "Malware payload (Gafgyt)", "value": "0b46d8f48956a9a71fbaacdb9951189e5f32bb0856cc34ea1fdbaf6be76ed22958170fefd5b9d5c07b43f8d1a27ca2f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845675, "uuid": "fa36e65a-1dee-4d9e-859a-5f1eae91ee6d", "value": "T15693F945FD404727C6D227BBFBDF429D7B366A1497D733016A256EB42BC2BC82E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845675, "uuid": "25013255-6f0b-4b43-b558-cc78622d8611", "value": "1536:VKm3CsuRu4ywzDzepcFPvDuAl1wLrY2L0qOvS4ydgsLx8kFHULBbUCH7iBsRcimy:8DzKEP7wJLJ4yCsLx8kFeYy7mq6qQOWa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845675, "uuid": "92a59676-1413-4ba1-b3f4-df3f00e12a71", "value": 93749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845675, "uuid": "aaa7b0f2-fd08-4076-a727-2967b6224ff9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845675, "uuid": "a9bdb5b2-be94-4ab5-a22a-e5b6766ba11e", "value": "qbot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178783f0-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644823016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823016, "uuid": "3b8e68f0-c090-42d5-a9d1-526523ee6f3c", "comment": "Malware payload (Formbook)", "value": "d6ff1bf3d769e567a0e41f7651a56c07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823016, "uuid": "8533a3b7-2314-4769-9dc0-dffb68710f92", "comment": "Malware payload (Formbook)", "value": "4d854fee4f2e2a7b2afb2c13b28207f5388b095d0f7f053b90e03cf5873904e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823016, "uuid": "13208129-e684-4be2-aa5e-49fc6187d412", "comment": "Malware payload (Formbook)", "value": "291bcef2a4335eaac400271209d0c0e99486b64c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823016, "uuid": "67605540-f780-4c85-92f2-98a6547d4c11", "comment": "Malware payload (Formbook)", "value": "aa8a530ba1cdc20c4d0b2c5f4dc38926ce8253a43f9851a75e71eaf2d41ec84203782fb11aa63edf5cf505770852b9bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823016, "uuid": "4779f333-379c-46f3-ae42-be5986d9eb82", "value": "T19654225A36D8CC35D29A8239043F97BBD7F2DF4B4AA260A76FA10D2F4C194C70385961", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823016, "uuid": "624c2d46-5743-4550-ac4f-41099b56047a", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823016, "uuid": "ffbf34a6-3f3a-49a5-adda-770799b49eb4", "value": "6144:owJ2GX7MbjMIMfl5/7m4koIRxAaHRdOk7/PogRNr7RSGDRVwoPZTaEaJ:ejMIML/q4kJJvzr7RSgRuG2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823016, "uuid": "f9dff479-1184-4543-ae39-48858f16052c", "value": 300904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823016, "uuid": "ad5b07e8-94eb-4568-838c-365f7342c426", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823016, "uuid": "afdb9976-65ae-40db-865f-813b8eb4d4ce", "value": "d6ff1bf3d769e567a0e41f7651a56c07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0549d2de-8d35-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644801940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644801940, "uuid": "d758cbd0-8b10-4682-8c4d-196396401a01", "comment": "Malware payload (Loki)", "value": "a93d9daabfaa05c4a7a0b2dc5d5606da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644801940, "uuid": "0c212fb1-d020-4b4c-9882-2114b920e21c", "comment": "Malware payload (Loki)", "value": "4dd4e59368f5e310bdebc4f7ee60778446873c9b930f16366592b471a86f3718", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644801940, "uuid": "e4668d37-7d4b-47cd-98bd-8e0457829b40", "comment": "Malware payload (Loki)", "value": "cc4f19903775112f85cf58edada5858cfcf8affa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644801940, "uuid": "50bf6b41-6df1-4531-91f5-bc9b67950a2f", "comment": "Malware payload (Loki)", "value": "c6d329e5f7ac1e64ba6305647efd3bf7cdfcc8736096e6b4366c9c454899bd14050fde7aa05b4ad451bdcf5c5902b7b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644801940, "uuid": "a7bdf3b4-9d7c-4fb2-8b2d-413a223b44fc", "value": "T148F40129A677A254C57A07BDA0A1409447B89A1DC156E77F716F3CCD2FB73838E3203A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644801940, "uuid": "5d2ca08a-5590-4f7f-ba97-0c2cc1fbf3bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644801940, "uuid": "b0b76a77-23d8-447d-babe-f49e1ed51432", "value": "12288:GlxdoW9NkWLZIcix++oEFvcOCqGX/gwrVGTpLC/a6w5+0zFxhNjY:GlxGWLZIcix5FvLGX/xeL8a6P0RTNjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644801940, "uuid": "7d8e5d34-4def-4e29-971a-2aca6f70748f", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644801940, "uuid": "3667732e-7671-43ae-a268-3f0394e49fae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644801940, "uuid": "2be3faf9-72ab-4418-a5f8-9bf1f48f320f", "value": "FedEx ReceiptAWB#5305323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad04a76e-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844741, "uuid": "71ac0dbf-70d3-429a-93bc-02344c029a1e", "comment": "Malware payload (Gafgyt)", "value": "822e7fa44e7f3c68c41cbeece2ddf9db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844741, "uuid": "a615515e-a819-4429-aea8-dda41d680bd9", "comment": "Malware payload (Gafgyt)", "value": "4e060f59f36848d821ca34efffa72b3fe28d920842db7ce354b36dbf25805eef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844741, "uuid": "b8d8bdb1-7567-4022-bda4-366016aff37d", "comment": "Malware payload (Gafgyt)", "value": "7eeb06ca3d9c9ec836b3f41fbed02b339aa87f5b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844741, "uuid": "3a73e113-a258-432f-9459-3c9185464c84", "comment": "Malware payload (Gafgyt)", "value": "df393053ea47b72808b183f06ac700ca34c2dec01a1d50bd75c51d993234f8dad747fb0c074982fd898b3c5afd6c04aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844741, "uuid": "1e90628e-f7c8-4b84-afeb-6f582789ec5c", "value": "T105632A026741CAB3D0831AFA06E75B250633F83A1E16DF56F32D7CF45B15188B62B769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844741, "uuid": "520788ec-0052-4112-9330-4903540581a5", "value": "1536:CWVYPCJH1jUdOn4JymPWBSgSh1MtNFr/NbHBDSDmd+l2OZ/fufYEZ:CWUCJH1gdikrEHM1IrrVbJSDmMl2OZXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844741, "uuid": "c1b36d60-64de-4e53-b4ac-1e29c03d92a1", "value": 68252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844741, "uuid": "cd34f423-27d4-4835-a31d-ff33fd144522", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844741, "uuid": "3d8eec62-b391-4436-8e73-1ad77d2a8dfd", "value": "Demon.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c0c0fe-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644861912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861912, "uuid": "c14d1355-942a-4752-b47d-a0dcd4c2e7ee", "comment": "Malware payload (AgentTesla)", "value": "79f89bbce17cdba3cfda85c29ce4e522", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861912, "uuid": "dce14fbe-2f2a-406e-8b7e-d90c160219ba", "comment": "Malware payload (AgentTesla)", "value": "4ea4984ea96300ac77002b130bba2e22f4e2469dd9d3faf00eb269e2cad822c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861912, "uuid": "0b1ae0b4-b57f-4b21-9f69-1580e1e7255b", "comment": "Malware payload (AgentTesla)", "value": "58ff878bd4f3ade01825a9eb6689dba3b2eb7510", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861912, "uuid": "e9361c65-060f-4646-b0a1-4c37d5ffcf9d", "comment": "Malware payload (AgentTesla)", "value": "658dc4de3ffe6ecbcde1b76097aca4920a7b41189e6c283680b03e84673043cc96129136eaa4feef9f6092786cb1961f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861912, "uuid": "79004700-9e08-400e-826a-462860eec62b", "value": "T1ED15F1017BEA6B23C5BB0E7BD8A112015770E94E911BD77B94D132ED0C8B3685E7227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861912, "uuid": "45dc0a8f-543f-4d28-a266-d446624b02dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861912, "uuid": "22143352-d4bf-4f5f-bf50-4372db737c92", "value": "12288:s4l1n7XyYLsKnJiRlWU9xorPTAR2a1hXQ6NE5UooE3rn09GsMyID8LNXzP0akdX:s4DSiJiiMxQTARj1hXQuAcMtIBrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861912, "uuid": "801f87c7-00bc-49be-a5d9-49fa4e69dfd9", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861912, "uuid": "10db03c2-f63f-4059-968e-e7048af39d71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861912, "uuid": "5f35ff51-9f09-40d5-bdb8-83536a756474", "value": "79f89bbce17cdba3cfda85c29ce4e522.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6ea797e-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844731, "uuid": "b5d1680b-8585-45b9-b0b7-62627dc564a5", "comment": "Malware payload (Gafgyt)", "value": "a81d45dc18163d6184ff31bb84af804d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844731, "uuid": "65576aa4-088e-4819-846e-e8ec7ebfa907", "comment": "Malware payload (Gafgyt)", "value": "4ef2b8c880e9474513c9586ff40c98a5f7f9b715c55f1b33db3eda43a42ba442", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844731, "uuid": "b736e807-6271-404c-be96-58bab8182372", "comment": "Malware payload (Gafgyt)", "value": "4d251999e7200bc22f3552022a7e8dd127d14bed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844731, "uuid": "9318cb88-884b-4857-b5a4-a510d11821bd", "comment": "Malware payload (Gafgyt)", "value": "810c5876846b8513a82f1120f5fe429f2ca0a04ed7621d202006148c182cd688ed29d201b6c715f6b66612e551282df3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844731, "uuid": "a75d7c70-025d-43a9-9b41-544a2d310d46", "value": "T110A33802D5508B57C1D2177ABB9F426D37332B6897DB3321AA247FB82BC279D1E39121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844731, "uuid": "8ee66b62-3e25-4fef-b984-30153d40b13c", "value": "3072:iHobm0w+aSP+w7sGZmDYgTE+mBQO/IXZFW:iHo6+aG7sGJEE+mBQO/OZFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844731, "uuid": "b3bd2579-adc4-4aba-b04c-6d880635d2ce", "value": 106529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844731, "uuid": "90346c63-6fbe-43e8-8d4c-3950620e56ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844731, "uuid": "65cf92c7-bb8b-41a2-9330-1d7e5946771f", "value": "Demon.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d548e51-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644854593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854593, "uuid": "ee78b3e1-daa1-42b2-9c46-66cd56e3c90c", "comment": "Malware payload", "value": "7b7c115e346b7caa81d432405c43ff1e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854593, "uuid": "76608232-e6ed-4183-9be1-2c96ab2bff30", "comment": "Malware payload", "value": "4fb531fc4695207b0842fd8fc902c9c7b53e1cab01da965f2fd8c94e286d5dbf", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854593, "uuid": "5b569751-474f-456a-ba9d-64340bee68cb", "comment": "Malware payload", "value": "2ad42003ebfe5877ff412836057289ddeeb61771", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854593, "uuid": "c9375fa2-351a-4fea-83db-cd5dbe80d933", "comment": "Malware payload", "value": "b07f8a7737a0d43f447f96c24d83088d77acca44115d84d01def2a9609b83f29b1bafe7c5d7b542321a37af1fb821bb4", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854593, "uuid": "cae7a740-4d8b-4053-9d72-783a4af15200", "value": "T1EE1422F3FA306616EEEAD77E51CD8049A9599D0C6A630CF0242A37BE2434D71DB84633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854593, "uuid": "6ead3ea1-1066-400d-a282-7aae9ca88da1", "value": "3072:wUi7szO4CuXJFE2fE3uPyqIHHdiJ0s9wXrOcsOqTjfAOujT0lhcwO3/z5uVK3vXj:i7oO4CuXHE2fpqqgH/s9wXacsOqTjfDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854593, "uuid": "750f4968-c4ec-4e1e-a8f3-fea0bfdb4baf", "value": 192216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854593, "uuid": "7890af3a-6c73-4357-b4da-d0aaa8f4a61f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854593, "uuid": "ba78f4d9-68cc-4d9e-a687-5661b6697bad", "value": "DELEGATE LIST.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa9bdbc-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644822404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822404, "uuid": "07ccca7e-a78d-4131-a18b-3845a59bc852", "comment": "Malware payload (Loki)", "value": "5e80ec25cb1818f0bb66c68e56a1b506", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822404, "uuid": "7272dec2-ca46-411e-91ec-5c7b4b8fa33e", "comment": "Malware payload (Loki)", "value": "5047122a262260e097e8d0c40a3136a127e1ff361d9e6e56bb91c910ef97e5f4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822404, "uuid": "9ee998ad-bdf5-42bb-af14-4425274f2998", "comment": "Malware payload (Loki)", "value": "d9a2000e00b6d8aba1b95ee841da827f06cc3b3b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822404, "uuid": "9a24b159-8944-4d2d-8617-0f59e132c9c6", "comment": "Malware payload (Loki)", "value": "3d43d62b2870e3f719159f1bcba75928b9eacafbb2c9ff44adf5f8563294ca25e8b011ae56bc63b14ba3058d69a0e982", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822404, "uuid": "8b111110-74d0-4dca-8f3b-e844525f2fc7", "value": "T17014126CB3861A55F6C2BEB12FCA72CC0A179F9F5412067674B6329C4D3492BE8787C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822404, "uuid": "c23b8ad2-51f1-4577-a6ef-2bd225cd29b1", "value": "3072:J49hrYAk80jeJijMirmlY2mGZPYjkCSzlkxPARH4I3ia7j33Y69:0OXj+ijMImW2FZPYj8zKxP2H1SQjJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822404, "uuid": "0d988c97-13e4-40c0-8d23-dc5647acd01c", "value": 191784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822404, "uuid": "c6a5c756-6c3e-407e-bcef-24b20b67ce12", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822404, "uuid": "40f66f8c-30fd-47da-a793-97ec480019a4", "value": "PO#C3001_20220322.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ecd576-8d8b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644839223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839223, "uuid": "a0e111e2-e316-400a-b29e-c6208b0f9278", "comment": "Malware payload (Formbook)", "value": "3337f2f040878565081d719c1fe3143e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839223, "uuid": "9ec353f0-b09f-4a71-83da-0726215a0145", "comment": "Malware payload (Formbook)", "value": "51abc2e98d5bd75b74bf30aab05092d714cf2ae43c55e9640c883293ca2d5db9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839223, "uuid": "f19dff3a-a8d2-4bc9-b172-cd1bc03f278e", "comment": "Malware payload (Formbook)", "value": "bb0a6a3f211d8f05c108315d393710b357d54879", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839223, "uuid": "6cd02955-0ae3-48d8-811c-5df523c80848", "comment": "Malware payload (Formbook)", "value": "791032f65179b497da4df99bb70d6ab4bdde8bd75ac57e1156ac16be29fe8383e4b3e0a97f334e8c0ac9f27a0e8fade7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839223, "uuid": "12c56f5f-ac0d-4967-b806-1aefcbb47c53", "value": "T15AF48F21B1E08AF7C12F6A789C1A77B96819BE402E185C4B3EE76F485F3D281743615F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839223, "uuid": "30ace130-6635-402f-88cb-2f25aa1b08c8", "value": "50e822ed4b7a82a71d116b8c7e2396d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839223, "uuid": "a25c429a-f529-4ce4-aedd-f5fc255398ea", "value": "12288:FlZjc75hO32cpuG7NVM1/vcDy50eVmZyqGz2PASl0i1K2K8Jr:3iz2puG7NVM1/kcVNqGzqFX1K8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644839223, "uuid": "511372f5-e8c6-4e79-810a-b6bf71ce5a38", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644839223, "uuid": "f583a55a-3786-4701-8df9-94325089d84a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839223, "uuid": "675da990-63e5-4af8-917a-9d66d9496781", "value": "Statement of account, 2021 to 2021.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643b0af2-8d9f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644847626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847626, "uuid": "3dbcb7b8-a773-4af3-937e-b347154bd9b6", "comment": "Malware payload (AgentTesla)", "value": "2734b5bcd00c2bb4363a057a14d66115", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847626, "uuid": "08b2bdef-ad4f-405a-995e-83c9f8d0b85e", "comment": "Malware payload (AgentTesla)", "value": "520a82e0a3364f2e1171dd9a68dc222aa42b80413d7d54c5274f39eb51935746", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847626, "uuid": "bc2cacd5-159b-4921-8ff2-3403ecf313ba", "comment": "Malware payload (AgentTesla)", "value": "f9cde8d053345d14da9402b96e35ecb08e81d39b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847626, "uuid": "f30c46f3-c513-4882-9e24-d12111952e82", "comment": "Malware payload (AgentTesla)", "value": "4ac90e9e4ff002451791a8fc9809bba0320964a22305f4127b37c72a67afd4e18a9e94362b71feb796f07cf159bf030b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847626, "uuid": "1a0648d1-3748-46cb-b9d3-3d7731028f05", "value": "T1F7F4235AA7E40667E5FE53B73062690113F2A54B341BF32C9BA1A1ED0123BD0A521F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847626, "uuid": "9512ba54-c5d1-4c1d-80fb-23c5c18cf8c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847626, "uuid": "f0ad5fe8-9f19-42d4-8e50-b7fd1c729119", "value": "12288:80QGZZK4cCdqrqUAT1XnRTL+JtPJ4e0etPUZEVlr+2/nJ:NNcCMGUA99Lctx41etPnvr+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644847626, "uuid": "d9fc1c97-f0d7-4c98-ab86-0d2da23f1c17", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644847626, "uuid": "d3f9f008-f585-4f67-98b4-0ab248425b5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847626, "uuid": "224ce51f-117a-4b72-8999-1154515fa788", "value": "HRyen4MQvEQI1wO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595616c6-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644851473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851473, "uuid": "9e42f2d3-3763-4959-929d-84130508ef97", "comment": "Malware payload (Formbook)", "value": "fa01d594faa6999f6e9e4af5cf5fdd73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851473, "uuid": "d205c9c6-c550-4256-a354-fe3f30510f6c", "comment": "Malware payload (Formbook)", "value": "5328d9144c5c8cf3d8962b4e8d6b6fa00b2433e55defc29d0c106755e9a4fc1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851473, "uuid": "44fa30df-161f-426c-a28e-a901a82de522", "comment": "Malware payload (Formbook)", "value": "99513f3b836833fd3e08a61e337c669f0df617ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851473, "uuid": "75fd8c7e-5044-4566-a83e-b4497ed8ae73", "comment": "Malware payload (Formbook)", "value": "9c4e5f1a573484c47b8f87fdad297211fdf05a7eee696cb5cf80122bdd7c108865a46503c8f4add6e6cbe51b779fb60c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851473, "uuid": "ba83dc34-1e06-4d7a-a2a7-6c275bccd021", "value": "T172F4D0263B95D853C1685F381AF9F2F563FA9EA1FD0B0207B5017BAD6E3979C2B01481", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851473, "uuid": "d24cbf2c-8b12-4597-bc67-d0be3d37249a", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851473, "uuid": "9a924adc-5db8-4bcb-aa86-c570298296c9", "value": "12288:tBzHHlh0El9lBm43rMmTWi+5Pv+6CTKiSEjQua:tNHHlhNxTbMZi+hm6CT1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851473, "uuid": "91441dca-af2b-46da-b068-6e2130f78d17", "value": 729580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851473, "uuid": "fce5376b-8300-4601-bcbe-57a1e30aa622", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851473, "uuid": "180b0ea0-066e-4a39-ac6d-244d546a8bcf", "value": "RFQ#505.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d6995b-8d69-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644824442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824442, "uuid": "46a21d42-ff34-46c3-88c4-ea0c19ac5e6f", "comment": "Malware payload (Heodo)", "value": "52696de777568e8f7bccfd42a56eb8b0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824442, "uuid": "8bf7594b-3725-4e61-a229-79883434cf88", "comment": "Malware payload (Heodo)", "value": "540be163e7bea2a6f158dcb9db1c20f35ad885320945032245da28bf3bc3b7d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824442, "uuid": "45957d5b-221c-4a44-8354-cd29a551d973", "comment": "Malware payload (Heodo)", "value": "8d7333906249aa3ea9f7b0bc02b1ebb80341ba2d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824442, "uuid": "8406e2c0-e79f-496d-8cd0-c765d34308c5", "comment": "Malware payload (Heodo)", "value": "7edc82eb88e547a867baff3414f8746b3534ec85d857091f97f114614ea05d16bcb34e6b7ea4a498487035db4b6ddc25", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824442, "uuid": "9cef381c-d130-4f08-af8e-eecd4cf5b59d", "value": "T11925BE516E9A91A5FA0B247E00AA73470FDD791117E0E8CFEF44F5A71F21CC2963889B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824442, "uuid": "8deaf188-93a0-4496-8e4a-0adc0fe55c3c", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824442, "uuid": "7617d329-1240-44c1-bd46-0dea1235684b", "value": "24576:vGvafwy8HdhFsvdjNxcnsnPMf9yoro8ult+s9CdRP332L6tFIIm2mm:vBft89mjtMf9yok9lgdZdFIr2mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644824442, "uuid": "0bfe54b7-1520-493a-b19e-c11d2e52b914", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644824442, "uuid": "337dd8d0-84c6-4575-9ddb-8c935425c27b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824442, "uuid": "6cff9d7a-2b45-4443-9359-633b1dcd6679", "value": "emob.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2bb829-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845220, "uuid": "68647476-0b68-422d-8c0e-86172f6913a4", "comment": "Malware payload (Gafgyt)", "value": "48f6892d4535404c21bad943e1b8c59c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845220, "uuid": "c649f4d8-09a6-4925-b6ad-c061d649edbc", "comment": "Malware payload (Gafgyt)", "value": "547610735e42f453a02c3e174f694e3f52126b7ff57e024f373c5e51184389be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845220, "uuid": "65179df8-ba12-4cc7-bbc9-25c1bc138a59", "comment": "Malware payload (Gafgyt)", "value": "3a595a6174a706844ec01f2fcaa55adde756cbd1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845220, "uuid": "61510288-e26d-4a03-9807-1e93d666379a", "comment": "Malware payload (Gafgyt)", "value": "ad267564c242e34dbc65d2e26a8119125e81762646ebe11045e039bc06c2ad25c5d2f82ec64078f33f419ff83814276a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845220, "uuid": "427e5c25-8a4d-418d-bc4a-417ce4467cd6", "value": "T12CC33B46E7408B03C4D22B7ABADF520533239B6497EB33065928BFF43F827994E67516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845220, "uuid": "84334b65-3bd4-4fd0-afa2-dd23f6b1dd91", "value": "3072:HUzulay6vPQgkOTK29N6ItQexVFEmCwirvs7:HUzAay6vIg8sN6sQexVFEmCwirs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845220, "uuid": "ffb895e4-b2a4-4783-81bc-9ad8cd17fd6d", "value": 125224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845220, "uuid": "c8f44af4-5787-449f-a1b3-b04d29826368", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845220, "uuid": "0c1df333-1488-4fb1-b368-87ba9f8b5f11", "value": "pop.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eee82e9-8da2-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644848771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848771, "uuid": "3c28f59c-53e9-4cef-833c-dc1351d89ce4", "comment": "Malware payload (Loki)", "value": "8d5b44c9ee2714a3b8c5a494e0d9f1aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848771, "uuid": "09633f72-0201-4c18-b9a3-a350f7dd6a57", "comment": "Malware payload (Loki)", "value": "557a40a6f2538708cf4daa70de86bf5cf50a460d33925a47e82ed33bb5f6c177", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848771, "uuid": "04ffe831-89b7-4a35-9e99-0d4485ec8668", "comment": "Malware payload (Loki)", "value": "c64c477bd5e513832684c0a9f47133c8be69f140", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848771, "uuid": "85e7b074-66c4-4c39-9d34-23c92f36ce54", "comment": "Malware payload (Loki)", "value": "3198d5ace3cdf5037f9fd9e67336f60985f36a6727e72c443f089b7810c63cd70e50a041cc7a5e86e13d7c480507ae9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848771, "uuid": "56ceaad6-e850-45ec-9857-b068a8917443", "value": "T14E05F10177ABAA23C87B0FBAE8E1424257B0E54A5157D73FA4D032EC6C9F3550E7127A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848771, "uuid": "af5345e7-f0bc-4e19-b54d-0c463ebd6ccb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848771, "uuid": "36963f8c-a6df-4d02-a42e-c5adcf7aba5a", "value": "24576:o+hBBi1WXczEAewp2sEUTs3j0Taa4phw2xT:oiHvXQ2xV3QLSwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644848771, "uuid": "da815bb1-040b-41c8-a96e-89a25a9fec5f", "value": 839680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644848771, "uuid": "70c8b6fb-f1cb-4f59-a5b9-b3a8332d2835", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848771, "uuid": "5449045e-6642-47b9-a279-0469e9329e44", "value": "DHL Express Shipping Docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab9ad80-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644851475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851475, "uuid": "9d3e332b-b321-4fa8-9330-328bfadcde86", "comment": "Malware payload (AgentTesla)", "value": "b9bebecef60530c06e1268c6ff9656a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851475, "uuid": "5647ebee-f985-4dda-bf20-b95ac8c7407e", "comment": "Malware payload (AgentTesla)", "value": "570db7da27af73440554e037bdddf491a0aece4c7b8061b22054a1c2a238ddd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851475, "uuid": "a9f45486-efe3-4238-be44-8fa520553389", "comment": "Malware payload (AgentTesla)", "value": "095d1acb50a97a2d385a5da35599fdfaa9581a4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851475, "uuid": "41e58e19-e353-42f4-bc60-5cb9f0741bca", "comment": "Malware payload (AgentTesla)", "value": "ba3bf3ac191cc69b9f97f8a3d7b5b979627122782d94372d4ada924559c0ba98216bcd0c84356579d86128b95c3a0304", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851475, "uuid": "78721322-f624-4ecc-9e82-36eb8b8eb909", "value": "T1C372F9587BE8C6A1C9761ABA4DF35E101A36F21BE465CE1F28C5721B5C337420962F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851475, "uuid": "a35e143a-199e-4c03-849c-34c09cd1335e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851475, "uuid": "6e66cf12-9113-4e8c-819f-a2cd72af5d30", "value": "384:1rvC4/CBJogHrDx8t3mYbiMf+FBQG3bL0iiay9ycyrsR2vZMtXv:JvC4/CBJ1HrDmzbKwG3b2ycyrsR2vZMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851475, "uuid": "1f26653d-2ad2-4000-94d7-f014fec27fb5", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851475, "uuid": "fa1e456f-ce41-4407-a488-398a8f91b39a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851475, "uuid": "7d04d28d-0259-4213-a29b-514abe995b70", "value": "RPTT09876543FACTURA987654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e5778d-8d71-11ec-9275-42010a9c0029", "comment": "Malware payload (HawkEye)", "timestamp": 1644828026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828026, "uuid": "866f549a-746c-4433-b50d-3a937f088ccb", "comment": "Malware payload (HawkEye)", "value": "91de6efc69676a4dd4ced5e2111ab489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828026, "uuid": "6f710977-2275-4164-9629-0c4ff95bfd5b", "comment": "Malware payload (HawkEye)", "value": "57754827b4e179d20088be1aa0fec9d1f8e3a872e81103b2c7264f80a0a86b36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828026, "uuid": "7e8bf3a5-5a79-4aec-ba8d-773392fff773", "comment": "Malware payload (HawkEye)", "value": "262f23feee502e24d6d044c05bcb7b3153b3920e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828026, "uuid": "e6c4e643-640f-484f-b3ba-adf83e494b1b", "comment": "Malware payload (HawkEye)", "value": "fafd586be86c6dd0d254761867dca748e62968893d76d14eb30f4788b8631bcf6eed52609e734b22a27fd72574a42c64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828026, "uuid": "199b72a0-2a13-4756-9929-12f5ae94e852", "value": "T10145F16D7611B1EFC81BCE729AA81C74A660647B571BD607A06312DC8E0EAD7CF112F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828026, "uuid": "675bf1e2-51de-4219-ba33-9a892f83ccec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828026, "uuid": "43208f7a-8fdc-4fb2-bd58-ba3e46a60b10", "value": "12288:zOTIkOQC3u4diHquSEbVziIN8cmGIhUGAVigEnKQHmlNhcoHnMaTvcXw8AKT/arK:oeMxSoTSTGZihnKQHToHnHEXw8BT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644828026, "uuid": "d1573d3a-5a0e-43fb-bad9-785f055179b9", "value": 1244160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644828026, "uuid": "09c3baf5-a39e-4821-8b1f-7a17931975aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828026, "uuid": "6ffc644c-2f4a-418c-a99a-655a61d63d64", "value": "91de6efc69676a4dd4ced5e2111ab489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53bca21-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644821965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821965, "uuid": "391869b3-cd67-4fa2-a457-de09cbb87d27", "comment": "Malware payload", "value": "fd39059f2544419047c7457b900f6ddd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821965, "uuid": "047c807e-766f-473e-89aa-b6b5f4c129cc", "comment": "Malware payload", "value": "58347655b92d8ee2eb8271732b6d612693f2fab7f3f8643efd5e98e012ef8e62", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821965, "uuid": "3c03fb06-a421-487c-863e-9dff40caaaf4", "comment": "Malware payload", "value": "72fbaa18b737fb60c595da912fc861dc7b02fc48", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821965, "uuid": "014dcf6c-0933-47db-9128-a6c5893dc314", "comment": "Malware payload", "value": "0e584bb9b7fd7d3d84c20ce0a34f3966038599c049ea94bf444aa8852f45a3dacbe3d930c89f50a392f9cbc64065bd39", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821965, "uuid": "46c38701-357b-4364-bca3-4d3fdc809086", "value": "T172E56C37B274613EC46F1A3A4527B35499FB6A616A128C5BD7F7088C8F3D5802B3E607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821965, "uuid": "44a761a1-4140-4dce-ac4c-c88b263fddf6", "value": "49152:x6NKRQWOd4aSm/E7+V6gILWnyTTiVyGYM3A:tRj+2LWUisGY8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821965, "uuid": "639326b8-7e08-419d-bcf3-be22a640ffc6", "value": 3099136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821965, "uuid": "369f7575-eda7-4ae5-8b51-7580db8e8089", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821965, "uuid": "076ba852-1528-491d-9c5e-a3293baa0d0e", "value": "Archnow.FactEndesID1402.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6279858b-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644821853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821853, "uuid": "36f3c32b-5184-4629-98fe-0fa55149aaa7", "comment": "Malware payload (SnakeKeylogger)", "value": "81749c1dee43b5eda8dbdef92ada12bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821853, "uuid": "d71bf3a9-4b6e-41ce-a409-6a6eea5843bb", "comment": "Malware payload (SnakeKeylogger)", "value": "5902b5643a1623603a659737543cc81da79c302326e4c687fd4f8b682e1ce038", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821853, "uuid": "031acb62-da13-4822-ad4e-4100c8247021", "comment": "Malware payload (SnakeKeylogger)", "value": "b8e039912b9d0e5df770921e8c421a8fedac6c1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821853, "uuid": "d72b68b4-f7d8-46f2-af70-f8c14785fd98", "comment": "Malware payload (SnakeKeylogger)", "value": "da816deafc776926147822543ca13fbf1bed4b33596a4b81fab6cdccc515a12d42b8eb426c4555b6c3d346f6e473915e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821853, "uuid": "17b1f752-3ef6-44c2-8061-8d947b06bd66", "value": "T1B774BE2960F380B5E9A897FFF862C65C1F75F92FD517B2FA0048613804BDA9946C5A33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821853, "uuid": "4757c811-fd3d-44ce-b572-852aba562b01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821853, "uuid": "e9371b11-2b91-4a2e-8cdf-84381aede16f", "value": "6144:3hhVasZHvtYD5NXI0EdHo31xNZRHbSI3YY8qGW9loYuSCxDncwAO:3hHasV+XJf1jZ1bSI3Y9TW9loYoAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821853, "uuid": "eda2ea5d-b673-42f7-8336-cb163cf8e08a", "value": 340480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821853, "uuid": "a99f8a8a-e4b7-437f-ae3b-89c79f895b0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821853, "uuid": "cfa8d35a-bf71-4b22-8235-17fb755c22dd", "value": "xH3lUnLzy5f4SkO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0305bdd9-8dbc-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644859918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859918, "uuid": "e018d167-12a3-4ff1-8507-befad70531cc", "comment": "Malware payload (SnakeKeylogger)", "value": "c13b7ad4d9010118266153a3eeae4550", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859918, "uuid": "cef726bf-3948-4597-b873-3d5535ee2d5e", "comment": "Malware payload (SnakeKeylogger)", "value": "5913281359aeb8fc71390f95df708815c9aed387ce4398dc608ac938499a893b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859918, "uuid": "8b27e413-a115-41c7-ae6a-522acc5fc5d2", "comment": "Malware payload (SnakeKeylogger)", "value": "056e706475b5fae1856c0263d3d1d29fe403c800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859918, "uuid": "ec5269cb-d1e3-4b1f-b9b8-2528360aafa2", "comment": "Malware payload (SnakeKeylogger)", "value": "ebe1c80a5929e722ca26bc8444a755042ea6e5349e89fe8aa2a72ceaee4406e7998288bc1cb4f9f1c1800f45663a9f7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859918, "uuid": "f31b55c8-26ee-47be-b796-d204225d2945", "value": "T17494D01032FD7B1AC8EC8BF96490D5301BB92DA57892F2951EC6BCCB3172F409786967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859918, "uuid": "39422f01-9e11-495c-89ce-e848bb475d2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859918, "uuid": "df1cb5a4-26ea-413a-9134-392543b6c9f5", "value": "6144:LonYp4NoIFz2DwtN5wi1oevvXaUlEV2BmcrY0XI/vTO:LonYpFuCMz5wi/qUlEVmU0XI3TO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644859918, "uuid": "e4b32f45-e1d6-458b-89f1-83621e989cfd", "value": 415232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644859918, "uuid": "4850ba1f-7a0a-4a0b-a4c4-a264e319680c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859918, "uuid": "95fda973-224b-4227-97f2-6aaa01f9b11f", "value": "Swift-copy_Wire Transfer completed 140222,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf967af-8dae-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644854163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854163, "uuid": "b8e1e10a-da5c-4b13-9a4f-9a723ab61213", "comment": "Malware payload (Loki)", "value": "a6e4c0010ad549a3ca425ef7e4f38adc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854163, "uuid": "6bb93e21-8d35-4d69-90ea-d7c3a3e1ab6e", "comment": "Malware payload (Loki)", "value": "59819eed25c7ec484455237149273827c8c3476bf961f5be7443e856d3131259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854163, "uuid": "72624e48-1b7c-40c1-9030-9d42f7e21a08", "comment": "Malware payload (Loki)", "value": "3d2fbcfaa9d02a605c4b5b016f67332630ac225d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854163, "uuid": "3f325666-8ae0-40d1-8fcf-a6cd63d16c63", "comment": "Malware payload (Loki)", "value": "bca6bb5f8bcf0df1cbc29a49eedfc6562016769e97ad66face4dc9816624b0e5fa15bb9a3cec3491d8c078165f020b3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854163, "uuid": "e4851bdc-e625-44b1-90f1-0427d7d7e673", "value": "T1EEA4CF2D073CC856F0B42DFC28229BB9BEFC5F11626DF96753206CD719F12829A89197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854163, "uuid": "6a18c104-416f-4112-b15f-4bd1f07f710c", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854163, "uuid": "ce69b643-b89a-4592-8a46-ad3a7a0a4a56", "value": "6144:XbE/HUsqlsSzyI0F0UjVrH76Brup88h8h+843ggbxfNSXNISJSdIX3u:XbwqKoyI0F0UjVrH7pv1bxfUdIOC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854163, "uuid": "1f64785e-9fb9-4f6b-887f-4e5139503729", "value": 458384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854163, "uuid": "3f276f37-a7b6-4c60-819b-ec44832fdce4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854163, "uuid": "2bba77f7-7754-4c0c-8acb-6d6fdf3b2531", "value": "Solicitud de oferta 14-02-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8027f02-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844760, "uuid": "9f66cf4a-2397-4d42-a34f-4a862e792123", "comment": "Malware payload (Gafgyt)", "value": "44fb222a9fe7b41a628b46c456f9083d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844760, "uuid": "37205af8-79fd-4f13-9e93-944ee69e73f8", "comment": "Malware payload (Gafgyt)", "value": "59d7026effb7d56091d44e39bc1de282732e79a944c95a0115eb577a5906897c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844760, "uuid": "c129dd20-8292-4892-99ab-567ce3c1153a", "comment": "Malware payload (Gafgyt)", "value": "1a9c51b2b9c382ec026af4fc9854297d2c5139ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844760, "uuid": "8d4098c9-88ac-4e01-8e30-d923f3e4a94f", "comment": "Malware payload (Gafgyt)", "value": "f82a5a78783b87a045e6b70764a9b67ea446beb9bbe3a395a4f252ed6b8972e970e6e0d926c6ed416fcba5faf129a9f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844760, "uuid": "f5b46790-1246-49c8-acd6-b06d0555e39c", "value": "T1BBA3D717AB51CEB7C85FCE7306AA460120CEE55612E46B6FB274DA6CE74B94F08E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844760, "uuid": "13192b4f-521b-4e86-af66-2031bc92bf6b", "value": "1536:0GeTzI+eXiKbmTYWZMbZMPtAw7p7sXjYggp22ymOimW+zWBSirHzai:0oc/pOZM1p7NggA2ytimW+zWBSgHzai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844760, "uuid": "0f32a2dd-066d-47e1-b9b7-056048680567", "value": 104824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844760, "uuid": "ef06d59c-7fea-4852-9e84-f2ae650f8d6f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844760, "uuid": "8a1f681e-ce83-4749-9305-7f79868cb835", "value": "Demon.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a68721a-8d73-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644828604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828604, "uuid": "f78016f2-a95a-42e5-8ac5-f9258fc6678d", "comment": "Malware payload (Mirai)", "value": "d60114de0e07f25d4a3d6bcd6c322673", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828604, "uuid": "2e4c4c27-a2c0-4dd7-8451-e7e58fd60742", "comment": "Malware payload (Mirai)", "value": "5a24d29f720f13396f3467b26f95e0b0f8599d27c328e6dd0a12c44266af113e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828604, "uuid": "5f7033a5-e946-4ff8-8342-e2eeab4d5095", "comment": "Malware payload (Mirai)", "value": "1e0559bd64184771f49904a38dd1287cd59d1f37", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828604, "uuid": "a7c16dbb-367c-49f2-b2a3-d01bc746e13b", "comment": "Malware payload (Mirai)", "value": "5c7e4209178c1c570dcf9e509b91fd1476935109cd9fc2b2f48e0de5ee38a78c9e4a40c7db5c7165f662178ef47d986e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828604, "uuid": "c811dbd4-373c-4594-bd62-86814160686f", "value": "T1E3735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E61625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828604, "uuid": "b98fb599-e351-46c3-b375-8473e6b19a5b", "value": "1536:b/DYQYs1ZokODichh615UzOHIt094fsH18ruUGDKVQSi:zDhzUkODichhgUzk40q0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644828604, "uuid": "77d165a5-6950-454a-b420-7bb756b08b26", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644828604, "uuid": "8e6a39c2-9d6f-4ccc-ba2b-547d0f65a716", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828604, "uuid": "dc774d16-53d2-453d-a0c5-9e12cf5a0474", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccf64cc8-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845224, "uuid": "c5d0df1b-e1d3-4e01-8a16-e91c43faa693", "comment": "Malware payload (Gafgyt)", "value": "bee1adccdbbea7b2eed34bd3a3a5d080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845224, "uuid": "80fc709f-4e44-4277-85b9-806a8f1de708", "comment": "Malware payload (Gafgyt)", "value": "5a348379fcf79791f0d030804f7cad9f45997ec2ad643acbfd9d5a2ff69de57a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845224, "uuid": "fd10bde0-b814-4b4c-9d27-a63912f0fe5e", "comment": "Malware payload (Gafgyt)", "value": "7984bfaa6d2f8a401eeed491c30ab410e085f506", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845224, "uuid": "3666ae9d-51aa-4097-8339-8bdfcc6ffb5a", "comment": "Malware payload (Gafgyt)", "value": "00fc22c6a470b61b56166522537ffa6852bba7f6036e3435c3b3e00914ad33b54653c5255920a9069fdca8ba7f1c584a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845224, "uuid": "0f6eed65-49ae-419c-be1f-095c99eae57e", "value": "T1F9C33B46E7808B03C4922B79BADF420533239B6497EB73065928BFF43F837994E67516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845224, "uuid": "7975f93f-2e5f-49e3-afec-9d8f0ef8d0a9", "value": "3072:HUzulay6vPQgkOTK29N6IxBKM/9FEmCwirvs7:HUzAay6vIg8sN6GwM/9FEmCwirs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845224, "uuid": "3b8efa35-a9a7-4189-8219-1755d540ca1d", "value": 125224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845224, "uuid": "a4ac5a05-ab15-42e5-a988-d81ad1e8d034", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845224, "uuid": "4dd12e12-2eea-4b33-8182-8ee7d39e1545", "value": "pop.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d40bbc5-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644851480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851480, "uuid": "07eb743d-f1ee-4a75-b61c-c6ebcd9347b5", "comment": "Malware payload (AgentTesla)", "value": "5c74d1ffe0c9cad7d99be2980cf65e62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851480, "uuid": "ff5c8690-e4e8-4297-bbff-10bb6d98278c", "comment": "Malware payload (AgentTesla)", "value": "5b7111b255847c65421262be3833aa1e77eb7c47a0b4b964b7b581d2526f0e31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851480, "uuid": "1f8375bd-6470-4974-bc23-7376146f2101", "comment": "Malware payload (AgentTesla)", "value": "361aca0027bb11c93dff31831819d1687f60a273", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851480, "uuid": "16deb88a-20be-4f16-9f13-ed5023d7169d", "comment": "Malware payload (AgentTesla)", "value": "d2146d7ee998764823be22f90c405feeb30cb52dcf0322b2dd7ce6a9c1b0e89953307cb49355d39e220951d0e61f59dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851480, "uuid": "e3e093c9-ddb7-4af3-a959-9e6098d4e2a8", "value": "T138C44A9C71A231FEC857C4BBE9A89C68AF20F47B830B9297901711BD995C997CF540B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851480, "uuid": "12298d43-35ed-450d-ad0a-d0859224110b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851480, "uuid": "172b6a1f-ea2f-43b2-9719-67180b2d2bc8", "value": "12288:RUoPyeTA0GkA4v28GFr963SKrrzpaYW7Fb8kXUm41AvyXqXZfHwkasV:RUsw3/4O8Sr96DxaY04s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851480, "uuid": "9f5e1062-195f-4310-baf0-a1a1fd819acb", "value": 550400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851480, "uuid": "dfbacd91-56ad-409e-9a37-c403c7da3fa8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851480, "uuid": "f13ef46c-2715-4e24-9675-4100eae2b90e", "value": "TT SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce9d069-8d54-11ec-9275-42010a9c0029", "comment": "Malware payload (MailPassView)", "timestamp": 1644815589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815589, "uuid": "f91fa876-3468-417c-9b64-5338a36ee182", "comment": "Malware payload (MailPassView)", "value": "7a99a9b01719fc89773b491c3fa483c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MailPassView", "colour": "#5EB499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815589, "uuid": "0b3c68c9-d01f-40d2-bc21-d5d41e89f71a", "comment": "Malware payload (MailPassView)", "value": "5baa379923c99cafe4d0592f0e45833e7a4883c2ff0cbafa5174d08d5bf0a8d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MailPassView", "colour": "#5EB499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815589, "uuid": "1625cc83-af5a-476f-b5b7-50ff6e3d673b", "comment": "Malware payload (MailPassView)", "value": "9fdcb8b63669d4995ce11f0d831f737701a8416f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MailPassView", "colour": "#5EB499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815589, "uuid": "76cee39b-48f5-4844-8ceb-7063275ff915", "comment": "Malware payload (MailPassView)", "value": "9a359d6d408ef57faee7a71d889b98f4eb6023e7c76550a078c417c5ce300b704f950843325df972e8b6bdcad128d05d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MailPassView", "colour": "#5EB499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815589, "uuid": "79dd286d-9cd7-4ad7-8f38-3751ac5f10ec", "value": "T1B375E00263DD83A0C3725233BA56BB55AEBB7C2605B1F69B2FD5093DE920122531F673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815589, "uuid": "09c84961-2d9e-4c42-bbae-a43704ebfb65", "value": "bbac62fd99326ea68ec5a33b36925dd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815589, "uuid": "61a1df5b-343d-40ad-bb2f-9b16d1b0153c", "value": "49152:pkwkn9IMHeaD7wtyDD7v0dLbPgcxKbaPCS:SdnV3IyfWLk+VPC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644815589, "uuid": "e4bd5e4c-24ab-4015-b75c-16c9fbc15a28", "value": 1573376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644815589, "uuid": "a67baad8-a67e-4f09-836b-92a4b289bb67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815589, "uuid": "90b3353d-2541-450c-a060-86dd9e273a48", "value": "YYYWWN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4543cc0c-8d5d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644819227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819227, "uuid": "95fa9d61-57f1-4390-a330-110d8d4b5ab1", "comment": "Malware payload (AgentTesla)", "value": "b8101ba37263f41a8bbca42d560913d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819227, "uuid": "8ec7f2ca-7a9c-4970-bf4e-1fb876f75dd2", "comment": "Malware payload (AgentTesla)", "value": "5c04a96ab4a615c47bd76a981409ce70a05d9762b30ccc203509973dd8ddbee3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819227, "uuid": "c554b0a7-d388-47b3-b2a0-170cffc5fb95", "comment": "Malware payload (AgentTesla)", "value": "0b6349dd30708a03469b76dab4c2c03487247955", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819227, "uuid": "d4b5c052-cf70-4374-8271-49a30176b03d", "comment": "Malware payload (AgentTesla)", "value": "22e7ecd2d9602bb9dd4ae7f328dd9fcab4b0e8b9fb60149439ab6ffeb181475c887a3e319d85ffaf56d9d4d97e197a36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819227, "uuid": "d93c95c4-39dd-441c-83e4-b597f0aad389", "value": "T1F615121DA6B3A508C97507BDE4A241A06BBC961EA15BD77F706F3CC82FA3386C935071", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819227, "uuid": "b6669453-7f5d-4514-9353-71101cf48808", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819227, "uuid": "eef103ce-4dfc-4ce7-a097-b9a669486cd9", "value": "24576:Gl8ZsLZ2zfCQgXxCNld7h80wcMBYToY/:9ZstY2XxCNld98zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819227, "uuid": "f580d896-e736-4969-82d7-8bd1fe4704d9", "value": 913408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819227, "uuid": "a96ed494-e2f9-4cc9-a128-2aa7ef6d321d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819227, "uuid": "2ee7c5c7-ebe8-41e8-8c2e-21799629c088", "value": "RFQ Total...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa3c19e-8db8-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644858240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858240, "uuid": "15c945b2-513a-4181-8fc2-31fa0ec3d350", "comment": "Malware payload (RemcosRAT)", "value": "0b8c68c972e32b648048cfa6a2ae655b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858240, "uuid": "89a75b3c-ae2b-4792-afc8-317b03bab48f", "comment": "Malware payload (RemcosRAT)", "value": "5c8973990d63bf969c6fca63d2856c35641d63774d3b362123059fbb5a74a578", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858240, "uuid": "ae1e2bc0-9337-48da-b195-cd832ee2eb17", "comment": "Malware payload (RemcosRAT)", "value": "b9fa80bb0c572d3766f6bcc62a6b800367188333", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858240, "uuid": "e6c42869-c33e-4749-897e-0eb70f2d87e1", "comment": "Malware payload (RemcosRAT)", "value": "834d62740274938673858483a8db29a2085de706d9fa2d41f66eff52d00830c74b21c51ac89aa37151c12ddb767f86c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858240, "uuid": "44202281-f9cd-4a64-9533-4af4c80cc1a5", "value": "T1B425AF1371904436D9361A78AE5B97A0652DBD646D28AE4B37EF3F4D1FF928038322D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858240, "uuid": "bb098175-b8d6-44e3-a635-4e80ad1afb0a", "value": "ed7200529d98ae266be09ddf8296ccc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858240, "uuid": "b8c7cfab-e62b-413c-b503-680ee8541aa3", "value": "24576:fxnYW9BukboCqOMlfczkYY/5wtAb81KNvT+SN6:fxnYWbWl5YYhH8QNvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644858240, "uuid": "768b17f7-2c80-4bd4-87c4-612e02c107a6", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644858240, "uuid": "ec5ac41a-ae1a-4de6-8814-e0a3f90f27c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858240, "uuid": "c854d489-e25f-4f90-9858-5629694d7152", "value": "File.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f472f86b-8d71-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644828111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828111, "uuid": "c3ce9f2a-d173-47d8-a506-3b5db914f103", "comment": "Malware payload (Formbook)", "value": "88b9c24315008dc024edb9d2cde0be49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828111, "uuid": "d9a9f8e2-fb5f-4280-84a2-9fe7a7ebfe6e", "comment": "Malware payload (Formbook)", "value": "5cfd3b8ba7a3da6c08222b824d569148499ebfd98ae94b991157bda8f78ab515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828111, "uuid": "2e6e58ef-fbc5-47e5-a25b-95a39e9189e8", "comment": "Malware payload (Formbook)", "value": "8da5f023e8e2e011019a1bc637cf6256f0bf5bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828111, "uuid": "9351a669-5f0a-43ba-9d03-cabcbfd0bf86", "comment": "Malware payload (Formbook)", "value": "44b9ff1ab194f02f5e40edb267b8636aad043b8c953072a7729a494e367cb412d66a8ce1f4df7b78512214dc401a1860", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828111, "uuid": "eab57ccc-c459-4ca9-a5e1-cfee06af9288", "value": "T169150101BBE66B23C97B0E7BC5E142029770E54A910BD77FA0D136F85C8B3691D7227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828111, "uuid": "bc389c9d-9aa8-4643-b0e3-6aabf667a076", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828111, "uuid": "6c1e506a-131e-4e65-acef-598be53a011b", "value": "12288:ln2pXIxReZ9Lr2cJwia5rcxTm7emhTehK4pvrbvx8TCVFFLsv64bhqzw791P4uap:l2a729/2cJwUxKFDuvrb3VM6ahqzgA6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644828111, "uuid": "00e439a7-5162-4d3a-aa1c-e68570159d5d", "value": 892416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644828111, "uuid": "c2f6476f-fa1d-45eb-8cf6-730b66d41366", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828111, "uuid": "89e5713d-3794-48b6-b5b4-648c64829956", "value": "Teklif talebi MBE00923,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97299870-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644854583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854583, "uuid": "5ae0548b-d4f2-4f9f-a3fc-cb30f392436c", "comment": "Malware payload (AgentTesla)", "value": "d480e30eca52377f4553fb5f48bcf39f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854583, "uuid": "3309ef3d-52ab-41e6-b7bb-4360ab1c0927", "comment": "Malware payload (AgentTesla)", "value": "5db9ed5db890a3bd459c00c491a57b246a5ea788940e35b57ddbdf0e0ccb54af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854583, "uuid": "85d0500d-7d17-4c71-b5e9-12a35fd5b0e7", "comment": "Malware payload (AgentTesla)", "value": "7705fd8c9a830f679197f270ef2797abb6ba453f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854583, "uuid": "a8e14662-0b0d-49bf-8f3d-0d281d41bf6d", "comment": "Malware payload (AgentTesla)", "value": "b5b9ee882f44f30a0cdc449fac4579e07d001f8b55ea8723f25e407688ae6826e9fda5196f69764bbedd516b59004ef5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854583, "uuid": "c5f49fd3-ddce-4dc2-8bf0-04738234e451", "value": "T10124D9B4684F0872C309DC1E25A8B655AE79FEE374C554B223AFE034CF5AAF29EC4541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854583, "uuid": "2aa5d7e8-0fec-4d98-ac72-0db4c45ab954", "value": "1536:icTDYAEUOyUlBf02seBYCocITlXZVmVoQRbxeN6dzFz76mAg5eeVhMDw5wfLU:i3iOHkRktdzFtr5RDAw5wfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854583, "uuid": "46debefe-6551-41ca-afe5-cad8db0aabe4", "value": 223434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854583, "uuid": "61c7c98b-0667-47ee-98d7-8436c961ca43", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854583, "uuid": "d921142a-e6d7-4023-831e-56f991d156cd", "value": "MV. BULK VENUS-3.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2ba905-8da5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644850409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850409, "uuid": "c442e624-5c8e-4d2d-b778-7b5cafa84ebc", "comment": "Malware payload (Formbook)", "value": "69fcac13980b13199f56841fb1e0e0b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850409, "uuid": "c6528b03-3dc0-465f-ae60-b1d919b8dd55", "comment": "Malware payload (Formbook)", "value": "5dde67093b891df286e998912557fa598ebebc662bb30252fbe9ce7798e50242", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850409, "uuid": "8000e5b9-d685-4b6c-b5cf-edc238c034c4", "comment": "Malware payload (Formbook)", "value": "98aa2e6b6c0698e0a4a439c94b80550b7ebad2d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850409, "uuid": "0f5649ce-b32a-4c23-8dcf-0e710a8dff7e", "comment": "Malware payload (Formbook)", "value": "13b8f12746be52d5bbc491909098665763af292ea426ca840d815277c4096b5b696bddc4d8a4ea27d570ca1d179f28cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850409, "uuid": "f7bf6769-7755-46c9-a328-d2295dbd53d4", "value": "T144B48D01B1859C9AE41316B268BFD7202169AF9D9176C50E3647BF3B49F3313346BB8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850409, "uuid": "0435907f-9a18-42f6-9da0-03bcf85644d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850409, "uuid": "b7b0c347-b396-4a9b-8ece-39a8613f8c7a", "value": "12288:n6brWDkvqrZMXptfwMO5MXzmuc0bGmIvjO:q6DkvqrctQOXquc06m6jO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644850409, "uuid": "e0c973d3-d3b8-4ea2-8a49-c258f62c6f06", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644850409, "uuid": "9ff5b16f-7c60-4f5b-8cb0-370690fe4a42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850409, "uuid": "cdd3afca-4408-486c-90e7-403359c57a74", "value": "IM2201-2T,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d25bbe-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644855171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855171, "uuid": "1c882779-c9d9-4d50-8750-a55213da8eaa", "comment": "Malware payload (AveMariaRAT)", "value": "2fa24f06caef169bbf02c4502bc3683c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855171, "uuid": "3ab7e094-e83e-49e5-8d61-4f3ffd1d1982", "comment": "Malware payload (AveMariaRAT)", "value": "5dfd7e1d200222b0c094c86865a4ac3194a7eb056b92a96a69c511fdfd542b67", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855171, "uuid": "a24732a1-83a1-4469-a5de-30134d99d49c", "comment": "Malware payload (AveMariaRAT)", "value": "4fcc97d4826e14c07dbef50bb4a7c878e3a7a062", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855171, "uuid": "436a13bc-dbec-4f02-baf3-896b52ca8683", "comment": "Malware payload (AveMariaRAT)", "value": "c0eefe4ffff2b819f3f93d83d094f83ca5865b01eac3592d81e67776b3dd6d83562e0dc16b331f3e667d48964dda1c35", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855171, "uuid": "dda3caa7-728e-44a8-8c28-d0a6b8c525c2", "value": "T15F05F1007BE6AB23C9BE0E77D8E182415370E95A516BD73FA4C532EC9C873980D72276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855171, "uuid": "dec01c7e-734b-459b-8a58-0597da5042c5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855171, "uuid": "7ff7f4e8-8a2d-4829-b6fd-ff0038bd8e9e", "value": "24576:PwUTo83p2vzwZ9vMXeJeMDnnqO5K0Cain9cO:Pzo8WwP4KqGKzag", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855171, "uuid": "d200fbeb-654e-4836-a80b-93447d42d0b0", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855171, "uuid": "26f552da-f0ce-4160-88de-7b474150d4c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855171, "uuid": "02e785bd-c7dd-47ad-b2bb-167d88f89704", "value": "Sat\u0131n Alma Sipari\u015fi FEB22_76543,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d896a43-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644823053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823053, "uuid": "8620d0ff-9d4f-4ff6-9364-4a2f57360801", "comment": "Malware payload", "value": "f2d567bef9555395a09e0ed00c84fe34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823053, "uuid": "67b96a3e-e617-412d-a25c-15470e55b8b7", "comment": "Malware payload", "value": "5ecfc609632125ea1013fb8d1688b4e5a9a24ee5a9752634cf28e926de7d80cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823053, "uuid": "9fa153bb-7a90-4848-9a0d-9357e853d860", "comment": "Malware payload", "value": "64d06a276c4fd8f2f129671847101dda373a594d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823053, "uuid": "8ed9651e-bddc-4c30-83d5-f9a0943792b7", "comment": "Malware payload", "value": "eb52e9c5c6dd2cdc58ba23ec04bc1c92527c5a7e4c262599733e662caa33fbead8f47ac4d03bd911e9312d83a05bc973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823053, "uuid": "ca72d3de-7cab-4cce-89ef-a30c0b1973cc", "value": "T1A2E26D9272A08330D6EA1BFE2867A3558777A6678456DF9C79CE00CD2F637004923ED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823053, "uuid": "42196956-0be9-4ff1-a266-f9caadc3a836", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823053, "uuid": "f7ed9132-87ea-4679-a77d-4ed4b7cdde0f", "value": "768:CTI1uuz9xSjvrfenI1uuz9BGtYcFJSx6K:CTIUNXenIUyaJSxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823053, "uuid": "f360fc17-29a4-4d56-b874-27fbe45a8ca7", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823053, "uuid": "9f8fc169-6a4e-45ec-ad21-8af8dfb75544", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823053, "uuid": "ee031561-3fa4-42d3-85ab-125d2d1022f2", "value": "f2d567bef9555395a09e0ed00c84fe34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da9455d-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644861895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861895, "uuid": "711cce42-1110-49c4-b738-e49e7ef396be", "comment": "Malware payload (AgentTesla)", "value": "1670ffbd8a6b25e1d527c8a3c8f811a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861895, "uuid": "9b4f0bea-1905-4bff-97cc-50762a984ff2", "comment": "Malware payload (AgentTesla)", "value": "5fd8ce1ead90e9ef50055ee61b68b5b94858f8ca2478c8e68bad04871e317b8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861895, "uuid": "2d943460-5ab3-4dbb-9df0-72cf33b3cf6c", "comment": "Malware payload (AgentTesla)", "value": "b0e21f645af33db3b77cdc99bd1d20b8b25ba069", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861895, "uuid": "26ea3912-85b0-43f7-aae7-9d481994d587", "comment": "Malware payload (AgentTesla)", "value": "27de09d8142524e37be6ecc4466c64a04a4302ac42e6587cff6217c41ebb5a8188c5015a6adadc5af9cca4dcae9fd472", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861895, "uuid": "97d79cbf-ed44-40c5-a28b-871a748b03f4", "value": "T14E151200AB37BA74C9B00BF889B2823F2AF49A5C4267EE7BE5B371CD10727664574535", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861895, "uuid": "f168caa8-5ba4-4c3a-87d8-dad4e7f46d61", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861895, "uuid": "6730175d-1913-44d4-a265-036e91fb496e", "value": "12288:wJakgvl3IJAh8lD7gyH32MND9Q4CKTL+rZa25/6BCm/YQ3cKZ8B6:wfgdAiag5MpK4HLka2Z4YQ3cW8B6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861895, "uuid": "5fae2388-e47b-4163-8ab5-3c692cddc6f2", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861895, "uuid": "4a7d75a2-fa8c-49f2-b624-d90295ad6f89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861895, "uuid": "5bd15f91-2f24-40a3-92fd-b0764d8a1e62", "value": "1670ffbd8a6b25e1d527c8a3c8f811a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cdd881-8d6b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644825241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825241, "uuid": "a0d71512-f3a2-4a01-bb7a-f8d6369e2621", "comment": "Malware payload (Heodo)", "value": "f8059fc303a36a6c668879ee6af02133", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825241, "uuid": "8cdd3dab-66b2-40fd-9942-68698b2d1576", "comment": "Malware payload (Heodo)", "value": "60a3ff767d5a0b1836afe8c5d144792928ecb48d7609f4ea5aea89d4e64de374", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825241, "uuid": "87312c7b-b0bc-4529-bd90-f6891d72fd15", "comment": "Malware payload (Heodo)", "value": "7b121be39bcba6e35d66463204b7d0a433cdc35d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825241, "uuid": "df6d782e-7474-4042-94dd-26b70960fee3", "comment": "Malware payload (Heodo)", "value": "1795d28e183268b0726e7ab8615eb8cf327a4b607b5971d767ce0f55e8a38367a66bc7b7a4027c805fb00225edc90b80", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825241, "uuid": "6a5267d9-ef3c-4411-bd74-4aca92755465", "value": "T1D5445C1672961C7DD87BC07882574A25FBB178850B21F9EF0794123A2F3BBE0AB3D654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825241, "uuid": "3a861113-3324-4eeb-8146-6f698afc0d17", "value": "e7d4845da9ed73fdac7ccb952f62ed0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825241, "uuid": "44c37af2-025e-4b92-a910-82cf2c4b2ba7", "value": "3072:6y7EpEidDodjWtYJI2aJIXT21Ee0gnEzum9nxyFRHv31IfU4AyNMuzL3vGuT1P2z:N0EiGdSYuXf0hzucCN1Izp1Mbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644825241, "uuid": "f941cb8c-f70d-4a6f-91ec-d02f7a1827e1", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644825241, "uuid": "ee4a2603-6c8e-4f27-8616-6b10da871ca0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825241, "uuid": "596dbd35-7201-4bb8-9ba4-18b88f6cd527", "value": "Elevator7494774624732740300.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3984a1-8d55-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644815965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815965, "uuid": "06486612-abd3-456f-9273-4b58b963f72d", "comment": "Malware payload (SnakeKeylogger)", "value": "2ce1ddaeb32d4b503618b9a77aba9925", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815965, "uuid": "7442a0f2-63ae-47bf-8225-59e2a7ceb4eb", "comment": "Malware payload (SnakeKeylogger)", "value": "612e14c615a6cde2d55021823854365d72913cc12fbb33c55139af9e058ccac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815965, "uuid": "e55177ca-35db-4e23-8047-cb8400fd7498", "comment": "Malware payload (SnakeKeylogger)", "value": "4e86d5eaf7616153a88c37a09f1f45cb43580ccb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644815965, "uuid": "be1b14fc-9f49-49c4-a032-5c28ee7380ab", "comment": "Malware payload (SnakeKeylogger)", "value": "f17783b099f3a54aa91919da8acbcb83b4d569515e6f8b57b38f666374e873c1c2d6460114327cc43897a16534a93fa0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815965, "uuid": "e159630d-26e0-4f50-8bfa-f9d24af8a463", "value": "T19A050119973AA519C97907B8E06150D81B799A2D8147E7BF70AF3CED2FB33838930176", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815965, "uuid": "910e99a0-5e32-428f-8a53-87e6368f6772", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815965, "uuid": "04f0702e-6c3f-4d31-9c29-6bba1c552a1b", "value": "24576:ClyNmOLZSK/uyBDXtZHXNZBxmq0OJOARyg4fRw:LoOt3nt93xj0pARyTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644815965, "uuid": "514bb590-bb00-4139-b10a-bbb8f2d0db45", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644815965, "uuid": "e445e11f-45a9-46c6-aa5c-32d896c7deaf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644815965, "uuid": "a3e9a124-652e-4ff7-a1a8-250bdebeea75", "value": "NWD5671.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ea4a64-8da5-11ec-9275-42010a9c0029", "comment": "Malware payload (DDoS.TF)", "timestamp": 1644850197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850197, "uuid": "f7982dd9-bdbf-4f09-b346-b7d33690935b", "comment": "Malware payload (DDoS.TF)", "value": "30e81fe048f848d90a0fe6c5a7e30628", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DDoS.TF", "colour": "#278C8C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850197, "uuid": "ada31496-e0e2-458e-bbf9-cc62a5d9820e", "comment": "Malware payload (DDoS.TF)", "value": "6178dbd74b5957692452ebe80136adf90426b146f888b9df5ed6c5581b68c318", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DDoS.TF", "colour": "#278C8C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850197, "uuid": "a7902fae-90e3-452b-aa8a-1c9e0e66b2a1", "comment": "Malware payload (DDoS.TF)", "value": "d0f8911bb2a7b2ff9c2dda41139185e43de61072", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DDoS.TF", "colour": "#278C8C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850197, "uuid": "5d608cce-f4f8-4259-a3bc-4fbbdbd47b89", "comment": "Malware payload (DDoS.TF)", "value": "6813f34a80cc762e2da1fd3193e70799162c7e62dc414378ee5330fd6b2130c9b96c73a467fc0b5b1cee811cacaa84fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DDoS.TF", "colour": "#278C8C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850197, "uuid": "edad7ddd-eb65-498d-a3e3-d70124ae48bf", "value": "T1A9B49E57F791E592C41502B0234AEBB5E530FA32502398CB7BE92F596E702E1EB8D317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850197, "uuid": "eca8f8a8-c9df-4d47-b874-74f70729865d", "value": "6144:KygpxJWjZCIDgFfrXPmIfTKqwijPDnZ8xHFDwEHuAMZa0uuAo2inLWWL:Kyg5WjZcFLmZqPjrnCxlkEOAi7nhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644850197, "uuid": "1348b4e4-1a0e-4425-9264-adf4c5ac7e50", "value": 538236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644850197, "uuid": "e63a7484-1a24-4a1c-975a-aac63c53c763", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850197, "uuid": "a862407b-1fb4-431e-9df4-d6c02a931f4c", "value": "30e81fe048f848d90a0fe6c5a7e30628", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3aa9aa-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851745, "uuid": "99485fde-3465-410f-9b60-8b8cb65a4c2d", "comment": "Malware payload (Gafgyt)", "value": "b00ccedd9f83721a5ebfd3d2421c634f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851745, "uuid": "53813b28-3843-4d64-b4a3-21772a269401", "comment": "Malware payload (Gafgyt)", "value": "61a054e22fc17c7b9bc916c6721c2ece24b6957324a7d328887dcf1703139997", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851745, "uuid": "6919b4f3-5bc1-413c-a08b-80c598402d5d", "comment": "Malware payload (Gafgyt)", "value": "eb14125fefbc58cff2ba228ef2ec4da894e6a2b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851745, "uuid": "751b5042-70af-4d56-bfce-7ef3dcebc1dd", "comment": "Malware payload (Gafgyt)", "value": "92f56b4652a6a7e3497ba2a456e796b2dafde022f9a8592e7e7e6e92426d5f06009881b062708ce93c8bfdf683ad4132", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851745, "uuid": "e5e0d6c7-ad40-4ead-a2d5-c7fe00d6e760", "value": "T1FDB3C617AB618FB7C84FCE3306AA450120CEA55612E97B6FB2B4C96CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851745, "uuid": "c78fd7e6-5faa-46ec-9fa7-e8d9c78fc0fd", "value": "1536:3LeT7etSb48MS3MYXZ5Wc3+aI1Hagdzcym5ZlzLUmkiSFxfC7xbXe:3F8B3MYXx4HaZjDlzLUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851745, "uuid": "1089b323-3546-4a0a-8635-f4540b5ddb89", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851745, "uuid": "413c9903-74be-4dfe-bac1-7da4e9e34d7b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851745, "uuid": "1e6bbf1c-0561-4a3b-bd4d-1a7b0d03daa7", "value": "m-p.s-l.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39933e84-8d32-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644800739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800739, "uuid": "d9fa180b-5b8e-4544-8cf6-e745b1d54d62", "comment": "Malware payload (Heodo)", "value": "b074d1c1024a9fd0e57f74a9173baa78", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800739, "uuid": "a337c219-00db-462f-bfb5-9b6d35f6622e", "comment": "Malware payload (Heodo)", "value": "6441f43c2fb570f99ee54fe2639f84311a0dbbba3b0d7c535b85ea8913bd5aa2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800739, "uuid": "57854a60-fb36-4aff-b3ab-b116c4ed57e6", "comment": "Malware payload (Heodo)", "value": "26322224fd62b464c21dcb008c89c8bd61ee2fda", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800739, "uuid": "a8f9033f-b517-4a9d-86eb-19ab58a51244", "comment": "Malware payload (Heodo)", "value": "d6df8b930131d8180a737003eaf2b197584cfb92a302d801d1cd2a2097f025165f16c64b4584f4df598309de78455ec1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644800739, "uuid": "5f8bba55-9ca1-465e-b580-d53fa292213e", "value": "T1DDD38D6ABA48CA0BD94913314EE7CBF67336BC819F5297473295B72F1C3A590CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644800739, "uuid": "c09f0e78-5b9f-4202-a9de-dd53af93c4ba", "value": "3072:TcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3E:TcKoSsxzNDZLDZjlbR868O8KlVH3skeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644800739, "uuid": "bdc11750-409b-4ef8-9925-b1aa7c6b3035", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644800739, "uuid": "1a6f896d-c690-4555-8de0-5cd5b0b33e23", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644800739, "uuid": "67b82ba6-8174-4494-8d81-4aeec6b69efc", "value": "tmpkdj1evbh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3543fa-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844772, "uuid": "42d0d2d0-58b5-4f43-a03a-703de388acc6", "comment": "Malware payload (Gafgyt)", "value": "3d19bc3143c96e27520fa06869e74735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844772, "uuid": "35e49f47-68d4-4180-975f-08ee215b91b7", "comment": "Malware payload (Gafgyt)", "value": "64f9c70cfbb140304cd27f3fb272b38c17676b322a587e22c2479259c2cde7af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844772, "uuid": "e1db819e-19a8-440b-9fb7-612bd5118750", "comment": "Malware payload (Gafgyt)", "value": "6a8046c88db5d68f5e6a559cf3eaa6ac9fad4e7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844772, "uuid": "68f43a1d-8caa-4ae7-a89b-6766fa60e8fd", "comment": "Malware payload (Gafgyt)", "value": "ff581d4895f56ad9c68cdfc6d61fb9f3c61d0f278fe97265b2ec472616e04caa955c76112a1a8ad38862672c2a707829", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844772, "uuid": "831070f7-8cd6-406a-9343-6102368fad37", "value": "T1AC933A277B230E23C0CA557112E30331B7B5D74938FA4797BAD16EAC2F16A8439167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844772, "uuid": "dd9782db-6e2e-4971-9b70-dbc7b7e67d90", "value": "1536:jW6Jk7jWNEqi+thy5ct1uNcdj333mX0Gq4/cOf3Tj:CwNzi+7C+uqdj33mX0Gq4EOf3Tj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844772, "uuid": "395c3383-0924-4f08-b76c-cdc49819f879", "value": 90411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844772, "uuid": "de230b2d-2f56-423c-8b94-574fbdcecb8b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844772, "uuid": "016d3438-13bb-4ab2-9b88-0ef5a19ea71c", "value": "Demon.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4a7a1f-8d2d-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644798735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644798735, "uuid": "7def269d-218c-4c52-94f1-20bf295ff0a4", "comment": "Malware payload (RedLineStealer)", "value": "0158450f7d9cb210f963d0e6fbd24d06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644798735, "uuid": "e614c523-84c5-482c-abb8-5c2832a1434b", "comment": "Malware payload (RedLineStealer)", "value": "6517bcfabed2b52d67df1c724ff05d90276179bac71cb603461cc65c63583e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644798735, "uuid": "d2aa5d07-8ccf-4c6c-ad68-0338e3f42c7d", "comment": "Malware payload (RedLineStealer)", "value": "4d828a4704724249df3c9b75c56e77bf9b701375", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644798735, "uuid": "b3fd5c49-097b-4d3c-990b-a5820592615d", "comment": "Malware payload (RedLineStealer)", "value": "6460bcf97d7ba4f22190be8d5b9c0cd5060aae5ef099e231aac3086ff7bf0038070c7b4daa15a3e086871324b45e4fbb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644798735, "uuid": "9eed767d-52eb-4d52-9b94-e6a71cd243f2", "value": "T1962633CD078BCCF5E0EA5C717BC068C6A1391A50D7AEE4DB04A0C9690CB5717AF6987E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644798735, "uuid": "103cefc1-25fd-43dd-a294-63fcebeb18c5", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644798735, "uuid": "a5abbeb7-e870-46fc-935c-cedf498407db", "value": "49152:GK0e8ioM8rh3gbOrgHIlTYbaFyxg/r7gtDrDZuy9V/ZYvf2fDZdGriyIoY+hKyAs:UeMbzmGwrjVRYqSiyIoY+wfD2IQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644798735, "uuid": "05eed8b2-83fb-478a-90dd-5e618e7e2eda", "value": 4527616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644798735, "uuid": "f5ceccb7-e918-405b-a2fe-fa06a5013b58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644798735, "uuid": "cf240f26-5a65-438e-b936-991e059378e2", "value": "Dying Light 2 Stay Human.exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f33eb4-8d5d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644819359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819359, "uuid": "a89152b7-d9b7-46c6-8966-855311233187", "comment": "Malware payload (AgentTesla)", "value": "73e25abf9218e870ebe65990133f5c2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819359, "uuid": "b95a0433-4607-45f7-bf65-03b70ed47846", "comment": "Malware payload (AgentTesla)", "value": "659909c5015a19d183541d68afd412856158551fbcf80758c5ada908fc38c2e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819359, "uuid": "4487cd5b-7521-430a-9e10-48496927b323", "comment": "Malware payload (AgentTesla)", "value": "870d033c08380119f5b1880a1374e7e097b3423b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819359, "uuid": "bbe977c3-c60f-4f9c-ba72-60033d529100", "comment": "Malware payload (AgentTesla)", "value": "b79fb37ef6d26ba903c3037a5e35c458610d8ef54b830817a133bab085e60eb9fa4dd096edabafbf8d8f0048dafe7f39", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819359, "uuid": "14b76512-87f7-4f0b-b693-18ee1762b84f", "value": "T16AD423202DC5686EE467ECB4900C6C76B1F136151AA5A24D06F6CDB57CB5F8E838BF0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819359, "uuid": "96beae1f-3421-4e97-b17a-550da0a63a8f", "value": "12288:25p+kl3+aMswHKPtb4CSd01kxeQ7tyCQZ0ZnP/DQ5Un:0+klulswqFA01kHtyCQZ01/DQ5Un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819359, "uuid": "f3572d65-082b-4c9b-87a9-7575cc5888a9", "value": 627379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819359, "uuid": "395d2245-5614-43b7-a022-b0f1865ad985", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819359, "uuid": "8a071d08-74ac-44f8-887c-a87bfaed906f", "value": "CIXPL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91fa1b1d-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644842549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842549, "uuid": "d9e5d9a3-cd49-4b0d-8273-19a4e689d222", "comment": "Malware payload (Mirai)", "value": "feda3af060d2752170caeb440e7f6989", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842549, "uuid": "390f4305-803a-4046-b850-2f4016714b1c", "comment": "Malware payload (Mirai)", "value": "6648ec5e77380e6a936b37d9298248cc99f7cce8cad14e1e46e1cd0e53cae5fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842549, "uuid": "d55d6522-a3e2-4f45-b100-5b22b67fbf00", "comment": "Malware payload (Mirai)", "value": "ac6fca06bb6e94ac418d1eb560d80af4b150f2ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842549, "uuid": "99218f58-da36-4ce7-8b43-ed032c668b0f", "comment": "Malware payload (Mirai)", "value": "c01a70e5cb8c9eb01ed84a83f51a92268f3515ef1511b9c61868815dc5bce6432fa9141292af23f09d10ce5e927fdb2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842549, "uuid": "aa20a584-7c5c-4abc-989d-55f8f2ec92d7", "value": "T148336D01F30C0947D2672EF43B3B27D1D39FA99122F4E685350EAA85D1B2E316686EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842549, "uuid": "3f9ccf57-4667-4627-93ce-448ce598a2fd", "value": "768:r7WAnaRgDa9gLthB03T7IBPgWFM8tGISn66K2A50qhTYXHIU:r7p+gD0gJhW3qP88st66KpsXHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842549, "uuid": "d183fa94-7eda-4412-9d44-3541d6eacb29", "value": 51816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842549, "uuid": "6327f9bf-29c0-4e4b-b678-9700643ffe1e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842549, "uuid": "47eaf7c1-0cfc-47c7-8f1b-e6b4e457c762", "value": "ahsok.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe4fa1e-8d84-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644836049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836049, "uuid": "87a89f22-723e-46ab-a096-f87a793ad57c", "comment": "Malware payload", "value": "71817d05c12b24d044c269b88f1904b3", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836049, "uuid": "7b70d684-d5d9-46e7-97bb-902f3c2c5dc1", "comment": "Malware payload", "value": "6667618913e92d79dd9d72c702f6328413f84aac0266665ea82c3a46ec2edac6", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836049, "uuid": "1ec7ceef-2e57-4070-bf4b-ec2de72e85d9", "comment": "Malware payload", "value": "bbbe0aa46ef4aba008a177bbb215e04f5df6b9a5", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836049, "uuid": "7bcb0b1e-1a54-4b5b-b541-f0de3e955759", "comment": "Malware payload", "value": "9944b55ddc4fc0d1af94581633794faacce2acf18d59be088d4194a42b6ea66c62c257d35419cfe4fffa296d527fcd60", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836049, "uuid": "446ef3c6-7035-4204-b093-c47f5de25047", "value": "T11F426D3DE10C9DE9CB4EA1F456267E16924CBD1413D2D0D275BCE7715FA262FA312420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836049, "uuid": "5b79f00f-7fb2-4be5-8478-bf736703d4c3", "value": "384:qT8SxsndfT7lcucYXOun/OLgljon2GV/zkMs8:k0ndfT7lLn2uPUVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644836049, "uuid": "928a3628-9f79-4375-8666-878fb88335c2", "value": 12799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644836049, "uuid": "c750668b-6b5a-4ab1-ab8a-eda41cf764b5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836049, "uuid": "34d4c0a5-172e-48c2-bdb7-48d787f83dd7", "value": "PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2daeee-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644821899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821899, "uuid": "19294626-2cea-4cdb-a1cc-f0abf9c724d0", "comment": "Malware payload (RedLineStealer)", "value": "9cb214a5e6388b5d007698b4e11d037a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821899, "uuid": "0d307c92-45cf-4334-86ef-1f08bc355216", "comment": "Malware payload (RedLineStealer)", "value": "666d74d282cdf637e7ad87e2910a9554ca547e15dc83efd9daf91fe3aca2031a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821899, "uuid": "1ed2a3e4-5960-4658-8f27-ba6b1a1f572f", "comment": "Malware payload (RedLineStealer)", "value": "f4ca4bc6f3747a13da185d80686d9faaa858455a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821899, "uuid": "9544877b-4c77-4170-8acf-f4b4d3456d8f", "comment": "Malware payload (RedLineStealer)", "value": "10cfeb88b6397c30a8ea396005f8db0cb1c1bd8466bb35863a9a7c00ff367b6b54859591ec861116fd7be50d8bce6ad1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821899, "uuid": "39f4f3f2-84f6-4c5d-bd2c-b8f4186d478e", "value": "T186A54B56FCE604BAC17EF130C55292627A72387803326BD71E949ABE1A76FD46E3D301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821899, "uuid": "855d6203-4b8f-457b-af63-8ba09e137e0c", "value": "167344a4df394fbba605fc972e41437a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821899, "uuid": "3fc7de39-8e8a-41ed-a96b-f731a5b2676e", "value": "24576:fwJGOL4BevJRhe43FAoSBTQB5YpwCXNN5/7BCo/2GB0VBaCJ2hL5El:YJGlAJRhR1WUKB03khL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821899, "uuid": "567b8bf0-380a-47fd-a807-74c6dc809ed7", "value": 2077696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821899, "uuid": "59e233b6-6e26-4f52-8b73-05b755a53ada", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821899, "uuid": "36f70b1f-3420-4d90-9379-09d8421c52e5", "value": "9cb214a5e6388b5d007698b4e11d037a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc844266-8de2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644876604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876604, "uuid": "76341f26-de50-403a-a9b3-5dbe62a1c52e", "comment": "Malware payload", "value": "cbec5d33d2439afd7adb7b9fa924f995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876604, "uuid": "a3c29fff-a77b-44ea-8ae6-92bcc47c10f5", "comment": "Malware payload", "value": "677e8ef9357686a23af2a729260036fc7432c9b3c59092ba117d85752b5e65d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876604, "uuid": "c49f77cc-479d-47f1-beb5-f7c8b2f7bbaa", "comment": "Malware payload", "value": "4e2edc24789feb373fb638f6fb7553a8b15ca25f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876604, "uuid": "fc418981-1c7b-4f4e-80c4-df962ca48e34", "comment": "Malware payload", "value": "9f433b335e562452520c12fc94a465ecf3529303e0948dfe425c5699fb0d5ce50d9549e77701703d9429e0a81befd114", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876604, "uuid": "f10e7357-42d0-4ddb-b8ef-0e4b6d2319f6", "value": "T13976339466334D31C1ED3BB9BFA1CE351706C9480A71E13E97D86EB3A42CD6B36211E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876604, "uuid": "8751bba9-cfe8-4d7c-8c45-fa2886c9c90a", "value": "668a44ff2871016aaf7fa16d60cbff30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876604, "uuid": "dcd96bcd-fcc3-4aa2-be06-7596f08e0947", "value": "98304:t/YySgrc9YQSqYlBfRo2aEplI+A6Ts7ZT0bLwj197m+wulSMiS3mR0W5XUvJKeRm:t/ar9YQN2RoSw+eZtHqQlSJ0WRoKek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644876604, "uuid": "a84ce2a6-1a38-4d8b-9985-c1df1308341c", "value": 7372187, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644876604, "uuid": "601ddc0f-48ee-4026-9ee3-4f70ba26cd1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876604, "uuid": "b170324c-ee8e-49bd-bf46-9750378fb5fc", "value": "Trainer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f6b2461-8d8b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644838920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838920, "uuid": "80294070-cf81-4530-890d-77dacdf47b16", "comment": "Malware payload (Formbook)", "value": "f72d0c13967a84adf37923ffb2dcdf97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838920, "uuid": "805fc236-ce35-4cf4-aa7d-6f4ecf5a3913", "comment": "Malware payload (Formbook)", "value": "67903cef77801bc8392a5f87e52b371ae95432f596638e37dcf240a44b36d61d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838920, "uuid": "b6444ff8-6dca-4f49-bfca-bdea5958042f", "comment": "Malware payload (Formbook)", "value": "fd0264a864ff4525c7336ba8c1fba18f1806ef62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838920, "uuid": "4d276bbe-87ed-47f1-9dc0-4176d1536246", "comment": "Malware payload (Formbook)", "value": "57f3f0ffd69dde57020ca3566d612259c2b0d2f477ebe39378f0856d9eefaa2321c6ec25f2d638041ca4d991c6e3ab34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838920, "uuid": "42cf21a7-588b-4b28-90b7-9524bc0dbe19", "value": "T1B68385E2B51ACED8DC065BB25C76D62010675E4D88A9D40E30EE3F2B77B33132866D5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838920, "uuid": "68c581c2-2575-4496-86b7-c75f10185ec6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838920, "uuid": "27988740-3158-46ea-89eb-9019a6bb2818", "value": "768:0hX7+c0thVxLetQ49FxSU2Ip4jBqltCF0AxEjenoB69+FxE:fPLMQ+TSFHBWAxEjc+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644838920, "uuid": "f2994a7b-0898-4eba-b113-ad78a7959118", "value": 86528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644838920, "uuid": "32c2231e-8a93-4171-95ed-19665797299c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838920, "uuid": "773221aa-bc88-4eaf-bae1-4b8b78085994", "value": "OrderN0-EG001_1422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18cc6104-8d85-11ec-9275-42010a9c0029", "comment": "Malware payload (XpertRAT)", "timestamp": 1644836332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836332, "uuid": "9ee0a912-c831-443c-976a-9393140ada8c", "comment": "Malware payload (XpertRAT)", "value": "889ae401a3acc4f824065ac0f47143b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836332, "uuid": "bc1aa570-0cfc-4cda-ba81-5e81effb0221", "comment": "Malware payload (XpertRAT)", "value": "69186bb77f81edb9bcc66a0382fe00944e6dc67982d61d37d7f0d2e32e92d727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836332, "uuid": "b6c7e6ef-0920-45b8-9637-70682a851fae", "comment": "Malware payload (XpertRAT)", "value": "6f81823927158edf53d6b08d2d38dab356cba70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836332, "uuid": "5db906fc-6cb0-4a07-910d-282a43493a6c", "comment": "Malware payload (XpertRAT)", "value": "ca5e24e5dd87c1e4d8411531eaa9afe391566867f3b08bebed32f3694565faed26bfe3ac2b486e85c925fc8f129eb066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836332, "uuid": "e8f861ae-5c32-4001-bfd8-0d219f4b8a5e", "value": "T18884DFD53280856ED47D78390B9AC7AE716B7F3CAA12263733B43B5EE9314D2F520285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836332, "uuid": "8e0655b0-6e01-4f59-8c80-0e707164fa54", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836332, "uuid": "c520bea1-71cf-4066-83b0-26d57a3a2c09", "value": "6144:nwAoRWFba8H8zTJ0O1j/QJSrUN1M+PNwJZlJ0+hdgf:eWFZHuTJ0Oj/QJSrWM+PebvJfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644836332, "uuid": "e350423d-4f57-4a7e-8344-68ee90452e9d", "value": 398731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644836332, "uuid": "700f63d0-4608-4ea3-b370-58b10e6f23a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836332, "uuid": "eab1b5dc-d86e-482c-a182-06a2b01c5491", "value": "Presupuesto proyecto P3787-SHN Barcelona.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cec055c-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644845976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845976, "uuid": "f668d63b-39a7-4f01-818d-43c67cbf0b96", "comment": "Malware payload (Formbook)", "value": "33452a85a4988b1734fd80a115e18e45", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845976, "uuid": "8e5e16c9-3cf9-4ac5-8979-793349dd9111", "comment": "Malware payload (Formbook)", "value": "6a1baf9c9a98acb3b9bf812185f4d674272dc52db43bf61a134cecf5a1af7739", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845976, "uuid": "3fd6b713-e4b9-496e-93e2-fadaaed13cf6", "comment": "Malware payload (Formbook)", "value": "34c7f196328c26bca84bdb1bb89e9bb4d3178383", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845976, "uuid": "930b2a76-837b-41e7-af0c-5ab12ad0c8da", "comment": "Malware payload (Formbook)", "value": "e4b02249bca6cb6a03d43689f8d05551c0dfd20f884386fac8f225ac9199f88607efb603ed6347dc9c83dabe25e9a244", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845976, "uuid": "57c8856b-cd3b-4709-aaf0-7c1457648310", "value": "T1948423C5D59A91C7769728F17814347C5A6239DB0F1E8A3A198CB77390884FFA83B0BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845976, "uuid": "95ee97d4-3b39-4570-80e5-a7c769e7f3ae", "value": "6144:WZNMy4mZbIdeHoD+3hI2DBMBP0nQaI2tdSmy0nWX0I3EVS/VutfAOkXQ3jw:+2aHK4S2DBM+QaIkd3Cp3h/E6OkXQ3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845976, "uuid": "f9f537a6-346b-4ed6-8915-155c1db2edd8", "value": 390834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845976, "uuid": "f8096601-9812-4a9d-ad99-77f9746597bf", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845976, "uuid": "9951b9d5-5d44-4f47-a7c5-d424db9981c5", "value": "1644832704.Vfc11Ib63d5bM401141.dynamene_Proforma e bashkangjitur.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515b22ff-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644851460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851460, "uuid": "3def3f7f-ee14-452c-8779-cbee6bc07151", "comment": "Malware payload (Formbook)", "value": "b2b4ccbfd732a86793a3b84466158b57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851460, "uuid": "9c592841-d059-4860-abcd-6c7b2078996d", "comment": "Malware payload (Formbook)", "value": "6a40f8d6e9ec178ae88ea1a08a6997154dc7b118ac126635b12858ac86d84995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851460, "uuid": "a50a17a1-167c-4b85-acc6-7cc88038589d", "comment": "Malware payload (Formbook)", "value": "9dd9132d72ea107b80cfab9607aca812c316b704", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851460, "uuid": "10ae846c-c510-4ca4-85f9-0c9226b4a884", "comment": "Malware payload (Formbook)", "value": "43d090be5a756fe3354ed932c3a839d0e98841b53d364a2dc91b00dd1ea2840abb0e1cd55f7c1a9ca8b57acc93f29d0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851460, "uuid": "f344aa92-126d-4ea2-9205-c1a871d032c1", "value": "T1AED3E7C2F698A8A5DC1B05FBD83BDE621217AE6D8479520B30A9771B69F33431877C07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851460, "uuid": "41f6dd38-9f70-4819-ae8b-f9100d5eff52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851460, "uuid": "2dc9573e-6bbc-4a16-87db-1717115094fe", "value": "3072:EBSYY8PJQaeAnuTCt2xbzmyoaq6rcYsc8tmyWIlwsAdL3cYlx19JSO2n:c68xntmCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851460, "uuid": "c98e3f61-0c38-4aec-a06c-f0be4423b5a7", "value": 132096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851460, "uuid": "8d2b62e6-5163-44b4-a718-d394452142c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851460, "uuid": "bd77500e-c0ea-4c68-ab12-4a3e00ec465b", "value": "20221102_3647_463773,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f30bbed-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644851510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851510, "uuid": "727323de-b689-4ed4-a7cf-0fa29ef57dda", "comment": "Malware payload (AgentTesla)", "value": "cd5d1e0847c44fefc891f2798173a166", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851510, "uuid": "ef9a6cf3-4881-444c-a323-fc0f2177e10d", "comment": "Malware payload (AgentTesla)", "value": "6aa29e8e1ff6fe0de8c888ed4390bcf5cb75d196f3753a838d24d4eeeff36a5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851510, "uuid": "b4cdd7c7-8a09-404c-950e-ce7e2dbd9cbc", "comment": "Malware payload (AgentTesla)", "value": "b904a472eb4401db5ee3703934a58e08f55a4c58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851510, "uuid": "f6eb9b6f-a3d4-47b9-a658-2cbfdd3ad043", "comment": "Malware payload (AgentTesla)", "value": "7930e24916c28454922840c83735461ce88d82d3f10b0a16e7c21367e3b0f7c2b59e8f70d115cd9a6b4dcd92dea1e8f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851510, "uuid": "8bb6a2a7-d8e1-467a-8da8-bbfe8328859d", "value": "T1731502017BE76A23C57B0FBAD8A502415770EA49415BD73FA8C136AC6CCB3690E72277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851510, "uuid": "d79d26e6-8af8-4f47-8f8d-dd8fdb58fa86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851510, "uuid": "738ff26b-592b-4671-ba3c-33581459a733", "value": "24576:pdYjaQI8FgifF4xg6GtwvqKxLhHYrvxWD0c6aVD:v2+iKIeqKD3Qc6I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851510, "uuid": "30445503-c991-4bf8-ba52-78c0da5aaa34", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851510, "uuid": "8e3b7a89-63af-43cb-9f57-adc37ccc6739", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851510, "uuid": "34c6ac0f-4cbc-40c9-a6f5-8bd53975d433", "value": "Curriculum Vitae (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f90e332-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644842544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842544, "uuid": "5ce675e3-7cf8-4a4b-a278-3c691f9557e1", "comment": "Malware payload (Mirai)", "value": "8b5cf712f51e0811773fe6652ed6282b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842544, "uuid": "fcbbff70-94b2-42a5-b500-07aefa5e3092", "comment": "Malware payload (Mirai)", "value": "6ab18f4051500c54fb29dca983f33b6e099dc5881a350d070545deeaa4b7ad98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842544, "uuid": "4094a75b-fcaf-4177-a315-108db2f9e74d", "comment": "Malware payload (Mirai)", "value": "b97a2a9ad156f00f7d6a93a2f55c0ff5e810a941", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842544, "uuid": "01939918-3ca0-4e09-9aad-89c25c6ff393", "comment": "Malware payload (Mirai)", "value": "291a6b45f5567d558cadd229f2ed71310c947a495e94aeb7d38dd6eecf641fdb8c114afe773fa1aa1f96043219a9ef8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842544, "uuid": "3a822cc2-88dd-4fff-a3b7-e5efb823ef86", "value": "T11363E80AEF514EBBDC6FDE3346AD070135CC944722A93B363674C928F65A64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842544, "uuid": "ee5b5d83-55b7-4000-b541-e98a7e3cb6ab", "value": "1536:FhHwH9h9Sr2gQ4ZCfdirtrtkEAs6+Lknh:rkarJNaFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842544, "uuid": "4add2346-709f-4bbd-812b-9ab97f999397", "value": 68548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842544, "uuid": "b0520db0-2489-4852-809f-2177af6307a1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842544, "uuid": "f182e67a-b5ce-4dc9-ae65-7578dfeea192", "value": "ahsok.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2dc648-8d75-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644829736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829736, "uuid": "86ec6f41-749a-4ffd-a7c4-ab163839ddb6", "comment": "Malware payload (Formbook)", "value": "81d2b37a620fa7eceef3506db6981ea5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829736, "uuid": "85ae6e79-d44d-4a6f-8765-95f0c10dda81", "comment": "Malware payload (Formbook)", "value": "6c00f2f1868618cf3ccb1e056bbdfabb89ac201b28dcb819af71258557648c9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829736, "uuid": "12efbaec-ce8f-4f60-affe-3ebc9e7c8982", "comment": "Malware payload (Formbook)", "value": "9373cfa41a0edcb55badddc4dda46d0a984ac080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829736, "uuid": "9c470d37-1428-4f8e-9add-9f57fed30b00", "comment": "Malware payload (Formbook)", "value": "39765cb338e029f3dbae9ddbad01c54b003ffb6d09e1978b86a1117753c2a83c1033cc27dfd264dccab0bb749c32ea45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829736, "uuid": "5e26806e-764d-47a2-a9fa-2bd694e7db77", "value": "T1C81502013BEAAB23C2AB0F7BE4B2424157B0D94A5157E77B94D036EC5C8B3694E71339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829736, "uuid": "69b824a2-e0e9-4c37-bd73-6bf823dfa741", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829736, "uuid": "11bb52a0-0728-4355-bb62-6fdd8bedcb19", "value": "24576:1hDQ+98soT8IsblLAKGUKB1/dkE1pACma2A8GXY:1t9OsBLAKM/dkE5m2jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644829736, "uuid": "61169998-5973-4a50-a0f5-f2748d0a076e", "value": 895488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644829736, "uuid": "5dfec888-2cd0-4643-b20f-ec1ede8a87d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829736, "uuid": "22aa3e60-5f2a-4fcc-8a68-fafac0d50128", "value": "urgent payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e737c9-8dab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644852922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852922, "uuid": "f4dd8cbe-68a4-41bd-97b4-5dadaa72258e", "comment": "Malware payload", "value": "d015c63ed6f3b372002e9e00ed1532e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852922, "uuid": "4bf55b46-5121-4810-b16b-b1ede16145e8", "comment": "Malware payload", "value": "6c97bbf5ed1683c9312f6e58e4e0381bee53b5704a4d3c619a7b8db6625ec3f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852922, "uuid": "8e3305d2-9f6c-45b5-b510-0a2dee0314ab", "comment": "Malware payload", "value": "0bc9078acfaeeb7f016793d2a062a96d82246868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852922, "uuid": "544bb789-f798-4deb-8431-81e95823d6fb", "comment": "Malware payload", "value": "ed754c0059d12b83bd6d931ae14ad9b2ce1e42a01cd36d52f71b42be880ebbb7d6a98bb76c22dcb5fa516eb72499ae7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852922, "uuid": "6cad7147-3599-460b-b5ca-3eb5e97e8a36", "value": "T1E023F2095C88397ECFF164B8CB2447427A1E7BBE6E949135125606E05D8B4DF15DBC23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852922, "uuid": "340d48db-a3ef-4322-a481-13dc48b74e56", "value": "768:jYsKZMWT2xu/0gN477qZuHjQXjpvB+z6NxA/9HJLzKJ8VNO/Gq3U7aShgJGD9lx1:jY1LT//0gNaoIsXtMzjHJlVNO/iaShgK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852922, "uuid": "d17b36e1-29f5-4376-98ed-ee7f44d87e9e", "value": 46800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852922, "uuid": "a77c365e-2f71-4adb-9734-787163320b94", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852922, "uuid": "b1622295-3ba4-4a94-b141-e5f81701b09c", "value": "d015c63ed6f3b372002e9e00ed1532e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af910da9-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844746, "uuid": "699db5ee-e635-4c90-82e7-e670ff27eebc", "comment": "Malware payload (Gafgyt)", "value": "5839eddd73c508586e8cb4ff8cd3fb6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844746, "uuid": "63f5f701-683d-476e-ae86-8a41cf2a9955", "comment": "Malware payload (Gafgyt)", "value": "6da820ac020a59460e87506cc36d6640ac02a6f0a9f7e4e5fee9271afc2a649b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844746, "uuid": "2fb8fa3e-fb6b-4f2a-a055-d8549e59e69a", "comment": "Malware payload (Gafgyt)", "value": "69cb3d2abd385ccf1e1ee213b28445457957fb84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844746, "uuid": "4fd75b68-6416-4f0f-82be-39956743659d", "comment": "Malware payload (Gafgyt)", "value": "c476e0819ea384aad0c6b41607817c06453d4687739c94929e00dadfb36b89044adca387931fcd83a521804674c724ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844746, "uuid": "985c585d-3c2e-47bf-96af-5a3f6708183c", "value": "T105632B42AA42CAB3C8930AB502EB9A261631FD2A0F179F55F31DBDF49F134C87617365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844746, "uuid": "428aabfb-1698-4797-af13-e824f72375ee", "value": "1536:5w8bIEmDIdV5LTepgWncXyYolDmF+l2OZ/fufYEZ:tbIEmDI1LeNcNYmEl2OZXufYEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844746, "uuid": "926b61b5-0c57-431d-bbf3-a9939a0ae946", "value": 68892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844746, "uuid": "216e99c1-876f-497b-ae1d-3d35c9235b92", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844746, "uuid": "696658af-c275-43ee-864f-b50c774ca433", "value": "Demon.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b70e4a7-8d79-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644831263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831263, "uuid": "d9bfea63-49dd-4bd7-a430-582e578a8c25", "comment": "Malware payload", "value": "8ad4e7bac25a1608fad586099698638c", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831263, "uuid": "cf92322c-ec2c-401c-bf13-1d49db4f751e", "comment": "Malware payload", "value": "6dc46d94ed17fea9815ae5151adfc23ec71b911456ceaaa6d6e8330e2c2721fb", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831263, "uuid": "fce7760c-d5c5-4b9e-8e37-1d7f678b4945", "comment": "Malware payload", "value": "44f6a306f2e91f60c7d68ba23a2b8669ecd03c86", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644831263, "uuid": "d99b1638-a739-427c-bb73-3d3c0c4858b4", "comment": "Malware payload", "value": "79d972cf6c2f02a4fcf27eb58891eb02ce5d044e7755cbb1abe540f9ffc24bb496cf7ca61287ca5b9813e84c5fcc1537", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831263, "uuid": "8e803524-9751-473d-b2e5-2668de13b039", "value": "T1EF1412E4F63CA8FCC45AB37DE29A49A787E2BEDD4858C1476B0B350249B0335D5239C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831263, "uuid": "63735389-9690-4899-b8a6-d8c582aef091", "value": "3072:1jK7pUjYF640WNtQaYdB4Pj8fomEP9samI4j69h4yh2MConCyJ5gteeEzje:6pUD4h0FduP6omq2ah4jshn2lY/g5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644831263, "uuid": "08fd9627-a7f1-4c16-8ad4-8c0c87eebc3b", "value": 191976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644831263, "uuid": "ee197d83-24bf-4c58-abde-92fe348e9b7d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644831263, "uuid": "5ad66d70-7481-45b5-9791-0c4b93b1063c", "value": "Quotation.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0446dc01-8dca-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644865933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865933, "uuid": "2c4834d8-4395-43ff-a652-80c4baa77990", "comment": "Malware payload", "value": "6cf8e7e3bf2743b9427e11574f9860e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865933, "uuid": "516decc0-710a-44ee-aaac-43ee1f7b7df4", "comment": "Malware payload", "value": "6dd535cb334ca75f6dca60301843d21b1eb63b8a46409a32b48b899b0c4ff7ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865933, "uuid": "be72af86-a344-462d-97f4-602df83d6c72", "comment": "Malware payload", "value": "b3446233f547e6a80b71b9091218ffd74cb1b7ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865933, "uuid": "6fd549b4-1dbc-4005-ae7b-d0037f81aa14", "comment": "Malware payload", "value": "61582d14ebb298db53153d36c6a9771f5c6817d6187e26fbaec5284685b59b2847307a96c41ae2817af9d00bd4686537", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865933, "uuid": "a74a7c60-6e1e-4bab-9693-7cc360f876a0", "value": "T1FB56BF1AF349FAE3D48F7EB7505D23447732C2420796778B531462FCAC923D09EA968A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865933, "uuid": "c60a9e87-47a3-4b70-b05c-84f5c509a2f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865933, "uuid": "891a5069-0e2f-4224-9d7d-5244ed2e9e6f", "value": "98304:OjLKyxDm1TX+wbvOnBbbaL3tni59+mDN:D9ReBbba7tni59+mDN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644865933, "uuid": "aa5cbffb-28f6-472b-94dc-6c0440a25993", "value": 6087680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644865933, "uuid": "e346502b-1faf-42f6-8551-118cd427c520", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865933, "uuid": "2bc2bc9e-7108-4070-ad78-165a556cdb87", "value": "CHAVEUT Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b373a0b2-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846041, "uuid": "95c1bb34-e461-463f-be02-fff8d8977aa1", "comment": "Malware payload (Mirai)", "value": "74439e2805bf7cfa3a218002b50ba8ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846041, "uuid": "f8cabbde-a807-4a3b-a006-d0ff20774fc4", "comment": "Malware payload (Mirai)", "value": "6ebc9ea143db6b87778f78d09957af686af510afd8644f1929a412946f3fbf8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846041, "uuid": "891d69c9-ff37-4dec-82c3-b93b07302781", "comment": "Malware payload (Mirai)", "value": "a5a69113b273e18b6b6b815c8364c17d3d0281ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846041, "uuid": "71d0dc78-86e2-4372-8e15-7cf6743df6c2", "comment": "Malware payload (Mirai)", "value": "67175a17dbba40298dd30dc9c42805f9446973e292ec176761c7f570eb7416058336461938eaf070739fbdf830ed2d7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846041, "uuid": "e2ee6c7f-0bf4-48b1-81c1-952ee552eaf5", "value": "T139A37C1B6251C5BBC08752B62BDFA6615823F83E0B33710673D9BCA93F258C95E6E740", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846041, "uuid": "08059ede-06cd-42f3-ac4c-3b4718322954", "value": "3072:sl2nLV2Woe9OOtJYyhAD3rZSrcphaCFHomHyVQX5A+u+cm:5gyhQ3phaCFImHyVQX5A+u+cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846041, "uuid": "a8495afa-652a-41fa-8a95-7d4be891792b", "value": 102929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846041, "uuid": "b88ef396-6765-447e-a99c-553b6664034b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846041, "uuid": "34efa2d2-1401-406d-817b-ed3ffa13c6e6", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b2fdfd-8d78-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644830953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830953, "uuid": "610a076c-bc6c-4e8e-ba9c-182d287a3765", "comment": "Malware payload (AgentTesla)", "value": "4531b4826053d3f35c6065e85adb398e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830953, "uuid": "90c6e46f-808a-43e0-99ba-bcb067068d28", "comment": "Malware payload (AgentTesla)", "value": "6f268877547c1ee1322aaeffabaa0fcb4bf031059fe1c672d7bc157b9f842e8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830953, "uuid": "4e0aa3d6-9364-41f1-b502-4ff30b97916e", "comment": "Malware payload (AgentTesla)", "value": "ab48c26c2c3e7973cf5a0c81179bdfc17761d4c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830953, "uuid": "6a70569f-cd08-4371-b4b3-fa16ab0e7d9a", "comment": "Malware payload (AgentTesla)", "value": "de5bcfd1fa73f699fe2050d828ac0a2df9a829ad9fcb33e15f0e10d8123ccb8c1d0347ea1e4c733fd08cd0bbff1ad150", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830953, "uuid": "b9d41a88-c755-4b49-af0f-67d4d1f9fba1", "value": "T15D250201B7EA9B23C5BB0E77D4A642015770E90B9027D77FA8C032E85C8B36D5E72676", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830953, "uuid": "9113c367-f115-420f-a232-d918a69526bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830953, "uuid": "568c1f62-9d5a-43a7-ba67-9d9f0a7456d8", "value": "24576:QO4LmrYETXUp6sR/9rB1ZwgMvLIPhLcobvD6:SmrBTXUgsN9F1Zl+LahRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644830953, "uuid": "40a276c9-7891-4875-940b-e2df6a21d1aa", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644830953, "uuid": "f97de4ca-647d-4443-a09f-4d8bd543a524", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830953, "uuid": "8c3b9487-cc67-4e37-8d17-e24e511e5d8b", "value": "ewa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a80401ec-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849887, "uuid": "b7ce8842-abac-4424-85ed-41cc17634986", "comment": "Malware payload (Gafgyt)", "value": "8bfc7e62f38f15976e2f81e534fa0d52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849887, "uuid": "686e9186-bab6-4ae3-a864-91644208cb67", "comment": "Malware payload (Gafgyt)", "value": "70af48dd3510b8b537eb36d43e77e19a3b9a440f728f8ebcd3f830b98f82671b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849887, "uuid": "70396a2f-3e24-4332-b5e5-27b8da05e125", "comment": "Malware payload (Gafgyt)", "value": "c97289d0ff1ec771504759acb19ca7ef4804b3fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849887, "uuid": "e87c8566-f84d-44a2-aef3-1841699a2d96", "comment": "Malware payload (Gafgyt)", "value": "8ef2919a6021b851880442a335124f5d5835e1d182d44785fd3a87977d382e73e0f7925e24aba9097063c401206b1e10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849887, "uuid": "796e9f71-97e1-434f-912b-0b14fca9a450", "value": "T152A30945ED05471BC2C227BBF78F429D3B366E5897A733166A347DB02BF27981E29210", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849887, "uuid": "5c33e4f7-f962-4185-a532-37f0cfe6275e", "value": "3072:TKRaxMjkL8swRamgZptp+u1CDm7/C+QN1rTfo7ND:TjxMo89Ramxm7/C+QN1rTfo7ND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849887, "uuid": "226a665f-7e8d-4b91-814c-b206ded8a0b7", "value": 104233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849887, "uuid": "5ea03645-cdbc-4023-9d32-76750ad6f804", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849887, "uuid": "86d20de0-8346-4237-870d-d1f9a96c981d", "value": "nv.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211e7ba0-8d88-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644837635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837635, "uuid": "8475dc99-cc2c-4916-8b65-cbe3d7b10480", "comment": "Malware payload (Loki)", "value": "7de3e281144b051f09326bf641d0d7c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837635, "uuid": "069d8169-2a54-4c7d-bb00-96bd3c08d598", "comment": "Malware payload (Loki)", "value": "70b02ad515a1e01de0be858d8d61932ce951b6b49a9bd39a7a5121be65ef0f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837635, "uuid": "9d8a6e11-69fa-4930-bc33-3bc03a5cd1f8", "comment": "Malware payload (Loki)", "value": "5125ad45842ee7f59763ee757b131fdeb960235f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837635, "uuid": "25f8aafa-3eb4-40d3-a423-66368b5bf69a", "comment": "Malware payload (Loki)", "value": "dd6e2d402990218154b14a1fddce902072fffebfa6fbf634aba8c0ef2f3a722003a51d41e11068a55773d4c07ebfbf9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837635, "uuid": "50e96011-a575-4d7e-a311-23a5fe8f6941", "value": "T1EF05F10177EA5B13C8BB0FBBE4B142425674E94A5517D7BF68D036EC5C8B3690E3223A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837635, "uuid": "fe5cb6b6-5e18-44e5-ac01-a7c97cb7f6ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837635, "uuid": "28b561ef-2f1e-417c-a691-77650b5772d1", "value": "12288:7wA1qNXLE8X65yxaDHUBxRXv1DpFRYXxvD3WTXdR6afzyqSEPErakZX:sz+oKyBpppFR6vDQXd5LyqSkE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644837635, "uuid": "9c4ff092-36de-4b7c-a967-1e56e20540e3", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644837635, "uuid": "f495fd60-952a-483d-8adf-5a8a9ab754ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837635, "uuid": "a7965288-c50a-48ad-aeca-2d746893654a", "value": "DHL Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0023e8eb-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851753, "uuid": "2c5b0f76-39cb-4c91-b291-42b5a0e7eeb0", "comment": "Malware payload (Gafgyt)", "value": "d76d60ec66460c34d44023e77db8d7eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851753, "uuid": "477f8c8f-e433-407a-b115-5234a825a5d2", "comment": "Malware payload (Gafgyt)", "value": "70ef475a94542aaea3a81706ac972bfa5b938abc63114a96e7c8f17123675f50", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851753, "uuid": "560ceaed-4882-40d7-94ed-de5d395581cd", "comment": "Malware payload (Gafgyt)", "value": "d50c44bd314432f0cb3bf4bc7133e3b740f5e82b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851753, "uuid": "f12214a8-7992-460c-b90a-722b7dcbaa47", "comment": "Malware payload (Gafgyt)", "value": "55b6b97e5292dc6b1158d9105ba8771856a072d256320c36242aadd4e4c4ed180eb3cc6cce321503baaf85df0c2c7c66", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851753, "uuid": "c3a1d2cb-d014-4afe-89d6-e06ae1db4b53", "value": "T1E6733A43A9A19FB7C0876AB666F75A300713B9112F4F1B89712CA9F4474B9CDB80E724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851753, "uuid": "4f911a47-3a49-453c-a607-668d40c7319d", "value": "1536:z0Ybvv32tAKqkI8jKrTvcJWhVQCz0CUPmj9VqYLe8f26e:Ysv/uHqiKrTNVQkYmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851753, "uuid": "f9192bc2-78d2-4870-9495-33eaaa174791", "value": 77061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851753, "uuid": "e18aad63-d2ee-4755-8d2c-3cc71a91a8f9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851753, "uuid": "e43ef06a-2a88-4bc1-8027-970a10254173", "value": "s-h.4-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07ec4ad-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845257, "uuid": "cc9a076b-dc68-49a4-b3f1-cd01a7f71150", "comment": "Malware payload (Gafgyt)", "value": "a4705cded626024150200c967d97aca1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845257, "uuid": "6b4034dd-d6b5-4f6f-a3a8-30682a71df45", "comment": "Malware payload (Gafgyt)", "value": "722b74364ad367f5a1b974800a03c7ce45f74d6ee4846ead8c1bc1d157081854", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845257, "uuid": "12147c7f-bd5b-453d-947e-9c6a9e026be4", "comment": "Malware payload (Gafgyt)", "value": "ee74b9218e7549042a8b6539d70d20670b7a198d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845257, "uuid": "7b031627-6ae1-4a70-9201-23861d698b98", "comment": "Malware payload (Gafgyt)", "value": "0f9f66d7c4705e639e1bea49497d74e67457872a3a975dce83d0e6c362821341591d75fdd3d1c4e08913d5fbbfe0bdaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845257, "uuid": "719e0fa0-080c-483f-8324-18158212a579", "value": "T1DD035A43DB43D4F2F96600B21237ABB29776D17E0417E682C7A8D435EC12992A637BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845257, "uuid": "3ff37ff2-85df-4e03-b59c-c359efc1f86a", "value": "768:04vK74WT5Hd39besDjJSLSBGH7hZ8GjrDrBp3IT:HO4Wl9NCOJSL4m7hRHDrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845257, "uuid": "77805861-502d-458a-be42-9ca99190f11c", "value": 38484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845257, "uuid": "0659809a-4ce3-45d8-a536-2e5214535f7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845257, "uuid": "8830e1d0-1646-4e74-8f28-a313f3ad067d", "value": "pop.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1561b157-8d4c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644811845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644811845, "uuid": "49c5a96f-de61-4df6-937d-1ae958eff19a", "comment": "Malware payload (Loki)", "value": "3e5d1b23a6cf66a116ebb7e7d04ab0ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644811845, "uuid": "41d96912-063e-4ed0-91c9-739347b14bd1", "comment": "Malware payload (Loki)", "value": "727610ecf5d6c090e8b2ff1ae1198a587429521d215ffefb91069ff2bff72353", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644811845, "uuid": "4b59b79b-2fd6-4e16-89a3-9fef3de5b66a", "comment": "Malware payload (Loki)", "value": "83eaff1db7741da371cf1f91450388c5ff7cfae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644811845, "uuid": "dcf56d06-4090-477a-84c8-1528c6560f59", "comment": "Malware payload (Loki)", "value": "9beb0cb8a00581344801b06b2fbe8180adbd481d78077bbfa588fc5f5e859ac231c0e0b98283b98012157d3a5b756dd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644811845, "uuid": "df21e48a-3ccb-4629-a56a-ef556996f8c4", "value": "T1EB050209BBA6D615C6A20FBAE4A042945B34EE2E1507C77F70AD3DCD3FAB3560532532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644811845, "uuid": "6e91d31d-821b-4839-9fc2-b44baf7a7c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644811845, "uuid": "c12f241e-edd9-4249-87cc-9fd30f88de5c", "value": "24576:Vh+bFtpLZfhSY+Yyw9BUCHHi6qEG5ExoVjDV:CbFtptfgYDJ9BU6G5PVjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644811845, "uuid": "25d409f7-593a-4824-a375-ee1c45d8c5f2", "value": 827904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644811845, "uuid": "117de4a4-1cd7-4c40-b833-bbbfcc5671e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644811845, "uuid": "57821f96-b605-45ae-8693-07e232100835", "value": "WGR7gHH0j05O6w1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c156d1-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822483, "uuid": "62fd2869-576c-4dcd-8164-c4032c9670ea", "comment": "Malware payload (Formbook)", "value": "6378ffb713b7aa0d9799b830e0eab292", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822483, "uuid": "9ed53653-9bc5-42ea-8b08-70420413708f", "comment": "Malware payload (Formbook)", "value": "72dd30eae43eea8bb1845cc57f8c2fdb93cd5702ad72f42dd60316e69df287c6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822483, "uuid": "29dda49b-555d-4db6-8c7c-519c0d260944", "comment": "Malware payload (Formbook)", "value": "d420c4c1cee36307e8fcac94cc37aebd2859824e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822483, "uuid": "b275f1fb-0960-46cf-959c-cf7b7deb1394", "comment": "Malware payload (Formbook)", "value": "2613b827437e8a81b826db9b8aec7a2a8ee70948e9cd354d891ed7e1c1c302758f62d03b57365ce5e8244113fb0ae2ad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822483, "uuid": "1675f08a-72cd-489f-9dd7-ed0c71907e0a", "value": "T1B314127A77A65874F392D73B5EEBAE2A13D3CC51728D4C0A304C75E48ABC5E400526FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822483, "uuid": "564ec39d-16b3-4555-8cd0-dfd878f82704", "value": "3072:Or4pPJDTSQcmUn2rjesZbo28mPxXXznJEKmtLoNgyp7LckWH0MiciAZhY:vfXIirCKoSHzn/yL2guXckWH0M3vZhY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822483, "uuid": "6debbf5c-c3ea-4877-86c8-c4d52295b633", "value": 191784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822483, "uuid": "a5834d26-2f89-48a0-8de9-0765a029a4c3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822483, "uuid": "b952ac63-30ec-462b-bd34-4d294161a354", "value": "IMG_223884949_TELEX_COPIES.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb821f0f-8d67-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644823828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823828, "uuid": "02b56297-e6be-4725-b0a9-0ae3e5f7cb39", "comment": "Malware payload (RedLineStealer)", "value": "80719e6b0ffcfd5d78de7e4de7218a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823828, "uuid": "999d711f-a76e-4d44-a39d-726318629223", "comment": "Malware payload (RedLineStealer)", "value": "740c9c55568b061b297c1bda104d682e91d340476e8901704c184ee641587883", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823828, "uuid": "a47d17ee-4bcc-4c45-acd7-f14d15ea39da", "comment": "Malware payload (RedLineStealer)", "value": "e42c8739c8247215da8b49bd5c281357a39da271", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823828, "uuid": "6d79d449-9e59-4b48-8383-15347c75940b", "comment": "Malware payload (RedLineStealer)", "value": "3aa210f8672e9d5ef70d64253f1c2962e5eed0d97037848b538bfc9015ed69d1cd474fe543469dd3a6b5b276463b6991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823828, "uuid": "db3d6055-dcf4-43fa-a818-ebdabc7d8c92", "value": "T1C02633FBA20CD499DCEF88B4F16DA1184858F501EBD3471B592886F0EA7F1CB1A691F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823828, "uuid": "c48320c7-ea22-4d53-b9a3-a80ee4749956", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823828, "uuid": "2f4d8fb0-f925-4433-97b5-01d84fbc4365", "value": "98304:pLfn+/bVQG5aLKAxGD0jPJTPPl7Et3FEN9ej3oAz+sItrSBq:pL/SVV5+KAPjPJR43L4w+sSSBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823828, "uuid": "14be6e27-13cc-4084-8d33-2814af8448c0", "value": 4532224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823828, "uuid": "c17c43b0-9591-45b3-914c-f69d0039c9a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823828, "uuid": "8a1a7e64-e93c-4db3-a6aa-8a4f79e854d4", "value": "FORTNITE HACK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79bad5b-8dad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644853805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853805, "uuid": "20779483-d58e-400f-a3c8-c9719be8ed5d", "comment": "Malware payload", "value": "b0f11597adc5149eb5c785572a52ec8d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853805, "uuid": "697006fb-93e6-4752-9ca1-6dcf44f35d5e", "comment": "Malware payload", "value": "74bd08c2a8edc7a45e896f9efb55ac61a663c85bd15bce05872a6b657a556a08", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853805, "uuid": "ffeb8b5b-295c-4881-90dd-54df3a8c537c", "comment": "Malware payload", "value": "b0438b06c4bf82600d4987e6c4c0c6abbc68c456", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853805, "uuid": "ee6413b7-d38d-4227-af92-3c9cb7753dea", "comment": "Malware payload", "value": "e9b61bc226035752cdda92803fd7706c4e13d10b17e3c9b91ff9b5a24d434a8228a91c7ce1dad2c7432f104ef9dc52f7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853805, "uuid": "337b7119-31ae-48a1-9078-15fa30733d19", "value": "T12B82D05A68801949D5A00BBF444DED45DA40BCBED142D31BD8F2AF839447E665E3DDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853805, "uuid": "621bbf9b-49e4-4e38-95e2-81bbeabceb7c", "value": "384:bAW5VGN0UjgRLEvVPOqzxkFkXqNXuwU6U/yVaKKSp5vXBc35vhNn/+f:EWI0OgGvIAclU6V4SpdePn/+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644853805, "uuid": "788e3d5f-1755-4058-af6a-86135a67e29e", "value": 17712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644853805, "uuid": "4a6e52c6-f995-4885-9bde-cd6fc8ce9488", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853805, "uuid": "6959519b-ca8d-4930-86e0-98aa3966e3ab", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d22abd-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845719, "uuid": "a508e557-53bc-4d89-91af-4871404c6496", "comment": "Malware payload (Gafgyt)", "value": "5190a93f9448cbe12d19196c7e56577a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845719, "uuid": "e40e5eb6-db64-4227-8795-8a5ece90d910", "comment": "Malware payload (Gafgyt)", "value": "75840ba6f07c2622fa6080d75ba30847e8d8b805521743ca1d24c230cf91bddf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845719, "uuid": "5f3e26ce-bceb-4b1a-a760-38061cc78a08", "comment": "Malware payload (Gafgyt)", "value": "923bcdf609b4ca0c31ae360657cea5df0107cdd9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845719, "uuid": "e28b4a48-d04b-4805-8fed-a6cd4a422302", "comment": "Malware payload (Gafgyt)", "value": "ba6c75eda0c82e0c372729046c6e244f5a5eebb487d98f16b8531ae1600036540cc9ddf1e0a23541401aec5c3f9d586d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845719, "uuid": "17872aec-1cf3-4709-9216-dff005e12c20", "value": "T13383174399B59FB7C146AAB536A70A300727BC250F5F1B89712DAEF4020F9CDB50E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845719, "uuid": "016f088a-367f-4431-8170-fa59c5ff7c93", "value": "1536:2qklz+TTHDjck6KP3wQRd3ugRzkBawoCGsCgwFwZ0Rmo33VUvfcebVyT:vnXPpd3xnjpZdocmk3VUvkebVyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845719, "uuid": "05666f3d-98f1-46cb-9905-a249d2849519", "value": 81844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845719, "uuid": "2d3b5128-84d9-4345-b80c-1fb604387e14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845719, "uuid": "684a13fb-20cc-4557-94a9-5e8850b65613", "value": "qbot.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbc5da8-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822681, "uuid": "f45614e5-2303-4547-9ebb-3fe385180a5d", "comment": "Malware payload (Formbook)", "value": "f508abf920fbd52e54dba67bcfd561ba", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822681, "uuid": "f1d0f836-8e8e-4b75-b7c8-12f637b2125d", "comment": "Malware payload (Formbook)", "value": "7612746d01cffc33f8f613b57bf35822aad22277ca6c071efe990dadd2fbc853", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822681, "uuid": "5a8d4379-3833-4ff6-b341-08bebeb3c59e", "comment": "Malware payload (Formbook)", "value": "e4b6476bbb722f0c6513284d827b9290d6056489", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822681, "uuid": "a61583b4-e031-4a68-9b4f-7ac12e9385dd", "comment": "Malware payload (Formbook)", "value": "06db8b3eb389ae39b50a0d73a0042231248ac602daae8e6f15bced099f3745dd6b591c5f556e833838f6cadcd08af843", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822681, "uuid": "482dc059-cfcc-4480-ad81-791eaf874472", "value": "T146150209BBA3D901C5720BBAE8E11191AB74FE1E4117D7BF306D3A9D2FAB39A0531531", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822681, "uuid": "783ec6a4-a638-43c0-81d1-01947f5f083d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822681, "uuid": "013fe6f3-79df-45a2-a884-4d378cfd83d9", "value": "24576:6qyd9G4LZ5fO7p9zgAAdsyyq4ZZsVoAc:8d9G4tA9gAAdsdq4HV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822681, "uuid": "b6ec3d60-ec61-4972-afa2-90ab80737d49", "value": 907776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822681, "uuid": "bdae6f97-c040-4878-941b-0e0126d7179e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822681, "uuid": "b2c223bd-e8c1-441c-b79d-4f4865d49b70", "value": "DHL Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfd463b-8da2-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644849061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849061, "uuid": "f4f84c7e-cc5a-4a35-872f-59459c71695a", "comment": "Malware payload (Formbook)", "value": "081acf8935d83040a5195949a3a492d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849061, "uuid": "c5939532-5350-41cc-bd33-45e973d59481", "comment": "Malware payload (Formbook)", "value": "7656efe9df4b4a184047174efb072a8fbdc08ff5727362d2f15ff8c8252abf09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849061, "uuid": "7e1f9ec9-a5bf-402a-977e-79cb46394ac8", "comment": "Malware payload (Formbook)", "value": "b7739cc7abb16f733ec0feec0f31bef2afdead6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849061, "uuid": "85c93f3d-bad1-4694-9e66-79cc3f4e315b", "comment": "Malware payload (Formbook)", "value": "ba570b32ee80cc781049c177be6cc7afeba72d7fd88652f8d26dbf217ebbf652e1312d8dc519020bf6eb84e149d9a76b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849061, "uuid": "2ae372c8-f637-4d2e-b852-5ac9ef5b5424", "value": "T17754222234E2DAFBC1498B7214D3D76BB7FF120122084297EBA81DBA5D114CF6E196C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849061, "uuid": "24e537d5-a03e-45e3-9342-06530751e10d", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849061, "uuid": "c47daa06-90ad-4cfe-a3d3-eaa4396bcbfc", "value": "6144:owPJpx1A4klfJvtbCrt0Au+sTLQA9a+5CRvXKyYUFdCNDIIUMA:Fn1Q1pQt0AuxBaJCyYUiNDIIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849061, "uuid": "02716622-3991-48b9-b0a6-8a28f9f9908a", "value": 300495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849061, "uuid": "223ed05a-ff85-4f61-b1d4-b378fd480625", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849061, "uuid": "f17368ef-c6d5-4746-9f40-836af6a58194", "value": "MKT234523Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aabab130-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849892, "uuid": "491230a8-04c4-4947-a43c-ae5970c0f243", "comment": "Malware payload (Gafgyt)", "value": "5c37e1cd45021c7f621c28d20e69e0bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849892, "uuid": "029a8034-a4ff-4020-8559-071627c5bfa2", "comment": "Malware payload (Gafgyt)", "value": "765b7ef8c3e7c808f5ba4dcb55c22224972b0ca3139dbc2d544acf4bc2811284", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849892, "uuid": "1adc2e71-871c-40be-b411-5aa8d1e0a93a", "comment": "Malware payload (Gafgyt)", "value": "f34bc9687e9fd0d1483e7303720cec48d09bbeb8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849892, "uuid": "0ce8ed77-a89c-4513-a8ad-cefc9cc939a9", "comment": "Malware payload (Gafgyt)", "value": "0d5d06b669eb150d2e1ad5246d9077237729b9616d590f002611900631e8a7e043f3e18a53855fe8f18f0c8cdfec785e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849892, "uuid": "35d54dac-c4fd-4325-bfd4-1605e4eddfce", "value": "T1DFC31805D5508B1BC2D227BEFB9F415E37232F68979B33156A247BB42BE279C1E39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849892, "uuid": "fec3e50d-0ca9-4174-89c2-45718009c499", "value": "3072:RScBamsP/MCAim/2imPCI2vINrOkmhrQHwCuJNU:5amsPC2imPv9OkmhrQHwCuJNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849892, "uuid": "4cd4a7ce-5461-482c-81fa-ff556ef3592b", "value": 122425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849892, "uuid": "a105f043-fa99-4a11-97a7-fb4839dd6db6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849892, "uuid": "7363e888-b00f-40eb-bbb3-0f4c08e9e993", "value": "nv.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3e9e4e-8dab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644852902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852902, "uuid": "420d7dd9-47bb-4089-9674-2a1fc4551ed2", "comment": "Malware payload", "value": "4934ca8b15a80ef1899530acd2f7055f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852902, "uuid": "5c9db169-dc18-49a4-8ba2-f8e536a661ab", "comment": "Malware payload", "value": "774afc5ba0c83ed466209d867737fd3fe4b246f2096a17609aeb2a4d43155b08", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852902, "uuid": "1494a5de-9778-4d7d-858b-c3e5151b5c14", "comment": "Malware payload", "value": "adbce736ccfb045a28bc64479147b37034fcd373", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852902, "uuid": "94ee7368-3583-4d21-a836-f440e3e79149", "comment": "Malware payload", "value": "caac56bd0c8dc716abf81e1219a5314f408ffe9172f6a1cc4c648041678411343d3edc4c096f497fb7bc0f0f065838c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852902, "uuid": "baca6f16-85de-4c29-8195-2a7bd8f66c70", "value": "T19F03E13C7195DF85E1FBB0781CEE3A8C8665E30D45C116E23F3C24258865FAC982D627", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852902, "uuid": "493ffb95-7573-4d62-9dff-6ce916599a1f", "value": "768:6uaph6C9gNxH2hSsxtYoEU9wbQl+UOoS8QdBVNPnbcuyD7UryqzRFLfd3mgT8KM+:vah9grWAsx39gSnpyBnnouy8mqzRj3jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852902, "uuid": "e85ad43e-e129-46d4-b09b-4f54efde5bed", "value": 38484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852902, "uuid": "9f7a4257-fed0-4d09-ac3b-69278ad5da14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852902, "uuid": "cc6876ca-5a7f-40ff-88d0-1dc7d8df2d95", "value": "4934ca8b15a80ef1899530acd2f7055f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866b7695-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644842529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842529, "uuid": "e09748a0-eab7-48c8-8a4b-1a66d5746ea2", "comment": "Malware payload (Mirai)", "value": "32b6a4365607a9be729dbab3e2bc8646", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842529, "uuid": "3da389af-fb34-484e-921e-b433889d45f0", "comment": "Malware payload (Mirai)", "value": "77cbb76a1fbff9c3f89110a381eab8c88ccb96b9b454781d0ebfc1324579ee70", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842529, "uuid": "e18d2038-1e5c-4551-83c8-445725c1ee8c", "comment": "Malware payload (Mirai)", "value": "942ecfb258e0ffbff5fc6e4d081844c12f27736d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842529, "uuid": "797a44f8-fd13-49c5-9b43-fed28244d888", "comment": "Malware payload (Mirai)", "value": "657d5a4e6ff6a39ea42a8d5aefb4d1822095ec92baa47d89fa60b9b58b00c621743779f5cb1081c6be5c709a5452d19e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842529, "uuid": "41c4af48-5a02-4d10-b143-04306d81f5eb", "value": "T1E1630856F9819B15C5C1127AFE0E124E73130B7CE3EE73239E24AB64778B56B0E3A509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842529, "uuid": "cbfd2233-4602-4231-b4ba-a4d23036b7ea", "value": "1536:rJn0hrxrar/FalIdimnwzaNR2IiiH5tq5xNYeL:yhrxra4ywzaNR2SH3OP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842529, "uuid": "005c5033-a3e6-4516-bfe2-a1123122a49b", "value": 66868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842529, "uuid": "4f698c45-517b-422d-9635-5c503cd204a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842529, "uuid": "c44caef2-d142-4db2-a5f9-e8c4e5f700a0", "value": "ahsok.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d78f18-8d7d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644833155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833155, "uuid": "7eec1f92-501c-4c75-aac8-34afe4c604cc", "comment": "Malware payload (Formbook)", "value": "0b68afef24aa43796b521b54a51c642a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833155, "uuid": "4f7f076f-6fd7-4c21-8a6e-dcd1047496b9", "comment": "Malware payload (Formbook)", "value": "78925291f09bb03febfff27735cd630b96b9ea2a21aee0a8b58e156ed20b256a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833155, "uuid": "a0e87295-a439-41c1-805c-27ad73392720", "comment": "Malware payload (Formbook)", "value": "6408d661e81d778f4b73e6c050c0ce43a0f4f670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644833155, "uuid": "47c46686-c49a-4360-9325-e4eef8ec324c", "comment": "Malware payload (Formbook)", "value": "e9e4188bb5ac2446f280e237f41a7c39f002caf61c350d0abc86de4fba51c3439a9c84efd10e528ca6458d3fe16aaca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833155, "uuid": "816b5733-dc99-4749-ad47-5826c3128ef1", "value": "T169A4BDC0A3F477C6F5310AB00AA7525F8FB29DF15B39441FEE103A6856BB982252175F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833155, "uuid": "c2567988-353a-4f82-a1ac-39a152ba5504", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833155, "uuid": "27d164e4-20be-4a5e-ac17-3122bb41e9bd", "value": "6144:VwGZS4/FupznpHQIBmGDddQS4mUEeHHqbk+1YIGZ3h8I/Fq0J6Ju:9H/Fc2IRddQEMHqVA3hrQ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644833155, "uuid": "1eebc78f-8478-420a-92af-5d35735a1e7b", "value": 477510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644833155, "uuid": "3ba290ab-20df-41ed-aa4d-ffb92450c919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644833155, "uuid": "48bc1c41-b11c-4e91-9cc6-3b44eba46199", "value": "Consignment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06b5da6-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849928, "uuid": "d83b7860-35ea-4bcf-80f5-2b82472a752c", "comment": "Malware payload (Gafgyt)", "value": "268e08418dab5890b3ca678ab25b5415", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849928, "uuid": "77b7f0d9-3428-478e-8637-1ab73f9626d1", "comment": "Malware payload (Gafgyt)", "value": "78eaf6462cf72967d4009d173c702bf4a46c1d7d97d382f8878675bbf871c683", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849928, "uuid": "b936cfb1-16b5-4490-a733-003f56105dd6", "comment": "Malware payload (Gafgyt)", "value": "bd1e14de044f6a96cb3e5b939ac68258fa680d62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849928, "uuid": "69abcb11-d615-4f86-80ae-91e4ae970d51", "comment": "Malware payload (Gafgyt)", "value": "90dc364da5c0c20cad00dab74d8cbcf1c52675e122d163ffe3db10763927e57c1d85e2eaeb10fcf880a00473e1ac7272", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849928, "uuid": "a60f7965-3469-4c29-b880-1da3fb509bd1", "value": "T1A6B3F7377B170E73C0CA147112E30332A7B5DF5938BA4657B9907DA92F36A8438167E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849928, "uuid": "63e525f0-5a17-480e-bbbc-1ab2c0bc2eb9", "value": "1536:Cb+mmXrRCj1RaU3N95H1WLttLtJsq7g9mmi4H5bNy3Cn8hND:LQrT3NPH1Coq7smm/H5bNGCn8hND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849928, "uuid": "342332a6-52bb-4fb9-bbbd-f26a6a215940", "value": 109991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849928, "uuid": "60382f10-5240-429e-85fa-97ac0351f56f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849928, "uuid": "3f2a3f2b-22c3-47d4-af24-eb0456461b4b", "value": "nv.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0dae4b7-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644861955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861955, "uuid": "cb967bba-6243-4ae0-a57a-02a6f612a2ab", "comment": "Malware payload (AgentTesla)", "value": "8028cace2f5e8eee4ac35661399f8e69", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861955, "uuid": "f2b4eef8-5adc-4954-9802-4f6ce1d1452e", "comment": "Malware payload (AgentTesla)", "value": "78f33a426b119c7dd6684b6aacfd22ddf2c9a6ae77a8423d06a947783a3ff7c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861955, "uuid": "c0e70df4-b7e1-4668-93f0-b2254ffd8cd7", "comment": "Malware payload (AgentTesla)", "value": "297b76389ed27eaaf100813e9bc637e85ed26b2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861955, "uuid": "60217f3c-dd6e-4697-9106-921b3403902a", "comment": "Malware payload (AgentTesla)", "value": "7b39c0653241666040dd6fc8f228b2e2cacb1c9040dbf681aff78279ad2d45186646b77145759414c0a4403d54d93568", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861955, "uuid": "ce4b8503-03f1-4fa9-9142-b94c9cb48e4a", "value": "T1A5250201B7AA6B23C47B0F7FD4A2521147B0EA4A9157D77BA4D136FC5C8B369093233A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861955, "uuid": "088bb8dd-1270-42f8-b3d0-bba40224dbe9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861955, "uuid": "44d6ea08-69a0-44bb-be09-a24565f8ae58", "value": "12288:PpGQyXLCrjIsn2pze2RwHXJUA3gitsgztINj3+g/bkXgsFof48QXWCI+XNFakhtf:nIbJzGxCw4VCXafsK+dLXGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861955, "uuid": "814fbd80-f9db-4316-84d4-677b0892e4a4", "value": 967680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861955, "uuid": "52c0adb6-908a-4f66-96b7-863e676f5a58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861955, "uuid": "99ddade1-ed53-4f3b-a710-1d6fc9cdf71b", "value": "8028cace2f5e8eee4ac35661399f8e69.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f7b143-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644851471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851471, "uuid": "a7bcb966-755e-4c69-b591-1bd8e348541b", "comment": "Malware payload (Loki)", "value": "ec258fb5d35dc18cc4e36b342eceed95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851471, "uuid": "ce401030-fad1-4c44-bc2c-d0ffd4fa39ea", "comment": "Malware payload (Loki)", "value": "7a093efda8682697e32eb9fbb4c608d64ddead6b11330a5d5279ff1edb305b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851471, "uuid": "1ae2c002-6d4f-4c8d-a6a0-230a08c5a783", "comment": "Malware payload (Loki)", "value": "d262e685701e00bdb0f95ad997947297b179ab23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851471, "uuid": "1deeb5cc-deb1-45e2-b09d-2b75f50d2c10", "comment": "Malware payload (Loki)", "value": "9285cd938a3d574aa3cd74cafe9aaa43b86880cd34e13cdfc0e6a71492ae92d25e977587d2c7eae86498434964034387", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851471, "uuid": "11a61b00-2588-4060-8cda-10b81904d86e", "value": "T156C4221829C1F936D4DB89BB50FBC398EDB84C4215865E572790BB6DA83C6C1BC407EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851471, "uuid": "fdb8caa0-5888-4919-b963-243ef8142838", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851471, "uuid": "1bda2193-de97-4d1e-ba5a-6cce2b1f2c5d", "value": "12288:qW4Ylxldww97N6W0S9Jc1j6OR/lgTLfWNBMg25ss:jb76W0SkHgHWfV7s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851471, "uuid": "774a8443-78ed-46cb-accc-00449bd86c7a", "value": 561378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851471, "uuid": "54237829-d984-4950-a847-8727222a68e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851471, "uuid": "aa4f0de8-f4b8-4e53-975c-a65aa00b045c", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd419ed-8d74-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644829360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829360, "uuid": "2ed269c3-dc4e-4244-9481-9a1f19af161a", "comment": "Malware payload (Mirai)", "value": "a7ea697a05ee5ae32a649308b898ec78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829360, "uuid": "102d20d7-df04-4054-bc8e-3ef9a99a4cf9", "comment": "Malware payload (Mirai)", "value": "7a789da1a25f7ad3bf0dafaa89c902308cdb15b7da95047fcf7f0730bdfff577", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829360, "uuid": "33882335-05ea-4f05-96b1-67edc9f67dff", "comment": "Malware payload (Mirai)", "value": "e0851d69cfb15a109cc9ac619c0591b0dea72a32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644829360, "uuid": "34aa293d-7ffe-481d-84f8-e9c20aa8fb76", "comment": "Malware payload (Mirai)", "value": "1642ca49e6a1802814fa294ae1c59508bb38b34fe32c1a44a8844931137edf53681f271e17bb36957658e961c1cf4fd4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829360, "uuid": "a2f6bfa9-d9b5-4fa0-bba6-8d2f095211f3", "value": "T11173AD33D1686DA8D0664B75B9988E309B23A28416933EF6D794CB784013EECF509FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829360, "uuid": "71d70392-ae6e-479c-88a0-57d4be8ee893", "value": "1536:9aD/MEGvbwt+i7EhHbSn8C/0rrnmFSlrKkNGIkFgCJl2c:9OkdzeEh7S0rjjlOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644829360, "uuid": "39f35e22-fe65-4f8c-85cb-63803c6c3fcf", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644829360, "uuid": "c9a643e4-1321-40f4-a0d4-252ae9235525", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644829360, "uuid": "0eb9e7cb-f7fa-41e0-9b75-98cd8b5843ae", "value": "a7ea697a05ee5ae32a649308b898ec78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9672345-8d84-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644836226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836226, "uuid": "dc1a25da-907b-47bb-bf06-5a1a633c6000", "comment": "Malware payload (Loki)", "value": "11737412e60494dca50ad6c86e6c086e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836226, "uuid": "5f7a712f-0c76-4aed-89df-9f88c95138b6", "comment": "Malware payload (Loki)", "value": "7a8f5dbcd00d364145d28a29b058adc75da8041fe35d852ad9cf9ae439b51cfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836226, "uuid": "8a0dfd7b-51c0-4e86-9288-2806f0ff9227", "comment": "Malware payload (Loki)", "value": "4831c3901ba799fadb94bbcc03f8059774f2e52e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836226, "uuid": "42eb4978-54ae-4194-8d43-19f5b5f62a16", "comment": "Malware payload (Loki)", "value": "0d571be5775c80398b21280740fa505936ed23193ed396606a70aa525a3bafc3e85c6feeb9169d0aa66fef98edd2c62a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836226, "uuid": "32c978c5-017f-469c-a65e-1bdc393975b6", "value": "T16B0501017BEAAB23C16B0FB7E8B141416770EA4B515FDB7B54D432AC0C8B3691E72276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836226, "uuid": "647feab4-5362-46b5-b816-93e813e17d1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836226, "uuid": "07787469-0340-40fd-ba96-5422313a7a35", "value": "24576:coJN8CRqyqsQ5pk3IUafxljqF7FahfgzP:UCR9qs8k3rsTjqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644836226, "uuid": "02905dbc-8bdd-4696-a362-6314f10d2af8", "value": 849408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644836226, "uuid": "cfffb157-5d4c-4777-8cd2-45d9fd17ff7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836226, "uuid": "69e0aa11-9e46-499c-98ec-7c964cb5e217", "value": "SI_DRAFT_SCAN_PO346314_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e65f6d-8d6b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644825154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825154, "uuid": "fce52b43-80d4-4dcb-b4b1-a1ab970c93c0", "comment": "Malware payload", "value": "1a405726663034605bcc792528f71c4a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825154, "uuid": "813c2984-4ce4-42c3-a1cb-9625e6cd0ec2", "comment": "Malware payload", "value": "7e101758db01bae6ab80a78d963bce70a67f8a9749e9b26234ab217270675f9f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825154, "uuid": "99933a99-564c-41ef-b0e7-3d358cc9d23a", "comment": "Malware payload", "value": "6eb3e56014964ea370bc59d527fa40b7b1e30666", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825154, "uuid": "5aaf00e2-f58f-4ff0-b082-9377b685138e", "comment": "Malware payload", "value": "affe36d1aae75c0f6f6b83b9a9eeb20a787394354130ad8d7a4f2839431e5828ce67b1f2db219d53a5d9a335ca02a2c2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825154, "uuid": "db3f43be-94ca-4e07-9625-e685b7a38c2b", "value": "T1F6C4237FF1A37130E72B1EE92088C14CA80D9389D6579CF49CAEA508447EFA83E5F655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825154, "uuid": "44d2b845-f616-4a00-af5d-9dbe774a49dd", "value": "12288:tiP44AKHLUx8hekw+jFJZZP6OEH2kISV99/kYo5Gg0UuVmdLz:tiP42Ux8UEpP6OEWkZv/3o2xmdLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644825154, "uuid": "8ec1be4e-abf9-40d0-a7f6-3b3871374ba7", "value": 593829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644825154, "uuid": "32716911-6e06-4773-93f1-ae9c247a2d48", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825154, "uuid": "a9869370-e5bc-4911-bcfe-3bc61eeb9be7", "value": "discord-rpc.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd71241e-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849923, "uuid": "5b4ce289-d7e1-4947-bef3-98a7a1729ac7", "comment": "Malware payload (Gafgyt)", "value": "00fe860c5c8361c3dfa9f3d7c83e8950", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849923, "uuid": "42901363-9ec5-4b3b-aa96-f03a62dcd347", "comment": "Malware payload (Gafgyt)", "value": "7e1663323fdff82a66198d835476b262895de2c178c07ad162e19fa76bebd4f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849923, "uuid": "9d4edf99-9198-4723-80bb-bfdb6e0346ed", "comment": "Malware payload (Gafgyt)", "value": "63a1924b58ac43d33242e3829fa6ad3c34c0e34a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849923, "uuid": "d781fa40-f509-42b2-8a48-604754072cd5", "comment": "Malware payload (Gafgyt)", "value": "19832ef5ed7c928e8b80015a1c762e38bba15aae697481e620cab42a2a2cf8cdc23257fdf3ba91d414362eb362199a27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849923, "uuid": "a143a093-ee9f-4baf-985a-b067b535fcdb", "value": "T131932A83A9655FB7C046AAB526B75D740753BC220F0B0A89712DFAF4033B9CDB81E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849923, "uuid": "b48ddaec-ce0d-458b-8b95-b13d85b9a162", "value": "1536:DkhNxqm/nsXFKBu1ew+L9rbp7KCuoEGCpmK4Hpbsi3InKJND:Dk4m/sXMBY+LjKIlsmHHpbs2InKJND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849923, "uuid": "eafe0589-5362-4471-b240-a0470d377582", "value": 89040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849923, "uuid": "fcf61291-9abc-41d1-a611-e8a2fade9d56", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849923, "uuid": "6f7f49c7-3b7b-4b63-b401-c813e16a42e4", "value": "nv.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b448f99-8db8-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644858294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858294, "uuid": "3ced5133-5cb5-4419-a284-b06390fed52d", "comment": "Malware payload (RemcosRAT)", "value": "6074e43112cae06a37aafe311cff1755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858294, "uuid": "dd5296b7-1072-4fd7-b64a-635b80b6ae87", "comment": "Malware payload (RemcosRAT)", "value": "7e4d8c9bfb728060738c6760ef7454c5a5351ea4166216a20679b8628c3585a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858294, "uuid": "7bbc4ff1-0186-4095-be70-c5be389cb3df", "comment": "Malware payload (RemcosRAT)", "value": "931f85d50f5e7f4ed65563810c0fe636bf6e9d05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858294, "uuid": "54fdca71-bbf6-4da3-a217-26decbb83853", "comment": "Malware payload (RemcosRAT)", "value": "66081d9ef80993eac0c251ed940f248f8a562a822dc2904e2aca129660ef8c6e28fdbab1739d6029f9c5e9663af628f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858294, "uuid": "573aeb21-179a-4cc0-9e46-17fb93024c26", "value": "T16AB4120828D84B77D13C5BF51C98FA949FF6AA26062EF31C6E8110C653A6FC08F15E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858294, "uuid": "061407a1-1b81-4d86-8e32-d0d05e48ab5d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858294, "uuid": "7216b712-075d-4db3-880d-d13eb483997c", "value": "12288:4o8FmJGKtWz+8PEjfPAWvbbt3Am8oHAAUT+DpbSN2i/CHGw8kl+:wFmJzt9RfPAEBQHoHAAU+1lGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644858294, "uuid": "e2fbbc21-511a-4197-85c1-df21993c7cfb", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644858294, "uuid": "78ec0ce1-2359-491f-93fe-fdebdbb7a15a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858294, "uuid": "c7913ebe-2686-4efe-b035-a27f779aaeea", "value": "Doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31567c1-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644861985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861985, "uuid": "0aafd6d8-c6ad-45fe-9525-c917fd6b5956", "comment": "Malware payload (Formbook)", "value": "1eb13ff8735fc63e1835466f8058de16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861985, "uuid": "80515361-f8e3-47d1-8483-2656e4ffcbe2", "comment": "Malware payload (Formbook)", "value": "7e63ecb107ecbb32d253e5c84cf5a964f82880cfde059f8d6b11cf89d6921687", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861985, "uuid": "a39cec24-af3f-41d1-9c6d-12bfe062f48e", "comment": "Malware payload (Formbook)", "value": "9520f81a9f43f26daa7c93d06f59d425fcc3b94e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861985, "uuid": "e8e986c7-b55a-4649-83e1-cc3c860f8ebf", "comment": "Malware payload (Formbook)", "value": "b5d7f7e5fb9eabbb3f10e38fb75348b6950eaf3c942be41ab9f071ca35b84cc8b9391ada9b2cb82c0d6500256feaf9a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861985, "uuid": "a632ed4a-d66c-4100-b783-68ac6b4d759d", "value": "T1E654132765C0C4ABE29B81730DF75B7A9777E2261323029B5F6A1FEF14170C3A65224A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861985, "uuid": "19f38ca7-0e78-4ef7-beed-1bc944336c75", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861985, "uuid": "ffc7939b-8411-4e4d-aab7-05e5be1325d6", "value": "6144:ow7XBnXlHir6dTjk2yN16yHyn7XKI5V2updOKb:fJV8AgKwyn7XP5V9zOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861985, "uuid": "ed577a81-660b-468e-81aa-e678b6db637f", "value": 296771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861985, "uuid": "3e6ac9fb-6308-4fc1-941d-b5a095b06211", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861985, "uuid": "cd3aafbe-5607-4e03-88a3-ea378f01c0a0", "value": "1eb13ff8735fc63e1835466f8058de16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82626f03-8d38-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644803438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644803438, "uuid": "8dc62f8d-5bb2-4a5a-8291-13bd0aea9dc0", "comment": "Malware payload (Loki)", "value": "9c3560d3fc389d4c97893bf4656fd2e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644803438, "uuid": "dd20f1a8-ee79-438f-85b7-5810f82b3237", "comment": "Malware payload (Loki)", "value": "7fe467ef6f392039c0ce5edaadf85c19a8406a0b0b7332131e2b2ddc9f074bb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644803438, "uuid": "986629bc-ea31-47f3-8656-31c0e6c94220", "comment": "Malware payload (Loki)", "value": "00227a442e784d346eb261cd8ca69c6d39c6661e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644803438, "uuid": "d881737d-01b9-40cd-bfc1-c36d4369c07a", "comment": "Malware payload (Loki)", "value": "35bbef8ff4a1988ca54066b72fad3f8d919fe3d4bca8927293a34be3a16264c74ccdb96a30fbc40b007b150537a8b850", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644803438, "uuid": "1b5be626-745b-44bd-a334-2300f3455b37", "value": "T13C050208B7A6D556C4B60F7AE8A141905B34EE2D1503D3BF709E3E8D3FA739A0931636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644803438, "uuid": "186ff5c1-728c-46cf-92c7-18db96bfb1fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644803438, "uuid": "333da16b-7c04-4e88-aa30-5fce5c2d92c0", "value": "24576:jqGD1tLZcFl9kMSexOsLeXBN6JX5G8pF/zX5:DD1ttcNkkkBN+k8j75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644803438, "uuid": "852d3d63-077b-4555-a2a3-8d60392e873b", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644803438, "uuid": "aca66761-80e1-4a03-82b0-33ab6d1bdace", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644803438, "uuid": "9f4c9cbb-f04a-45ec-9558-21be2e7d1422", "value": "DHL Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a14818-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644851472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851472, "uuid": "023e05d0-1abd-4626-b090-e051e0c1e3cb", "comment": "Malware payload (Formbook)", "value": "3fc53e5192c7d0b282d18a0219371d9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851472, "uuid": "256d7073-0cd1-4e25-9c0e-3b4b86831d9a", "comment": "Malware payload (Formbook)", "value": "803e24982335c39926310a763833c2a77f9d1e5b4171e9624af6f26fd04e8eb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851472, "uuid": "205e0272-95d6-4642-aa15-6bd6cbfd00dd", "comment": "Malware payload (Formbook)", "value": "80785c3569ccc327c30b529d8a380a011b232dcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851472, "uuid": "bc5d0475-89f5-4ce1-87b9-5dad0393072c", "comment": "Malware payload (Formbook)", "value": "83aa82ce9bcd017aabbf46f0b7145f52f57a39d82998a5818f66da1a97663a6ee61f363d2837be348d31fcbabe0b9492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851472, "uuid": "f7823340-4eae-4ef6-bafe-ccf2a8beefa2", "value": "T12454120362C5E04BD66A4A3246FFABF9D7BD775D2E006B3B07218FB53805512E2236A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851472, "uuid": "5a91fef7-89a1-4583-9473-0b62ff057c48", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851472, "uuid": "e56773d7-b294-495e-9c3c-fa7be7dcc1eb", "value": "6144:owjvrKYI3XrY6wi2BkpcJCO9ySMZiJ4zvKbnH5ArkGtfp2G+7QdrGeE:fvrKYI3XrYni2BkpcxMQJCSbZAhfp2vJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851472, "uuid": "18f41554-7c3f-44d9-8a0f-d81ec92e5683", "value": 302231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851472, "uuid": "983451ba-641f-4171-b4f7-375edc581a9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851472, "uuid": "c4213888-48cc-44dc-a150-2ee5ef4b5ce6", "value": "QUOTE-09434.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840a8708-8db1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644855410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855410, "uuid": "f974f040-4564-4111-b150-4cee24141b2f", "comment": "Malware payload (Formbook)", "value": "a8c7fd9fc57f65e261faa76632e7bed5", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855410, "uuid": "7eb4ea6a-4e64-4b81-8284-c8d3de1a1e15", "comment": "Malware payload (Formbook)", "value": "809d14a7da9cd6bfa85055311ac75ea3b5e5fa7d2cd5d03076e8bad13d8791f5", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855410, "uuid": "1e940f9f-91d7-46ec-9b38-f6b3c439e1b0", "comment": "Malware payload (Formbook)", "value": "ee6fe23415f6e5c1f00090b2f8fe31ecf576b53a", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855410, "uuid": "460e6461-d67c-4f33-8cf8-2afa6adf02a4", "comment": "Malware payload (Formbook)", "value": "c3ec64f5962fe4c8a27b275a47ac3ff7a50e45fb955b1c7b18c2478541dd978bdfda806baca13c0ba391ff24f02ebe66", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855410, "uuid": "f166ea7a-e2db-4c18-9d57-e2eb651a4e40", "value": "T1EC54236396E944FBF7B10E331EA51B99D3F9160022D32E5B23682ABC59102C7DD790F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855410, "uuid": "42347262-df29-4833-8fd4-c83b8f08a80c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855410, "uuid": "158c3c59-8291-437e-9de7-9afcd5535f67", "value": "6144:owIQ7Fv/cXdOb1F6YInca5Q2bZOXmEpjhnnxrF4U3c7eMlvgkymhLp2EUJSxnZCZ:17F8Xcz6hnvZ5KhnhFD306QQIZCyj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855410, "uuid": "4dab169e-6a6a-4cd2-91d5-e25ccb807dff", "value": 301058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855410, "uuid": "2493d2d8-5a57-415d-8d9e-09f7c59fcdcc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855410, "uuid": "cb334edc-69a7-40c9-a82d-3ba462771941", "value": "Rechnung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878d6ad9-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644821915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821915, "uuid": "1df2560a-32ca-44e9-a3c1-20f394fedb97", "comment": "Malware payload", "value": "59c507945aa5affe3adafdf805ccdc79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821915, "uuid": "9dbf9b22-5f0d-40bf-be7c-339fe5fa4954", "comment": "Malware payload", "value": "8101635bb2b91a6f5bc70fad40d5a517f2f349941255e4c009185efe01a92a9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821915, "uuid": "0b394f4e-4b35-4f74-9fe0-7eb7912b4a02", "comment": "Malware payload", "value": "e1cf3d8df32ca5215251a6f60c9f75d42b4d2ee9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821915, "uuid": "dc143d58-f221-476f-8e1d-73eea5be4024", "comment": "Malware payload", "value": "aeb82096d7741e7a1ba4cba37dcff78032eba5123b45cc5d1633ce9b5549a817e8acf32405f563bd12d333b6a17657d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821915, "uuid": "3e3fcebc-d2a9-43a3-8561-e5b64f144a1c", "value": "T146F38E43A9CCB576CB9B02372A94DA3811E82190D7484B02FBFD397ABFC6AD1354E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821915, "uuid": "04a5867f-4bb7-4eee-a519-2575ea5af43b", "value": "4753904c40d638a1bc745c65b88291d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821915, "uuid": "b4b059ca-2ec7-44fd-978b-a495c00c6d77", "value": "3072:MpaDpvDpzDpvDpGDpvDpQDpvDpGDpvDpZDpvDpGDpvDpQDpvDpGDpvDpzDpv:2aVvVzVvVGVvVQVvVGVvVZVvVGVvVQV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821915, "uuid": "e588d5e1-3ed6-43d6-844d-3a3ca2ff2d3f", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821915, "uuid": "b2677c2f-14af-4876-b2eb-3299d818c8c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821915, "uuid": "60c7904a-6925-4e93-9c52-c2dd78901944", "value": "myweinerhurts.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f1aea1-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851945, "uuid": "4bbe617a-e132-4f2f-94b6-cd183f7e3caa", "comment": "Malware payload (Gafgyt)", "value": "50215fa06ef5901a3b078ac400641662", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851945, "uuid": "c2f40fb5-5509-49a4-9e4d-735c83bd7afc", "comment": "Malware payload (Gafgyt)", "value": "8223b08d7ae31ac71499ccd5dee3ea05fa05b9769dd4bac71f8c44a3ac7f0a27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851945, "uuid": "6792aadd-fbbb-403d-854b-bf68e78ab1df", "comment": "Malware payload (Gafgyt)", "value": "bdca808bb471412502337e0557f2f262e662c3e0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851945, "uuid": "72d995d7-8b9f-4e89-9871-25e4878e3b7d", "comment": "Malware payload (Gafgyt)", "value": "6efd5bed6f32b8d602189f15f487c9c95a9501dff93719c0f7fa524f6e291a214e628d30b07f59d72c63f9295a849ae6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851945, "uuid": "0ccff28d-f0b7-4264-ab6d-e32ea0382978", "value": "T1C6A30941F9418767C2D22BB6E78F479D37355E29A7DB33016A347EB02BF1B981E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851945, "uuid": "22ae575a-8bc5-4196-9297-8075af5cfd6a", "value": "1536:Ciba1J45r/R2lbAKHslc7aIGlPGbUOlbtGq3WpZ4xQm4yoHQuQ/mLvQsmv:QADclbA6arGqq3WpCQmBoHQuQeTQsmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851945, "uuid": "72caac56-f5d1-441d-95cb-b17e7efb8434", "value": 103558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851945, "uuid": "8b110c7a-847d-40b2-9016-8e29d57e37d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851945, "uuid": "9a16c222-98d5-4baf-9f35-7bf872afc0bd", "value": "cc9cco", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e0d6c9-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849932, "uuid": "36fcecab-35fb-4e21-b7bd-cc87034675af", "comment": "Malware payload (Gafgyt)", "value": "c451613e4ba42574ad35e8ef4721c5df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849932, "uuid": "1b1955a1-ff2f-4225-9747-18bf8e1093ee", "comment": "Malware payload (Gafgyt)", "value": "824159696e342f1b64ccdbb7e5399db3c7a80c312e0a30688c000b9538f4ab14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849932, "uuid": "d7676ad9-4e03-46e4-a01a-536ba69aa655", "comment": "Malware payload (Gafgyt)", "value": "eaff6be409fecc445336ff36a3e37f990e84d726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849932, "uuid": "1312230d-f8e8-4b34-b09e-f22b44b14d7d", "comment": "Malware payload (Gafgyt)", "value": "cd7c3dafea2d85ebe922dd76dfe593243cfa7c25097c01a45874c093846ec15136b9fa8d9d99337da107611ee2098007", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849932, "uuid": "3e617d39-06b4-49bc-8286-d80468c250bc", "value": "T13A934A275A62C63BC0E757B92BDB91218413FC3D0B33221AB7D8BDA96F359C81E59305", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849932, "uuid": "45a11cb2-fc47-446a-9819-0ccf2165c643", "value": "1536:Wnkh9jDP0VRpQi0NomVnVCqz6uqg3mMBS5HpP38ddhi2hhp4hxhhhhhhhhhhhhh4:2khGb2loQMqz6amMBSxp/83om7FQI39t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849932, "uuid": "1123b594-0633-470e-9232-0447762b3693", "value": 95950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849932, "uuid": "2ff8c6ca-df11-43f8-b712-fcb7e82f55d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849932, "uuid": "5dbafd63-3637-4482-8769-f4690a4451c9", "value": "nv.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc4138d-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644855158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855158, "uuid": "3cbd8888-9c13-4427-ba55-0bc6dd8a9645", "comment": "Malware payload (AveMariaRAT)", "value": "d498e190b594112628f2fcb86256275f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855158, "uuid": "4e2f4681-6d08-421b-b243-beae766a5555", "comment": "Malware payload (AveMariaRAT)", "value": "828624989a7b28c370ca64555dc6f7495601169ee75d5b3a779427a10f67b78b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855158, "uuid": "562184b6-3daa-4ae9-aebf-6de336bd2667", "comment": "Malware payload (AveMariaRAT)", "value": "bcd8b04cefe7e66dff2c7eafc94aee2fb5156e98", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855158, "uuid": "1ac3200e-0eaa-4582-92a9-0a61cd790da6", "comment": "Malware payload (AveMariaRAT)", "value": "ca8194cc94eda077ddcb9493cfec797cd5f34cdaa6a9325ebaace5e50428c002fcdda1ebb0ff7c4acef15c8fe04801a5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855158, "uuid": "5b143a1b-319a-4149-93df-424931bcbe6c", "value": "T15605F101B7E6AB23C8BB0E7BD9E2014157B0E54E515BD73B64C032AD5C8F3695E7223A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855158, "uuid": "a6b6a2ee-5764-4391-8599-2f016c6085be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855158, "uuid": "8cb4b034-d0c7-4ca6-80c5-64ad3794cf80", "value": "24576:LM5ZySmjGT5TSEUdtmAPKd8dHaUDEDahbk:oZyZ6HU7mL24mSL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855158, "uuid": "d7f1932a-0454-4e3a-8efe-ee9f49fe52e6", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855158, "uuid": "bfcf5095-f37a-4f1f-ba6f-91215eaf3f01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855158, "uuid": "7a8c52a1-3328-48e7-8696-2b8029d57a12", "value": "Sat\u0131n Alma Sipari\u015fi FEB22_76543,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52dcb0fd-8d56-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644816243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644816243, "uuid": "1cde2ac3-065e-457f-8f7b-95c10a313058", "comment": "Malware payload (AgentTesla)", "value": "80598f46e3fc01ba8f5387598ee48b77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644816243, "uuid": "e96b952e-6e77-48a4-81e7-89d30959626e", "comment": "Malware payload (AgentTesla)", "value": "8380129e811fb5bb84379340ed1ff96f71ebcd513ff94da31a72d6afc10a534d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644816243, "uuid": "6ad57113-fa28-4b04-8795-b028e1a2df68", "comment": "Malware payload (AgentTesla)", "value": "591a35ddce648997c1ccb2b824f525bb35027a70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644816243, "uuid": "7acd781b-da3e-4a32-a364-1e8a00fa93e6", "comment": "Malware payload (AgentTesla)", "value": "f0486bddf49eb8ee169f181e8d85bd4045e242a167585aaba2cf26a1af451fe5833294cd30a89d08d125ca9b5966bc77", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644816243, "uuid": "cff8d0f1-9bb1-4247-b2f3-bec0f728512c", "value": "T194B49CB121679B55EA3FC7381321C2380FE6AF12E313E5797CD86C9B7192E450B66A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644816243, "uuid": "9b26fcc7-7fc8-4385-b16b-0d4d126cdd74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644816243, "uuid": "c0779813-00e7-4700-b2ea-5dac8c3fb290", "value": "12288:nbdPS4VjApa+t4IqNh9Cbb0xLslcZKJ0FQBIW1wjvkTh:pHjAI+t4Iln/lP0FQqW1wA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644816243, "uuid": "06d3e383-4eb8-4714-9a4f-5dd0331fa602", "value": 529408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644816243, "uuid": "e12ded17-fee9-47fc-9d7c-85929c5cb351", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644816243, "uuid": "08b67d39-fc1e-424e-bd24-6c52287493a1", "value": "Bank details 0927625292528.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55292eeb-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload (a310Logger)", "timestamp": 1644822690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822690, "uuid": "3124d67f-53c8-4652-becd-f485fe04a2b9", "comment": "Malware payload (a310Logger)", "value": "a8a624e79ce84c5d8c40d55eaf701d05", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822690, "uuid": "a338b11d-e12f-407f-bd00-3e13f7284b62", "comment": "Malware payload (a310Logger)", "value": "83972d5474a1d807a1197cdaeb64b0e190a13c6f2cd69772c847feccf1517260", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822690, "uuid": "0a6d20f9-5367-4e59-b2b1-67eb0a63dda4", "comment": "Malware payload (a310Logger)", "value": "f147abbc5c06ddaa3d6e3ccd13261a78b65708a8", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822690, "uuid": "f2e78a71-7a48-42bd-b51b-933c5e3e8406", "comment": "Malware payload (a310Logger)", "value": "511623e1472fa720b0176fb751415e04a76e0a89a50a94fea007728599cdd99b4a57cb3f1494e1a6761d5811b4509d5f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822690, "uuid": "73a4d2de-c9ab-4061-adf6-bde069f37fc3", "value": "T116D25002B3D5CE16F15246714DD3C286B22DBE1E9E56C20F3384BF1EBDB46718A22B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822690, "uuid": "1d7ccde9-1944-439b-aadc-560a3be01c8c", "value": "192:wraIlLZEvA+6/6rJvEMOOnC+8ypHFsfrAAuVGg0jbwJ2tJd/BUa:w2E8iSJsrXySsAuVGg0jbw8t3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822690, "uuid": "64fb18b1-7532-4c92-9e46-a552f7d56576", "value": 28672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822690, "uuid": "e15f8844-925e-4ffc-9328-f8dcb376c004", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822690, "uuid": "effe0452-d9f9-447f-9f3b-cc18816ae5ca", "value": "DHL NOTIFICATION.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15536a77-8dc5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644863814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644863814, "uuid": "65d2238d-ed02-41ec-9411-48941eee4c0d", "comment": "Malware payload", "value": "36f524871f759a24933b8edfd6e1dd3c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644863814, "uuid": "8ab485f2-df0f-4e3e-9840-45b5a208bf91", "comment": "Malware payload", "value": "83aaa8741b14fd2ffb80dc21895cefe06ff143b019837456dfcbcbb7aff66388", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644863814, "uuid": "1f68e7ee-7c94-46ce-b329-a68455e8df63", "comment": "Malware payload", "value": "852383734b39adffab3fc3449ec8eefbc902b5a1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644863814, "uuid": "138ea011-264f-4b6c-ad55-1b48a7e5a0fa", "comment": "Malware payload", "value": "2b386d5e43593753f7537709f8529941891b1858dc2a9fdc4fdb5556552eee339289458dc5616932920df3b8f6b0a110", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644863814, "uuid": "c058b925-14d1-4c25-a817-835c6e0f948d", "value": "T160830285CD5F776B82424E64B8DDA301ACD6A523458CAB109CC5883344A3EE7EEC3FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644863814, "uuid": "2a5436ba-7939-4867-b96e-847ce0447883", "value": "1536:nBbSWjIl1DT1ruyPXabOwc9Km8XtKexkFSqz7acNpoPcD3YFseP3hrtEEt0:nBbSOI7DxrHvaCwc9D680kFMcNCP+5e2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644863814, "uuid": "b5f2cb7c-b81c-4028-b9fc-91d9e8e8baf9", "value": 81043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644863814, "uuid": "aa5eafc3-0608-4fb4-aa9f-b481bdcae011", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644863814, "uuid": "6b57ab0f-cc89-4249-a300-f14c4c6ccf00", "value": "ad2b032665a6d49c0e334bcba36625bf-sample.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46ff8dc-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845237, "uuid": "81e273ac-7cf0-44dd-be12-48bf3a070d79", "comment": "Malware payload (Gafgyt)", "value": "cd34fb6943490c0d65bb4075e655a40f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845237, "uuid": "dbdf154e-0deb-4a1e-b3e7-cff6e1f6311c", "comment": "Malware payload (Gafgyt)", "value": "83d625399a3785c04ed58be2b9a4a6864f3b84c535baa4f0301563471cf30877", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845237, "uuid": "8c58b179-ba76-45bb-a8e1-202700e843c9", "comment": "Malware payload (Gafgyt)", "value": "510c21b5fdbe4d2dae700d58e8131c9680d68d52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845237, "uuid": "6b821c71-aaad-4920-b7f4-ec05d6834aff", "comment": "Malware payload (Gafgyt)", "value": "bab8b135f939fb45c9fcf7ad541bac8d70a8cbf8a5747bde351626889c8dd472f4bc1916c8684d740cf3f669549ec79e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845237, "uuid": "6ebb9237-5e24-4762-862f-55ee44cc952d", "value": "T10D43C64AEBA44EB7DC6BDE3302A9075135CD955B12B83B363834D838F55A50B46E3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845237, "uuid": "433477ed-f5b2-466a-9027-db1ec2578327", "value": "768:LE/fKedVPHcKlITlVRP0BAA1SmMvwHeYZu+hZLp+XiAFkeFXyF3ebe59Tox8tig8:LQvAA1XZnZLpvNF3qi9Toxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845237, "uuid": "747a653e-75ec-4b1e-9dab-f937876e05d8", "value": 56516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845237, "uuid": "5db90d84-acbe-4e73-b220-e1ae41c10f02", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845237, "uuid": "bc5a0222-dae4-41f2-af46-e3f5b45bd7c3", "value": "pop.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e69699-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644823006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823006, "uuid": "4fb7b8d4-e169-4d1a-8c36-8a676efa680a", "comment": "Malware payload (AgentTesla)", "value": "8ae707c3a539a3530fb5650fd44c5a34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823006, "uuid": "16afaad6-2fb5-402b-a3e5-e5b876db0baa", "comment": "Malware payload (AgentTesla)", "value": "85e5b23cfb7fa5d56e2ec01d701d1ffe555b66ef37fcce39be1107e7f4ebb664", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823006, "uuid": "67a3755c-6866-48bf-810b-3df93689990c", "comment": "Malware payload (AgentTesla)", "value": "a13faa6087ec1340311ac556192dd591f89af452", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823006, "uuid": "29a07133-091c-4b5a-98ab-ff92e6a30a72", "comment": "Malware payload (AgentTesla)", "value": "98b65779dfa1ea8920e2c351d150980d52a4e009aa57eaa66540b9cb21535b8a693f6aad20ccc7bcb0bc878cbd7a833e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823006, "uuid": "b2d29d38-426d-4a6c-8a39-57d2b81316fc", "value": "T1A5251219B7A3D950C1B60BBAE49042A06F34EA1E954BC77FB0AD3ECD2F9B3560531532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823006, "uuid": "4aca43a6-a7b0-4eb5-868c-a00329367593", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823006, "uuid": "241f9602-b4a3-485d-9650-7cdaef0bce2b", "value": "24576:xBolP88LZ8BRUIcQeSNiOzy9qKCp82m4LxIeGG:clPvt8HUzQt4PvZ4LxIeGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823006, "uuid": "95292c42-35c3-4115-b329-a4d9350f1859", "value": 965632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823006, "uuid": "1d27de31-067c-412d-a9a1-7a246cd106f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823006, "uuid": "c1952abf-f32f-4e68-95bb-64a48abcf5c8", "value": "8ae707c3a539a3530fb5650fd44c5a34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64ad13f-8dad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644853803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853803, "uuid": "b131fb06-d819-41df-842b-77f46f7bb698", "comment": "Malware payload", "value": "1b333e808f8df0ff220f58e0b9fd5b5f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853803, "uuid": "cc8c89c7-a24d-452c-8d74-29df0762e1d2", "comment": "Malware payload", "value": "8647946d0e71646f368914acc9132a6c148672378ce94bd87a0a8313d4e799ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853803, "uuid": "0cc7efe1-fa24-4abe-8077-9bcf1cdb0f70", "comment": "Malware payload", "value": "3144638ea52271ca955da57ab0fa032880e9161d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644853803, "uuid": "e37c89e7-c35d-4bc3-b638-5d7a7d21e0fe", "comment": "Malware payload", "value": "16ae6fef93805bceb91e456b8010f8abb5af097601cdc7bf8a24ffc07bd73c4d3fee63e6e357eee14cfdbaa0bb54b607", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853803, "uuid": "0b254acd-a570-4972-8333-c5850ea0cd74", "value": "T1D482D0E4324A32A1C441333FF743AC9BAB3B601A51CE495DD7F0C166A6E2505C6F1D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853803, "uuid": "f58bada5-fe7a-4d93-9c38-753bf41c2cb3", "value": "384:MJQM9nsmeErmuGWs3ViXRY8QACbJDzN7fIo729Ro1fwjewpPF+czh:k39nneBCXRYGOrfIo729Ro1fKewFFlzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644853803, "uuid": "76871b9b-d458-4e9f-a43d-6cfe41fe03b9", "value": 17800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644853803, "uuid": "d504692e-8bae-446a-895b-2aeab9233208", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644853803, "uuid": "d8b94e88-a08c-4429-b210-8400ad4ca1e9", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f36337e-8d83-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644835645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644835645, "uuid": "e9bee926-3209-4425-aefe-3c76ef2da28a", "comment": "Malware payload", "value": "31a22a2ac0a28995ce3683d7624b3c52", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644835645, "uuid": "73552708-d36d-4a84-a4ff-1a16bb1b26e0", "comment": "Malware payload", "value": "86ada986e40742dc3b759ca2964eb4b8711647bc84a0ef6cf385240c4818ef65", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644835645, "uuid": "8f1d8357-69cb-4d7c-b7c6-c3b9b57a0b05", "comment": "Malware payload", "value": "1876c0e5c3373c350cd543e9fe0206f65ece0cb1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644835645, "uuid": "7f140f35-46ce-4fdc-abb0-2290167eca62", "comment": "Malware payload", "value": "9d1853fa64e412c8221560503bf544f4c62dec885aa8bf80c80c84b9752b5855f590b146dc783b70e421022cc5cb2342", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644835645, "uuid": "039765cf-60e6-4bba-97fc-02c9e257b84e", "value": "T1C265E145B3C5BC2FCC7384364FBA8A2A95468C56C746D7135AA0B62C5DBBEC04E49FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644835645, "uuid": "79858a06-2e82-48ba-85f0-34b1f1c6383f", "value": "24576:teSYbY55O7OyD/ofy1a+40x07jxOhBN6kvSm1aKBrrO3ePq920qRzcgAe/bQhu7f:teSIY55TyTSy1VzxNSkvSeaKBrrOuS9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644835645, "uuid": "674ac511-a277-482f-bbca-79f7119f0e99", "value": 1504133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644835645, "uuid": "628454c1-30f1-4150-810f-ad500d46669f", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644835645, "uuid": "ab8ed4aa-4a39-466b-8fd5-99049301cfc6", "value": "a1-netzupdate.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363864b7-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644823067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823067, "uuid": "2deba85e-eb7a-4083-939f-dbd2c2277755", "comment": "Malware payload", "value": "02fc445d8085c3c093d628bda904862a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823067, "uuid": "e87f56f7-6f36-448d-a492-16a91b51441d", "comment": "Malware payload", "value": "871e05ce39305185cbbfd5c330230fd31c034000d571796384ef8db72deff19c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823067, "uuid": "d76f51d4-3598-4334-9d48-0c1e8537dc27", "comment": "Malware payload", "value": "9bed1d77f3f2329bce876ce88f085a3a2f35f1a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823067, "uuid": "16ce3d6d-744a-413a-8266-926b6ec91c7e", "comment": "Malware payload", "value": "3a627635ab9b5b5c086215035accac75c90e0cd0a9fd17c5b31916ca6ec99d5bf8511d10d39b41be582da188bed676d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823067, "uuid": "547ff20f-8794-4264-bdfa-c3becabf5db8", "value": "T11906017C266E5E4CF784947CB1794EFF27A2B82F05A774F7900CB2D70AA9BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823067, "uuid": "64d018b0-9f65-43fe-a53f-b5d420e40c20", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823067, "uuid": "91e93318-ea79-4934-be52-7c2c117f898d", "value": "98304:XpEdtLiNZG93jfpSP1atPI/nRl+WY05grrYyg:XpETCZ6TA1oPcnpcrlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823067, "uuid": "e088a424-9c01-425b-85b1-2da68ee82194", "value": 3883512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823067, "uuid": "cf272cfb-d578-4b04-bce8-8b99d1cb465e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823067, "uuid": "e9be80d5-efcd-4009-9ced-b19709de4aa3", "value": "02fc445d8085c3c093d628bda904862a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7647949e-8db2-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644855816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855816, "uuid": "b27e95d1-85a6-4f17-9926-e3a02599c164", "comment": "Malware payload (GuLoader)", "value": "11f3b0bc1fcc8f15573e14a08abaccc0", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855816, "uuid": "2de4ec70-0870-4d68-b39a-e890266ab3d3", "comment": "Malware payload (GuLoader)", "value": "87501a1292f7f1cf271b7ab4299be339be744f3997219712f0f7aa2f021990e7", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855816, "uuid": "281a1807-873c-43e7-97fb-58700140075e", "comment": "Malware payload (GuLoader)", "value": "b6f4c865d57411f72285c88afd6281daada7ab32", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855816, "uuid": "61db1377-ae77-4887-8e5b-16b882e59505", "comment": "Malware payload (GuLoader)", "value": "55257b46b582880e5a40ec0ab90a4684ddd0ef03883f3952a3f9bcf7c249bf60cccbb5bdf96b9bcd01093ae9b3dea0b8", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855816, "uuid": "2a004d95-6bb0-4fc4-84a4-1865f1e361d6", "value": "T12CD39D407708C81AD9E14776563BC7B69AB5AD01A958FB03F310BE6B3A332FE1D5D290", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855816, "uuid": "14c3a4b4-022e-4f8e-908b-e2afb9221d80", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855816, "uuid": "b61f4fef-fc32-423e-8a93-740cda17bcce", "value": "3072:/bG7N2kDTHUpouvX2b9JoJHzN8ndyMhUMRWGPP:/bE/HUQ9mHhK11X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855816, "uuid": "327750c8-ef22-4487-acaa-b0da86a14936", "value": 131760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855816, "uuid": "becc71c8-7073-4210-a56c-f87e1070ef44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855816, "uuid": "2f3cd35f-36e2-4eea-8123-080417b680d4", "value": "Bank\u00fcberweisung.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe4c6c9-8d49-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1644810943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644810943, "uuid": "b5dcc41a-1983-41fc-90ae-235d6e73da84", "comment": "Malware payload (BitRAT)", "value": "b86467c3fd901aa94ae021ee2208a477", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644810943, "uuid": "da3973ea-a2c8-4139-8906-de0e6c662310", "comment": "Malware payload (BitRAT)", "value": "879b3899bd1dc321c620a9abcd9fa2ce3222047bc49b57cd00a8dabfc9e2b0ac", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644810943, "uuid": "a704c1bf-ff7d-4962-a3a1-1decba0d1cb6", "comment": "Malware payload (BitRAT)", "value": "a41fb8edd0f5a84e39c6fd2fca9b036b42b4968d", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644810943, "uuid": "56cfc834-8015-4f79-8247-3e551d2788d0", "comment": "Malware payload (BitRAT)", "value": "f731ac75b7fdfe62c9dc404cc4c04ed0b760734e6a6dc155c7aa80820a503f2c8397092ae4ae238237cbfbadf9e8ce7c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644810943, "uuid": "21525ae4-f048-4f43-939a-25e2cb0638be", "value": "T1D1A52310AB91D03AF4B722F88976C36DA63EBD719B3181CBA2C96AED16345D1DC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644810943, "uuid": "de287a02-ca9a-4c2e-b224-2b04b07dee2b", "value": "01964b8ce8a862adba8387753bd05847", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644810943, "uuid": "52867094-aed0-4b8c-b65d-17958041592e", "value": "49152:TOouFjHj2CozLkOLvcpwTVV0NcTzIVtVOen01:TO9FjHKCMk2ceIOczOe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644810943, "uuid": "fd13a326-3cd2-44ec-8c26-43c25ae3a098", "value": 2195456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644810943, "uuid": "dbfbf913-dd60-41a7-b9cb-1a2aa9ba0c29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644810943, "uuid": "cd136e88-1524-400f-960f-cc2cebf6c617", "value": "b86467c3fd901aa94ae021ee2208a477.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49c4cfd-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849908, "uuid": "f5cb6bcd-e14d-4e0d-87ab-dd95cf9a01be", "comment": "Malware payload (Gafgyt)", "value": "938d5dcab6297610d92f9fb4e725d181", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849908, "uuid": "930cd12e-8d12-44ef-b32b-3fe22f2eaad5", "comment": "Malware payload (Gafgyt)", "value": "8a503a1dda9d3d5c05a9345c6464210c85ff98023f238a9ec74c079febd459f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849908, "uuid": "0fd8e3ee-054e-4fb2-874f-23811f44e207", "comment": "Malware payload (Gafgyt)", "value": "40ab66dadbfb5ce9661111a757de2f81112e9467", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849908, "uuid": "996c8395-e718-4618-a9ca-d4f979424f5b", "comment": "Malware payload (Gafgyt)", "value": "12225922ad9199bfef7a5720a89fa89bfde7855bd7eb7cce60a1213e292ae865a0c4b527f024d6d1fb2278e82fe264b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849908, "uuid": "97273d63-84d5-46c6-85bf-79768b374d55", "value": "T1ECD3723A7E21AFFFE16886310BF39B7083956D9226A19345E26CF7181F7128C1C5E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849908, "uuid": "78261c81-a228-406e-98e9-178608f776e0", "value": "1536:GYbogOeddsPoO72PxKSStSe3gj1nbfU3BevRndReTalFSUg/D9m/iimUr+MrmxUh:EYtvFfU3MdgTa5gpm/ihUr+MrmxUND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849908, "uuid": "45b06cf5-4c39-4b72-81d8-67935a44e800", "value": 130241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849908, "uuid": "89ace767-78e8-4a95-9503-a989ae2b7c4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849908, "uuid": "21ce8ad1-9657-4e97-83a7-0c532b9f23f9", "value": "nv.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7007e7ea-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644821876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821876, "uuid": "6f25acc0-d13d-4fee-bb1e-5f7870c1d784", "comment": "Malware payload (SnakeKeylogger)", "value": "26db4511615e946bd1b79f4c52339f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821876, "uuid": "a8b0357a-af1c-4cf3-908f-790a4125235c", "comment": "Malware payload (SnakeKeylogger)", "value": "8a648180e488d70800adfc0f601dd2790bc1d63bbdcd9ba189c7b8e792feacc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821876, "uuid": "bb0dc70f-0a72-4502-a236-ea232bbc7f39", "comment": "Malware payload (SnakeKeylogger)", "value": "f7ee5b3065fbfa76867576d7f72e65614f64bfcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821876, "uuid": "9382420e-4c34-483f-84ba-43f00a3232d6", "comment": "Malware payload (SnakeKeylogger)", "value": "09612e4b69efd002bc4bf2deef5d5c3984879f3be2fede7e773fc15f7258d679710803a2d3881b620722526345ac1bab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821876, "uuid": "8a7ef21d-e505-48bb-9174-affdc3def072", "value": "T1F194CF7910368B92DE7FDB381331902C0FF6AA75D207F6782C88B56A00F1F994B56667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821876, "uuid": "c250b3e5-5f43-4469-b0f5-6bba36664c95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821876, "uuid": "342ea19a-de4f-497c-a1fe-bf6947052941", "value": "12288:0/2JjApT6xXwBIqQJBJuL8ssK/BgbK777777777777:msjAQxXwKqQJBcgsp0K777777777777", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821876, "uuid": "d497c5b3-f7db-4cc6-b75a-c4e50593276f", "value": 429056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821876, "uuid": "841f0f30-726a-414b-b35e-de25b40d51a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821876, "uuid": "d87b5d22-071d-4d36-905f-444ff0a9c836", "value": "26db4511615e946bd1b79f4c52339f29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd70804c-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (Adwind)", "timestamp": 1644855184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855184, "uuid": "b77887a4-8252-4671-b2d5-5ba9d96b600a", "comment": "Malware payload (Adwind)", "value": "374f6fb8ca0d24035d74732b3ec773f7", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855184, "uuid": "156052ea-2e2c-4811-822f-3e0435ce31e4", "comment": "Malware payload (Adwind)", "value": "8aa9890f75cc5256a75dce6899a612fced36cc05556bb60beb177b47b9991f32", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855184, "uuid": "4312420f-128e-4ce7-bd86-3746379328fb", "comment": "Malware payload (Adwind)", "value": "799592a0d80bbec04056888946f18c9d1baa71f1", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855184, "uuid": "9f794397-13d6-48ed-8bdf-01a3179ff891", "comment": "Malware payload (Adwind)", "value": "e546bec233fd1c2f9ce67b52f7a304c69ab56e190c63570856ceb67e835aed4ab1e54f4b736dd6e4485c22fd453070eb", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855184, "uuid": "4116732d-0ca4-450f-b32b-11f09b360b65", "value": "T1E4D4239746FE478CCDA1F03BC8B165B2EF8539A201DEA2BD8255D41EA83C727D49F409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855184, "uuid": "392bc670-6647-4191-9cec-3f79288603c5", "value": "12288:QUT62Jt/gGZTMAiG64P7T2RLwo1ZjTbIURiUdEfksb7IgdXNon7ImSeqQV3ap:5Tnt/grG6ITCLwUjPIakklgdXqlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855184, "uuid": "eb875c10-15b5-4030-9255-cb0f292cf532", "value": 653307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855184, "uuid": "47f258ce-10d1-41a5-9ef3-c4bbacd1f245", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855184, "uuid": "b2d1085f-524e-431c-b836-446fa62b066e", "value": "JAN SOA---- Worldwide Partner--WWP SC+SHA.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a8a98d-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644821717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821717, "uuid": "33cff699-f1fb-474e-b764-6eb9c67163f0", "comment": "Malware payload (NanoCore)", "value": "ebd3e6c87a93ed81b0ed0a306d9406fb", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821717, "uuid": "25e3f3d4-260a-4965-ba3a-7559d426d55c", "comment": "Malware payload (NanoCore)", "value": "8aaeb0bb59074b222994ee47c4ea7980d6644618ba095c42431e926afdb65d63", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821717, "uuid": "9d499a5d-3f87-496f-acdd-b9260805beb5", "comment": "Malware payload (NanoCore)", "value": "7a51ef64179210b12a6cae7eed1789f7a22b2023", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821717, "uuid": "7d40306e-47ef-4a42-8ae7-556d5e208a27", "comment": "Malware payload (NanoCore)", "value": "3dd570b8808c7882a1e88d2928c3847f7c1541c135b838ac15dd6e489bfaaebb13f666de647f3a6708db7d44b0b2b564", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821717, "uuid": "fc2c3e72-79eb-41be-9ca0-55f75eb164f6", "value": "T1449423315AD369FB2EFF25DA46657B30D8BD10C43B71AF9BD92666384B60C0509E02F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821717, "uuid": "4bfe8e71-5301-406b-b76c-54f625b55b75", "value": "12288:2QXJDKbrdRGPjPkU+SwqzEfq/reyfMmglory3Cja:2Q5DKb58PjcDqQfGrey0jlcKCja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821717, "uuid": "af0b5cf9-1952-4c9f-b531-778bef25af32", "value": 431794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821717, "uuid": "efab031f-37e0-4cb8-8ab5-a6e10c1f7b31", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821717, "uuid": "85fe7a00-0076-4108-84e0-c1feb0356b70", "value": "ebd3e6c87a93ed81b0ed0a306d9406fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e7fa95-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644851469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851469, "uuid": "642f696c-686b-4537-9e45-0f669be1bde4", "comment": "Malware payload (AveMariaRAT)", "value": "ba984679a27c575a7ed341288dff3747", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851469, "uuid": "29cd1edf-b7af-4bfc-854d-ea16db17cd35", "comment": "Malware payload (AveMariaRAT)", "value": "8afcb20499b76c7a17353108a4111da53dd08e6fd432eec72edd61788f784e3c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851469, "uuid": "1ea3f88a-7815-4c07-8ef8-54066a8556cc", "comment": "Malware payload (AveMariaRAT)", "value": "fcf1a0dddf37f6afb30dbd5fa8a3bb08b700a21d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851469, "uuid": "176a8231-e0ea-4ecc-8db5-c3b76fbd5dca", "comment": "Malware payload (AveMariaRAT)", "value": "eb46f7636802a9b1e7edce2d7826ec1d960c13c969a41a15d5acf3630624c0de9278f7935575cc940970ba023a24cbdd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851469, "uuid": "0f24317a-7c9f-434c-b386-170b832ff308", "value": "T14AD3BE0877D8C98AE5AABE392CC4E17416B8B19A7D07CB0370581B5FFC761DC1E87929", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851469, "uuid": "64ad8866-3e3d-4c8d-b6ac-b70d4d85c3a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851469, "uuid": "365fe46c-1001-4f7a-9f33-4a8ca7869708", "value": "3072:XNob5PYgJoyxkGVAvYQH9e3oVvMOrZln:XNob5AZikgAQvoVJVl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851469, "uuid": "73eb0010-6989-4a57-96f6-b98e6362f987", "value": 137728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851469, "uuid": "d605d48f-1f0e-413d-81eb-42b46324af41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851469, "uuid": "a74bf91a-2f65-499d-a4c1-e79cd32b60d3", "value": "PI20200206AP,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc6fe20-8dab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644852930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852930, "uuid": "aef308fe-09bd-4901-9a36-4773cf715c9d", "comment": "Malware payload", "value": "c77234a1df851aa224a06baa8596f462", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852930, "uuid": "f72898db-bd22-4d2f-bb24-62c5807d4413", "comment": "Malware payload", "value": "8b22357227229cffd14c29146095fe2853beb5c920fc660676940055faae5f24", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852930, "uuid": "d2b97e37-d1a3-443f-a3bd-2a3859554c5f", "comment": "Malware payload", "value": "3d9e0456b4ddeeac4ed07173ddbc267802f60b04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852930, "uuid": "fa48d737-92f4-4262-a170-a7b51654f0de", "comment": "Malware payload", "value": "3887a5885f62e35b3c53e4cd7ca365b35a74abe459b2b564fd6c50cd019972f3fc04b98ab1be574576bdc7c1c18c432e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852930, "uuid": "8840ef87-6b89-4b21-bec0-c7a634fac3f9", "value": "T1A403F174E989DC62EFD8AC76C35600047B66B5FC4AE63346913C53BCDEE21160E9A3E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852930, "uuid": "3442e08b-3320-4397-a7a7-a75637ecde34", "value": "768:fd0QlwPDTPU4x5vw3Z9hAsyN3xPiiqBMeYM9idVOIU7mTRDo3U4u568kF:fdODTPU4xi9h+3xPiicYM9idVOhaTRDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852930, "uuid": "9f3ed855-9569-4f67-9bca-b61b78582942", "value": 39116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852930, "uuid": "a31eb1b7-4226-414c-bc09-1a44918df6dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852930, "uuid": "a55fbcbc-3997-4e4b-9842-cd6cc4bb454b", "value": "c77234a1df851aa224a06baa8596f462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55d9092-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846071, "uuid": "1cb4e97e-b964-4f1f-94aa-e568c5abc661", "comment": "Malware payload (Mirai)", "value": "9d8f436b39cbe6a30e366475c0b9f5c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846071, "uuid": "0d54deb5-97fd-433f-9769-3d3acec7e145", "comment": "Malware payload (Mirai)", "value": "8b3afd434d2c083df42343c331d03f177c6a94a5e7aeea7fc858d6bc2ca824de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846071, "uuid": "e73d0399-93d8-42a4-9ea1-abfda09dc3b9", "comment": "Malware payload (Mirai)", "value": "da57c7428980366dc02766f0321541c0f3268120", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846071, "uuid": "a3fcb472-b620-4dac-8cac-d31791397ab4", "comment": "Malware payload (Mirai)", "value": "8e3f4dfcde5e87d8b898d5a03a2319103555175e234d09418a6aa8260231faadd24947ad9c709edd520d49db4222f661", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846071, "uuid": "59ef5ce2-d9ef-4d5d-bb00-c15d9cfb0b14", "value": "T11FC339377B231E23C0C9547102E30331BBB5D76638BA4797F9D1ADA86F26A843522BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846071, "uuid": "eb850570-92f6-469d-869a-87a4de154f1e", "value": "3072:PeboPoHEhphaw5yyF92fiDUURE9/tAoQtTm:s4fphaw9PDUURE9/tAoQtTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846071, "uuid": "094c4a16-049e-458f-916e-0cffa6b5383c", "value": 118325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846071, "uuid": "152f0050-8321-4a86-a813-8c3525f26be7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846071, "uuid": "60ed6dfc-57a2-4f26-8a3c-fde7f5be4764", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a19d11f-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644823020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823020, "uuid": "76cea480-3295-4cd5-9874-41490d087d00", "comment": "Malware payload (Formbook)", "value": "6263deb8f5d3b2fa51ee952ec83866cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823020, "uuid": "34e2399d-48cb-469c-9f43-3473367b2a67", "comment": "Malware payload (Formbook)", "value": "8c2c738ee2230ec142259f31fc60cd23ce3bac65dec24427437ec79250fa3653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823020, "uuid": "188f98ab-97ef-4ac4-b21f-51849dbcb0fe", "comment": "Malware payload (Formbook)", "value": "c3229136845186b926c1c047ad943a3dadb67402", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823020, "uuid": "65e458f9-848f-482c-a658-9d4116cc121a", "comment": "Malware payload (Formbook)", "value": "5d3810cbd04ead4447c12940d031ddad6b73b1cf0a8088aba38853ad9ab6e4e7701242ad7efbaa5e221c4cde7acf501d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823020, "uuid": "80007ee5-8da4-4dd4-a9a2-92fe8c4c205d", "value": "T190150219B7A6D545C2B50FBDE8A102816B70EE2F4507D7BF709D398C2FAB3560932932", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823020, "uuid": "fa9e47f9-4325-44b1-87ed-b88622b80ea7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823020, "uuid": "3f4b9873-6090-4842-9a71-f7e1939f02ff", "value": "24576:6qQE+DLZHyJVb9ZTAfkUZf9FCatWNlGGFiYPy9p:mE+DtHyJD6cxaClGGgAy9p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823020, "uuid": "dde596e9-b44f-4b97-bd9c-92dd84987f82", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823020, "uuid": "56c2c72b-b115-4dcc-84da-90efcb3e08c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823020, "uuid": "f64d8eba-3963-4d94-a065-3720ad499078", "value": "6263deb8f5d3b2fa51ee952ec83866cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844ec72b-8d83-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644835654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644835654, "uuid": "559e3f5d-47b6-4133-b5cd-c3fe46435b56", "comment": "Malware payload (AgentTesla)", "value": "efd65e7707bc0bfb334c3c1a9126ab74", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644835654, "uuid": "9580c8d0-f998-4754-8f3a-fbfb430c008e", "comment": "Malware payload (AgentTesla)", "value": "8d4c8674d1c1e885b1ca383715c0d39aae78ea79c8dc47a0f6ea5ff591bafbc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644835654, "uuid": "514df6f8-cde7-422e-a806-c967b12f79c9", "comment": "Malware payload (AgentTesla)", "value": "976963cc4539ad7f545c9607cf1195496a7ef75a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644835654, "uuid": "77c4a538-d395-45e5-b337-051f458cc001", "comment": "Malware payload (AgentTesla)", "value": "8f726665102a16bdb9323b661c72c01cfddd30532a7d4078cedc42f873276cee261da30b3b9b80ad91476f164ab440f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644835654, "uuid": "3bf680c7-1e2e-4dbd-bb8c-db9f44f5018f", "value": "T173150200BBEB9B23C57B0FBBA8E242511370E54A611BD77BB8D536D81C8B3651E71236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644835654, "uuid": "3d12ebde-072d-4786-97d2-3a575de92841", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644835654, "uuid": "9546c981-2a96-4ba0-91d6-d381dd5c08ed", "value": "12288:bMkXso+2k6lxyFji0oULrru56x55U3bVlTZhd+/JkULpNwIq3Sji4u5h5IrH/IQy:+YIFjivcryugJ13ISYidmrfIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644835654, "uuid": "66383ddc-f225-4d84-9101-0153a26cdb0e", "value": 955392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644835654, "uuid": "16c4d205-7438-44c8-9a73-e1570f4bd213", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644835654, "uuid": "5023dbb4-1d01-402b-a885-409f686f8828", "value": "invoice 38129337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e51e0ff-8d77-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644830490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830490, "uuid": "89093336-b076-4d19-9c58-2f7306692da1", "comment": "Malware payload (Mirai)", "value": "2c8ebc89ec72645213bce4b6c4415026", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830490, "uuid": "acbdf299-2caf-4361-99ad-fe5187477b91", "comment": "Malware payload (Mirai)", "value": "8dc86dee860738378129b728b1a78adf5a09b98689a51955f651042f8cd6afc4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830490, "uuid": "5547663d-9695-49b0-980f-172f1649ad62", "comment": "Malware payload (Mirai)", "value": "dbe656a53f21ef369cfc87412f3551d5b3b47823", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830490, "uuid": "4cb6b346-f991-4b54-9f12-c690eee454c6", "comment": "Malware payload (Mirai)", "value": "ced3280fc61749f173e4e764e2d519c4b28d9e9fb04a3f8d5d69964622e6138d3c9b94285067612bb1e7c2920797f8c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830490, "uuid": "dbde3d63-d925-432b-8184-db44db669cbc", "value": "T1AF832A9AF400DEBCF88BD6BA40664D0EB930A39016920F367767FE937C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830490, "uuid": "b7438f61-c25f-4fbc-9672-cb63f8119b6c", "value": "1536:qLf0+QM5PHyVwi7f2FUiEy+DlOo7NL3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fw+DMaSJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644830490, "uuid": "a4c9e60c-7001-4a14-9e2f-20839cfe8d45", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644830490, "uuid": "95a3b506-b826-444d-bc17-d2b020a5aab6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830490, "uuid": "2187d98e-407f-411a-8eab-3afd7d6e15b7", "value": "2c8ebc89ec72645213bce4b6c4415026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b85646f-8d52-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644814620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644814620, "uuid": "324f101b-846c-41d8-b59a-d3ef8a73160e", "comment": "Malware payload (Formbook)", "value": "4cb6dda56d27fd42b677d92e274ad338", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644814620, "uuid": "3b361936-620e-4364-b857-396e19083300", "comment": "Malware payload (Formbook)", "value": "8e7d51fed783f934d4d700d649c3d97fb4b616077e5303abb5251e3321b74f31", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644814620, "uuid": "52f117aa-15fb-4307-b2ca-f371b6ca01ce", "comment": "Malware payload (Formbook)", "value": "06efcdc5f26854a187e306eb6f63e2fb8ebc9c67", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644814620, "uuid": "c66dc372-2edb-44b2-b86b-64ca4cbd5ac0", "comment": "Malware payload (Formbook)", "value": "1230bc0588a933d72359d2f38f91a153ebddd2cfc9520bd6497eea8204a9a60150905f466569b06de3861277387a702c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644814620, "uuid": "9dd48ca4-8479-4fc4-8a9c-93bf7b94bdd1", "value": "T17BF433D07A415F2A1E0709C14CC77B07FF0ADC59F381B71A6A60D12B89E2A94AE6F5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644814620, "uuid": "ce9c8520-d5ab-484d-9ea9-6cfc17914130", "value": "12288:fBl2juCa3hIHwrMLhFsBkY2YiyVMFYIpIKppXjOSAMpAf7Eq3JNpI0kI7QQ/fjGr:fBluDuEww/wkgMFYaIKTnafI0pI0N7QP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644814620, "uuid": "33767053-ff92-49cd-add1-d7b261d9d729", "value": 773484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644814620, "uuid": "2a856040-d5f0-404a-bca6-4c7c6322ae69", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644814620, "uuid": "2557e0a6-76b2-4d1d-8d47-5e54600cc070", "value": "1644808983.Vfc11Ib60c2cM776337.dynamene_Remittance.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f94da0e-8db2-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1644855832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855832, "uuid": "0a80f404-ea36-45c0-8638-6951c0318a2c", "comment": "Malware payload (NetWire)", "value": "624303414149d85996bb2634c8037c76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "StandardBank", "colour": "#0E4811", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855832, "uuid": "847eb02e-23c9-43cf-8548-06f1ea13e607", "comment": "Malware payload (NetWire)", "value": "8e8c6ff8c495e4cb69154665d99a3c8f6f29d91f00406ffb73aa2e353abd46ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "StandardBank", "colour": "#0E4811", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855832, "uuid": "89300753-d976-42e9-8247-1d3ec963d4da", "comment": "Malware payload (NetWire)", "value": "9ad7e77c2ee38bf98de68fcab8fdbb3408fddd12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "StandardBank", "colour": "#0E4811", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855832, "uuid": "505c24f3-aef5-4c47-a23c-d54c4f5c9b7d", "comment": "Malware payload (NetWire)", "value": "67655ff4f24402abe47e97aef4ef48d86150d1769a27d022bda583f9f4ecf9428443718b517d4a72361462df1dd92113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "StandardBank", "colour": "#0E4811", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855832, "uuid": "f9ee902f-a8b5-494d-913a-8f8577c02c82", "value": "T1A5F48D22B2E045F7D02B59744C9BB3A654197E112D28AC4B3ED72F485F7E381353A2AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855832, "uuid": "d20aa424-8e10-4fde-aab6-59c43f3f6b49", "value": "50e822ed4b7a82a71d116b8c7e2396d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855832, "uuid": "69ab3de4-67c6-44c2-96a9-93389aa5745f", "value": "12288:FlZjc75hO32cpuG7NVM1/vcDy50eVmZyqGz2PASl0i1K2K7Jr:3iz2puG7NVM1/kcVNqGzqFX1K7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855832, "uuid": "19d39f5e-539e-4d9b-86c9-66ae757bf2fc", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855832, "uuid": "6eda6b1f-2820-4c4d-a57b-876d1787b1c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855832, "uuid": "5f0e7a7a-82ed-4971-8a76-eaebfa15165c", "value": "Standard Bank Payment Notification _ 383736299_393837376_397363535_3863373736_93633939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d72658a-8daa-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644852258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852258, "uuid": "7cece07b-211d-4650-b280-50333945bc41", "comment": "Malware payload (Loki)", "value": "d0dc4f2edd550c2ebdb2eec6616e31de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852258, "uuid": "50fbccc3-bedd-47db-b855-da71a5833a5f", "comment": "Malware payload (Loki)", "value": "8edf66f1c8c4dc62e3cc1ea37225cd19aeb3597be5f806be5afd55664a3229a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852258, "uuid": "daf05114-fb5b-4ad3-bbc3-fb60558795f6", "comment": "Malware payload (Loki)", "value": "fe5c7e8beb1aab7b8fbf3980f036be9597cd9c83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852258, "uuid": "eda5ea26-a71e-4be0-8511-718daff84f3c", "comment": "Malware payload (Loki)", "value": "52ef8a5d142b432bfafa1b130454d8b2038c0bf71b40cc190bddf6ca96cd254056f394ee227662476b1bdf91aecb37e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852258, "uuid": "f494111a-2787-407d-b57e-9a6032dbfc0c", "value": "T14C539D3E17A8C5EAD716E176E043F311232A6EA5DB41451F33A03ECF2CBA6848DED491", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852258, "uuid": "e838615b-d05e-40d6-b731-952040b9efaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852258, "uuid": "540675cb-b33f-4554-a1b0-45db834bab18", "value": "768:AxY0mDK/nP5H2YKcYeFehyJrkcvPhOS4/Vi3xnehErtX+GsME4:cY0m2JHJKcYesQzPhOvVihneW9+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852258, "uuid": "6833d696-1f77-485f-b13c-19f397193091", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852258, "uuid": "f67f6cf8-6de1-469b-bc0c-ca36550d760a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852258, "uuid": "5cfd5f0c-48a5-42a6-a13e-5dfd2c8d4ef0", "value": "factura 7685 doument_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06cdd78-8d4d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644812562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812562, "uuid": "0dbed3d5-c22e-4f93-9ee3-0e5dbaa93767", "comment": "Malware payload (Formbook)", "value": "cd046f8dddb14335d33f37f2ce229f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812562, "uuid": "1934d646-3f43-4ad1-a9ed-38104f131475", "comment": "Malware payload (Formbook)", "value": "8f3f5241a8c1bbeb66db71d0836e576ae397e001b80975c4d45514a40388a12e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812562, "uuid": "9832ef79-46b6-4d7c-9777-b455e22e0b62", "comment": "Malware payload (Formbook)", "value": "73ee67a22cf4ec46256f18b9488a8f8485dcfa69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812562, "uuid": "0c2441fc-8d2b-4f21-bd31-f95a00084c91", "comment": "Malware payload (Formbook)", "value": "7f0d3ca8975f6e2fc658bd8531117452a08ae264a09e1875a90e18432b84f6bad4c14f5e86033eed3fe6ba7ff9eee409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812562, "uuid": "dda5a2be-85ca-4f20-a6d2-53fc2db94ecb", "value": "T18D151204B7B2DA16C5760BB6E8A141416B30ED2E9243D7BF70AC398D3FE73694932536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812562, "uuid": "79e04dae-4b1a-452c-b354-073d27398771", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812562, "uuid": "34eff8ec-6f34-46f1-a123-edb096a4c3f9", "value": "24576:XkS3rnBLZCEw21MkmMFyoWKV1XatIYpI0J7cYQ5:brnBt5MkJyxKV1QIYdJ7cYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644812562, "uuid": "05e46ad7-b87b-4253-92bc-38d00b6df60d", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644812562, "uuid": "0fedff89-5cbb-42bc-9108-25a1455ade4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812562, "uuid": "a22eda96-8508-41e1-a742-216d4d12fd68", "value": "Remittance.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc412f3-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844768, "uuid": "1c341a72-11de-4195-85b1-49319a36c022", "comment": "Malware payload (Gafgyt)", "value": "6a6b427110f04ab396741a5d33497180", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844768, "uuid": "e6977175-1bea-4d22-8ec8-8c8dda007cce", "comment": "Malware payload (Gafgyt)", "value": "901eafcddb568662da266fca471acda73a7fd9b948a95f843e423fda4781e4cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844768, "uuid": "811281be-789d-4b68-9677-17cfaa834f70", "comment": "Malware payload (Gafgyt)", "value": "9a64ff7f22947a607d4fbb495e7b8721bdb04e12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844768, "uuid": "baa077e3-0c5b-4c45-9b4c-23eb2508d826", "comment": "Malware payload (Gafgyt)", "value": "7072c3facb6caea4c47bee42ff79ec9f1d1d0610de2fe27c9af1fe7fb164c592708b7b08a035fbb4e509dc31c9f0a8d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844768, "uuid": "bc948415-6887-43fe-acb1-cb50794f64fd", "value": "T1A063290399669FB7C0866EB525F70A304753FD251F4B1B89722DAAF8070B9CDB80E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844768, "uuid": "d27272bc-9795-4ba7-b4e7-710c89be3163", "value": "1536:N1BOxUVm4Wqj6WMzKrtg/p96CUf3l/XnVMuC4mk02q5vc6fBnj:NnOxIm4Wqa2rS6/9/XnGuC4mk02q506h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844768, "uuid": "6a32a4fd-f7fd-4c60-bc80-6212b2b41d77", "value": 72105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844768, "uuid": "e28fed06-d8e9-46d6-84e3-85d89917e2b0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844768, "uuid": "ccfa83d0-aa4a-4757-8cdb-b91300b512fb", "value": "Demon.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8a0150-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849900, "uuid": "6139d890-930e-472a-bc08-d19b8a0ba44d", "comment": "Malware payload (Gafgyt)", "value": "8338f5be187e63f80a6fa5f6bd8b316c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849900, "uuid": "ed7554fb-71a4-4ae1-a84f-a1e361de04d6", "comment": "Malware payload (Gafgyt)", "value": "9105d65987086b0239d1ff7c6936f427fa24d9f3b36952a1a1dd691a183e3d0a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849900, "uuid": "0b107f71-0435-46e2-817a-bf3bae766e93", "comment": "Malware payload (Gafgyt)", "value": "455bb967c5ce2b5aba952f14fc94f77d4c08fbde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849900, "uuid": "2c3c4c27-7f66-4b46-bed6-bae60c7b613d", "comment": "Malware payload (Gafgyt)", "value": "1402a1c5f2533fafa1510c2b8e5b925fe5309dcd8c11a3f9828802519b77dd88fc96279212a9eb5b5fcaffec088a1787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849900, "uuid": "b11e996a-47c0-4260-85f5-d8d60196432f", "value": "T1DF833B06E646CBB3C8430BB602DB9A6A4631FD295E2A9F49F31C7CF49B324C87117765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849900, "uuid": "94bf96a4-55ee-4b8f-9e2c-5efab014baf9", "value": "1536:HpFtncETkzsPs8Wh+HuteubhpALnSdq9gTIEmmiIkp3MyaLnDU7:Hl9TkxwHUeubhp2SdqmMEmmFkp3MxLnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849900, "uuid": "aad6979a-b1a9-400c-b641-739aab7ddaa8", "value": 83449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849900, "uuid": "5310bcfd-0a59-4a1f-8f7c-793512b7a53c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849900, "uuid": "ab9698e3-64ce-47ac-b89d-bd0f2a0b9e68", "value": "nv.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f2747c-8d71-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644828040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828040, "uuid": "d92c929b-3435-455a-8f16-a07d6c647270", "comment": "Malware payload (Formbook)", "value": "abd523efbd0cf9cb958750425f3bc876", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828040, "uuid": "aff12c84-92f7-4d37-a6f5-9b11bc29f12f", "comment": "Malware payload (Formbook)", "value": "91448e38956b8c90fe707164fb09aede72af062dd51365dec1cf98a4d9e08cb7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828040, "uuid": "5ac257ef-2351-4a9b-b740-b98240757b24", "comment": "Malware payload (Formbook)", "value": "3d6da322c96a2bd0dddbfd382d0f34c3a59fca3f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828040, "uuid": "3f017e23-8c32-4958-9209-2a5e2e304c51", "comment": "Malware payload (Formbook)", "value": "3f0675614b952c70d2ea6830e9d5d55083592e2ca574d7df514ea1f7bead62a85d99dde85d587961a89064b1d518a55d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828040, "uuid": "8c47bd27-00f7-45f7-b879-687309459025", "value": "T133D41209FBE488D1F09D29300A76CA2EB2B33D763BA4460B35AD7B0D57725465A13F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828040, "uuid": "5acd78d7-7410-4974-989a-57302e416689", "value": "12288:hGGWPLTzYKV7VfSQp+gwc3FTrXsPmrFEuZPf0P3I7VLB+ZeZ:kMKV7Vf9ZsPmrFlZPf0PY75B+Ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644828040, "uuid": "26397813-9dee-4545-a4e5-f26b5756c1b6", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644828040, "uuid": "0899be90-a8ef-4881-a194-6829762e0a08", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828040, "uuid": "a9b34d27-5c78-40c3-9188-c8dbae863906", "value": "URGENT QUOTE REQUEST_____Pdf_.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f1439b-8d9c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644846265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846265, "uuid": "af26219c-bd96-48d9-a13f-af529c7c067f", "comment": "Malware payload (AgentTesla)", "value": "65e291952d523303a47d826a7dcfe999", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846265, "uuid": "0b3e8802-fad4-4965-b1c8-a7fb095d4bb9", "comment": "Malware payload (AgentTesla)", "value": "9163b5f63794c915f9d2c941516bd7bfcf2811bdfc695e97fb03be7ce3f436c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846265, "uuid": "6bc2195a-81ed-46c0-bdbd-ee1541eb0014", "comment": "Malware payload (AgentTesla)", "value": "ab6fa75b2c8d025794eb190a16fcd210b38e0901", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846265, "uuid": "fb0ffc8d-0b35-43c5-935d-5e55a2fea2ef", "comment": "Malware payload (AgentTesla)", "value": "c87c233f57b1ea5cea0367a3847d6d159812c835b08150e23a226fa445f65e4233a20ea09bea38bf8bc6e1b225317bc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846265, "uuid": "eab30955-9e26-4e83-bcd1-698ed85f9252", "value": "T13605F1EC725176DFC957C97ACA682C64AA6070BB530BA34B901364FA995DAD3CF100F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846265, "uuid": "d3308b3f-fe84-4883-8454-04938306757d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846265, "uuid": "16000844-dde9-4ce5-89f1-acd89a3393f3", "value": "12288:AutQtVuvbquTbnkKqhJP5bZvnsw01aieu2hnsPSaH7TNg6+XZZPj+066w0rdc+My:AuIVf4nhqh7Zvnsw0bshS7Taxj+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846265, "uuid": "96ba64d2-10a7-4533-8826-27e7800d5f20", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846265, "uuid": "69baf453-abf8-448e-b530-cd34c5485bbc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846265, "uuid": "815c8ce1-5c85-422d-8c78-0a1c38ff5f27", "value": "Remittance Copy.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a2d86e4-8da5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644850213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850213, "uuid": "00886b83-5e58-4f8d-a316-edd437224a8c", "comment": "Malware payload (Mirai)", "value": "87e90827c999544a3b1cf2489dc0b1af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850213, "uuid": "3e333ac2-20e3-48a1-b0e5-90b6dd357c5e", "comment": "Malware payload (Mirai)", "value": "91aef27ab9df0ed4127681bbfd6012c3d883f32a1b3628f98c04b9e17c5e4f23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850213, "uuid": "a07572d2-0e34-4631-b95b-c969e16fcbde", "comment": "Malware payload (Mirai)", "value": "d2a0c0c017da93533921e0ba4e512073f6761c55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850213, "uuid": "9a6f523f-84a1-4284-bebc-35b807844428", "comment": "Malware payload (Mirai)", "value": "fa6780019320b0e6ada7ad169116c49f7789289912155b44c3947f97d8b3e284d8fa04e6fce4613622c27685000b4f93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850213, "uuid": "a1250bae-d591-4858-9e4d-6d1b3ff8c970", "value": "T1BF933C9DB4014DACFD87EE7E90124F1EEE206281AB530F2B957BFD932C631A59D02D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850213, "uuid": "59561d83-9a46-46df-83dd-aa1260b5f642", "value": "1536:hPiijN8A4IV1wiX6NcA2ZYEzIpptc9+JnZo+i+vxap85KlPyo8ImTWGpaZm4Ho:tj1V/Afpk+Toh+5VKl6r/pc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644850213, "uuid": "ead71605-e6a2-4987-86df-a43a76d06cf9", "value": 89816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644850213, "uuid": "5c009ee4-5b32-4436-9235-f353f8fbdebb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850213, "uuid": "2250c3a3-6bb1-48f9-8ca3-ebc3980a8dfc", "value": "87e90827c999544a3b1cf2489dc0b1af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff1e7ea9-8d42-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644807942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807942, "uuid": "554703d0-087a-417e-b1e4-6393fd0478c5", "comment": "Malware payload (AsyncRAT)", "value": "bb8270690536d010a0f22e8252f796f3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807942, "uuid": "c47c865b-e8f1-492a-8cf5-9be34bf55e1b", "comment": "Malware payload (AsyncRAT)", "value": "91f0141821d1acad32ea97bdc0bebbe911a607cf89c2505379a60e14537c7805", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807942, "uuid": "736e552a-1a86-421b-b044-4edc1c8752f7", "comment": "Malware payload (AsyncRAT)", "value": "c617fe2137eecb5dd091e9ac5948aa467f9d9b54", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807942, "uuid": "665ce629-dcfd-488b-8558-e4304b63c2a2", "comment": "Malware payload (AsyncRAT)", "value": "ea7368d7b79021cb6e254f41ebd1ea4342cfa6133de62cc3e1c4d91a306a8fc54c234eeeea85b4d4bd241f425097dd8c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807942, "uuid": "8ef404e5-43a7-44e0-8df3-ed2b41f02d16", "value": "T18BF40208B7E3E655C1B60FBAE4A042506B34EE2E4507DBBF71AD3D9D2B6B3950432532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807942, "uuid": "881966fc-524c-49dd-8cce-7522944add7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807942, "uuid": "818452c8-6142-41a5-a1eb-d24b93e0324a", "value": "12288:9oecAuPv2LZiEogvdTPhAyNn7kEyUx1fWcgpDQELk7XBp+5IjrnKu8PVYNk:9oecAIv2LZiEowZAs7kpq1OBpUWk7Rp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644807942, "uuid": "23263a6f-eaef-4113-88a8-098db0ac348f", "value": 772608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644807942, "uuid": "9bd7ab0a-2155-4e6d-82a5-b07dea7669a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807942, "uuid": "962f36d4-219b-486e-a8c1-a3e775f1da84", "value": "from-imgCERTATT.EXE1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8012584-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851739, "uuid": "c049a480-e9f7-46b3-9600-e8cca8f12307", "comment": "Malware payload (Gafgyt)", "value": "29e826668ef5eccca89e69713a2dc03e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851739, "uuid": "feb79601-3070-4f2e-a360-a29695c56034", "comment": "Malware payload (Gafgyt)", "value": "91f39436f7f8c3a5d810241d3f1722c6cf3290433e05d43a2e3125ef06a73308", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851739, "uuid": "cf5c20d1-9800-4c95-8c95-2f0241afbdad", "comment": "Malware payload (Gafgyt)", "value": "d7d15d0e05e1b68d484c736dc97a5b27de0dd3f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851739, "uuid": "71ae4df4-c715-4a53-aac2-dd5203aa0f62", "comment": "Malware payload (Gafgyt)", "value": "9ad4610e410b73e80f23ad31f043da68588266779b3e0ab6ab52e0398350f4dbee45014f0eb97147ec0ead82845bff61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851739, "uuid": "00827441-5e74-48b2-8a8e-5f560c7c5407", "value": "T15EB3942A7E22EFFEE169863107F35F7097D521A226919386F26CDA181F7128C1C5F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851739, "uuid": "f16fcd97-c14d-48df-b8b6-225f89cc8d3f", "value": "1536:G7ju1Tjpq+XvYA2rKUPewTN7D1sbekSSGhA3KZUmkiSFxfC7xbXe:htANTN7D1s6nhA3KZUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851739, "uuid": "26466fb7-3b45-4870-9221-27ee0277105f", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851739, "uuid": "53429a4c-781c-442c-8140-ab9e15dc4b6b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851739, "uuid": "781d7cab-8daa-4e3a-ad9e-0e519c7b6b9d", "value": "m-i.p-s.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e8d692-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644842553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842553, "uuid": "27522282-bf23-4b63-ba54-00c6d371b8ae", "comment": "Malware payload (Mirai)", "value": "c7d8b308544dbe20f2c95607a1707999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842553, "uuid": "c30ae6a6-1bf6-48c4-858d-585d26a2aae3", "comment": "Malware payload (Mirai)", "value": "92a082185ec3378c7f0f1346cdc8ace771827c82e785c9a94c514872fc55c72a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842553, "uuid": "06587aa2-ea05-45cb-a3d4-7d12048f9a5a", "comment": "Malware payload (Mirai)", "value": "67c7bef07ded82b1962bde08f6db3eef5cabae77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842553, "uuid": "107ade72-a253-4d60-a1e8-1267f1775e64", "comment": "Malware payload (Mirai)", "value": "8eb6fd9d5515b47259c383b21a5e885769fedbbaac364dd1409608a48e140b9f89827477f93e431e50a123324b6b4436", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842553, "uuid": "c43c4e1f-123e-42f8-953c-95959c9d9d6c", "value": "T15D238D63C9252E28D26AC5B0B0708F395B639495918B4F9E5066C37CE487EDCF61A3FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842553, "uuid": "db63423a-98aa-43eb-a2f2-73c7e3846837", "value": "768:6lTINfc9YKCB3LaFoOlKvOljdcxfRQOtNk+baTyCGnI:TKCB3mKOyOgP7k+1CGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842553, "uuid": "820189be-4cb6-40bc-b693-66217859254d", "value": 46404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842553, "uuid": "a1c288df-4bc3-4cc4-8863-c1f9a2a6f903", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842553, "uuid": "405ea9bc-6dfe-4c3d-93e8-5df9f22a8e23", "value": "ahsok.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d983b7-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644823036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823036, "uuid": "5e889363-4a03-4031-9da8-9cd10a1b01fe", "comment": "Malware payload (Loki)", "value": "9189fefb8536c068b41b611a641ba369", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823036, "uuid": "4f1d0909-9f68-461b-9f44-7183c88f53ea", "comment": "Malware payload (Loki)", "value": "92c31707cf71d588110d8118811182ae7fcca9f45af84a276cfa1ea202a7a133", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823036, "uuid": "179d9e14-4a74-41d3-9f9a-044320828a7a", "comment": "Malware payload (Loki)", "value": "cdaac4f550cfa6205363025b7d1dd4feabfcfce0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823036, "uuid": "14832a4b-a8a3-4de2-9ab9-931fcbbfe546", "comment": "Malware payload (Loki)", "value": "29bb43fda1e161b41cd94e17827f769d5a92cc1c734cc55785aa2546e136b384ef08aae940f5922d3526af0ea184f8e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823036, "uuid": "a2ac9980-5703-45f6-892e-ed6f552fe2d9", "value": "T1D354121BB8C7ACF3C04725F15B63463ADFB2DA902345A46F4F884EB74E242D6910278B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823036, "uuid": "42c18ea4-247b-464b-b186-b98314568cb5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823036, "uuid": "2947695d-5c66-4a4a-9fff-b83129a768bd", "value": "6144:owiSzJ3xsXokJ7S7GsExfAcBN2WCAse/TTEmfH0WwPAMRg:jz16okJ7S7G7xoM/nse/TLHMg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823036, "uuid": "77faeb69-0c17-4d7d-8add-b188368c008b", "value": 287898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823036, "uuid": "ff1ad708-a481-442d-b3d4-2fccf99f4941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823036, "uuid": "1e2c4290-66ef-4c5f-b9b1-9b0b3c00bf7e", "value": "9189fefb8536c068b41b611a641ba369.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b45970-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849917, "uuid": "f416b69c-85ea-4dab-9091-eeb24561c3f4", "comment": "Malware payload (Gafgyt)", "value": "431766e4c2537a759f7ad11049fb84cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849917, "uuid": "30badd47-9804-4ee5-9542-e871cd406ce0", "comment": "Malware payload (Gafgyt)", "value": "94cb0a3e490c1a81ef698362135d6bd448be382d22aa17abaca5f0e34e3b4fb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849917, "uuid": "c73f6caf-b0cd-4914-bf22-05b6a56d0e93", "comment": "Malware payload (Gafgyt)", "value": "f5d2edb31eaa700a07ecab4a576a4e7749e4d25c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849917, "uuid": "65bcf0f8-c4cf-4c36-a22c-a8f4cf5071d8", "comment": "Malware payload (Gafgyt)", "value": "dff3b315d9f6cc888aa47f7b9e2d4d4e08439dccb7fba5ce868c9ee54eaabee653639b85aa24d116f5945c8f128de6bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849917, "uuid": "e440fc9b-521d-428e-8516-e178e9ab5d57", "value": "T1D1933947A72C0B47C09B6AF03DF723F1836ABE6116A65180A109FFC05772AF47526FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849917, "uuid": "7a2619b3-2da5-4bad-82f3-3c2c11c1f0ad", "value": "1536:GzEWVj17ShmMhivUkiJ+JT6jEREwd6a0S0ZlEusMSkmmi4HpbxyWsnK6ND:gJd17ShmMhiveUAEREw0Ghkmm/HpbxLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849917, "uuid": "260fcad6-a3eb-4467-9315-5014e934ddbd", "value": 96967, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849917, "uuid": "40f2f72e-3512-4478-844c-92541c044e61", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849917, "uuid": "da9156df-bf13-4583-9aed-89a7968ddf3a", "value": "nv.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80814b65-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851968, "uuid": "b6d02873-24e1-4fd8-a55c-1b1d42a89085", "comment": "Malware payload (Gafgyt)", "value": "7a87c62f5061853c4bb5d31cc049a823", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851968, "uuid": "47545189-3e1d-4474-8859-ef542f10f1d5", "comment": "Malware payload (Gafgyt)", "value": "9506323594a4e25d0a57e771d207ce4404ecc578ab08bc0670a3cea2b9f1b7e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851968, "uuid": "59325c71-966e-4490-9f48-e6360e3b7b65", "comment": "Malware payload (Gafgyt)", "value": "a6370bb220b099c790baf87a35e6ac2901eca4ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851968, "uuid": "382d354a-3f86-434d-81e6-81e53e8b2954", "comment": "Malware payload (Gafgyt)", "value": "c6fa3bbb0f0fb4ae9fa6d5a688aaaa2ebcfdebee0c631f009bc8161dd9f7d61e421edf23424314aacab3e8b5b82252da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851968, "uuid": "57f21a86-4030-48cc-9165-3f0c8802964e", "value": "T1D4D3852A7E21ABFEE168863107F35F7087952D9236A19385F26CFB581E7128C1C5F790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851968, "uuid": "0db7f387-6b40-4deb-884b-b8d5348ad4c1", "value": "1536:BtVN37Kq8bV+zemyPUk+aofie2rK5O9HUfke8PCxMspoZ4FImlP+s4z0PTD/v:Tl2HtHUfAayhZ4FImlWs4z0PTD/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851968, "uuid": "4e150489-f905-4da6-8558-c8936c011e1a", "value": 132406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851968, "uuid": "0714c78e-235d-4a3c-a05f-cb6a8a1a5337", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851968, "uuid": "d54c19dd-9d68-4b50-9bbe-6ab461848ae9", "value": "cc9mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618c51bb-8d4e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644812832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812832, "uuid": "1e92c22f-fe8c-437f-93fc-c2f5fac9ec33", "comment": "Malware payload (AgentTesla)", "value": "22a840ade85197cb812cc03718332703", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812832, "uuid": "ff3f8d19-4fab-403b-9d63-cdfb5a78cbf2", "comment": "Malware payload (AgentTesla)", "value": "95096fd8f6089e035aff7cce49436ffbf667e03e0eca8d233b01a678ec7cd0d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812832, "uuid": "151dc13d-2e12-4650-9fba-9a2f1aa7f2b6", "comment": "Malware payload (AgentTesla)", "value": "80ad492fe1875696646170973292c727be00c8c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644812832, "uuid": "a413cb14-26bd-4261-84e6-aa08784cd91d", "comment": "Malware payload (AgentTesla)", "value": "4352dabcf53abd3cd93a2c9f64e51249cb0906f1c6b42a643172f07703ad210e5274df42b582c4c95770162c4947a793", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812832, "uuid": "6ec733c5-64d4-4292-a1ac-1d5167b907ee", "value": "T1A6C4BE607E0524D7E68F88F2798E41A6D691B938B3519C0F23E0BD2ED52B5F04E5E1EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812832, "uuid": "c19f8280-7c9f-4e8f-9eac-9d6018be1efa", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812832, "uuid": "39113ce9-362b-42ec-a9a5-92225c0aa002", "value": "12288:RGlWyXWABh3J0BcEKEfNVz2r78XvUeD/Df:RGw1gheNjmAf5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644812832, "uuid": "06aa3320-e8be-4610-9400-68afaf1021be", "value": 549426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644812832, "uuid": "6e0a0314-30f4-451d-b9ca-ae6b4a3bc6ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644812832, "uuid": "e6ed150d-3a17-4076-bddf-12a846138055", "value": "INQUIRY_SK91403BWK.DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1188121-8d9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644846466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846466, "uuid": "7c06bd4a-1235-4c5b-ae7a-1f206ea981ee", "comment": "Malware payload (Formbook)", "value": "9f6a3d3c90957368fe2175a7f03f6b24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846466, "uuid": "0eab58e1-5e58-4677-9401-44f05656c2f4", "comment": "Malware payload (Formbook)", "value": "950ead10061a0d06ae1314f85d90925ed519d91ff8360236960e9abf68a99b7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846466, "uuid": "9927d7d9-3f00-49c9-bc62-917b0bd434ca", "comment": "Malware payload (Formbook)", "value": "584f3e0d525146efd06d1cf6c4df6b0bca83fb16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846466, "uuid": "fa1646ed-1792-45d2-a960-09d53d108489", "comment": "Malware payload (Formbook)", "value": "10c600e703a76a2808ac8da45ac412342bdacf0d41b61541a1fc5ba2e1163fc64a649fdb0349feae6bf9da926b6e4795", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846466, "uuid": "695c61cd-104d-4c16-9d42-f0b731e6bce5", "value": "T12035F12FF94256D8C83D6131E071061E87BDA66A6486B7B731BD34983FA63B38D30476", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846466, "uuid": "e6820531-5872-4413-8731-0ff4be717967", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846466, "uuid": "bbbc3b86-9dc4-4d2d-8c50-fa3c88c2a3be", "value": "24576:5lVKOLZLYgJ6LB8pGxwjTF+PCSv7KnwI:NKOts06F+GxwFIvenwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846466, "uuid": "c7b5a6cf-4a7c-4e9f-829d-6481297968b2", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846466, "uuid": "86272121-948b-41f8-b19e-adb564fdccc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846466, "uuid": "1d1c63d7-ddef-47d3-9579-ac07077ba053", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1fb857b-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846065, "uuid": "c9edaae6-5d51-485d-b7b0-6d2d878105d4", "comment": "Malware payload (Mirai)", "value": "66d04398f55908a86cdbac0d6e10811e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846065, "uuid": "e83bdbe3-d7c8-46df-8567-0f119cf1146b", "comment": "Malware payload (Mirai)", "value": "96d61229b33e4ee69e5ca12da0a9823470d2ca94597a205b7ea0489ebd0e049a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846065, "uuid": "a00a8385-f239-4e7b-948e-0a251e5a0071", "comment": "Malware payload (Mirai)", "value": "f00e6ac9ffd121ed043572ba53eb22bf1280acfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846065, "uuid": "f401d772-045a-400a-83a4-1a8f1d119349", "comment": "Malware payload (Mirai)", "value": "db9bf2ac3b7a567fc30ddb0cbca2c866aeff2aded74aaa665ee33f1c80488760b9a5a5388e554e9c476aa3969d1bb877", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846065, "uuid": "2150f5a5-3681-40d5-94ab-5703711615fc", "value": "T1EBB31993F801DEA6F40EAA7605D74721B630FB720F531A7263173966AE362D53827F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846065, "uuid": "349200bf-3920-44d3-9e31-f66363adf786", "value": "3072:JGutDPqYTmutJbArygKYJ3VW3o/mFZ09DRAoQfgm:JGuVqYTmO8ygLJ3VW3o/mFZ09DRAoQfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846065, "uuid": "32865c4d-9dc1-478f-9ca3-0e702b2244d3", "value": 109316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846065, "uuid": "1ce61935-4f01-46bd-8075-d8678f228586", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846065, "uuid": "a4c6ce5b-3160-4473-bce4-9ddb7b3d6897", "value": "pftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b7f013-8dd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644868652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644868652, "uuid": "d66cc782-6b4e-48f5-81cd-ae623cee9c8c", "comment": "Malware payload", "value": "56ac095150d0c44d76ff3804a3d1c8c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644868652, "uuid": "d2108ce2-b292-4ef7-9175-5820f2905143", "comment": "Malware payload", "value": "9767d52eebfbf17f2e549a57d68d7f11c199af327eeb20542b39485f883f61e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644868652, "uuid": "5c08ba9b-eb6b-4f8c-9dcc-0134293ecd3e", "comment": "Malware payload", "value": "9b24f78d9041962f54397f292e1257a81fc703a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644868652, "uuid": "080f119e-5067-4b04-8b86-64de3a80ebf9", "comment": "Malware payload", "value": "86fe7e4102f7990abc9c96e392076270c3a0b34a84330dd24f7a12ea6cc7289bd300c7abb57786a5bc46e0d012f33ed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644868652, "uuid": "52b46ec9-b4e5-4013-95cc-bdfe3642c7ef", "value": "T10CB48E823145DC9AE40329F258AFD62061B97D9E81A5C60E3743BF3B95E7303385B79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644868652, "uuid": "9443fb56-5393-49c3-80eb-aad96a9e7932", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644868652, "uuid": "de1db612-894c-417d-82a1-74a5017ed150", "value": "12288:etad2+/TPIg4WirBpleBPFGnLWjaQY2CyAbNNSi8AvK:4ad2qv4ZBpllnLSCBndI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644868652, "uuid": "39b2935d-81a6-41cf-abca-139c41c2327d", "value": 540672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644868652, "uuid": "cd6fc6ac-bd3a-40d3-b10a-3075af55f777", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644868652, "uuid": "7f9c0176-dedd-4eac-bf46-d67861dd79c9", "value": "IM2201-2T,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9995e8a-8dc7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644864922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644864922, "uuid": "b04468e6-9afc-4a5e-b20f-6e09001b4901", "comment": "Malware payload (Formbook)", "value": "aafcc8f4067e44358ffef9b5703e557a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644864922, "uuid": "c6b7865f-b736-4d5e-8286-5595813ee84e", "comment": "Malware payload (Formbook)", "value": "97c7906af4c9b5013a76a977f387c03aeb9cf30ba653777862da3f004058ae18", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644864922, "uuid": "228898f0-0bb9-4c3a-af14-72d309f0a6ef", "comment": "Malware payload (Formbook)", "value": "5ee275f5d4a1f10987da1c45613ce44298b800ba", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644864922, "uuid": "58de70b2-656f-40e1-ab2b-ab01fed60c42", "comment": "Malware payload (Formbook)", "value": "88738b3b2910c3fc024b0d332dc558350fffcdabe686f78bd1e390955a3faceadc2d3dc4c6bc9b26632769c7b3cdecf8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644864922, "uuid": "b7854ed3-e76b-4e32-b85c-c7ccb7f49ff5", "value": "T1AD8423FE766BA014CF731DEAB691C4112D1F359EC7B0341CA8109FAB4998CB9B4610F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644864922, "uuid": "8c1d8891-8a7a-4499-b455-3d99051e4e39", "value": "6144:d26actshvNrU4GlTWv5YLYWAkyxk2E1nikgMwTbICjWuEgQbqoiN/5sS0Y3fsAWX:dRacC1Om8YWAkP2E1n5gzZE7moi95n3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644864922, "uuid": "5b1247b7-190c-4a8b-8cd6-0bbae509910f", "value": 387573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644864922, "uuid": "ac6dd25a-5be6-469f-b152-b07e37ae7b3e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644864922, "uuid": "33eb299b-ec2b-4ff2-8ce3-7a1d9cdf5aef", "value": "1644843625.Vfc11Ib657d2M498908.dynamene_RFQ#505 & Photos.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3b2048a-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844726, "uuid": "7b2c597d-043a-4f46-840e-3da525a492a3", "comment": "Malware payload (Gafgyt)", "value": "204e1a2e6f5dc50660a8031e2136cef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844726, "uuid": "0d1c5bd2-1f01-49be-8fe8-90bf26c5fe18", "comment": "Malware payload (Gafgyt)", "value": "97d65ac5136982a6eefcfa1d8e589951240e5f7d4a2bbcfc5a348f2ac59ed90e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844726, "uuid": "91f0d505-ad52-4e93-aedf-e758e7ff7dc4", "comment": "Malware payload (Gafgyt)", "value": "9189fbb919462da7f9382cadc978cc4ebe6b7abf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844726, "uuid": "d64f1644-fe47-4e84-972a-fefb466663ce", "comment": "Malware payload (Gafgyt)", "value": "6b45da96adc4ad434041c07e87b8f57ba6cb3685ab8e09a9e97d1ad774b9e0e50685b4a75dfcc5a30cfff53fecf30b44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844726, "uuid": "febaae14-3f7f-42fe-84ae-d5ca97cc7e22", "value": "T1E7830A41FD418B17C2C327BAF79F435D37356A6497DB33016A386EB42BC67982E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844726, "uuid": "58afa3fd-22fd-42f4-a89f-dfff91ba75cf", "value": "1536:2TxGIBAIxQJ8x5OEVBvFB3n1w8OYSUmZhBQ4Kb3RXFFj:WBa8hBb3+8OY5mZhBQ4KjRXFFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844726, "uuid": "d4445d9d-8b61-4131-bc79-fc9536019a1e", "value": 85249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844726, "uuid": "624e531b-365b-402a-b958-a505c9eda8e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844726, "uuid": "81bfabb2-8c6b-4bc1-a0fe-0f75ad21e983", "value": "Demon.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b31f05-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846095, "uuid": "2468e916-ad6b-4d13-971b-dd81fe9bcc15", "comment": "Malware payload (Mirai)", "value": "833a9e938512352a1f2d5d31a8a94406", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846095, "uuid": "2cd1bf26-70d9-456e-9b21-6e4e811e3ace", "comment": "Malware payload (Mirai)", "value": "98fe638ddb8c2c02f0dffca1be892cb6c88705e47ac398ebb021a4f6c9ee3bed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846095, "uuid": "4a828baf-3c8d-4854-a6bc-fd9d5958a7f5", "comment": "Malware payload (Mirai)", "value": "56b8fbe052a8068e5d552ef3a5cff1b4d77b3439", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846095, "uuid": "d0842d62-f3da-4557-9629-49a3e76b54a2", "comment": "Malware payload (Mirai)", "value": "e4d2abee6402433ce89924af14d90a4fc716eb5835adbfb7bd1b64e83b93a9198a4065d9f14f53a8d23d87488b7ad9a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846095, "uuid": "769a35c0-e210-4cef-a6b4-5fcce085fc50", "value": "T107D32905D9508B23C6D22B7AF7AF528E73236BA897C733115628AEF42FC179D1E39150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846095, "uuid": "900b44ca-0efe-4000-9862-ce8271412448", "value": "3072:xmfdWmd6pUeQKb4XSYaCumWA2PKjymN45hAdquFmy/QsYJ0Yj/:sCYaCumWmO5hAdqImy/QsYJ0Yj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846095, "uuid": "a2cbbc01-6338-4d4f-9c22-b7af69b7cf2a", "value": 130429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846095, "uuid": "5bb91eb6-6431-4a0a-b32a-12f5baca8004", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846095, "uuid": "6561a9ec-3741-4f07-9ad0-e6d84592fd8f", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "415d0583-8d9e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644847138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847138, "uuid": "4caced4a-d04f-4217-9c0e-df456310b6f5", "comment": "Malware payload (Formbook)", "value": "4ce4756f9e0f915b5691cdc4576a65c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847138, "uuid": "63fa8fbe-523e-4b9c-8a42-be5fc64f2c4e", "comment": "Malware payload (Formbook)", "value": "990f9670fa7d9b45b44f6f4e9de0ad9a71c2f519d4b654ada06464f742d5899a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847138, "uuid": "a4295b35-5906-4517-b421-38bfee0e075c", "comment": "Malware payload (Formbook)", "value": "51f388209524ce20b47e872f1e54ee0991c201ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847138, "uuid": "ab9a8557-0374-4f68-bd8d-2ddbe24732f6", "comment": "Malware payload (Formbook)", "value": "4698614e2a51463fdaaed64e4bc0acd152972dc1cde4caaa19d6500bb648ef960900daf5b9afb7b313c8d98d5f4bee2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847138, "uuid": "b12299bc-7d31-4794-8652-1935c14fd959", "value": "T19D54135634C58473D86709F90F35BF73D7B8860EEB950787A3B88F6B1B524C2898A5C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847138, "uuid": "4fad606b-095a-4e88-924e-a7ccfa486e86", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847138, "uuid": "c03ce85b-3d85-43eb-9490-9b2ac51c0cfa", "value": "6144:owkMbgPsY1FhQYes5RZteH2fxeG+yK13tF66UtEiMv73q1ALbTbLlrX9:rbwsYHhN5RZteWfxon13tQJtEiYTq1Aj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644847138, "uuid": "9cd7d99e-dc35-4d99-9fff-9afbbf172565", "value": 299135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644847138, "uuid": "0dfe2287-4870-4040-b444-ddbdd9921334", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847138, "uuid": "064b3d88-aee9-4bbd-ae16-4909f657d957", "value": "6600007714.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e354d0fe-8dc2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644862871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644862871, "uuid": "7f8024cf-c59b-42b0-9dcf-b68f7f7abbd6", "comment": "Malware payload", "value": "a1bc85a0edb8ff9808bab23ca500b3ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644862871, "uuid": "316d8ddb-2cfb-418c-b9da-3c311ba700be", "comment": "Malware payload", "value": "992dffa683d5a6e02b1bc40a2447a7cbfa03eab11adf8f9a5ff2b1d18cec7c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644862871, "uuid": "e3662385-e81d-4b0e-b5d9-028d954b6ae4", "comment": "Malware payload", "value": "cab6c5ba1b8f6c12176a818707a191453a744155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644862871, "uuid": "e86daf06-df5c-48d5-b901-14366c2cd747", "comment": "Malware payload", "value": "4fa41bbbec1ba85037f067c0b5f027dc291ca92863c44ea3dd3ffe39d0d8682146595f30e8c589b036409ed1bad4ef20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644862871, "uuid": "a4ac00dd-d0ea-43ab-a2d9-5a9635c930e3", "value": "T1F0236D4037E8C136E2BD4BB4ADF3D2458275D26B5903CA5D2CC854EA2B13BC996036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644862871, "uuid": "930a410d-22ce-4164-9df3-93f6ca56cba4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644862871, "uuid": "5c8cd4fd-b52e-4a88-91ea-3d6fc1968349", "value": "768:oq+s3pUtDILNCCa+DiywpzdiWpEicq8YbigeK/FAdZFUvEgK/JfZVc6KN:oq+AGtQOySiCzbFR/FAdZFUnkJfZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644862871, "uuid": "12687746-939a-4624-81a8-4cb9d0832fba", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644862871, "uuid": "ada3f0dd-f665-4514-a8ae-b48b636d7969", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644862871, "uuid": "8dbb0ac2-caa3-4884-a6e8-ed64c61b741d", "value": "async.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a495e090-8d69-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644824541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824541, "uuid": "66b442e0-b6ca-485a-91d2-1850f02d7801", "comment": "Malware payload (Heodo)", "value": "dd1164a78e60ce4c3cf270f3e89cd8b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824541, "uuid": "b8291b04-629b-411e-bc7b-c4d053947eda", "comment": "Malware payload (Heodo)", "value": "99bf691abb8fb55192e14e379b42ceefd5fb3b6c840ffb8826754a56043d501e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824541, "uuid": "2c9c27f8-6c81-4aa9-ad74-7bad8704d9a6", "comment": "Malware payload (Heodo)", "value": "0b202e33eb8b1f9497d4ca876a26313a228e5fbd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824541, "uuid": "c8707962-7b97-4dba-bf4c-84f4731d2acd", "comment": "Malware payload (Heodo)", "value": "40d6ed22a74fb67a95858ea777f5d86bc2c86ae87587a6d93633b3e80398c461e0896c0230bcaec1ff82785ba571f474", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824541, "uuid": "6a0800b2-9b7c-4f8a-a342-91a813acb280", "value": "T19125CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824541, "uuid": "7faccbdc-ac91-4f5a-8fb0-0483d0abc4e0", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824541, "uuid": "d58265e2-9fed-4b1f-9fff-fb5f7141b43b", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPzFIIm2mHv:exyq2kpWGWRCLWeNWO1tyrFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644824541, "uuid": "2c5204c7-3bc0-4abd-ba13-c2868afdf914", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644824541, "uuid": "318f2c5a-69da-467a-8494-eea4563b5ad2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824541, "uuid": "a6560f61-2eaa-4a41-a822-804ada3f3cae", "value": "emoe.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "830b03b1-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851972, "uuid": "c9aabcf0-dca1-49b8-8bc2-c28215ee66aa", "comment": "Malware payload (Gafgyt)", "value": "eab9b04684e8826b7891928f6dfa237b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851972, "uuid": "3205bad3-c4e2-4bc8-b40b-ffb0347136d5", "comment": "Malware payload (Gafgyt)", "value": "99c04a5ba350ab71975bbaedb0923aaa1415f7273e55d7977b14d3c15286b71f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851972, "uuid": "c1e6dd69-c1fc-49b9-8c7c-6925a217bf06", "comment": "Malware payload (Gafgyt)", "value": "0259bc2d921403a6051b838f9f45c644b6b71e8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851972, "uuid": "0a8cf707-c309-4645-bd84-d16f4d74523a", "comment": "Malware payload (Gafgyt)", "value": "faede6d16e77389719c7bee63072584299f4e66f758a7fd0d8850194f1e6467fb9a4ef15c979f0089594ea57aeee5b22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851972, "uuid": "052d19d7-406b-422d-ba6b-e58cb6194b07", "value": "T124D3B717AB218EB7D84ECE3306AA4501108DDD5612D96F6FB2B4F96CE76B84F08E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851972, "uuid": "9bd2db4b-ed3f-49ab-89fc-d8bc9305bc32", "value": "1536:lceTLQAxHtkQdPQQyWZL/80fekB/oHLyZpcoDl7DhcfImlP+s4z0PTD/v:lDQQb4Y/WslJqImlWs4z0PTD/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851972, "uuid": "ecfefa7b-d7cf-48c8-b781-435396f2154f", "value": 132406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851972, "uuid": "e5754c64-5459-4b57-9a8c-3cb47ab75d49", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851972, "uuid": "90ca0da6-e1a7-4e06-a48f-bd299eecce33", "value": "cc9mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "792f651b-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644821891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821891, "uuid": "845db7bc-f4e0-483c-ba4c-09cea563b2e3", "comment": "Malware payload", "value": "486ad001825e7d575e6928338ba1da8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821891, "uuid": "960d18de-7f7c-4e4c-82d1-f33786aa4017", "comment": "Malware payload", "value": "9a03af49df6fd2f1e0946aa96a98bba18764d516a39b7731fd654e65572e6bd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821891, "uuid": "382d592c-0ffc-4fbe-b608-1d69c787d01a", "comment": "Malware payload", "value": "8ce1218a1e40195860e190fa99ac43a0022b5eac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821891, "uuid": "fc089f2d-094c-4f63-9b2d-ddd8a2b447c7", "comment": "Malware payload", "value": "98ede2ec5aa24dd62ab623b40b2243cbc7a5c4884c75d97d69c231e6c324b27ac20dd0743fbf6da1b7808c2357cbc0c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821891, "uuid": "45d5e3a7-87f8-45dd-a297-cb1f2ee621a7", "value": "T1C8063382DDA91737E67612B02823649CF9B499D11539C87E03F6DFC73332172E6A9293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821891, "uuid": "7fec469e-fb0c-4187-ad34-e0468958f2da", "value": "3997a5381ce0faf49dd427298e3d1606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821891, "uuid": "d4ab7e6e-4c12-4bc2-8206-4578c7279e02", "value": "98304:Yq/uYy+UVriYE4i2XbGAeLuEd+hy4DbsCZf5zrfj:HGYy+Aro4ZLAleDX5zrfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821891, "uuid": "e7f5730e-227b-4085-8e49-92a44cdeafdd", "value": 3819008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821891, "uuid": "839a8665-0158-40e2-8a06-203d7ae67c2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821891, "uuid": "aa6c4ffa-f7d9-413d-8b10-f698229dbd59", "value": "486ad001825e7d575e6928338ba1da8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc13f9bb-8d5d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644819534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819534, "uuid": "ab66cfe3-8228-499a-b4b6-ee7c7e114311", "comment": "Malware payload (AgentTesla)", "value": "4d229b9f904b2379f8b6288824c357b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819534, "uuid": "ab521c8c-13e5-4aaa-a63c-e1adcd135774", "comment": "Malware payload (AgentTesla)", "value": "9a32438b609219ba5ba27799f7c8bebbfa01ebef654bd5b7c0be7de414ab0eec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819534, "uuid": "73d3a2f6-9f04-4563-a3ac-d75ec76cb939", "comment": "Malware payload (AgentTesla)", "value": "e13a0be1577ac38120bd1ef95c514c62c8da47ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819534, "uuid": "35e2f4b4-43fe-4711-95bd-72ea7d467e0b", "comment": "Malware payload (AgentTesla)", "value": "0e8e8613022d0bf24e6676080bfa2b468d5fb926f786403b900867fb5009f8a88cb421ec4b7f148a092d4d0faa29de8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819534, "uuid": "1a979e2e-ea12-4731-8885-bc89e5a22ce5", "value": "T11C1501147BA3E854C5A50FBAE8A141919B70ED2E8643C7FF709D3D8C2FEA3650936532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819534, "uuid": "5b7d90aa-8996-4eef-8818-fe75f4b1255d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819534, "uuid": "9d45e6ad-df27-429d-a59c-a6814485d75c", "value": "24576:xqmQeaf7LZvZXy3/nwTJWQQ142XUUZBtml2aIBn76sH:lzaf7tRXlzC7wPI7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819534, "uuid": "1a07edd3-8c23-4286-84c8-81a15ffe4586", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819534, "uuid": "893af6ca-6242-4f6e-8404-31652ac700c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819534, "uuid": "e3a134b5-38b2-4d8e-bce2-0529bb55674b", "value": "Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ce57c0-8db2-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1644855648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855648, "uuid": "9070fb69-2c1e-4d38-af40-b5511103cd0e", "comment": "Malware payload (Amadey)", "value": "3bfb98da658ac9ab05d4fefa844581e3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855648, "uuid": "33cb6cea-16b2-462a-8f5f-7277fb6ded91", "comment": "Malware payload (Amadey)", "value": "9a32f2155d612fc6f736dce19e5c580a8a6164ee35173650041a9e8e336d3e6b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855648, "uuid": "5403f9f9-9fcf-48f4-a227-1124322aa307", "comment": "Malware payload (Amadey)", "value": "d975ddf60445e6910449586917194cb8a4cfa470", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855648, "uuid": "405566f7-7f85-451c-84ed-69646fdf50b6", "comment": "Malware payload (Amadey)", "value": "e7dbedda19021e94fa01e716958b11e652c625495a6593e1ae8343345ebac9493f11167387390dbb03e5baa8e520bfd2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855648, "uuid": "a34e9069-92b8-4050-9e1c-10dc885d3703", "value": "T1DB659E01F101A136F8B340BBCEFE592DD658AA71130954E7B3D85A4F8BA2EF27932157", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855648, "uuid": "2b3cb98b-f34a-4be2-bbe8-652c65d99588", "value": "0465747311fe70402943db309d0266f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855648, "uuid": "43d5766c-3f15-49fd-a431-7d0a8b8d40d2", "value": "24576:unAoJxemkooXpOORu192dkFq5zOPwsvDP1f72+DWh7QTDvBiv:unLkoEpOOc192SdPwsbP572Dh7QTDJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855648, "uuid": "d49fa512-ee56-4796-aeca-0d500ee03037", "value": 1464256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855648, "uuid": "bd3feeab-367c-490a-a135-ff8e41a17b99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855648, "uuid": "ec986de5-07e4-4e13-8d70-509112c397c0", "value": "AnyDesk_144032_5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663b1af5-8d5d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644819282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819282, "uuid": "3507483b-ad7d-4ae2-ae80-e2302197fdef", "comment": "Malware payload (Formbook)", "value": "159147f928555c4a9a7cdba77440ff1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819282, "uuid": "0b586004-8755-401d-b377-e2838a907bb3", "comment": "Malware payload (Formbook)", "value": "9a3c724a5b4f22557a467cefaeb87c74db4f084663e67be797b0652ff7c9a142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819282, "uuid": "c32bc6e8-7e8c-47f8-a5f7-f45171ac77b3", "comment": "Malware payload (Formbook)", "value": "dbead1921939a852d7c26ada1e8d945d428cb03e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819282, "uuid": "91d8a1a8-cd75-4f68-9a5b-5f4ee48f96b7", "comment": "Malware payload (Formbook)", "value": "9a448095b1c7869f1cfb85163738bee6af807ed3a0324ebb3871765848b8d8e130387f8f52e63b63703d70c41fd40085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819282, "uuid": "34d6deef-9b00-4918-aa43-8289e9e2b4fa", "value": "T1DDF4137378C86E93CA889C3B46F5C72D93BE86111E124F8A4B0C79987E77D4AAD11307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819282, "uuid": "c9e18165-d83e-446f-8dca-f8c88a2f9770", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819282, "uuid": "00f5dacc-d45a-43c1-9342-c5641c7b9064", "value": "12288:Cf06hMU7g6qPtnaAX+pg1/9kwIjeHfATSIPe+nnJrdWSaS+Gg:e06hMU7g6qPtpxHHfATSIPe+JrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819282, "uuid": "4769aba7-d047-4d0e-9e8b-1ea402cd3725", "value": 731054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819282, "uuid": "9bffc579-9bcd-4bbc-a720-00715a4297c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819282, "uuid": "0dfcec82-3982-412f-ad9e-ea0e49e90753", "value": "PURCHASE ORDER-1402-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062870eb-8d44-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644808384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644808384, "uuid": "1f27e83e-b308-4379-ac32-321d0288c071", "comment": "Malware payload (Heodo)", "value": "29ecf0f4f67c8c032ac512f25bfb7a59", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644808384, "uuid": "63ea57fb-4cff-4b0f-835c-4dad701099a9", "comment": "Malware payload (Heodo)", "value": "9a9cf301fb26e30d3d638d374a731964edaf65a27568eedb8f6426d728d1e0b2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644808384, "uuid": "83cc9d52-1351-45fe-aad9-f7f168e53243", "comment": "Malware payload (Heodo)", "value": "05bb90f73adc01914f33115bb4f1fbdd231ea71b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644808384, "uuid": "2953d644-6510-4bb1-b8a7-597edf2703d2", "comment": "Malware payload (Heodo)", "value": "c7509553b0d5da9623690c6fa5d8d0267cfbe4534e592204a3bbd777c0e2be3bb3e5eeb4304c69fed137c2062284f4ea", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644808384, "uuid": "85887136-3a6e-4b7b-9518-d105bf4b4771", "value": "T19A25AE127AA5C072C26D3038449AE3B856BEAD318DF4958B7ED12E7F3F340D1963856B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644808384, "uuid": "b5c3a315-5303-4ba0-af56-7c34164333e5", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644808384, "uuid": "ebfbe86a-12f7-4737-a85c-5b144360b553", "value": "24576:kviZsGQJEdX3Y7GTCRhukkplyb9DYxOfFIIm2m42:1ZshAI7GTCdkp4b9DFFIr2m42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644808384, "uuid": "e930e11f-c410-48c4-83e7-06a2c00fce4a", "value": 1021440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644808384, "uuid": "deccaeaf-915d-434a-a15c-9a2cea6d6a80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644808384, "uuid": "fe00bd1c-68f8-43c7-89f4-31d1f7c336af", "value": "emotet_exe_e4_9c017c8cf2291109b1a500a04d0c9028071e4bfae8093324bdd911c88d257d7c_2022-02-14__031259.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932b25f4-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644854576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854576, "uuid": "e55bb4ad-9719-443a-9bf8-59727abaf078", "comment": "Malware payload (AgentTesla)", "value": "7cfb79c8e0e184220bb0b97ec0df0ba4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854576, "uuid": "fa205c41-2cc8-40b6-b5b0-8d07de2788d1", "comment": "Malware payload (AgentTesla)", "value": "9acb67b48bc0be01c38e54667431deeb1e0a457d8f3e65fb73101452f17930f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854576, "uuid": "fbc6fe86-ee04-4d48-bf3e-b75a46d687a4", "comment": "Malware payload (AgentTesla)", "value": "f65ad85e9c862d6f09f2c8299c29aee3ec0babd5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854576, "uuid": "958021af-bb2b-4d41-aac1-f7ce9bff94de", "comment": "Malware payload (AgentTesla)", "value": "da982d8a916de96ac7e71cc92743b5795ce4261e0cd699dedd9cf06b844705e95aea06b21215ae14e2e3565a43de7a44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854576, "uuid": "3b8cf6df-9e22-40c1-973d-c031a59ddc42", "value": "T14424D9B4684F0872C309DC1E25A8B655AE79FEE374C554B223AFE034CF5AAF29EC4541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854576, "uuid": "f7118ec2-c79f-447f-8265-ebf5ccf41c4f", "value": "1536:itTDYAEUOyUlBf02seBYCocITlXZVmVoQRbxeN6dzFz76mAg5eeVhMDw5wfLU:ieiOHkRktdzFtr5RDAw5wfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854576, "uuid": "cfc61725-21c7-4c57-b48b-3e7c30fd5f6c", "value": 223434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854576, "uuid": "7ed84be4-a432-4571-b1e3-79b1f50b8da4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854576, "uuid": "7df80992-7397-4623-aa57-1b6ddb15c10e", "value": "TONNAGE CALCULATION.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34990a53-8d85-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644836379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836379, "uuid": "370b56cc-6b6f-49bb-8cbe-224eecc47d5a", "comment": "Malware payload (Formbook)", "value": "7f3e567c1faa659bb2ab13aad78a94f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836379, "uuid": "43681f78-1d73-4c18-87af-8531875f7bae", "comment": "Malware payload (Formbook)", "value": "9bceb9680d39094087add5289a7e19aa93168faf9c5f2465700b117d59e8d841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836379, "uuid": "225d3674-0fbd-474c-8afa-1ecbeefb4091", "comment": "Malware payload (Formbook)", "value": "0071f9df4b481c8a70cacc3383475386d4b26d40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836379, "uuid": "7d19f370-bca3-4aa0-b2c2-7ada821c4d60", "comment": "Malware payload (Formbook)", "value": "4c8802c04731bd1bac2d50ee60a134fd53713c88b6eec695fa0a132fdfff5543c04151c964b3909f88ff2ac2cf639891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836379, "uuid": "deeaed6c-d9c4-4a5f-acf9-b3f7ac8901df", "value": "T12E1501007BFAAB13C5BB0E7BD9B142415770E54B5127E77F949036ED6C8B3280A7227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836379, "uuid": "96daff9f-9245-40ff-9b25-ff012c97b810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836379, "uuid": "d00b6387-db03-444a-8161-80a79fe9ada4", "value": "24576:bHwINqwaKEHxMZhmqBZ0A11ENkmJvHUvxC7wXaGG:sIecw5kENt0vgiaGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644836379, "uuid": "0e6a1f80-0b01-4357-9832-8b0412bbcc48", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644836379, "uuid": "e6c17aea-65a1-4a20-95e3-4a5e976fddf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836379, "uuid": "5232dc29-aeac-44df-bbf1-5ebf906d126c", "value": "mazx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc77ad4-8db8-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644858378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858378, "uuid": "27590ac3-422a-44d6-ac5c-e5add2745f08", "comment": "Malware payload (RedLineStealer)", "value": "bdb76e7169e988c45518f8844bd5db4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858378, "uuid": "d01b5368-df76-4d3b-8cc2-eafdbf03eb4c", "comment": "Malware payload (RedLineStealer)", "value": "9c126bfde9969c0d34230993dc33d233ac66eec831fd35204d4b7faf1f7af990", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858378, "uuid": "ff8acd0e-56c2-4f6a-83c7-f3d2c0018a8b", "comment": "Malware payload (RedLineStealer)", "value": "d9c610251e938e0dd89d50010964f95a92e2c8e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644858378, "uuid": "f7ee77bb-2dd4-4275-8445-c3284e2205df", "comment": "Malware payload (RedLineStealer)", "value": "71ba6bcdd5386927468c0ee4cf222a72c76bcf650708bca47df852c90165597dd1c58014d375aedff4a0597225fea88a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858378, "uuid": "faf76381-314e-4ea6-9928-01ed98c1b9ad", "value": "T107A4AE197190AE60DA49293AA096C0100FE3B366F3B7F79DE97B01571E1B7E2DC186D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858378, "uuid": "bebe9cba-c888-4d94-bf9b-21a536bb2fa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858378, "uuid": "2387f625-5265-42ec-85b5-4381fc1e0f3c", "value": "6144:nbda3KgTUU6duNNmEbAgsYzvwjTz8eTqqvOYasbqNysrEryKrfX:xQ88N4/CETIAvOYdMErdjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644858378, "uuid": "2cebdd24-3428-41b3-9d8b-178998cbaec8", "value": 479448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644858378, "uuid": "c423f4a6-cdd2-45d4-9765-2e2927e6e0d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644858378, "uuid": "2cf57b3e-2129-4b41-a098-756c35761671", "value": "bdb76e7169e988c45518f8844bd5db4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f82c21b-8dcc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644866999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644866999, "uuid": "c0e13fc4-0f64-43e0-a1c3-c0001b4578b8", "comment": "Malware payload (Mirai)", "value": "cef46556666da86c71de4ffab1732e7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644866999, "uuid": "19392063-61c6-4f44-9e75-fa877910408b", "comment": "Malware payload (Mirai)", "value": "9ca76b68737347388b6cc97e01f0056888e2f1125784aeabb0cb13651deed067", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644866999, "uuid": "ba5e0952-befd-4dd9-a328-211188ff603d", "comment": "Malware payload (Mirai)", "value": "ce2ebd355feef5ef28abf2f554eee252c708ba8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644866999, "uuid": "b9662514-fb20-4856-8913-78660b3e3ffc", "comment": "Malware payload (Mirai)", "value": "bee0cfd4ee6bcb52c748b8de64b90c0f6d7b9048388af8928edcffd099156249b463c0f7a460d8fd7cd9931669345d65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644866999, "uuid": "dff9f59f-bddf-4701-922a-d2d49316129e", "value": "T1BAD34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644866999, "uuid": "1bb9a234-240c-4b52-9bd5-f98732c0e9b5", "value": "3072:f0DvinprSHrDqtV8lB3RJxQds/neqfasbNE7V7M/zrr:f0DvinprSHrDe81JxQds/eqfbNE7V7Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644866999, "uuid": "b16c6fee-346f-4115-a5b7-2d2f75beb620", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644866999, "uuid": "dca405cd-13dd-442a-8d2a-d1000a48a73e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644866999, "uuid": "b5212b1c-5af7-44d6-9ddf-c1e74e19fe9a", "value": "cef46556666da86c71de4ffab1732e7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147e5d26-8d5b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644818286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818286, "uuid": "3a10a26d-947f-4a97-bf10-f52fd90c88e6", "comment": "Malware payload (Loki)", "value": "5e05bd167b83b3315ad59866d0e83687", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818286, "uuid": "134de59c-2dab-4f98-874e-623313c48e26", "comment": "Malware payload (Loki)", "value": "9d935f0d9a071e199f0d63a8ea3e9a3322dac2d52c19ccb713bc84dc0b79ae88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818286, "uuid": "2b74ccb9-0c74-49e3-8da7-f56976bdd58f", "comment": "Malware payload (Loki)", "value": "86254c2dad6263a45e6b733287fe734ed6e320d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818286, "uuid": "9a5c5a5f-a433-49ce-a3b7-c1d65f7e9b8a", "comment": "Malware payload (Loki)", "value": "1a13e5a339f7a6db0ecdaa6e12aabe44a5af364a432eb4f9fcbf270937de6e60f2c9c3ef1208866ed6fce0b41ac3df90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818286, "uuid": "6af9029b-225e-4ab7-8759-d1d99bd7dac2", "value": "T1AE748B4601FD455DD0D13635CBDC99C77ABEAD0EAB64448A2248B9323AF3BB2931D0DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818286, "uuid": "061827f7-2eb2-4cf2-92be-d98ddb3e59e8", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818286, "uuid": "5ba3bfab-89bf-4bba-8f7f-02206d6aff5b", "value": "6144:ywOqISYJaVRg8/0fkyioUTA/C3MMr6uut:MXNAVRcfkS6K0No", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644818286, "uuid": "483d7dd7-929e-40dc-91f3-15af3cd63169", "value": 366260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644818286, "uuid": "9091cdec-ccd3-4a28-a92f-f6e0968d330e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818286, "uuid": "a2e99aa3-91c2-48a6-a941-e4a3fadc1b62", "value": "UBL e-statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f58fa9-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845671, "uuid": "c53203cd-572a-4555-9258-5ae19ba9ecd8", "comment": "Malware payload (Gafgyt)", "value": "3962f7c6c9c9035740e9beec047cc1c1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845671, "uuid": "f2f00ef9-2994-48ab-b098-6ecaef60fc5c", "comment": "Malware payload (Gafgyt)", "value": "9dbb4dcfb8b10bbe62dc8a77d029a8be01c334701b1e1ab7f095d095e38a59e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845671, "uuid": "3b908472-c111-4054-9399-2114f667cfa4", "comment": "Malware payload (Gafgyt)", "value": "6819d117e432520c59ea036de8c65329cf977849", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845671, "uuid": "6abbf214-f383-4db5-8d8a-641f051ed0e6", "comment": "Malware payload (Gafgyt)", "value": "369ad46f13e50054115ec8bd78d5a0c8f02d0ec416c547d5b97a209464d6575851b4643d388accf407835180cc4ffc86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845671, "uuid": "fdea4c77-cfa8-4f8b-8c95-a19326843b91", "value": "T17DA30945F9404727C6D227BBFBDF439D77265A5497D73302AA287EB42BC1BC82E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845671, "uuid": "bdf3a331-5eae-4a00-96bb-be0e96e55d69", "value": "3072:XDzK6rIgjXH+/y0psPn6X0bq/XsemzVrQ2m4UzRwT:XFrPH+/y0p3pmzVrQ2m4UzRwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845671, "uuid": "b57a6845-3358-46ed-b9ed-da5177559050", "value": 101103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845671, "uuid": "e460c362-d3e9-4e59-90ed-5312f3d34af9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845671, "uuid": "1dd67433-db82-40bb-8631-818f3e52d4b7", "value": "qbot.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5ac6e3-8d9f-11ec-9275-42010a9c0029", "comment": "Malware payload (Matanbuchus)", "timestamp": 1644847611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847611, "uuid": "ba4abac2-9482-4560-8999-b87ed2eecb13", "comment": "Malware payload (Matanbuchus)", "value": "e74051c5139a7203dddbe6d029a9bca7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847611, "uuid": "31a96be5-e304-4af1-b015-3beb22c197a8", "comment": "Malware payload (Matanbuchus)", "value": "9e497cbd0c15ee052d6963de0c0243e4bb2f661472fe952c42f5af5aaad57290", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847611, "uuid": "07e7e644-6fb4-47e4-b035-42e607d0c890", "comment": "Malware payload (Matanbuchus)", "value": "d3568d295e2c8cee189e1592ee966bc4ae634e22", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847611, "uuid": "83c115f9-411c-4b9b-9507-0a74f2cce15a", "comment": "Malware payload (Matanbuchus)", "value": "b739a6c8ed2c5e03b9a6d71458c10a5d16f2dda44c4877e754fbbdf1679463c7c996be46371df1926098416ca7c37ce3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "matanbuchus", "colour": "#F5A3C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847611, "uuid": "63e8a686-007e-43c2-afdb-8d7c2c356709", "value": "T154C48D2AF6D08437E2722A3D8C5B9254A8397E412D295C8D3BE42F8C5F39742376539F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847611, "uuid": "8e78e824-6e91-4f9e-b70f-b3bacf763c2e", "value": "edc35d61ceebdfca301ba5422ad04ecc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847611, "uuid": "6029f59a-b101-4a6d-8418-fb09e7a18ab8", "value": "12288:R+CvUhJUun9nVn5uSKoseGqR2LTqEqeOkXtjEymnk:QO3Q5UHLTR3tjdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644847611, "uuid": "53eae6a1-3f19-485f-8e93-fdd804061821", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644847611, "uuid": "44ad54a8-3545-42f4-a060-c8948efb3712", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847611, "uuid": "029adaf9-7a92-436d-ad13-a4dd2e5f1866", "value": "9e497cbd0c15ee052d6963de0c0243e4bb2f661472fe952c42f5af5aaad57290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ed5435-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644822500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822500, "uuid": "ac61cd7b-7d72-4de3-ae5a-e1fc8d6325d1", "comment": "Malware payload (Loki)", "value": "1662b1c6e8a2e10406b8ac5217d9888f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822500, "uuid": "978a8451-7457-4859-87bd-32c8f963c05c", "comment": "Malware payload (Loki)", "value": "9faa1e0ec64017af9d2ec7a844046ea3baf425de027afc3bd100712f377a9570", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822500, "uuid": "1f5efc04-5f4c-4f8c-a524-9633d25ad436", "comment": "Malware payload (Loki)", "value": "36591bd5d31214cbbc0153775bbdbef29e31318e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822500, "uuid": "50bb0e05-d944-4acc-a966-f277a2490723", "comment": "Malware payload (Loki)", "value": "66e31eb88b721264b67c2f955ae3ea6f55922ed599154977376a79b98c245ce05defd47d46574a92ff2be432ba971011", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822500, "uuid": "aa96ba17-3fc0-4d40-a57f-3197c49ef699", "value": "T18014020E3928BFA0DBE31973A15D467CA0723C99980DC42F799F369E9DB2F314542297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822500, "uuid": "e1d0e1c7-98ca-4f38-889a-001b3958cdf4", "value": "3072:Hp/V0eTW6xa3eD4/q+EQml9J5SomKBsebzhh5aVepXkz+nztEICBMe3n5gMav:JC4W8a3eDOdydSolPt+ephzmBMe3Ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822500, "uuid": "274ecd4b-2ae8-4568-903a-71ad49e2c6ab", "value": 191720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822500, "uuid": "17ff8802-6377-42dc-bcb2-12d62e64da85", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822500, "uuid": "15606d48-b686-4bb3-94f5-f20020545380", "value": "399.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a12e08e-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644851474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851474, "uuid": "c4ddba00-66a2-4d52-a10c-b626e14cafc5", "comment": "Malware payload (AgentTesla)", "value": "e22683916de558eb63a832d4e742aa1c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851474, "uuid": "45634640-3929-4522-876e-a0428a956267", "comment": "Malware payload (AgentTesla)", "value": "a13c67016d8ebd9f71b554001b394511b8dbe7f67bbed30d68907eec0e2be987", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851474, "uuid": "70a493d3-532e-4d86-b6be-9cbc742a7759", "comment": "Malware payload (AgentTesla)", "value": "e05b484cf3b43b6007582646975c5ec3e4e01449", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851474, "uuid": "ac881310-2c5f-43dd-af89-87724273c130", "comment": "Malware payload (AgentTesla)", "value": "f6504662fbebc3a08d58dc1c55daabb8574462b784ee8924a8077c0753a92b506636eb07eb9dc6100411ccc7989cf82f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851474, "uuid": "c9f0e41f-94ff-4cf9-8d5e-33381b9721f6", "value": "T1A135AD49375176AFC85BC97699A45D20FB70A46A530BD333A05326ECAC4E69BCF300F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851474, "uuid": "b0285673-ee7a-4103-8bd2-53444303e98f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851474, "uuid": "5c2d9c12-4ed6-4cee-a056-88bb04393aec", "value": "24576:D9OBIILiWw0BHaN+/eAtlkph5DOF8jXtEyfi:DMGxWw0tgq6Do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851474, "uuid": "785c0bc3-f113-490b-9f51-3c7c0f61f6ae", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851474, "uuid": "dedf03ec-e97e-486c-b443-47b19d9b055f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851474, "uuid": "2d620376-47fa-4097-8dfc-c1e74db8aa62", "value": "RFQ#AWS121100149 (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32929097-8db1-11ec-9275-42010a9c0029", "comment": "Malware payload (N-W0rm)", "timestamp": 1644855273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855273, "uuid": "a4da5773-cd12-4d8d-bdfb-53530eda6db0", "comment": "Malware payload (N-W0rm)", "value": "43ccaa017a432012f15e6f330c19ef90", "object_relation": "md5", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855273, "uuid": "6d2074d5-b2c8-42d9-9f8e-bdedf3f9c2b4", "comment": "Malware payload (N-W0rm)", "value": "a14fcc6851b168544feec2b3889ccff2bf11306f4d420731b471b249a16af089", "object_relation": "sha256", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855273, "uuid": "4583944f-2387-46a8-9ce2-dc0a387b5acc", "comment": "Malware payload (N-W0rm)", "value": "52962106f3619283a741129e0cee4423f07fb9ec", "object_relation": "sha1", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855273, "uuid": "cea7a231-a165-474b-8d3c-3d5bb80fc052", "comment": "Malware payload (N-W0rm)", "value": "c3c6ae51efa868221bd1bd9e7dab2e848285a964234d1ee73c8a52b926738a17a168630422f8e5c00173f4286723739c", "object_relation": "sha3-384", "Tag": [ { "name": "N-W0rm", "colour": "#152A57", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855273, "uuid": "48bccbd0-41a3-412c-a099-78f8dd2f4ac0", "value": "T19E41519E3567F47DC5164DB6EC4B9C3E55B2124BA2B8C240BB0CCBC84C346ACAB89D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855273, "uuid": "ce73a1de-d1ab-4dd9-9778-25054a5da093", "value": "48:uFKUijzKNmQuC9XdU3IGmvEA+XjOgxR0RQ0Qw8j+LL7b1UKn:8TNmQuCbU3IGmvEACDq8vSLL1tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855273, "uuid": "e826bb61-65c3-479c-beac-d350b30a2694", "value": 2382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855273, "uuid": "174194f4-43e4-4f65-abf3-c29204803e21", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855273, "uuid": "a7f165a1-a939-41e3-8ffc-69e9310bcdc8", "value": "Protected.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a03ee848-8dbb-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1644859752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859752, "uuid": "b1faef8d-24c6-4d99-b9fa-ded34371676a", "comment": "Malware payload (BitRAT)", "value": "4b60bb4d11850a546305a201443fd580", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859752, "uuid": "2f87dc86-aadb-4367-b3a1-64f1892eb15a", "comment": "Malware payload (BitRAT)", "value": "a1554259073fe90c0b577c90357f22a73291e57836e74933f0c6a000f7f1ead3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859752, "uuid": "6faf35e0-2ddc-42c8-9230-a55d807fe893", "comment": "Malware payload (BitRAT)", "value": "24c5f9280ec90638f877d772811864e71221776a", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859752, "uuid": "55ef0934-f7b3-4733-b1f6-60e393cfc8db", "comment": "Malware payload (BitRAT)", "value": "5971e04904e09b9625df9ea52675e975730795e1dc937512209466c3c827dacbe1414bbe9bd1f717b6ee32393ce9a5d8", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859752, "uuid": "6986de16-1b7a-4b51-8841-ccb86237fd80", "value": "T17295224296A61FC1C849413A90CF1F933369BB0B1546A30B97A6E7AF3EB73F1DD64814", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859752, "uuid": "b7360ad9-570e-406f-a791-cb6c059a6fe3", "value": "24576:lN5shlZ0BSTJIEkOvt19Kpth4A8FJczB/Xp/lvGXB26Pl5rrSWebjy9/fzmaL9W7:tyZLvtaz8FuPRlOBnPlNfkyZLmaL9G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644859752, "uuid": "6d13ea99-c8a6-47bb-8454-4decfbddf6a8", "value": 1911599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644859752, "uuid": "10ebcbc2-202a-4b95-8032-1c68e7e553c0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859752, "uuid": "61c732b3-8056-4358-9a6e-1fd0b4d70761", "value": "Scanned101.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52771e54-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644851461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851461, "uuid": "70bc04ec-9683-45fb-ae7e-6c14b9f8bf28", "comment": "Malware payload (Loki)", "value": "61cfd4abd701e3d5e2d482f170a839ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851461, "uuid": "8cb7256c-ee2a-450b-a099-f6c9e878766c", "comment": "Malware payload (Loki)", "value": "a3c57266f4f2f229c35a60c0c07914b8029d22f4e258288b296b3e2669e1d566", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851461, "uuid": "582f550f-7c4e-49be-888e-7bb875a9c056", "comment": "Malware payload (Loki)", "value": "41a9fc240746155357201ebe0a60e765e8f84137", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851461, "uuid": "727c18db-551a-420c-b913-f7bfe1ed6fdc", "comment": "Malware payload (Loki)", "value": "8a66c454f6616a924a1226e40d7b9d6f4fa9d256aafdec88a793494b2f0d7eeeedccac9bc596758db6fdbe4f3923552d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851461, "uuid": "85972947-5f4d-4171-a9be-3c535befed88", "value": "T15205F10077AA9B23C5BB0F7BD4E641406770EA5A5567D37F68D036EC8C8B3581E7223A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851461, "uuid": "0ba851d7-0962-4152-8007-63bb076ebe19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851461, "uuid": "41eb3459-895a-46a1-859d-3669747cb12a", "value": "12288:ZfOm2XtXVfRBuBiAkMe401l/XE2zDiyZTDOqxL2PF9Jg+vqx/IUBWpakNX:ZfJ2zjMvV0Fzm4vWdMr/In/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851461, "uuid": "558c47ad-3a70-42ea-b7d5-e4cd18b1e3bf", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851461, "uuid": "8314cf59-71c5-4f78-bd58-6ee8079242ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851461, "uuid": "2cec08bd-e907-48b3-b8f5-84539ffd01bb", "value": "Contract No 64889955.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e964faca-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644822938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822938, "uuid": "42a35990-28a8-4582-9232-fc57bdf8b1cf", "comment": "Malware payload", "value": "19dbec50735b5f2a72d4199c4e184960", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822938, "uuid": "66d1b646-42c1-4436-b134-2943f1f7f365", "comment": "Malware payload", "value": "a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822938, "uuid": "341111f1-1c88-431f-bfd5-d855f34bbb91", "comment": "Malware payload", "value": "6fed7732f7cb6f59743795b2ab154a3676f4c822", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822938, "uuid": "e503864c-18c0-4d53-b1a9-3f8f8998148d", "comment": "Malware payload", "value": "ec2cc6b68157372b3b60124c6e7c708f416f67a62f770b542cbc5e21edd01f7fc22f0de544413da11912708d63b7a706", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822938, "uuid": "cdbfe5b1-b238-4c5b-820a-cc8a4f901b30", "value": "T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822938, "uuid": "89f89cb9-36c3-427c-87f2-b674439f2230", "value": "52753d226ff5a8a88caf9829928cd5d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822938, "uuid": "7bc05898-f15f-4d63-8cfe-d5e6c699916b", "value": "192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822938, "uuid": "2c40945e-5440-4eb3-91c1-d3a8527f46fc", "value": 14848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822938, "uuid": "57bb1b6d-aa98-4b02-9b84-385c963f781d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822938, "uuid": "4207084c-025f-4071-bb04-1406f913d4a7", "value": "MEMZ-Destructive.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bbf998-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851735, "uuid": "3f3a628e-8b47-462b-9107-54a9bd6885c1", "comment": "Malware payload (Gafgyt)", "value": "c1d9abab717743cb3defc48076a102e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851735, "uuid": "006b6907-bdc4-4d6c-b23f-14e69a06fc64", "comment": "Malware payload (Gafgyt)", "value": "a44d149d6d0a67911c3dfb4a961aac378eee4a502c055aa536052caa7e61c3a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851735, "uuid": "199901e5-fc1a-4bd8-9dd8-0c8a0995b5d8", "comment": "Malware payload (Gafgyt)", "value": "363a752383c945f0e4e811fdbee67fb7de15eac1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851735, "uuid": "987722ff-dc1f-43b9-b587-db5b8c5ecff0", "comment": "Malware payload (Gafgyt)", "value": "7ca460ac7ec4510fb004b127d8c924d1db5613991dc412c2ad83a1afa6ac8ed532be2fbe2ef05a889e6aad376c9ebba9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851735, "uuid": "92dce320-c62e-4b8e-85dc-d1f9360072b9", "value": "T1DEE34A05E6408B57C1D2277AF7DB424A33339B64A7EB33099528ABF43FC279D5E22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851735, "uuid": "f266782d-11be-4cc0-9953-80451e0bad5e", "value": "3072:tNnfaSulYhy4xatn69R5OnoXjM/9uozH/mpwfvRQfZn:rfaSulYs4G69HOnoTM/9uozH/mpwfvaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851735, "uuid": "cbcf10fa-cd22-4f97-9da0-f0b5f527a130", "value": 150017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851735, "uuid": "4c09eb8b-77f2-4dc0-9a95-e6df220e2a16", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851735, "uuid": "23829c03-102d-4382-8096-0b6fde3f6b76", "value": "m-6.8-k.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f510eb5-8d5b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644818412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818412, "uuid": "b8ccdcfe-364d-431a-9b82-140159c9f841", "comment": "Malware payload (Mirai)", "value": "f138fdb86108725d7d3206c1d8e4299f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818412, "uuid": "f218aa95-75bc-45da-ba75-3601ca6ea51a", "comment": "Malware payload (Mirai)", "value": "a4d749cd6e7ae211acfaa93e716c69dd1faa98c37e015de2cec58374df01a425", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818412, "uuid": "6e7543af-16d4-44e6-ae6a-7e64b7a978c6", "comment": "Malware payload (Mirai)", "value": "c44c1ac4514aff9147dd487040bef72de0d608d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818412, "uuid": "c1332d88-0c81-48eb-b849-ff8f821cd1d5", "comment": "Malware payload (Mirai)", "value": "420a17be647665c1d4973d3bc3fca74713083b5ca945bfd7506ce8b95b8abd0b04834e7ba41c1f4c3a9e52c5be52e882", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818412, "uuid": "b2e64e4f-e621-4c81-bf9e-fdb8a2ae49da", "value": "T1C2143D86A6404E23C4D72777AAAF054633239B94D3D7730689246FB43F8779F0E6790A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818412, "uuid": "23ae8756-4fdb-4a48-9a3d-e218efcbbaf8", "value": "3072:l51z2TrPxYkBjzwf3cE3gRRpRagBwYLawSVcPB2ka8iQBrv/NTM/9ASw6ojQjq:z1GPOCjkfBwZRagBwYLaPcw+BrnBM/9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644818412, "uuid": "5b203344-4cc8-4606-8703-cacdb0701761", "value": 193692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644818412, "uuid": "7bcc0e32-c9e0-41e7-88ea-b61d97a85a10", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818412, "uuid": "e7fb4c35-0511-4a40-9429-bf18d081042c", "value": "garm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55378a9-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845212, "uuid": "23c01184-59c9-4cc3-a83e-ce9a0326714e", "comment": "Malware payload (Gafgyt)", "value": "66c354cb634455f04d9ddc49c8a6ba76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845212, "uuid": "e7a1047e-3d75-4db6-94ea-c404bcdef6b1", "comment": "Malware payload (Gafgyt)", "value": "a59060d43960c7f553363c799c2ab285833b0f95f8eb0c6eae81b4fc9a9364b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845212, "uuid": "61839ea7-b797-4cd6-98f9-b3b46ba54a9f", "comment": "Malware payload (Gafgyt)", "value": "90a91225fb5f2e3cf0163ae0b1dd05da5d13b5ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845212, "uuid": "a1257128-59af-4718-9852-5b9f1d566295", "comment": "Malware payload (Gafgyt)", "value": "0f55180d8636fe2aaf707e790e8c186ebe80db0912e12e90dd458521a7da1966deb6f04b3ccaf12ac702affa87bb0e3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845212, "uuid": "ff0a7ea2-6264-474e-b8c3-224f430e64f8", "value": "T1FF133B82F9415A03C6D15A77FB1E428C3B1A03A8E2EE72039E259F6177C39570F7B591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845212, "uuid": "3c11a76e-a5fd-420e-ab00-5b6fec30c791", "value": "768:fLH7rpRUZ1NFHtwJQM0Z0xrD+iUrnRVEV6evatTI:779RU5vA0q1rUrRQ6evy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845212, "uuid": "10cdea1f-334d-4af2-b528-d8d13cc9e86f", "value": 44548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845212, "uuid": "f520bbe6-275b-4fe7-8b55-00bf2220fe3a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845212, "uuid": "4d11452e-7e35-4401-b324-ce7910525984", "value": "pop.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d6101e-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822397, "uuid": "557297b1-a1f8-434f-9928-41f77507c26b", "comment": "Malware payload (Formbook)", "value": "e29ab840675a57be3b6bf409b074656f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822397, "uuid": "956ae853-512e-4528-aa95-350a478880de", "comment": "Malware payload (Formbook)", "value": "a5a5f44907b66b03277d484eac713c47cb4c39751b8cba89a4d0c54d387362bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822397, "uuid": "d83ec58e-fe0d-46f1-a580-0e1e112689fd", "comment": "Malware payload (Formbook)", "value": "e06c39414bd6aa6c993a099ecc36636c483ae518", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822397, "uuid": "12324fe9-519e-46ae-8204-8d780a906aec", "comment": "Malware payload (Formbook)", "value": "29333f14c8372b7697939417306150e11dca8ec552197561a8db6dbd41457bf01dfd647ec526cfb62fd3270ab35c11cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822397, "uuid": "5cb1cad5-efcf-4ec3-89fa-5fc04876d9a4", "value": "T10AC41209FBE5CCD1F0AD29301A76CA6EB2B33D763B88460B26A17F0D57705465A13D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822397, "uuid": "5d51ae07-900c-47fe-9d60-de509980fea9", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822397, "uuid": "d9929105-5f06-442d-a0f6-6c24e67c4e34", "value": "12288:9GGWPLTzYKV7VfSQp+gwc3FTrXsPmrFEuZPf0P3I7VLB+ZeZ2:IMKV7Vf9ZsPmrFlZPf0PY75B+ZeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822397, "uuid": "2739117c-9b24-43ad-91bf-0d8232f7f791", "value": 555283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822397, "uuid": "549eb101-f1de-47c9-82b8-f11a62b1adee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822397, "uuid": "2f028577-37bc-4622-ba47-655f2804eba3", "value": "URGENT QUOTE REQUEST_____Pdf_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88087867-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851981, "uuid": "d124eb86-61ea-4151-9284-62a72b4e95e6", "comment": "Malware payload (Gafgyt)", "value": "ad6de861adf6aeee906fe84d0bb6f1ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851981, "uuid": "4e070810-669f-4d3c-b75d-9d0873e2b8fa", "comment": "Malware payload (Gafgyt)", "value": "a6d3fcde7af4a51c31bcff71a4b0740f34f4b4775ae84551406b59f389806ef2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851981, "uuid": "722b4ac1-094c-4aab-bfa9-4942847d8b71", "comment": "Malware payload (Gafgyt)", "value": "adb01fc3a518c9e4f131d9a4d29921fe9161c1d1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851981, "uuid": "089d8711-e476-4a4d-91dd-a9e75ad8f460", "comment": "Malware payload (Gafgyt)", "value": "b6f706d679a69f726efca3fced291c3c3ed85d4798b8ef9f2ba5dabb218db8b71ba0a213ee7b0ffcf0d73230e6148848", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851981, "uuid": "a8e6653d-9562-409a-aa08-8d70de4b25a4", "value": "T10D93384799619FB7C186A9B126F759300713AD124F0F1B98B12DBAF4473B9CDB80E7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851981, "uuid": "820791c7-52ef-44c4-8726-73df3313588a", "value": "1536:fqTghk4gebzgK2rlJDQ/LZ5pZdC/BG/9tngmmycgYvLusIAWb:yTWbfzn2PQ/DdP/YmDcgYvysIAWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851981, "uuid": "cf0f00e5-a3ef-4877-bd34-d512c4465c29", "value": 90980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851981, "uuid": "d3ae6432-04e9-44ce-b0ab-1f4dfc2f43ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851981, "uuid": "859ba490-fd12-44ba-bf88-83449f2dddbf", "value": "cc9sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafcf8bb-8d45-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644809224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809224, "uuid": "b54074db-f431-4d32-954f-c059586b64d1", "comment": "Malware payload (Formbook)", "value": "94f327c3dbb3880dfec7693a1e1ffd72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809224, "uuid": "9ec943ea-d906-4d6d-a0b6-57bdff7411a4", "comment": "Malware payload (Formbook)", "value": "a83afdd193623f46ac870f04455f2176d64466c5e2d3cd92eda0498de29f0417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809224, "uuid": "8162630d-8b45-4f72-bcda-fcd294afa504", "comment": "Malware payload (Formbook)", "value": "f3a3f8f53d2b7b751f461b5c04941a4740344511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644809224, "uuid": "87af7e77-46f0-4345-a596-35a9a8833423", "comment": "Malware payload (Formbook)", "value": "aeb7ada0bda82dc92a67ed2c77a4418c89b6379703b7e87e118be0e9087a3515104701388ff8e01cf74cc844221b6de9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809224, "uuid": "e4b8b386-48fd-4c0f-b0d1-112d219d45ba", "value": "T1C354129B77CB899FDA020970CA7F8DA3F37BD93422104287675D4FCE59619C3981E642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809224, "uuid": "511fd848-9eb2-4870-817b-bf9ed0e5e241", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809224, "uuid": "7b375fee-8964-4984-86ac-5a096ddbcf7d", "value": "6144:owWIimwHcgfPiIXid9jNo6xg6rt3LrzC+MMmEMZc/:aIJwHcLGsji/Y3LglEMW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644809224, "uuid": "16bd678c-62fe-464b-a640-fabf1a76979b", "value": 297082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644809224, "uuid": "a9171ef2-5d07-45d2-8270-66201d47438b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644809224, "uuid": "600a4097-af1e-45c1-a369-414b1c356a96", "value": "DHL Shipment_xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e8d9c1-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844778, "uuid": "12ce6f7f-69d3-4c05-b0ab-7db0d370c4e4", "comment": "Malware payload (Gafgyt)", "value": "b667adac35247238176fa46b69b87365", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844778, "uuid": "28d6faeb-31fe-4871-bc4e-e24b7eb80f07", "comment": "Malware payload (Gafgyt)", "value": "a859c4b4e6e2ccb4c423ee712effb616ca330bcd04377d5775606426b44d11b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844778, "uuid": "566032c4-daae-4b9c-9b39-7fc1f09b1f52", "comment": "Malware payload (Gafgyt)", "value": "c5b617972f3219365e885f556fcfe4443411e5bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844778, "uuid": "1b346fcd-755e-4f2d-9a4a-7cc5ed28481f", "comment": "Malware payload (Gafgyt)", "value": "abf02c9325158ecbb62666c603af566da7e38887cc746725931f428564aa7dc1001165b6191e01cc87eca1385afb7f2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844778, "uuid": "b14fd5ac-c332-45d2-b4dc-138c603fee6f", "value": "T1ED735C136991CB7BC4C747F92BDB952144A3F83E1F32620A73D8BDA92B1A9D82D5D301", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844778, "uuid": "e2ebce6f-c5b3-41df-b921-7b11a05779cf", "value": "1536:Y7IZurwakbDu+1iDnD+Q8bQ8O32Ls0FnswNEzvmA+JbOm/coZ3ymj:+7wakbDR1ItqQH2LDnsEEzvm/JbOmEo9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844778, "uuid": "473c27c3-fca3-42c1-ad97-975d93d805db", "value": 80455, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844778, "uuid": "565903d1-6e65-4f0f-91e6-ed65e38c01d3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844778, "uuid": "c464907f-7abc-429e-bbc2-6c103a595302", "value": "Demon.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f419cc-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845233, "uuid": "96942685-fa21-4599-8e67-5d354c8cf093", "comment": "Malware payload (Gafgyt)", "value": "5af0ca7175bac315c869289304333dd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845233, "uuid": "7c44a14a-2dec-4a74-ab9c-a7fd98b962c5", "comment": "Malware payload (Gafgyt)", "value": "aa238a57d799e5f4302441b932c240075cd297fb6679d7dce2be5236e736d71b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845233, "uuid": "dacb6a67-6cdd-49de-88b2-516f4fb80436", "comment": "Malware payload (Gafgyt)", "value": "3628b9823df7869e5202eba2b473d28596d93c1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845233, "uuid": "7d20153d-2378-4c9d-b908-c118bdfad7ef", "comment": "Malware payload (Gafgyt)", "value": "312e15c209befdb7d2a61e348dfa49f7bf542731a7380657ad15ac5a378e8fae73fa0c3f275fc72e7be1f91cee975c5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845233, "uuid": "46ff4d5d-08be-4625-887e-4bae3febc75e", "value": "T10943A55A6E319FEDF6ACC63407B34A20A79D63D622E1C6C5E25CC1052F7024E652FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845233, "uuid": "98b52f6e-22fb-4534-82bc-db69d5cd1c1f", "value": "768:/Sm/IYtz5w1MFAIWeaFcCebB9go4efe2rysfseQirry6tpIH:/Sm/IYhiIWHGbBKoLrge/rykQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845233, "uuid": "57590cb4-f753-49d0-9862-e3a99c0ea257", "value": 56516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845233, "uuid": "6fcca472-862b-41e2-ad28-f6c1caf961bd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845233, "uuid": "c9ff4b7f-3590-48e4-b168-d8424f85adeb", "value": "pop.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d64ee8-8d8d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644840055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840055, "uuid": "c8d8729b-48f4-40b0-8fc8-ca05d5527b23", "comment": "Malware payload (Formbook)", "value": "d856408beede6c0313c6c65db4790267", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840055, "uuid": "8b9e9361-7c70-4567-9804-d4e73e136c07", "comment": "Malware payload (Formbook)", "value": "aa38c8327df5d1755de504ea0eccf988a34c786d80f0becb3e99491527289089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840055, "uuid": "ce1637c9-2311-4a37-b5bc-27b58a6fef3d", "comment": "Malware payload (Formbook)", "value": "6b2a51bec97c4182ace628e48cb4f12309d51485", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644840055, "uuid": "a96f414a-3d5d-4b5e-9792-f89b31914327", "comment": "Malware payload (Formbook)", "value": "2d3ceba403d6c20b2e0b8d43c0d9748e3380f16956773053cc0b08e53174d8c57e10a8afd4d2d7f8befb04a743d09a71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840055, "uuid": "924dd3bf-9f97-44a3-850a-5cc616b13637", "value": "T11CF48D22B5E085FAD11B26789C6EBBA854287D113D289C4B7ED76F4C5F3D240343A1AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840055, "uuid": "a72d3987-e2bc-4740-921a-1fa2a296fafb", "value": "50e822ed4b7a82a71d116b8c7e2396d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840055, "uuid": "fdda78e3-348e-495c-ba61-7f02d9c0d43b", "value": "12288:FlZjc75hO32cpuG7NVM1/vcDy50eVmZyqGz2PASl0i1K2KAJr:3iz2puG7NVM1/kcVNqGzqFX1KAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644840055, "uuid": "f71297d8-309f-4e4e-8ef7-dd60a97228ba", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644840055, "uuid": "d97950ef-b2a5-4ba1-9672-0ae950e0e947", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644840055, "uuid": "8bd2eed8-5025-4f03-a47a-432a4010062c", "value": "Proforma e bashkangjitur.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29dd4bba-8daa-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644852252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852252, "uuid": "a04f9a47-c238-4125-8b80-77f38f1bf6ae", "comment": "Malware payload (Quakbot)", "value": "a10a2c494cac5eafccee74cc73648646", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852252, "uuid": "3a7e23d3-5e5d-4d74-8ee8-9e70c5188865", "comment": "Malware payload (Quakbot)", "value": "aaaac7add78fd2f9eb7638559958432498ed11480acf706d6023923fc75a48ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852252, "uuid": "be63b49b-ad8f-4347-bf04-befb0c122836", "comment": "Malware payload (Quakbot)", "value": "1f33182c46d587c40e642874ccb6001bdc86bba5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852252, "uuid": "a071e55a-b1b4-4a18-ada4-bdd2e8ad930b", "comment": "Malware payload (Quakbot)", "value": "3f27148df1f3b2fb0616c8d3e6d1fd99a61e9cd710b1aa601afd0967289fc9b32572890703986b8adcaac80eda951751", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852252, "uuid": "6e20ebef-ace6-4abd-a655-64fed0e86838", "value": "T1BC050B9DA3D01ACEB1DA28AC761833D90F960FF10A7EB073E1132C8516B51F94E66B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852252, "uuid": "d1884d84-9998-45fd-bc3d-8cccb2251079", "value": "d8b6fe98d2b0a8d6f73ca1ea92363dc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852252, "uuid": "83485f74-c359-46a0-94e3-eb8fbc5409c5", "value": "24576:g74I8i4ZOpi+cQcFRnb9lgo+1TAaKBsXg:5i4ZYi+cQcFRb4o+1TAaKBsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852252, "uuid": "f8ab860b-bd83-40dd-87da-a7b1d3c4691a", "value": 818105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852252, "uuid": "1d8a4757-e440-4230-8708-fad9be54e797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852252, "uuid": "437f03de-97df-42d1-a61b-51d51e141411", "value": "dxv1.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d309938-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644842541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842541, "uuid": "35673f56-85e2-4ef2-85e4-6671564cd496", "comment": "Malware payload (Mirai)", "value": "473555c02cd59ed92f9f7aaf9b2b9f5f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842541, "uuid": "0764a842-0776-435b-bdf5-bd6ce01c22d6", "comment": "Malware payload (Mirai)", "value": "abb1186a400a94ac38ea0d7d1a0a6fc6e8d00ed2e37099a11557ee9d1a3831f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842541, "uuid": "8258aedf-7796-439c-8293-f0b832a07dbd", "comment": "Malware payload (Mirai)", "value": "668831611ab4bd2777777f67460f31a26cc363bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842541, "uuid": "0bafcf95-59d5-4cc0-878c-e7075adfc80e", "comment": "Malware payload (Mirai)", "value": "52f803ee0834e4dd66235ec3b4756bafbc416732d1a97c1c6882b61a522abf9a54cb7bd1d71753f40e11f0a450cb3633", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842541, "uuid": "46df1490-73bb-4537-91ee-8207a93ce6cd", "value": "T19163C85A6E219FFDF26C87304BB34B21A79923D623E1D685D25CC5041F7038D585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842541, "uuid": "5c19742a-9de2-40eb-ae56-687b6a7846fe", "value": "768:bBupf3HxHpJa+3ndzHswBLg8yEtleUjINNgDbRRIXK:bkR3R7Rn/JHerN+bRRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842541, "uuid": "74ef401d-573f-48fb-ab69-ff7b8495e0b2", "value": 68372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842541, "uuid": "e62b010a-7331-47a7-a88c-3d146990f664", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842541, "uuid": "227b9faf-950e-4a5a-8f7f-bd89ecfb4d37", "value": "ahsok.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ecd4ef-8dda-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644872909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644872909, "uuid": "01edfe2c-17a8-4a50-a979-114b6e3aef51", "comment": "Malware payload", "value": "f5aaeff726b78848bc40be70767dd504", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644872909, "uuid": "78aa19ee-08ca-4970-a14d-dcacd640a1cd", "comment": "Malware payload", "value": "acb3183004440b8668c37e7a9805c858ff24deed1c95d82e4491d126ac6e739d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644872909, "uuid": "53fde510-291b-4bd2-b324-bfbd2d933b25", "comment": "Malware payload", "value": "96913b90fc3b7a5e6494104c2467d901a4df1cd1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644872909, "uuid": "ada5f1fd-6afa-4d85-8146-bd4421398b1c", "comment": "Malware payload", "value": "9e99060e3db9fdfceddb1b10693d59f41d386171765079682210348b06171c61fb9242089b2c1b5c894ad56aff560eac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644872909, "uuid": "75a47bd7-d83a-42a8-bddb-07595ef09ec3", "value": "T1A613BF58C6012616C273753ED83999D20D674C03A215889FE5EB7D470BB8ADA2F1EBCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644872909, "uuid": "9cde0d0e-9cda-4849-9b29-fa2a1a6cff5c", "value": "768:xoRD4S0JS00SneSnjS0yS03S0IMS0bS02SwGHKYmJnhVy/i7ftxomOEkbuhhQC1t:xKl+a/eNN2uoCSCAMW7U1/K8NytsR5ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644872909, "uuid": "c3d72e46-8d2b-4742-a5a7-0592f260edd1", "value": 43381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644872909, "uuid": "32b7ba26-ab6c-4d53-b838-7abeb22189d7", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644872909, "uuid": "4cc31593-2f84-4a79-90d9-de19bb245a3a", "value": "23.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40a08f7-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644822393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822393, "uuid": "25d8dd5b-a6d7-46b7-8a7c-a1c13b65084a", "comment": "Malware payload (AgentTesla)", "value": "dc8b456745a003ad36da14f0152329b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822393, "uuid": "2a82eedf-e659-4f98-87a0-cedb9c9b5c79", "comment": "Malware payload (AgentTesla)", "value": "acf07e3a8e5eab40aaa587590fe81ec7a98b0eb238d5640a857495500a9df71a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822393, "uuid": "5846912f-a9fa-4ca4-9611-a9da7c5821b2", "comment": "Malware payload (AgentTesla)", "value": "31ecfb95252307cb3b4bdbac19ca65c3edc91a4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822393, "uuid": "dee2e288-cf32-4b8f-9d0c-6e010c1c4f84", "comment": "Malware payload (AgentTesla)", "value": "c75f89b3f2a368fb92aa8825db89a7aa49b7979281ce194979de461b31b536a952e8a8cc1a103213c3aa3a29f5882d20", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822393, "uuid": "87b8846a-6ecf-44c4-9fe9-18918bbc3cab", "value": "T1882502017BB9AF23C4AB0FB7E8A202411770E95A9167D77F94D036EC5C9B3680D7127A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822393, "uuid": "a6a9ae6c-2548-40fa-896b-fe452023ec90", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822393, "uuid": "7ebddcce-2970-4dc5-aaf0-0727f19c0615", "value": "12288:p+Ex2d141r6Z51XsmUPA0H6Q7eiehT7623QDD6c20Am2+KqIgF+X42aIsXblnFol:pr2da1GjXy/xeFk2+KvgFEyxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822393, "uuid": "4b2161e2-5f68-49ff-ba98-ee56ae24c807", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822393, "uuid": "b2267e48-f486-4f41-bd28-1e062b5ad394", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822393, "uuid": "479ae5be-b76a-4e8b-9775-bbb65ff01c28", "value": "DHL Shipment Notification AWB8114704847788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5096bd88-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644854894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854894, "uuid": "c8f5cb1a-4a7c-4834-863f-6199069ffb4a", "comment": "Malware payload (Formbook)", "value": "d232c424641bd7c98da1e72b340c9960", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854894, "uuid": "c06a32ec-f3ef-4120-9085-fd45ac2d77cf", "comment": "Malware payload (Formbook)", "value": "ae027ce7ae2fe9beae54dd28cc762c3be6a7652918490c9cc30f8498937d50b8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854894, "uuid": "470a97ad-c510-4d7f-86a2-6349604f8474", "comment": "Malware payload (Formbook)", "value": "7b77e0a5959bad76d514f5a055c055ef3fcd1053", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854894, "uuid": "c477d42e-8478-4dab-801b-da00a660c3bd", "comment": "Malware payload (Formbook)", "value": "c0428576a4187d9a8f7fbbdc53fe7e7455c8081911b5545aded19f8fe080761b44325b78ca89671fcdf77fc6ef7b0493", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854894, "uuid": "3ff4a475-84c3-4318-8be5-cb0525d6c39c", "value": "T1E21533147639F6CAD1E5E7A6A4B0B4F01F1D4879862AF8FC0812B360F7387D79969C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854894, "uuid": "c6859769-a02d-48c7-a67c-88a811d0c275", "value": "24576:cAh8/GckcaGG8lYyCiVgDTQ0b2PutvXe7xQH51:o/GBGG58VEzvXYQH51", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854894, "uuid": "10c90ac7-7f4d-4064-8d41-5feba0f0e1cf", "value": 951563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854894, "uuid": "fef56753-30fa-4e16-85b6-0025c2d82d7c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854894, "uuid": "2b73a4bb-e115-4d39-a3f7-4213f0e2b44f", "value": "pounds Payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c651d6ba-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644861964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861964, "uuid": "1c6767d5-677b-4f99-bfa1-1d7e52cede76", "comment": "Malware payload (AgentTesla)", "value": "77929b2d8cfafa2f799991db317f7e67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861964, "uuid": "25cfc88f-918b-4d6c-8d97-a15bad79b1c2", "comment": "Malware payload (AgentTesla)", "value": "aec2d23bb87716eaa174b4204cbe45bebd6dfc447a009a73e03604ef49b11e88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861964, "uuid": "56673f25-5c42-45ab-85a8-8faf7856735a", "comment": "Malware payload (AgentTesla)", "value": "5a31e6810dd688ac6b3b024208d444c6727070ad", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861964, "uuid": "bc7875d8-0a2d-4ce4-bb32-c2b7bded4c14", "comment": "Malware payload (AgentTesla)", "value": "f55210b563ef967c4a6671772f89b7cd37fbcba1e5c15951e5a3dcf1886a7ea95f61bc321cac38e342acdfa3ae7e0962", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861964, "uuid": "680d4cbe-be70-416d-847f-e01cd31587d3", "value": "T1D62501017BAB6753CABA0F7FD4A141021774EA4B610BDB3B949036EC5C8B36D1E7127A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861964, "uuid": "206a0b2e-0f30-459c-beef-7525bfe0c3a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861964, "uuid": "d56ebbe6-31c2-4104-b9e7-4a67fc56a4cd", "value": "24576:EgYKnByfASZdLGPZPZUSdZBTQpy87mg83ZqLmGG:EgrnB0nTKRPOSd0yy8JMmGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861964, "uuid": "43df7b2e-ec9d-4f37-a6b3-26b4b237729c", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861964, "uuid": "6e7732dd-8c2c-423c-b6f6-f1796f8e4ccb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861964, "uuid": "f8e39942-cb85-4b4c-b338-6a40499cbe8c", "value": "77929b2d8cfafa2f799991db317f7e67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38c64df7-8da1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644848412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848412, "uuid": "c4fcc500-5252-471a-abde-fbeaaf130e39", "comment": "Malware payload (AgentTesla)", "value": "f136a198e29787a0f396b7dffd054fa2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848412, "uuid": "abf915e2-a009-41fa-bb5b-849fb9fbe297", "comment": "Malware payload (AgentTesla)", "value": "afa2076003dad755fdc8c128afaa2122b3b36f644625b1053b40cce260f8fdd7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848412, "uuid": "2941c161-15f9-4806-8b4c-f37d18ed2667", "comment": "Malware payload (AgentTesla)", "value": "ae2f6ce4f5b39714f04b035d9f840e058e81b453", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848412, "uuid": "dd55de4e-2af9-4968-8951-c0b68c847aec", "comment": "Malware payload (AgentTesla)", "value": "e2e2eb08ad07f01210f26b71c3cf58e534924bcc4a86ec0d9774377c8da4cfe53935188167ba965b10af81f75f81ef97", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848412, "uuid": "55c1ace3-d545-4418-940a-08c3951763f0", "value": "T1A1151225B7A7D915C9B50FBBE8A14140AB30EE1A4507CBBF709D3E8D2FA73650A31532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848412, "uuid": "615d12f6-867d-41d8-b3b6-145a4db3c972", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848412, "uuid": "201c0022-a735-4144-b22a-5835e747d715", "value": "24576:8bK8gqj7LZ8ksvbsju37cK2ZCh/6LBGD/Tx/NiT0:Igqj7t8ksvbsC37cwtU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644848412, "uuid": "4ffcf9b9-8eee-405e-ad4d-ffc10838dddb", "value": 961536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644848412, "uuid": "1823c2be-efdb-4add-8c30-cd4a800dc516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848412, "uuid": "35743bcf-ecbb-47d7-be88-832ffeb85aad", "value": "OFERTA ALSSET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4e1a5c-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851985, "uuid": "ab0ad5b9-8a8f-4ec2-a336-12fe32788f83", "comment": "Malware payload (Gafgyt)", "value": "77737a1a3750c273b2025d0c0116c2c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851985, "uuid": "9cb27b19-59cd-451d-a5da-9bac788cf532", "comment": "Malware payload (Gafgyt)", "value": "b087921cd959c2a74dfa0667cdc9b0357678a19e7773dd5ffdcf8cc80eb2696d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851985, "uuid": "45d71ad5-5be9-486f-ba0c-ec72d18bf59b", "comment": "Malware payload (Gafgyt)", "value": "75880735dd75a7f6b527702b74182a949e90b8d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851985, "uuid": "e6ca0eb8-75e5-4e18-bcc1-e77a0413652e", "comment": "Malware payload (Gafgyt)", "value": "5ae7d35532a139328fbf3cde0e24075333ef2b493399d6d5ffd25a616b47dd52da56800fd7019694930778461e0d4d0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851985, "uuid": "c243fea4-a188-448b-b7ff-136922f4fd22", "value": "T18BA35B17A652C67AC0C356F52BDB96615123BC3E0F32720A73D87DE62F368D82D69702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851985, "uuid": "dfd7487a-5b62-42e7-b382-f317d81e549b", "value": "3072:sd0wvUdg1o89XuDkelw9Up23m3mDk1cwxc635v:D8NKjLZ3mDk1cwxc635v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851985, "uuid": "97bb74a0-641f-4cb9-b6d7-1a17de426d99", "value": 99093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851985, "uuid": "dfcbf36d-3a4f-4501-a6c0-36664125883d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851985, "uuid": "3f0e3910-4663-4420-ac68-9072d3644cad", "value": "cc9x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19517e66-8d30-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644799826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644799826, "uuid": "61ff79d5-fbf0-44b5-971c-0f1c2aa67135", "comment": "Malware payload (Heodo)", "value": "e89973f8aae69d6a13761a00039392f0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644799826, "uuid": "0f580c7c-5232-4239-8871-f6bd3c6fccde", "comment": "Malware payload (Heodo)", "value": "b0e9805cb20c84c2ccdcd0ac3c1274b29c03e3df5559857c5b9ba603270ce309", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644799826, "uuid": "b61ee779-acf1-462c-bee6-3408aaecfdba", "comment": "Malware payload (Heodo)", "value": "744737dca5d61ca17af432dcf730a31b0267eb3b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644799826, "uuid": "421fb726-88ed-4854-8c5d-399d643ffe2f", "comment": "Malware payload (Heodo)", "value": "9b3313ab1db0a7ad71b10837152429224156fd18a0de6d501177b02812a14c3bc7ddc296d876de31f1ed0f4677d5203a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644799826, "uuid": "ab8057ca-0de7-4e57-8fb8-985ddc92d71d", "value": "T11DD38D6ABA48CA0BD94953314EE7CBF67336BC819F5297473295B72F1C3A580CA03B15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644799826, "uuid": "40f5698d-5a79-41ef-9fdf-683c240abebb", "value": "3072:fcKoSsxzNDZLDZjlbR868O8KlVH3skehvMqAPjxO5xyZUE5V5xtezEVg8/dgDa3H:fcKoSsxzNDZLDZjlbR868O8KlVH3ske2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644799826, "uuid": "6a13e58c-e651-4b65-9e75-c3eb4f951c26", "value": 132608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644799826, "uuid": "4206cf99-3e70-4dbb-897d-d2320207a7b3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644799826, "uuid": "c7e444ef-84c5-4578-b3eb-8c0ee25c124b", "value": "tmpvurorxqs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804c527f-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1644854545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854545, "uuid": "e515992a-8da0-4540-8523-cf2ebcc7ba66", "comment": "Malware payload (Socelars)", "value": "8540b2038775f785e1963b69790460ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854545, "uuid": "68859022-6fcb-4049-b4f3-2e8f6c340385", "comment": "Malware payload (Socelars)", "value": "b114b070850d14c7493c9f17b89e9cb774a43da5e971f3dff8915eefbf07d1e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854545, "uuid": "51e07937-8e7a-4027-9762-60439a132c68", "comment": "Malware payload (Socelars)", "value": "6da922130ec11c384381892eefa3edfae5c2a5c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854545, "uuid": "f90d3a51-8398-4d27-819e-ff9497b0adf4", "comment": "Malware payload (Socelars)", "value": "3fff6d6dcc83790d51669d0fcedd45cb9458028b5d0449088fc3d89fa90c66ccfd6c54ea3187c01ebcf2677ec5b53a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854545, "uuid": "059dc888-1ba7-46f2-84e3-0d73988b9ea8", "value": "T1C0658D20F6426032FAE340F2C1FE56BA8D29B633233451D7F3E4695B9B615E23636D16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854545, "uuid": "d616a202-82eb-4813-9c4c-168757ab7ccf", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854545, "uuid": "456acd7e-a143-43be-89c5-ff610c4c1898", "value": "24576:0Pp+wbkYdhaPeAKOJ1bD/pu6sssUZIpEOsn/mZHeDxP:epxLu9EvDVsn/mZH2xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854545, "uuid": "6e0e7a47-2b04-4908-8bf7-f373fc0ac1a9", "value": 1491968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854545, "uuid": "e7066b7a-d6bd-4f13-a78f-901f63a4cdbe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854545, "uuid": "243037d6-fe13-437f-ae3b-9e1852a5239d", "value": "8540b2038775f785e1963b69790460ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc1d16d-8d9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644846545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846545, "uuid": "10121b65-b249-4ec9-93ab-72e3bcbbd1d4", "comment": "Malware payload (Formbook)", "value": "fa7ae8aacdae5c29240544a7d098b43f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846545, "uuid": "037aeac0-2616-4fa2-a927-ec13d3c4785f", "comment": "Malware payload (Formbook)", "value": "b1623f58bfe1b81afd809e8b60a395ba2bcbe9c15b67ccb1938bd21172a586ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846545, "uuid": "8d6be869-64d4-4976-be94-d8da60a13255", "comment": "Malware payload (Formbook)", "value": "911b39ab19a80ba61b0b71dffcdc29bc27552828", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846545, "uuid": "4cbc6571-c517-4840-ba6d-9f5cb3937a6a", "comment": "Malware payload (Formbook)", "value": "785d9d82ef3680ba181f7085f069b2fd0ad3bbfcc56d8d7f9f8db5b8480a4b73ebbad423ba9f5337dfbdd7c9c0cce9fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846545, "uuid": "49fa78fa-8882-4f28-b0f4-1231184f9f68", "value": "T17D54238EB2C2D4E6D4630F706EB5933DD3B667491A00018B9BBD7EB7B9C40835A7A191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846545, "uuid": "cca8139b-9a68-4f2c-b378-2ada094768bd", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846545, "uuid": "bb49259f-4813-4866-b2a9-1938afa6cf8a", "value": "6144:owVSeuJL9KLBAVHM4C+1dAh/XPIGyC+u1yE1zFQgY8nMkAosyoUM6sz:ZSe+KabfC/oC+u1n9Y8nMkAowHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846545, "uuid": "1ca5b588-ef1b-48b3-aeca-2c3ca7632c5c", "value": 296576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846545, "uuid": "10c2f671-29f0-49a1-ae11-6cc91f015c82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846545, "uuid": "6dd2ad81-a085-4d48-bb06-63ab17ac3c75", "value": "rocee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974141c4-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644842557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842557, "uuid": "e62cc23d-2fa8-4962-bdc6-326426129ef7", "comment": "Malware payload (Mirai)", "value": "4b9e3c293b4f99a4070b2306dfcd5886", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842557, "uuid": "c7d7f7bf-28e0-4564-8797-de8f276a2d9c", "comment": "Malware payload (Mirai)", "value": "b181a7083944a59ce271341ce0ece1e50a754fca33970e8eedf8378d2ccf557c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842557, "uuid": "88dd945f-66b4-4a3e-89f5-b587b076c4a5", "comment": "Malware payload (Mirai)", "value": "1a52db8f373675c8092fbc81c2cd15b3d56179b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842557, "uuid": "82e98964-25d3-4649-9597-40310b6f43f4", "comment": "Malware payload (Mirai)", "value": "f7d601d90368d7c9257b946918b172c2ef23044868194fb89f0810d9fb45804016ee3181a474158aa6085a4a6b3915fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842557, "uuid": "27729813-3cfb-4442-bf24-ddd84562b746", "value": "T1DA336D23A4C180FDC8DBC2BC9B9E7636D533747A1366B16A63D4BD225E4DE215E0DE20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842557, "uuid": "1171c4bf-d5c6-48c4-9c85-d0a924351745", "value": "768:1Q29ucs6CZ26jhv8bi8ja92+7Kpmv5W83mkx4QrTlv32dl8A/eITOOL:tTCZvR8jakJ45zT932dF/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842557, "uuid": "f1c96bc1-3fb4-4ad9-9a4b-07b16a26845f", "value": 50584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842557, "uuid": "8c62d53a-78f0-4098-bcb5-6cbcc7939f9a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842557, "uuid": "1369df82-cedb-438b-8fbf-78db1db7a73a", "value": "ahsok.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25795333-8d71-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644827764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827764, "uuid": "dc1b5344-8ae0-4edd-a5cb-196fc68728a0", "comment": "Malware payload (Loki)", "value": "dceb699db09a9fe17e8e6a53804470ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827764, "uuid": "83ccb740-3836-449a-85fc-54a00fd317bc", "comment": "Malware payload (Loki)", "value": "b2c4e34cf9e59885a100b02fc7e808673d1311d86ac1170de009fb607778703b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827764, "uuid": "0e8c4efa-61e8-4457-b487-59823da2224b", "comment": "Malware payload (Loki)", "value": "d14a7b958f473392826d15e057e4c952d95a6078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827764, "uuid": "56a6475f-4e12-4cf8-a7cf-294112f4b8ff", "comment": "Malware payload (Loki)", "value": "facfe95ba673ade956b51467e6f0c75ddbf2db6602a4926b4444f9c40a9b7de55a82b78cb9fac1250f4757ea3164b233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827764, "uuid": "c297eac5-172f-4a63-bbd4-bb8918d5b2a9", "value": "T1F5639D3A1AACC5E5D714907EE047F32013A6AFA29B55851F33603B8E2CB7355CEED581", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827764, "uuid": "80990ed5-2ddc-4b37-9447-9f5362d7d398", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827764, "uuid": "2526cdc0-9ee1-404d-831c-9eb50cbb45ec", "value": "1536:9MiamJ85eb8HJ0cYeWQzPhOvVihneW9+T:9r85eW0wz5OdRSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644827764, "uuid": "abf16ffd-8703-42ef-ab29-9ade5842a41a", "value": 72704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644827764, "uuid": "9f3d2db4-e306-40bd-8fdb-e3ffaee01ffc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827764, "uuid": "1f0ff460-56f3-4cef-b20f-6d19f7482d92", "value": "factura 7685 doumentpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f246bf-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644842332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842332, "uuid": "215bacdf-6d01-44e5-93aa-7b01b1a4eefb", "comment": "Malware payload (AgentTesla)", "value": "a97deff55043c8eb1501576d7617fd11", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842332, "uuid": "d71f19c6-f311-473d-b5db-7fdefd866455", "comment": "Malware payload (AgentTesla)", "value": "b2c7dca5edb0529982e8c25ebd45ae48f5ebd5c3cc09c5bebc21c909b48b8b71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842332, "uuid": "b057a78f-379f-4e50-b935-795bb43e4f77", "comment": "Malware payload (AgentTesla)", "value": "8d24ef39b97c46f51b402ec52577a222e6ec2b7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842332, "uuid": "48ffa14f-9af7-4f3c-a605-2220b3ec7458", "comment": "Malware payload (AgentTesla)", "value": "1e68df55b1b9507dda0696f6d25f943b37d6737c72df01fb88cfabf06efadf6826a593dd23bb83cf6bcfd99ece3c0a78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842332, "uuid": "a4abcbeb-db9f-4dae-ae45-c9b5559b4e08", "value": "T100053351D31D250856A21E6F1C88AA17B93D37E4C2BDD01FAC7C0F6429043AFEEBE55A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842332, "uuid": "097005a9-92ad-49b7-af29-850fbb8e5e89", "value": "24576:nJo17AuIWtLzjA8GU89R/EkyR19ARuSkfsXLe+JJ:ni17AuIovjAW8E+/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842332, "uuid": "83a8d367-4af9-4f6a-8302-37dc5dd49ff1", "value": 795684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842332, "uuid": "12d69d51-a083-49e3-b44f-e1fc7005dcbb", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842332, "uuid": "472c46e6-d2c7-44b8-b0a7-09366e52f6fe", "value": "SJ Revised PO Feb-14.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f92f5f-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851956, "uuid": "93810a8d-a0d7-490c-8c6d-e5406bfec1ce", "comment": "Malware payload (Gafgyt)", "value": "a95b7cfe12ea6a16a4e339bc6725c924", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851956, "uuid": "d0c49482-479d-4f7c-a412-bea38e617d99", "comment": "Malware payload (Gafgyt)", "value": "b39249a18c5230fee7b7f3ce08fef34678266319989c854ce754b562079cbcb8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851956, "uuid": "0564860d-2edb-4df6-908d-a190bd50d192", "comment": "Malware payload (Gafgyt)", "value": "00d74f876db6ce025623cd2307b933544aadd5e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851956, "uuid": "73ccde94-731a-4f5a-bdfb-6a453513eab6", "comment": "Malware payload (Gafgyt)", "value": "db42fcdf222c6aa9c70e90d1ddb02dc71b505a646db4320a37db39932fa0dbdab7089490b362c4996c419b57c9804cdc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851956, "uuid": "9e42dd45-f8b7-4c53-8b03-fd0f4e933e6c", "value": "T19C834B02A781CAB3D0431AF616979B210532FD3B1E1B9E56F35D7CF49B354C8B226B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851956, "uuid": "c565e815-aed6-41b7-bf11-be0cb3042b33", "value": "1536:MPhRQGU4M+TvuBdp/lqzNWKv8jTCk3xkwV8pxm7WAgcJjmAI7Hp:MP4GU4Dvud/lYN3kjWWV8pxmqAgcJyAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851956, "uuid": "0d16891a-96b2-4304-9196-f56e142261ca", "value": 86338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851956, "uuid": "72296de6-772a-4573-befe-528b6d6af79d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851956, "uuid": "228de6a6-0f90-45e9-bd3e-dfb50fdd80af", "value": "cc9i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb67498-8d5b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644818406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818406, "uuid": "8fa68a65-73fa-4a16-969a-2d9bd4f10771", "comment": "Malware payload (Mirai)", "value": "fb9f41bfc4a9c1f8f477da57af7cbeb1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818406, "uuid": "b840d17f-cacf-4cd6-92fc-7b976ec333de", "comment": "Malware payload (Mirai)", "value": "b3ff08a32c6b8fd5f181c7cafdf02524464c7c0ab73e9d9af918f46dad649530", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818406, "uuid": "30be533d-9dde-400e-a56e-f2056f275f7b", "comment": "Malware payload (Mirai)", "value": "24f3b273cfca573c1d54f348626c632c5c732e0c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818406, "uuid": "1fde3ad9-8b38-4665-80c9-88fef3771445", "comment": "Malware payload (Mirai)", "value": "1bc807e2cc222272cf19cc1984ccf093cc9afcf99263f4d5ffc925ffbdeb09bade267882a4c7eb1229ac6328dcd8e687", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818406, "uuid": "affaf934-6b94-4916-bbd5-64560ae63fc8", "value": "T1AB835BC9F983E4B5E8111E38306BEF73DD73E1B96024EA47DBA856326C22B41D506B5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818406, "uuid": "f750e6eb-b817-4976-ba49-ea86355b6ab1", "value": "1536:I3u5AIgEPxUxje1V/SNA9CTBkgRAsOrDVkKRtSoNo7TQPS/ZZNI:uu5AIgEPis/SNdGgRAsOrpkgSomXQcI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644818406, "uuid": "4542428c-b4ab-4695-9f12-b23f90046c8c", "value": 88240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644818406, "uuid": "18de608f-b176-4038-8769-dc30028b27e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818406, "uuid": "14049122-6629-4fd0-8381-f8ca023143d6", "value": "gx86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0dda369-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846036, "uuid": "35df2702-d344-4313-95cb-8705a2ae3b92", "comment": "Malware payload (Mirai)", "value": "51e6a21842e0902271eb94045985c28e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846036, "uuid": "88dcc474-e2fe-4f35-9d62-c04a1bbe4b28", "comment": "Malware payload (Mirai)", "value": "b56d8141bc1dbc9a68afcce166b9b63fb37c0faf930bc0858a9b731fe0460c1c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846036, "uuid": "126e5be0-5e9f-4697-ba1c-93f28473e059", "comment": "Malware payload (Mirai)", "value": "b27c7787075cf9bdbe7d8db650f8fc562f2a4ecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846036, "uuid": "fa59aa62-7fc9-45ce-b7eb-3cd21e585bf6", "comment": "Malware payload (Mirai)", "value": "849a6a8b8080a4db9c0deb51b7a790c071c5cafe8c4084cff48116d87435d1e5c53a2e828a27da614a4bb3a69607f6b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846036, "uuid": "10fb9000-f028-4be4-9476-5b9ffb92ed8f", "value": "T1BEB30905FC404B27C7D267BBF79A438D77366658ABD7330266296EF02BC17982E3A150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846036, "uuid": "33b36f0a-10bf-4a1a-97b8-e4010142d9df", "value": "3072:NqDUOulvQ+nozmLCJZf94SNUl5h8nb6FlrJR07HoDQHDVpZAlvm:cZfpil5h8nbp7HoDQHDVpZAlvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846036, "uuid": "74230ad3-89fc-433a-8ec3-fa981dfd8daf", "value": 109441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846036, "uuid": "1e1dacf4-ef35-4d06-8bae-d051340f7dc0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846036, "uuid": "1520c9bc-3d81-4c55-bbfc-1cd651c0719b", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a1f3534-8d5d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644819181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819181, "uuid": "8cd3163c-3264-4642-85ba-cb6df801564f", "comment": "Malware payload (Formbook)", "value": "476025c59bf12eb32d8d03a47bec669f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819181, "uuid": "b8bf0693-204d-4cf7-a8c2-b9b16f3e9a46", "comment": "Malware payload (Formbook)", "value": "b5f535ca0bd6dcfd4c23ddaa607e30fff1869223f5363ad3bb186e5766e9dc73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819181, "uuid": "d0b733ad-4544-4640-b588-6db83ab8afc4", "comment": "Malware payload (Formbook)", "value": "3879b0c48cbd9776fa68ca8ab0c4b128609304c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819181, "uuid": "85ef4f7b-31df-4378-b821-cfb2f40264ee", "comment": "Malware payload (Formbook)", "value": "cb4c8d706ec97a006640131b6ead3a882864a08cd8c76a9dcd15dbce340e82056916979caece7af7693226330e0d3416", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819181, "uuid": "1442eae2-6937-4f97-89a5-75ade9b780f8", "value": "T148640206B8D490FAF8298B3298F75A2D72B53E3C2B71284F4B5CBBE9053125352554BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819181, "uuid": "a99fbfe8-8396-42a0-bf03-4c034a21ad07", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819181, "uuid": "6732858d-2acf-44d8-b1bc-c6770b1fd0fc", "value": "6144:Pwy14jfGAMsdFxsFCbxTL7TE9l+ST0MBQcA9dvrR:MNMs0CtvPxYBQc6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819181, "uuid": "fa5c2be6-dc3c-41e5-a8c3-0f9531428771", "value": 322151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819181, "uuid": "4b283779-b6ce-4215-8d5d-07851e853f15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819181, "uuid": "8eb87857-23ec-43ca-8849-395898717ccc", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32d72ca-8dcc-11ec-9275-42010a9c0029", "comment": "Malware payload (NetSupport)", "timestamp": 1644867086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644867086, "uuid": "47268311-9ef2-43d6-ae5f-291de1701dd3", "comment": "Malware payload (NetSupport)", "value": "88eb1f48be9f402a57f604c0a9aae82e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644867086, "uuid": "0e637d4c-6e6f-4124-b26b-ab33501efaca", "comment": "Malware payload (NetSupport)", "value": "b6a0cc1e5488c0c9f1429d1744f8c2f81f7dce4229b8322fbdad043cd9084b1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644867086, "uuid": "d1f83a6a-8ba6-47be-a71a-2a9e719fab49", "comment": "Malware payload (NetSupport)", "value": "b00e619270665c52a6d51ab9cd119aceaa34cd24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644867086, "uuid": "2e262bd3-b0f5-480b-a3cd-a5898f590c90", "comment": "Malware payload (NetSupport)", "value": "33311e64f7a48289cf37db01e2a19b9f30d521231957705408458d0407913c345aa24e7d4e6e75fb856d45f100543031", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644867086, "uuid": "c49f45ca-06e7-4fd7-bf53-b8d08db2228a", "value": "T1D8C5334EABD419AAE0768F704AB156C71A327C516B39C5DF668C8C3F6E233D06630F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644867086, "uuid": "5e06961f-87c7-4f91-b32e-ffb3bef54666", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644867086, "uuid": "d66a0a26-9985-490f-a673-613a0da41e89", "value": "49152:pEl3r2sbp0Y5B87b4ECTHj7BLWE8uT9hMVtYgtmQH2LIU/3Wwe/J9oMSMf:qqsbfKHwTHfBz8AmLfmQW3Wwe/J9gMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644867086, "uuid": "c56f574c-ebc5-424a-aebd-8f056d8a42f9", "value": 2595840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644867086, "uuid": "68dd2e12-1781-4271-a614-9b865ed2d2b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644867086, "uuid": "4a76cafd-71b0-40ac-9d55-86ef943e3742", "value": "B6A0CC1E5488C0C9F1429D1744F8C2F81F7DCE4229B83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74541e9-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849913, "uuid": "32c0a659-46b2-475f-b9c1-f22ce821b457", "comment": "Malware payload (Gafgyt)", "value": "e1ea826c9568e52841214f14c42c3ea7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849913, "uuid": "a46fd962-b0c1-4435-8a26-67383babe33e", "comment": "Malware payload (Gafgyt)", "value": "b6e7dd02a1eada13868223218a18cd825f95a7fdca3c1d20c7290007342b9103", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849913, "uuid": "336d778c-8630-42f7-a183-4432f6fb4946", "comment": "Malware payload (Gafgyt)", "value": "6bf37cb7ea8133a8db080722fc6651d855f2c247", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849913, "uuid": "22272b72-bc8d-4245-bb25-c0d837c4f3c7", "comment": "Malware payload (Gafgyt)", "value": "b44061f0fe31a04106e10c0d8074ed2389215de8a59fa666288c283641cfc0a27f95417499a6697d58a8a57d57a28b60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849913, "uuid": "b2dff298-c556-4b21-a8a4-0c6fd8a6fefd", "value": "T15CD3B717BB51DEB7C84FCE3206AA4501208DEC5A12956B2FB2B4FA5CE77AC4E48D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849913, "uuid": "223ea1f6-4e36-40ac-a264-6386fc4b98d5", "value": "3072:SaXqUDmtbEwsYOCrZ9Ol2ixm/ihUr+MrmxUND:Sa2bqbCQxm/ihUr+MrmxUND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849913, "uuid": "10031b8b-1a6c-4660-a2bb-e5be77eb12c2", "value": 130241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849913, "uuid": "eeff4617-5d7b-4c43-8fc5-5a3236799c86", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849913, "uuid": "60cbc443-825b-4939-af20-5a3007ea90c7", "value": "nv.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945b7a04-8ddb-11ec-9275-42010a9c0029", "comment": "Malware payload (a310Logger)", "timestamp": 1644873476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644873476, "uuid": "77a6f43e-9faf-4429-b66d-8100d2aa55f3", "comment": "Malware payload (a310Logger)", "value": "277ae8af8a83d0fe4c85e0ac2c20fa03", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644873476, "uuid": "99a9df6a-bb97-4baa-817b-b365aa2e3758", "comment": "Malware payload (a310Logger)", "value": "b7b977158ee75a3d56546049821aa0467864388c7ff3091c4c529840db010023", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644873476, "uuid": "830b946f-e7bd-457d-b13c-95d95aa32eac", "comment": "Malware payload (a310Logger)", "value": "3ffe23221d83ccdde796eb580c7bf184dcbb8948", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644873476, "uuid": "a82b3125-104a-477c-afbc-eedc92c2ec57", "comment": "Malware payload (a310Logger)", "value": "a73eaecb911d9dbb0a8ded453e543e373fc421d34c40fb2e4f6b9b6d06c9cc0d6f3302dc57a5a2f4412319f93f1d7528", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644873476, "uuid": "922060a4-68e7-47c2-a765-58c6edfdaf85", "value": "T162552305AB37BA3CD8B507FA88A6943E23F4E91D146ADD7DE67334CE2D232684474970", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644873476, "uuid": "b901971b-d892-4db8-bae6-1cec4ad5f908", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644873476, "uuid": "45352a11-b7b2-48bc-a8f0-bd6028fa63ac", "value": "24576:eKgCq4csPo8glUom5dR841sSwI9Ns2SK8OtlxbIQLPAenPu9:9gao8EU7841s29LSTO5H4en29", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644873476, "uuid": "daec348b-ff0f-41e7-908f-500f45101a34", "value": 1378816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644873476, "uuid": "726e921a-01f1-41f8-9bc4-dd9d73fb6614", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644873476, "uuid": "ac84cf33-542e-4493-8b72-38469c1612e2", "value": "New Order 001965387.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ceb61a-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload (HawkEye)", "timestamp": 1644821989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821989, "uuid": "71a3e6b7-8bf2-45f8-a84b-c7309836fd12", "comment": "Malware payload (HawkEye)", "value": "def7f323a9c899eeff2daec6c685436d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821989, "uuid": "71238151-a68a-42c9-93b6-aed790fb09fa", "comment": "Malware payload (HawkEye)", "value": "b80f646b11b61cb3d989da0858fec2bad99b5006f5d3f0e6a3a2bd86d8a8ac6f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821989, "uuid": "b8206f42-83ac-4fac-ae10-e09e547a64f4", "comment": "Malware payload (HawkEye)", "value": "19759534b1d50232576ece5e49e567bd158267d1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821989, "uuid": "d23fb3d2-861d-4cac-aa24-08782b9a1d9c", "comment": "Malware payload (HawkEye)", "value": "7395c72bf27f44690d9119fb1cec3a7effaa9bcbe5b4d832d086b0ade3ca2083fa79cacd997fdf498d6b343f6f2b81aa", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821989, "uuid": "b2518497-8a64-407d-b29d-d40b8ebea6a8", "value": "T10B33AFD057944ED0DEE69793553A7E8C06A2F17BEEC91588604DEFFA272B3818E0CC85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821989, "uuid": "bb0252c8-337e-41a9-bfb3-7009b9ca017a", "value": "1536:KXgC3+CVqTcX7wVBAZR7r6/LhBsL18HH+VDD0y:EgC9LWBAehBg0y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821989, "uuid": "5ad3705a-52ae-40d4-9bab-82c1cdf2f60c", "value": 51849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821989, "uuid": "2686f462-1e0d-471e-bba5-2d7cf6b012d9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821989, "uuid": "508b174d-c02f-43de-ab15-54af90ad92b7", "value": "02132022769992.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f842d2-8d5c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644819047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819047, "uuid": "16340bf4-24b6-4084-a3a6-15057b37f32a", "comment": "Malware payload (AgentTesla)", "value": "81f23c3a5989d58c002f53a91b9712a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819047, "uuid": "b5d5e15a-a5f9-471e-b754-e7d96a5df184", "comment": "Malware payload (AgentTesla)", "value": "b9c838a8d20cdc11efb288418610539a9e46981b5f6375fa03a9f9de68218e9c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819047, "uuid": "cd834ebf-314f-4a09-8185-a3d1b9e278ec", "comment": "Malware payload (AgentTesla)", "value": "ccb11f7b8629c789c42c64d90ff51881aefd4cd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819047, "uuid": "69649d90-225d-46d4-9540-c11a57658ae3", "comment": "Malware payload (AgentTesla)", "value": "50e63083a94a791236a7bd65129662c32907a78bd91ed4b5d1dd41060d53571e80a929c9ca3dee9b4aef232504555ce5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819047, "uuid": "87951cf4-9882-4cda-ade8-44fc6e40d8eb", "value": "T1BA151205BBA2D540C6760BB9E89142825B74ED2E444BC7FF716C3D8C3BAB3668936532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819047, "uuid": "69e2346c-dbc5-421f-adb4-56a395659b2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819047, "uuid": "d57cecd5-bcc6-4ccb-8914-874e763d1d3b", "value": "24576:L7g4RhLZ+oAjEjiSC84t/X1p+fZzQJO78+3FIVZ:Y4Rht+1E1C31X1cZsJOX1Iv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819047, "uuid": "ad10666c-a8cd-43a8-8fba-2b6a06ec8f71", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819047, "uuid": "788a94b6-8e18-4811-a084-6d069053e528", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819047, "uuid": "8303b180-a841-4cad-bc4b-7e23fe85848f", "value": "Payment Details_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a42aa9-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644851465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851465, "uuid": "59cf2d05-6648-41f7-aa67-ba5483a34367", "comment": "Malware payload (AgentTesla)", "value": "2db59678cf2b250387bea31a55558a5e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851465, "uuid": "ad31e29e-d1f7-4795-879b-d59a3e69d0bf", "comment": "Malware payload (AgentTesla)", "value": "ba132ff71429e3e5d3a219326df63d882c88986e0eddf830a17ff44b84765368", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851465, "uuid": "542a566f-159c-4ac4-8fa7-c6561b719979", "comment": "Malware payload (AgentTesla)", "value": "93ea190b3c95d811e2bd07b10543ec5e14d493ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851465, "uuid": "f2a3a4d8-ac4a-412e-94d6-925bf3374353", "comment": "Malware payload (AgentTesla)", "value": "9de357941321ef4cc79b3515be732086bab914d9f9f032b253bb915afcf479b2f563c201507478146cf615da9dcc8f6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851465, "uuid": "5fdbfa46-f164-44a9-ac93-98d1f7098392", "value": "T1BCA4712C3E718772ED6DE17049720AF5BB274B03624899A713DB15C8878EC27EE46DC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851465, "uuid": "3e4302c0-3621-4a16-9d5d-a3e5adf4b288", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851465, "uuid": "4df704f2-edf8-4e9c-8151-e8d949e0299f", "value": "12288:TMddmQ+/ZcK9zWj2pafvGqFmO+o6oz93Yh:A1+RPVWipYFmOd6oz93Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851465, "uuid": "222b7aed-2e26-4cae-947d-5db9231fb134", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851465, "uuid": "1dfca5c6-1ae3-44f8-a63e-d995e1b1b9a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851465, "uuid": "54ba963b-fede-461e-8f14-6a47f095b654", "value": "MV TBN - Performing Vessel.xslx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba44905d-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644861943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861943, "uuid": "ec35ad7a-c687-4a25-9097-4a77e46a177d", "comment": "Malware payload (AgentTesla)", "value": "1fabf5ad5a8be2ff5c05c1d605c0056d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861943, "uuid": "9bcbaf5e-02a5-4b52-8baa-d502770880d9", "comment": "Malware payload (AgentTesla)", "value": "bb324ac6fc91d827646e61d40b5213f55ab7359d611559d876825fe7d4cd0b57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861943, "uuid": "36c87b7a-830f-40af-9fa2-bdabe5fea0a2", "comment": "Malware payload (AgentTesla)", "value": "86be99f907b769aa732688d2953a1ac93ad0dcd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861943, "uuid": "f1c12326-a060-42e9-bef6-a10f90efcdaf", "comment": "Malware payload (AgentTesla)", "value": "cbdb1f3f15df827fdb8817a3ba40f502c28f9236ffd8a7e544b50b46d0fe99e4a2e0ddcfadd2fe06ab0052ef9d09bc47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861943, "uuid": "87b70b64-c852-48dd-8d59-f30a3c17d14d", "value": "T12715020177ABAA23C57B0FB7D4B6424167B4EA16852BD37B64D431ED1C8B36C0E72239", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861943, "uuid": "8936d25f-7080-48ae-bf7b-9b478976976f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861943, "uuid": "8ce472e1-4c3b-42d8-8203-2a0acb56997f", "value": "24576:ou92ofHSu2KxkNwrcvDbllNqB63lv0Yx55lWhW:omfy1ukV7gY3fxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861943, "uuid": "834ef1f7-ec46-4d87-a573-c81c6968bd8b", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861943, "uuid": "24e1ed47-0cdd-4a83-94d7-e11fc0602ce7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861943, "uuid": "533cb18b-c579-4b23-9211-82bcfb9c893e", "value": "1fabf5ad5a8be2ff5c05c1d605c0056d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b86ad71-8d5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644818754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818754, "uuid": "75c62a07-bac0-469a-931f-2ff42d04340b", "comment": "Malware payload (Loki)", "value": "b10962d2847920b536022500ed28fa68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818754, "uuid": "4c6f48a2-6f3f-46a7-8e94-027ebe45596f", "comment": "Malware payload (Loki)", "value": "bb8e5543df945a55653a320f95ac3f81a8b266ca788fa800139c61a1d5c88549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818754, "uuid": "54bcae38-4b5f-4160-bc9b-2c5bc5afd555", "comment": "Malware payload (Loki)", "value": "71904f8041f8644633806ffbfeab4d7b3d0195ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818754, "uuid": "7b687e50-7de7-4d29-8be3-03720e518edd", "comment": "Malware payload (Loki)", "value": "dede01987790ae314ea4373ae142e11b2ef68f184f67d9c3efdf97c48a6abad52d9d89e75768ffc104f9347ad393da48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818754, "uuid": "3edc7d65-79b8-44f6-b150-e580791d4b5f", "value": "T1ACC44A85D5E255B0DC589BBAB932CD385F26FDAE9835A4AD14CD3D3B3BBF2920015023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818754, "uuid": "c161a494-1d51-415a-a4bf-b9437c919dd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818754, "uuid": "f389e03c-d2e6-4261-8462-92ab0ccb71b7", "value": "12288:++asVjlma8ljR7tQQLUPhsL61291qGhP7r9r/+pppppppppppppppppppppppppz:+Ts1lJgkQLKum18g61q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644818754, "uuid": "633c69b5-337e-443a-9052-12f183c355d0", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644818754, "uuid": "c555504d-ae8a-4d59-beb6-115788df227d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818754, "uuid": "af51261d-1d89-4025-a82e-b655d8616f98", "value": "T\u00fcrkiye ?hracat\u00e7?lar Meclisi sertifika formu..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4d60fd-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845685, "uuid": "8f1d6bb3-1d14-4b54-8979-7a5caa55a45e", "comment": "Malware payload (Gafgyt)", "value": "303a7d266007e1890d4680881e22306b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845685, "uuid": "f6c745d3-9349-457a-bea9-8af5ee24a471", "comment": "Malware payload (Gafgyt)", "value": "bb998b39511a7de2d2b4994d33bc5c01949c832df86e1c40973760fb892bccaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845685, "uuid": "aa566f9b-adea-445d-9993-402945a6b965", "comment": "Malware payload (Gafgyt)", "value": "3c6a0a9e7bfca9d2fb67d08d66ab2d4010d02436", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845685, "uuid": "ff5efb2d-b5ab-4333-922f-a86001504cbf", "comment": "Malware payload (Gafgyt)", "value": "e7d5875e4f60ac95c3759d8fc2dafc56f680d2cf3aa8675ec2c994d4f15da8ec47064f56305676666bcd30d96f95e4e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845685, "uuid": "0483e79d-0dda-4e6d-ae09-2d7b60000247", "value": "T1DEE33B05EB408B57C1E227BAF6DB434933239B54A3E733095928ABF43FC679D4E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845685, "uuid": "fcc8d2be-21df-49dd-a237-909faa034a9d", "value": "3072:l0OyDaY8OR9wDK7xOht9/DF2fufM/9EObqw+5mywXuUQOde:lEDaY8ORODrht9bF2fmM/9GmywXubOde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845685, "uuid": "19b098c7-22be-48a7-ab75-39c023e5fabe", "value": 153425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845685, "uuid": "a52a704b-bad5-4c06-8cc7-e81d6d389909", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845685, "uuid": "6fba473b-55e2-445b-8802-e9d4333655a3", "value": "qbot.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9514f06-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845245, "uuid": "aa8ff655-4ade-40d0-b805-e049e7f410f9", "comment": "Malware payload (Gafgyt)", "value": "e78ff3156f45ec207a256600638234b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845245, "uuid": "5b595ce4-a877-478e-b310-d6fd712f97df", "comment": "Malware payload (Gafgyt)", "value": "bbc679d6a4b0017e98b2679d3451b46c1f3c717711a00611502dae8223301342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845245, "uuid": "a03777c8-3bc4-4f9f-83df-0361824561a0", "comment": "Malware payload (Gafgyt)", "value": "45c7c85f559238079ed7bc34b7acb396bc69c1ac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845245, "uuid": "ca3af549-ff1e-4d4e-a430-71c02f54e5a1", "comment": "Malware payload (Gafgyt)", "value": "a2d1114a04ad549a78827d4d54f8f52e6ea68ea09acc505bff6c25b9fa1d6a328e2f8fe29cb57db2935fdd1087af5ee5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845245, "uuid": "2591ed11-81e1-4671-bb29-720e1c2e5d86", "value": "T17C233C32FB220827C0D595B661F74735B6F683AB24BC4A2B3D610E8DBF50A4066676F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845245, "uuid": "cce559cc-b622-4280-8720-cb1e8b7f6ca0", "value": "768:FSTqUOAcqIzO+YM5VlNWOuU1tMOattgI7:FdU5GYM5hXt/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845245, "uuid": "a95aece4-2af2-4bdd-8e61-cb609e4616e9", "value": 48232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845245, "uuid": "8c5f3fcb-381e-44da-a878-b7ccfd0a35dc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845245, "uuid": "b0c6af66-dd68-4077-bee8-9500f369c8e5", "value": "pop.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0ca999-8d86-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644837007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837007, "uuid": "cba02b62-5bb1-4f7a-826c-1364b48ba67e", "comment": "Malware payload (AgentTesla)", "value": "c068ffe24189f07fa7d5052e5d0d54f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837007, "uuid": "668fa090-1bfb-4be5-b790-eddccf952020", "comment": "Malware payload (AgentTesla)", "value": "bc297a5178f17d2b1f7c69649155df74086c99486c2caa5a1117fd45f52f41fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837007, "uuid": "37f413b3-4939-4b38-aa46-f4686fc0ff52", "comment": "Malware payload (AgentTesla)", "value": "a1c977813bb3be028dc52f74155402d7902d5ce8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837007, "uuid": "6c5d862f-8943-4a9b-a905-6d8b8177e82e", "comment": "Malware payload (AgentTesla)", "value": "8dbe6faf871f4fa6b5805d92e3cb0cb252e36fbe6c5c71c47ba8d586e53aa3d852c139e5ec5426bc8000f215d2d4d780", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837007, "uuid": "a3b76ea4-b640-4250-af21-5ad96d1efe09", "value": "T11D1502017BEBAB23C57B0F7BD4A1514157B0EA4A615BE73BA4D136EC1C8B3580E32276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837007, "uuid": "1e897062-ae8b-490e-94cf-f921c25fbeb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837007, "uuid": "852d783e-f5c7-48a0-a7d6-5d8c913471a7", "value": "12288:zOR48XeK3YmIdk6OnhpLNPd/EhfVjGF2EpO3wBm3BvWmGG3Mk/JDq+PmHkZ+EcAu:6B3Jodi4z1eiw8dWdG/VPZ+ELyU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644837007, "uuid": "3d4595d6-6635-42da-baff-71d6b69e7771", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644837007, "uuid": "7d1eb82b-8237-43b4-b8e9-a0cb5fa88cf3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837007, "uuid": "8286c2ec-0d98-4356-a314-5df724ad84e4", "value": "Curriculum Vitae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab4d94d-8d32-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644800848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800848, "uuid": "4fc21103-4f9d-4b6b-881c-ede9690e3ea5", "comment": "Malware payload (Loki)", "value": "977c99c08531964f82f9507061aa240f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800848, "uuid": "6340b5b3-02a5-4417-831f-92d7a0ee46ad", "comment": "Malware payload (Loki)", "value": "bc4e9db6c6cc42bb03d7257abbf2105e1ed6c4fe24ccaabcd3db84fe8a935c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800848, "uuid": "277c12ce-e908-42b2-92ce-27959ab7e5c4", "comment": "Malware payload (Loki)", "value": "551ccfc5a19d58c6887f54c7d2892b20bd42df55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644800848, "uuid": "11f9a0d6-3cb2-4539-baf4-0528d567ff1b", "comment": "Malware payload (Loki)", "value": "4950f63a87a9be67fd812e2863faf4997e36a0dadad9aed770ad49f9dc570ae9d08101341fe7be79335e7cafb7a13339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644800848, "uuid": "03b496fe-358c-4933-b24c-de6228e37a81", "value": "T11FE42368AFE95333CAFA577E60A3A51647BDE81B6452E30E1AC090D118737C09217F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644800848, "uuid": "536e4b44-ef02-4aeb-97c4-cdccfaa76b12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644800848, "uuid": "35d585b9-9f01-4fe6-aa97-d59539a2345d", "value": "12288:IzQwcj+j4dvZ52VDlx3g/SQ4Y3SBC6DxzoMwQOA9KfvCPVFhGJWBNhg2xLy3W:E6+4Kjq4Y3SdFoxAUXCPMJWBLg2x+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644800848, "uuid": "671ec0d8-9357-4ca3-95a8-6a6c3dae8cba", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644800848, "uuid": "13a9fb58-e155-4bd0-b9b4-64685aa86be1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644800848, "uuid": "ba83441c-756f-42e7-a185-6471e1978c05", "value": "PO 220211-032A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a3540c-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1644855121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855121, "uuid": "19fff753-ec05-41c8-9f49-695b305e6cca", "comment": "Malware payload (IcedID)", "value": "791779361e8db64ec7fbeb8b82d68ce7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855121, "uuid": "f59b8787-db4e-4816-bc85-84d9f09b1d1e", "comment": "Malware payload (IcedID)", "value": "bc6a441a3036c1310886b671943e487d47f2c7d1b4bd125d7b0cf0f3090b8281", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855121, "uuid": "f4de2c22-4bce-4074-9852-7e31a85bf5e9", "comment": "Malware payload (IcedID)", "value": "8632bff9f308fa57ae5bd1aad56b5ec8ff91f466", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855121, "uuid": "92ec4f10-95b7-4120-806b-07b284e014d1", "comment": "Malware payload (IcedID)", "value": "003ebc29577ca7ad001e5835756d10a9f074bda711d1c9a800e327e3401b08507c0a86be1130558dc231a2269fdc7179", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855121, "uuid": "94569876-2e13-4336-8141-4a7e19e1b5b9", "value": "T191C4BF65767505F5E067953C88734902D7B23C71173093EBA3A5B21B1E3BFE06A3AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855121, "uuid": "f4088b41-d708-4e4d-b7bd-95e4db970469", "value": "b5a81cca6434169cd57fee19df69c17e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855121, "uuid": "fd636c47-675c-42e6-abfa-d0744157840f", "value": "12288:1p5lV8LxIGxW79Bnoe7WlQg80K8cb7rsO:1zMOGxWZBnXtg6d3rb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855121, "uuid": "fb31475f-acc3-42e7-b385-85921798d0c1", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855121, "uuid": "52b42b9e-dda0-457d-a1d7-5cfe6699fb42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855121, "uuid": "344196a5-9110-41cc-9d04-4df05e8efaac", "value": "loadfsc2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ffa8fd-8d97-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644844253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844253, "uuid": "b12bc29e-6e7f-490f-8b30-c8f148be003a", "comment": "Malware payload (Loki)", "value": "f25e44d567f2db7b333e556eab7fdd48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844253, "uuid": "8d61d203-4267-4437-9857-188895aa5cab", "comment": "Malware payload (Loki)", "value": "bc73d44a8507c613c7ee7880a140def5c6adbab257a9d0771613eef4b4221653", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844253, "uuid": "2f56f8a5-b4b8-4b5d-861c-6c86b88d76d9", "comment": "Malware payload (Loki)", "value": "031dc766db7fe746da9969d5c3d468cc432866fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844253, "uuid": "8db4c58a-7c13-45ac-869c-ac33e6ee07c9", "comment": "Malware payload (Loki)", "value": "ba04c7499ddc5fc415edf41b802b7da01123b488856d3b23d1388ba7dca6edbba9987b8bbee73b2075bb0a9fbae63189", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844253, "uuid": "32540975-2aad-472e-9b24-2ed7a457555a", "value": "T1A1C44984D5E251B0DD5897BAB932CD385F22FDBEA835A4AD14CD3D3B3BBE6920015423", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844253, "uuid": "bf187ffa-188f-48e5-8270-78a8578dc0a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844253, "uuid": "6aa147d1-f89c-4aab-9a65-6f011eb28a63", "value": "12288:ybaasVYnLL52fvNvB6tG0xmkfg/Qa530UKP7r9r/+ppppppppppppppppppppppJ:ybPsk52duxmL/Q+ZK1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844253, "uuid": "03a15b9c-8d2e-416a-9c6d-3684a00137dc", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844253, "uuid": "5d98abf1-51fd-400b-8e91-69def62f5943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844253, "uuid": "ae277466-bfb9-4dd8-b837-ab7e306f0387", "value": "Pedido laboratorio Biogramasrl.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b7a4fd-8dba-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644859377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859377, "uuid": "3d69a694-3be9-4a01-a750-53f1e100874b", "comment": "Malware payload (AgentTesla)", "value": "b19ce63e57501aa9390c68b7d3458a8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859377, "uuid": "e486d992-9af4-45ae-995e-2389085c3c5e", "comment": "Malware payload (AgentTesla)", "value": "bd09722682d6e0e78b3de5dc4545bf5f5c0d1493cf2954e8f3db320845410421", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859377, "uuid": "5eb953e2-fdc0-4a06-bfe1-a9e8b9c1e5db", "comment": "Malware payload (AgentTesla)", "value": "492b9b1088bd75e7da512766c4a56e5d426e7e21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859377, "uuid": "7f2bd4c4-1515-4a46-a8b1-617fcaace5fc", "comment": "Malware payload (AgentTesla)", "value": "6bdb7c7778e94fa9c5f0b38f5327408ea40a86e55575ec2817fbaf4543f01ae9dde7a2f155596080929010563ef83a5e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859377, "uuid": "29c9107f-ab0b-4138-b537-c9982010f1bf", "value": "T153B44A9D31A231FEC857C4BBE9A49C68AF60F97B830B9297901311BC995C997CF540B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859377, "uuid": "96a60ecb-3b0b-4ac9-b189-4a4cdae4551c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859377, "uuid": "2a715043-d858-4f53-b121-8200aa2bffc0", "value": "12288:xYqimwr0JeWVObLhRv8rGw086S+USV0YDAGyDlEHbHVU1JasV:Limwr0gWVG8us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644859377, "uuid": "695e5edc-c8ad-484f-9eed-86c0255e1af3", "value": 530432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644859377, "uuid": "e8a338cc-41c3-4960-9621-b1e761c18e78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859377, "uuid": "1874259a-352b-4c68-839d-6172e368e743", "value": "FTT # 13668 EURO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d1ead4-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644822454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822454, "uuid": "9d3bc538-f223-4b2a-a825-483c677570ed", "comment": "Malware payload (AgentTesla)", "value": "d7313e58e78dd3a83a2b4bbd873785f3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822454, "uuid": "9bdcbd21-2c36-430f-9bfe-bc1f8a957030", "comment": "Malware payload (AgentTesla)", "value": "bde88ac76873a58778ede3238c048dbc89fca1a4e9d9ba8bc01415a99dc43616", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822454, "uuid": "eb8c41eb-77c5-42e5-a35a-620c4da4a693", "comment": "Malware payload (AgentTesla)", "value": "b06a88b1b578f3827cb557d460da8f87f754360c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822454, "uuid": "e3cbe44b-79e3-40a3-8439-0cc4b7294253", "comment": "Malware payload (AgentTesla)", "value": "0f3d1d47621d31b2346985a529973fbf77dccb4510b176b7ec9749aa22db4f747abc040c92b6e2e10ecab8ada5f7ab2d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822454, "uuid": "f0d4bb8b-680d-42aa-b784-54af525a3df5", "value": "T12B14120839225BA8FB51C272E4D84E58F266ED0F8D1CB96553AB782534BD907D031FEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822454, "uuid": "f98ca09a-9416-4450-92a0-e485d0611e0d", "value": "3072:ULeQuv1AQjHLVpQXed8wCFlLrdsxiOwYwVLXpH0tFSc0LZNgc7dFxj5vXa:7tNjrYXIC7LAsjpUXSIoFxj5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822454, "uuid": "ea28c45a-4228-43db-a3b5-fc178150fcd8", "value": 191848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822454, "uuid": "8c033349-794c-4a5e-b35c-6da392c58308", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822454, "uuid": "eae47efe-783b-43b4-b077-fe766b83ad39", "value": "Doc7367474.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7dcdb1-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845229, "uuid": "698366da-9f8c-4534-8cc6-0c6e5e6ae9b7", "comment": "Malware payload (Gafgyt)", "value": "aada5309c96a6595eb0e849937f09cbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845229, "uuid": "337e9e44-9a2f-46a4-ac69-5df0b72efc10", "comment": "Malware payload (Gafgyt)", "value": "be959d50809be8902fa9ca380030f63bc9157b45e3736fa9d1650372fd467257", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845229, "uuid": "7e66f849-04ae-40be-9f75-00e64506e052", "comment": "Malware payload (Gafgyt)", "value": "21a1d1aff4278dfad71e5d971c3b93156b6f58d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845229, "uuid": "829a566c-8123-4513-b35c-3042d712af82", "comment": "Malware payload (Gafgyt)", "value": "43977183191eb9d3850d2cc6264888381bc56821d277f03f4626e77c0b795eede09372bce61f0093894c0df50d2e496f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845229, "uuid": "2e9f92a7-2bff-4fdf-8e58-369c33c848db", "value": "T12B331997F900EDBAF80AEB3B44571006B271E3B645921A3233A3356BFD751A90477F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845229, "uuid": "34b93669-07eb-4287-808e-130d9ae74ec4", "value": "768:86FP2B7/7HMeBav84mX6vCPb4R7V92tasg4WUDGpIMtEI6dL:e7TF+8H6veb4RDcasg4WUipMtdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845229, "uuid": "e019ea71-9e0e-4b87-a6bf-7d9b7b0186a7", "value": 50856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845229, "uuid": "6fa8fe13-813c-44de-84fd-254060857522", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845229, "uuid": "cb74dc6e-13d8-4b30-b739-e441ec4d044d", "value": "pop.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ac876a2-8d6d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644826189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644826189, "uuid": "728be574-edf9-4ae6-827b-9893cdbee675", "comment": "Malware payload (AgentTesla)", "value": "065ac96092822806d443a7f201214643", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644826189, "uuid": "38ea9b6e-989c-4ca7-9478-62b33eaf3945", "comment": "Malware payload (AgentTesla)", "value": "bf48cc4c185fb344bc044215fc47b55935b6545609776db739711b7d24a5cf52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644826189, "uuid": "c9382be0-ea03-481d-ac09-06457d50016e", "comment": "Malware payload (AgentTesla)", "value": "cbb589fd2fdcb60474a4616a8e1014d41c7d4c04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644826189, "uuid": "4ece221b-3169-438b-832a-9891cefc1559", "comment": "Malware payload (AgentTesla)", "value": "1f514df96a43ec20ea1b75a90becba3624593607c17c5e9679a94d1085b9a86c23a19bcd4a7cbcaf6c951d734c6ab17e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644826189, "uuid": "315e36f4-74d0-4caa-ba4c-f973deeef9da", "value": "T1F31502067BB3A655C1B60BB9E4A401406B74EE2E9547C3BF305D3D5C2FEB3A6493123A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644826189, "uuid": "a3e32fc0-f0b7-416c-b0e6-bd974bf6ed6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644826189, "uuid": "827e002c-8306-4879-8749-3f006bfd839f", "value": "24576:OBDKL8LZmSYglxecBVaMoE6jtxx4qy+IP9Dlu8hvIssgm:uKL8tmSYSxeAoMojj54sQu8vIhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644826189, "uuid": "cbbcaf9b-b2bd-43f8-bfc4-f1db50f6f408", "value": 954880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644826189, "uuid": "80040d54-eeb9-486c-9fb2-0cdc067d69e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644826189, "uuid": "7ffed725-82cd-4cf3-ae8e-3c36f9f977a6", "value": "DRAFT QUOTATION 20220130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f822eeb6-8d9e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644847444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847444, "uuid": "2ef14a88-b14f-421b-a753-9bd98ef2ead9", "comment": "Malware payload (AgentTesla)", "value": "cf43933b630a554cc2ef56903468554e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847444, "uuid": "1eef49bd-6825-450b-92af-024ad681cba6", "comment": "Malware payload (AgentTesla)", "value": "c07e2154bd7603dd3a6fdf4810a799ff7d31670747236cd1d2a52be397c0676b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847444, "uuid": "6e4d247a-7139-4f23-8ebd-297bcd935a98", "comment": "Malware payload (AgentTesla)", "value": "43a18b5850d820aa3cf0c0a730025a68ad4523e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847444, "uuid": "aeae67a5-bcb1-4e50-9edb-24991758eedc", "comment": "Malware payload (AgentTesla)", "value": "8ea15beca32c6dfcbf17a95f1ec609a625417d64ad68a3fab05f361710191d39d89dbead0a900009aacb6603ca31951c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847444, "uuid": "e0d7ddb3-fac2-421f-82a9-d4e21bc62571", "value": "T1ED150109E672A154C5B907B9E06101A44B785F1D909BE77B706F7CD82FB73C389328BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847444, "uuid": "183129f7-ef7f-4ff3-9883-ad5cfe4bc4bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847444, "uuid": "377ff011-abb2-445b-a53c-6ad6e8cc4f6d", "value": "24576:IlraWLZkjOWx5IsMcWFisRvzUaleacNiav7cO33eVGq5nr:MaWtpWrIsM2ytl3cNiWreF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644847444, "uuid": "09de285b-8b66-479a-af70-c37236fc227f", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644847444, "uuid": "fb3c80fc-e083-4155-9b0d-95968037c46b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847444, "uuid": "2d30e6d8-b458-4206-a7f1-f3971c3c9334", "value": "Q9890-REV1-12022022111759.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c79dadc9-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845216, "uuid": "1cf6f7d8-a036-4708-9289-b74ae5e66745", "comment": "Malware payload (Gafgyt)", "value": "2d043a0adc378ff15431a10f35ac2b95", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845216, "uuid": "10befa77-f005-41c8-a9de-f7ad2a536877", "comment": "Malware payload (Gafgyt)", "value": "c0ae8fa91ce02d8dddc89f9ce19516c1a4fda52580907fa0390750a96017a3d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845216, "uuid": "b070ac90-91ab-4c29-b3a1-d18d2c6532db", "comment": "Malware payload (Gafgyt)", "value": "ee6a96761c09d05a684235e9596168dc492594a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845216, "uuid": "14b708f5-49e3-40b2-a434-687d33f5195a", "comment": "Malware payload (Gafgyt)", "value": "97859459036612763c96b19b1f280a47325041440d285f86b011bb8ec21b891ba9b99180dd3cc4a9c3335ad28318988c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845216, "uuid": "60dff3d7-40e5-439e-98d8-368397f71c32", "value": "T16282F843F602C6DAC2D0CBB6274B9B4835969375CBCE3653E56886507682F0F4E7AED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845216, "uuid": "a8b89c0c-7291-4eb2-a6a9-a0f64eb6fd70", "value": "384:fH2/XyMDB5YMuI0qpHq4Knj7cV7AYuqB:fH2/XycsqDHqxUFtuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845216, "uuid": "0d58d01f-d76e-4710-b797-a6e394639646", "value": 18068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845216, "uuid": "02da68f3-417d-4d49-b63e-9be32587f0c8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845216, "uuid": "2447d41e-8a8d-43a3-b89d-ec974f3b245f", "value": "pop.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8656b7-8d7b-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644832315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644832315, "uuid": "e21603d2-4452-45bc-abdd-928c701865dd", "comment": "Malware payload (AveMariaRAT)", "value": "e4dc566243b6594872d8f84c1e97e464", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644832315, "uuid": "bffe2c55-f516-4e4d-b2e4-d2edb5cf2b21", "comment": "Malware payload (AveMariaRAT)", "value": "c170541f8e735bd55f0b18f88e5352d293103b4f24c300aefe767096725991f4", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644832315, "uuid": "a77e0477-9afb-408b-b476-1326927f43da", "comment": "Malware payload (AveMariaRAT)", "value": "0f45507d3620b34cc9652205507c66a72f2b7c2a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644832315, "uuid": "c9a79e61-2652-4270-84f2-d60fd8f2890a", "comment": "Malware payload (AveMariaRAT)", "value": "1ea5ed1af9a7b854268d21340d7c9ea5082098421375723d99f1a76a212e5b65cd7f4fa9b35059b36a5f4504d589d16e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644832315, "uuid": "cbad9f2b-2b2b-41ed-9539-e46060d0a59f", "value": "T10084126534D1C4BBD84A467098F78BA2E2B36D0011B5164FB35E7F9B337B0A3A03A791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644832315, "uuid": "ee317424-1f81-465e-bddb-b6233042f845", "value": "6144:SwekOYizw6HTW9DMum2kUzCZwwI/b6xQkOB5MverfLH:fpN6zW9DMXXLIT6ygmrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644832315, "uuid": "56c7979f-81b3-4122-a552-c7571fad5266", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644832315, "uuid": "a7dc49c9-7562-4204-b8f6-65985e5607c7", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644832315, "uuid": "9e7a2060-d6b3-4fc6-b378-749e82010091", "value": "nowe zamowienie,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6edec8c-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845241, "uuid": "c8e7efba-4d3e-49f7-abd9-33a9ad72693a", "comment": "Malware payload (Gafgyt)", "value": "03839e9afe27cdda6e90a0955982d1b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845241, "uuid": "70323d3f-86bf-42fe-9c0e-7728ef9bddec", "comment": "Malware payload (Gafgyt)", "value": "c26ff75cdb9c0adec5966536cbf4cdc0bd081f07e0ac68f30fffcd943c56ef0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845241, "uuid": "4ae765ac-e375-455d-99b6-a877114f110a", "comment": "Malware payload (Gafgyt)", "value": "c6cc8e1c0d8425187e9579e97854a8f1d04a4129", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845241, "uuid": "d5499f90-36bf-482a-8945-86699ffd4fd0", "comment": "Malware payload (Gafgyt)", "value": "f1bfbe35fafd7d9509e8b24b3216f173177e1b252cf751de6874aec8400f8dc240beb99df0635657d6abdc1bf54881da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845241, "uuid": "149f9b14-a384-476c-a82a-18bf6de98d43", "value": "T150036C73CE272E48E28989B070215B3497639269814B1EFF3676C265D443E8DF66B3F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845241, "uuid": "ebfc02f0-54f1-41d6-91ad-c252c3404a0e", "value": "768:tis6f0xuKOAcIaJo6TsIjC+Lg2Vfl8SOtTI:UsmKOAcTO6ljC+98x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845241, "uuid": "10d9907c-9b87-4dd8-a1f4-38b3edc7e99d", "value": 38668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845241, "uuid": "4b765d40-4117-46d2-8503-4209dc899c98", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845241, "uuid": "94b212f6-c32d-4cf3-aff0-df8c895bbcc1", "value": "pop.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c5c7aa-8dab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644852917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852917, "uuid": "015d7923-9edd-491c-b6d0-985054e42738", "comment": "Malware payload", "value": "f815460a3b151580ceb3c8e0d215b0d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852917, "uuid": "5b78f28b-7d88-4d15-835b-47284f8c44ab", "comment": "Malware payload", "value": "c2f76e34227617a9aa475527a8f68ae5ae2b6a3d9ae2eca6af050570ca6f2538", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852917, "uuid": "63f604be-5fc7-46e8-9c96-0422e5d38604", "comment": "Malware payload", "value": "af69d26631dd578317a5dc42f35cd886cb8d831d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852917, "uuid": "1e360c17-00bb-4d23-982e-0b4466657cff", "comment": "Malware payload", "value": "ffe486005e6f7c8d0784d14e8ac711598a0d9e7fd1b7f872877cd0eb41a18a6a9e78995bd6eb095e840c67d67dac1b63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852917, "uuid": "9dff1497-74d5-4e2a-adac-dda0ad67978f", "value": "T1B413E1ADAD4E6D4ECF4D5EBC415E2D29CCAE75C132EF0E58672C4C90AA4440EBDCE0A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852917, "uuid": "f7500939-244f-42f6-acd4-1ee92e37bd62", "value": "768:DR/S41RBveiVob60wXEZftci3gxXGkv7EByNIi6VidKBoCDJ3RWRA6PqeATABJQ:DR/S2Teii+fENNct7EByNIisiqD590oT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852917, "uuid": "c777e7d7-b973-47aa-ba35-02bbf885c2ee", "value": 42376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852917, "uuid": "2977b771-4025-4a6b-92e4-81ff24dea7e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852917, "uuid": "6a96544c-4512-4214-bd61-d20b49e0e41f", "value": "f815460a3b151580ceb3c8e0d215b0d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ededb2-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644861904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861904, "uuid": "dce4b6c4-644a-4e20-b2f7-6bc52b7d9930", "comment": "Malware payload (AgentTesla)", "value": "e934f67ceb739de8ad7ff300783fc962", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861904, "uuid": "6ae22f68-fccb-4500-b48c-0f1a5d00d2f5", "comment": "Malware payload (AgentTesla)", "value": "c2f845522bd4c5c8f5cd282843a13e56f8deef0b24627fe92e3157a8be4a718f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861904, "uuid": "9ee1ed5b-9168-493f-9187-d2e660c16f89", "comment": "Malware payload (AgentTesla)", "value": "3711e906f32c6433128d22611a228c81deb61002", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861904, "uuid": "ff0e8383-f403-4e16-a03d-9775d97dd778", "comment": "Malware payload (AgentTesla)", "value": "650284e0324f678851cce5c9f405e9bf748776e289a95b2bacf403cca8144c241bf7fdc5081f97995e6e2075dc769db1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861904, "uuid": "17a6e777-c3d8-4062-becd-d1bff8b0165a", "value": "T1631502017BE2AB13C5BB0FBAE4F141112B70E54B555BD73BA89132EC2C8B3691E72635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861904, "uuid": "161a73d5-1db8-41dc-a0a3-c252267b363e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861904, "uuid": "9e7b2ec6-f289-44c9-83e4-b97b9069f549", "value": "24576:YxZ67lVJC8pxrvIKrs5tgIjmPbBo8QhGG:YGzDxrAVtgIjmPbYhGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861904, "uuid": "8c9b0171-162b-4598-96c0-0a80a9c7bff9", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861904, "uuid": "982995a9-8bc4-42a9-8ac6-539039011daf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861904, "uuid": "d642d2d6-c8b1-4b0e-bc77-63a04f8325e1", "value": "e934f67ceb739de8ad7ff300783fc962.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cb8c11-8d73-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644828603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828603, "uuid": "ec5805dc-def5-45fa-94cf-b23f58ce477b", "comment": "Malware payload (Mirai)", "value": "4f6e24ca76095be759eb87bbddf9495f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828603, "uuid": "31eed318-2d31-4904-9095-a4ea8c0bfce3", "comment": "Malware payload (Mirai)", "value": "c386dd6cf90ce22ad29df5aea434bf615a3a13c960199b3d9d4af83b2da3d2ec", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828603, "uuid": "3555b9d5-f844-4661-98a8-8e43b0ef569d", "comment": "Malware payload (Mirai)", "value": "3b83c25e5d85757887de2e93c41fbdc1c9a795c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828603, "uuid": "2b9e070b-b3ef-40ae-a57e-28da8f13d8fa", "comment": "Malware payload (Mirai)", "value": "04e56a139dc6fbcabb1904fb39cd097bfa3f91544b72f8e76b87bc9a1f43400b43e0c41df366a4cdb382bbb902f81904", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828603, "uuid": "7584a114-166a-4b74-9234-bb83ae4d1269", "value": "T175F33C46EA418B13C1D71776FA9F414A33229B94E3DB730689286BF43F87B5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828603, "uuid": "0b40f43f-971c-4fe6-9dcd-b97b9b3ee8b0", "value": "3072:dUW6GNytqhMwDh4uaWGLKWdwffuSFYEJPdslWM/9OalM:dDVytlISuaWGLKWefDDJPds4M/9OalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644828603, "uuid": "1ce389f7-2492-43d0-a6f5-6c3859324262", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644828603, "uuid": "d58901e1-6612-45b5-a623-cbab52905551", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828603, "uuid": "bbb69197-144c-41f0-9fde-f60ac01632e3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3c7b0b-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846087, "uuid": "d970a12c-0024-448d-8176-8fb30d6e64fe", "comment": "Malware payload (Mirai)", "value": "b5af8532e7169fb87cd33842d976510f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846087, "uuid": "dfa4f6e5-88cd-4e94-b9f1-1e77ab9f9449", "comment": "Malware payload (Mirai)", "value": "c3dc1f4bc6160c851d47b7235a983c705f04c3a168e30763c463a626529e6e9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846087, "uuid": "c958341c-d812-423c-bc59-51c0d468eab8", "comment": "Malware payload (Mirai)", "value": "b14f9f9656db30836b86d440abf21bc84c64b781", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846087, "uuid": "d2216133-6a76-4932-a6f7-e61e8590f7cc", "comment": "Malware payload (Mirai)", "value": "fcbe0cc9557901b436ef07443d5864384ccb3f295c46bd82a82b3409f3bd868c68df35e994ce896ba3624109377f20ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846087, "uuid": "02c84ab4-3fcd-4276-b5e7-3f02add314b4", "value": "T1FDD3C7176B508FB3D81FDD3706DA460120CDE55A16E87B6BB6B4C92CE78A84F09E3D84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846087, "uuid": "eb0acf78-9ef2-432a-a238-0dafe68681d1", "value": "3072:oMiqcUkF9C5e45h2k+xaKNF3xemqY1fuBmvm:oxqo9ce45h2HaKNF3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846087, "uuid": "ec8e2f15-d088-4148-98cc-4832186382d4", "value": 137912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846087, "uuid": "86554ae5-b18a-4b70-9132-edfa302e2ecc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846087, "uuid": "5a48e4cb-af20-4071-903c-baafb01b7bf2", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a959306d-8dd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644868787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644868787, "uuid": "c61c5040-7e3d-43be-9833-638d9caf9dc3", "comment": "Malware payload", "value": "a1821c7c405965f78f1bfc9d2b8855d5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644868787, "uuid": "155359ba-a9f4-4263-aa6b-29fb7a9fcda4", "comment": "Malware payload", "value": "c4b1d5a644c67326fcf89c8df366b3b95892dc2524a8f018f8a9fc7da7ef8e75", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644868787, "uuid": "21855323-a894-43b2-81fd-2a4ac9d8b665", "comment": "Malware payload", "value": "4ac52ad03104b08c0622d774da1e5e0c832a0485", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644868787, "uuid": "1a33c984-c9d4-457e-9c06-3ca08a10f7cc", "comment": "Malware payload", "value": "05cafa78ac0956f7b902bbab48f9bb5bacd3bfa09bca616b64c9b1395594d72de827a6b9347d8e9608a315ec28539ea6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644868787, "uuid": "8bbd34d2-b2c2-49b1-a1b1-69b439949b8f", "value": "T1EA35270DAB948F75FC1D013894DCDB79A999EC3B4A504F062ED2EE7FB5B61824C18D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644868787, "uuid": "3c42a568-c9bc-44ad-b196-61ee5a22213c", "value": "e140b4188c69c3bb4852b94813f9ec7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644868787, "uuid": "9326774b-cdab-4bee-9a62-540cf91cf414", "value": "12288:aA9e3OrvpgqjtQFecW6dddifiHxoB3rNPVvoS5kFIIm2mR+0:blrvpgqj2FezQc3rHvTGFIIm2m40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644868787, "uuid": "28cf2512-619f-41e9-b5c6-ebd694ad4bc5", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644868787, "uuid": "45bfd8e0-c05e-4af6-9e43-7188f651651c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644868787, "uuid": "979681b9-67bf-4993-8b6c-59f2b2e49267", "value": "emotet_exe_e5_41c29283a428cfcbc71cc76fa57233e2d04752fe1b4c7369ff9172b45a242d9d_2022-02-14__195942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd33674f-8d71-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644828018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828018, "uuid": "4bd1be43-edd5-4c08-8531-35bc2a4f809d", "comment": "Malware payload (RemcosRAT)", "value": "bb662e82e04ac3c7866cba446c15ccae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828018, "uuid": "23a9e084-5e97-4496-8410-e00e344942aa", "comment": "Malware payload (RemcosRAT)", "value": "c530ab34e439bbcaf995290504072a5f77ec085e2ef485e4ef324b7a957f5738", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828018, "uuid": "e4e9387d-4baa-4208-9182-e6071495fbf1", "comment": "Malware payload (RemcosRAT)", "value": "1b90f8f280d5d90c771aa0afe393b29c4ab8e2c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828018, "uuid": "c6057bbf-c5cc-46bd-9057-6923217aad9a", "comment": "Malware payload (RemcosRAT)", "value": "a6389f3f27c35db9aa41e7af70f07e4d357a53288f95dc7469e04fe07a7bbc6d96b52eed4cbdd888395e91f5f138ae5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828018, "uuid": "b0bfe55e-9c6e-49c3-815f-e973097054f8", "value": "T16CD4CFB1EAB18453ED5E09FBCB32492530979DF9DAB0033B96AD76A51FB32811071D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828018, "uuid": "8b7854d2-d5cd-4086-a396-0d40b2baa41c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828018, "uuid": "186f9717-be45-42df-9de2-3d32ff2cfba5", "value": "12288:8oIzAxAjLyVG/QGlGwqC5/3z3P4I3xJRKY:EExM+8IGlThD33xjKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644828018, "uuid": "3c60fedd-fd35-47cd-8607-e992349d021d", "value": 614174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644828018, "uuid": "46610d1c-b47b-45a8-822e-a54b70147fe3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828018, "uuid": "501f761b-4fc4-4d71-a306-682fedf570a9", "value": "bb662e82e04ac3c7866cba446c15ccae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7261a21-8d35-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644802238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802238, "uuid": "7b0d04f2-afc5-4fe6-b9bb-6e7880f2c796", "comment": "Malware payload (NanoCore)", "value": "9db971c6ba92707e441506ad96620746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802238, "uuid": "d83f4a36-727a-4563-acdc-87fb064989be", "comment": "Malware payload (NanoCore)", "value": "c59c8e3be7ec42553ff6af2588e3bcd0569e9467dbb9307218fb8724e02739f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802238, "uuid": "f333cf7c-d6e1-4cd2-b916-40a00ad4735c", "comment": "Malware payload (NanoCore)", "value": "0b8c7553a2b7001012ee01e969fa3d716b85e3e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802238, "uuid": "51e697e9-cc28-4739-a38f-00cc90fc5745", "comment": "Malware payload (NanoCore)", "value": "a9c001a074853466a6eab7b95746494d7af5bc61ac2390e427f700ce4239bba76450ede1eabfd388f0a96385f3658152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802238, "uuid": "0be1fc4e-7920-4ec9-8957-8ee79aa4af2a", "value": "T170151209D7726A90C1B407B9E4E180449B798E2DA05AD77F71AF3CD82FE7387893107A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802238, "uuid": "58cbc9e6-8f22-4c0c-a590-ef0cd8da62a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802238, "uuid": "8c62c2df-edd2-441c-9e90-dc70e514a244", "value": "24576:Llzt+0LZez4JGsAXI33nOGKMy18AgWa4y:p40tZJGsvJy18AZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644802238, "uuid": "db61487e-7474-4fa4-8ccd-2fdf94ee7c66", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644802238, "uuid": "d0429799-f200-483d-871a-cbb2cce92cd3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802238, "uuid": "82e15680-2062-4da2-ab1e-8193c98c5bed", "value": "00000756438954167908653456897532678965.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017149ba-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644822979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822979, "uuid": "ee9200f6-f24f-42ad-b2ef-06973a5332a9", "comment": "Malware payload", "value": "ee46e4cfa1cd9adc588295de178ed946", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822979, "uuid": "46b46223-ca1e-4130-8dd6-a0c92daa884c", "comment": "Malware payload", "value": "c5b21478cf997b38a6eb3499240b57be69e2d7cf6b43de9fdb2b195a93943c79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822979, "uuid": "d76e2893-b6d6-4a46-94ed-587bf8865f6b", "comment": "Malware payload", "value": "0e54d3c34ec69b20d4714be6c928cdfaa022a52e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822979, "uuid": "864ba267-8e70-424d-9154-505c31130286", "comment": "Malware payload", "value": "0d8527ea448730ba47354676ef0bd37b2e94a1e11b12cb94d71d9bc9d80612151c70e8df5bd8592039bf56c7b2aff360", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822979, "uuid": "f30c0d57-b71b-4b10-9fb3-43c86f1ac44b", "value": "T1E9B5338C2C52A059F8719FB629F8AD8F0D4E1E5016414EF3894EA9F89ED801F9FF941D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822979, "uuid": "fe3365a5-a1b0-4449-8dfa-a8b4f5863696", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822979, "uuid": "85427e43-7c3c-4d3d-afcf-8fc35ce47517", "value": "49152:nIx7+gw4C4VQymJE+0fKHZGT7nBH5h9eNtqxoPsITo+s/Sr:E7+x9qmJb6uA7nBZho0R+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822979, "uuid": "ebce79d6-b4e7-41e2-9b79-0e76baee1ed4", "value": 2488875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822979, "uuid": "2e4b3504-afb0-4a42-874c-41e854f5c729", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822979, "uuid": "cf631d55-73fc-44df-94c1-1fe0fddd7430", "value": "ee46e4cfa1cd9adc588295de178ed946.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edd57417-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1644855158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855158, "uuid": "272e2239-640c-456a-b6f1-cd94502649ef", "comment": "Malware payload (IcedID)", "value": "7d1233f06811c1baaac3cd45ac6248f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855158, "uuid": "c5bbc9e5-119d-4a53-8da2-371691dc80a2", "comment": "Malware payload (IcedID)", "value": "c6765b0c795af907637ebc5e0703a285b44041e96d43e81922f8601a2346cafa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855158, "uuid": "b2f06f82-2568-40e3-9cf8-b5467315b83b", "comment": "Malware payload (IcedID)", "value": "a8a213d13e6e91954bd7e46158bf96ef52695bfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855158, "uuid": "6f9496e9-854f-4396-a7c4-417a88e9aabc", "comment": "Malware payload (IcedID)", "value": "7a814ccd668c0b4deb7fd134cbbdb16cac79ebfa106f5f99375d52149dd5939d99b9c35da9a0fcf6caa3dd2dd90168a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855158, "uuid": "52693d6f-1a55-45a7-9fc5-1d49eecb7a27", "value": "T1ABC4BF5526A409E6E077943888734907C7B27C72177097DB93E2727B1E3BBD0A63AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855158, "uuid": "8142f15b-b9a0-4746-8518-96a42fb1a376", "value": "9c098f488680765e44c6773defc21449", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855158, "uuid": "aef3d2eb-9c03-4400-a2b8-81b7210b86b5", "value": "12288:b+vuC7dScPPVP0YChno7GbWCokimAM3lbEEn:b+LZJVP9Chn0GbUkiXMRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855158, "uuid": "4260daf2-b8e6-4cd2-be91-fc06ffd66b51", "value": 596992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855158, "uuid": "208d7513-d20e-4281-bf8c-b7e79d9e72cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855158, "uuid": "f25bcde6-7b2f-450c-b471-81b7fe9ab8c3", "value": "loadfsc3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9baa534f-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644861892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861892, "uuid": "fcabec3c-5006-4cc9-85c4-e9f8702f9e43", "comment": "Malware payload (AgentTesla)", "value": "6623bdd75fed1aab522ed135be6f14ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861892, "uuid": "8f26b4ee-83f3-4507-b9db-0c784fb245ac", "comment": "Malware payload (AgentTesla)", "value": "c7306a5127ceb855a0a1c821756df7c06a8fa143a09217ae03c92acbfb95c1cc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861892, "uuid": "f81e10cd-f9ca-4fef-9f32-87b75db68ea0", "comment": "Malware payload (AgentTesla)", "value": "8ae959e58b3d22c57f577cc22c0afeea9cade7cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861892, "uuid": "c6842e12-8ba6-4a5b-bef4-97a76da0da5f", "comment": "Malware payload (AgentTesla)", "value": "f1b3a68d3e3bd29e959cb850de57806e77bd30e71a72a3f2a55e177eee3659d6fed39d511dc5c8ab534215e23ce1d1de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861892, "uuid": "49f15397-ecb4-4831-9f4b-84725fa6dfa8", "value": "T1693522107B37E1B9C5B103B589E2CABA22F85E8D9063CF7FD8B370CA143269154795B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861892, "uuid": "d0d28b56-8522-40ac-a98d-c0cee0ec07b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861892, "uuid": "4166fb30-f788-401e-9194-7c69ad697a10", "value": "24576:Dgm1FRBv0jXTQIhgC4GhFkmiTAfPRypv47mXYb36lH8xSYtFGGU:DgCFR50jXTJhg5GjkPTAfPeQlbUISYtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861892, "uuid": "49090e92-955b-4b89-ad4a-cf695c76e80a", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861892, "uuid": "f1562ec5-7aa6-4e7a-88aa-897ef320032a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861892, "uuid": "157038d0-a37c-4b7a-862d-bdccdc23afca", "value": "6623bdd75fed1aab522ed135be6f14ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17abbe45-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644844491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844491, "uuid": "791d9fad-24ed-46dd-900b-657ea465a654", "comment": "Malware payload (AgentTesla)", "value": "a0f94d817c473f781bdc1ab97743d76c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844491, "uuid": "e8226233-5085-462f-a0b5-651ced5521a3", "comment": "Malware payload (AgentTesla)", "value": "c7965a9dcce272289b0c211ee34f28ea3c6065daec618bbc826c20d58e686323", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844491, "uuid": "35a0cd9f-d2b1-47c8-82da-2b3b0d42b7ef", "comment": "Malware payload (AgentTesla)", "value": "ad4685a957a226349ce822a18000943d6d3eb516", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844491, "uuid": "80c7de8b-64f7-4b58-9c7a-d80b0e20454a", "comment": "Malware payload (AgentTesla)", "value": "cbe39cfba6944cb7618ecc78cc9e3848dcbd0d0eb475aecb558d3791c5dc88d89e37e43892979f2695ae021ff43fc898", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844491, "uuid": "1cf95e2c-04e3-4a6e-9a5a-55f5b4c028e6", "value": "T1C6141240BBC85E4CCA798E356A6E3F925321FE05854A4945F7DBF28E64F263C09908F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844491, "uuid": "a96f00fd-fa88-4191-89f2-f5f4f58dab32", "value": "3072:4FCQUYD/BiimOIOJqHLRJOH7RYqE4cShIOnKaCkDR3gHzlHFuqTRQFWE3y5sArEJ:7QU3OI7HLTVnxSYavGGqrE3yneNcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844491, "uuid": "371267c7-85bd-4d54-a6c4-91fa103d4c13", "value": 191496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844491, "uuid": "d70b0f0a-355f-445b-ae12-81484419f17e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844491, "uuid": "984a8366-74c9-4291-8eae-0562f1d6615e", "value": "new order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc3d5f9-8d69-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644824474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824474, "uuid": "d20ce4e6-e2b4-47b6-94f2-b8d7a57107f7", "comment": "Malware payload (Heodo)", "value": "bb30d399dd839c140b0803851c6392be", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824474, "uuid": "fb47ccba-5fad-496f-95e4-68a33190b361", "comment": "Malware payload (Heodo)", "value": "c7c5418b9e081b1a5fe8813c428e4f05f35c5a1ffef26da0036530eccb0bf12f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824474, "uuid": "fc3756eb-5835-4d87-91cf-72480d8c1fce", "comment": "Malware payload (Heodo)", "value": "4529269d63baa12b903c50b5ab71d9896d2d5fe0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824474, "uuid": "73eb9ee6-c6a8-406b-8a1c-2cba0853d438", "comment": "Malware payload (Heodo)", "value": "e45d94e41549038a0f323031e6c132fefa1810c93e117744770b81833305bab5a487bb644c8c96d590d474b51be71e8e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824474, "uuid": "06d20beb-d773-4014-9f7f-3c21faf0329a", "value": "T19525BE516E9A91A5FA0B247E00AA73470FDD791117E0E8CFEF44F5A71F21CC2963889B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824474, "uuid": "5e25e409-e256-485d-b6d1-8a123c54095c", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824474, "uuid": "9d6b9842-f32e-4509-bfe4-4607657adfae", "value": "24576:vGvafwy8HdhFsvdjNxcnsnPMf9yoro8ult+s9CdRP332L67FIIm2mm:vBft89mjtMf9yok9lgdZrFIr2mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644824474, "uuid": "bfe889ee-4b15-40f8-b22d-1f1158cba5be", "value": 1000960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644824474, "uuid": "9e508caa-3fa1-4b7d-a43f-b24930c7d49a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824474, "uuid": "f7fe74ea-53ac-4238-bc1e-9da4ba44b4b0", "value": "emoc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed20dbd1-8d87-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644837548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837548, "uuid": "754e7fb4-8a93-4f93-b7ce-7033a449e40a", "comment": "Malware payload (NanoCore)", "value": "fbd485b525e40ccfb5703696ff17abe3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837548, "uuid": "5af98aa8-cb44-4862-bd15-2e0460d8dcef", "comment": "Malware payload (NanoCore)", "value": "c80bd7922c085768a632008c9db0b9dc947d60e1127debe7a089681f89e0eb09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837548, "uuid": "113d2807-443c-45e7-9731-937a4db79fd6", "comment": "Malware payload (NanoCore)", "value": "2e0a23f60b0e45c11f3e5a0226081aa635c8ab05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837548, "uuid": "f04f1aab-d8b6-436d-a155-74cc604e5399", "comment": "Malware payload (NanoCore)", "value": "cd5ace97c74102608280f31cfde90c34b8d497f95357fadda336b82bb9fb491f1c515f70c71f7a41d154bd5510afbbc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837548, "uuid": "a5d5d911-9397-448e-a6ae-b62d4f79ed6f", "value": "T115151219A7B7A504D6B806BCD4A141944BB8990E909AE3BB706F3CDD2FF33874D311B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837548, "uuid": "0ac5da6c-fbb3-433a-a8ab-0a8b5ad254c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837548, "uuid": "46eb0a77-00de-4ccb-8e24-bf0b67a7f0b1", "value": "12288:llHDaoQNkuLZ6194RP28jsldTpoGcTK59DVRldxuqivxr6rFQ:llHLuLZ6osldTptUsVRWvxeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644837548, "uuid": "976ee28d-552a-44a5-b4e7-8643176d6aa7", "value": 883200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644837548, "uuid": "507bdcb6-40d9-4202-8619-0751a23519c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837548, "uuid": "5ab3bf72-e4cf-42ea-813e-63e03bca7f2d", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07997fd3-8d78-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644830720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830720, "uuid": "b913001f-6ee9-49a2-9360-f0c916f20962", "comment": "Malware payload (AgentTesla)", "value": "4fd77c1112957894f46d795b0847fe3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830720, "uuid": "a7b0cc35-d5df-462a-8694-198c58ac67fd", "comment": "Malware payload (AgentTesla)", "value": "c8689c7b138ff22906456196e8b73c216ce3bd08f7c825f43006a636aa58ea25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830720, "uuid": "707f2db4-64fb-484e-bdf3-12777147c48d", "comment": "Malware payload (AgentTesla)", "value": "76355ea8fe34b8d246278d7d697a726888216ce5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830720, "uuid": "772088aa-7594-4894-b730-1f6480df775c", "comment": "Malware payload (AgentTesla)", "value": "7482908e7e9ca1b3f4f25c61001388922f11012472b6da2057ffabaaea901189174ed8be543f6a816762989c7afa801e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830720, "uuid": "27787d4a-11b1-42e9-8d02-e37f39c006c8", "value": "T17C141294FE429494E95F36BD8E41BE95C930ED81ED1368E22FA7371FB13E80A8614391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830720, "uuid": "738977aa-1325-4c2d-8aad-ef18d064c52f", "value": "3072:65KMaNM7U4pbRDJIfBuHbXt8bqBBJ/rGA8RU+wyQ+9XlIyAIxcTbfposQEqNwnxz:2PX1VHDt6qpamXxwvADGs6yxwJk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644830720, "uuid": "8a507421-172f-41f9-9a2a-b852efe49dad", "value": 191896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644830720, "uuid": "e2d21a00-180f-40e0-8606-b6740d67edc2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830720, "uuid": "4cdd7f6a-9ac9-4acf-89eb-10227701b7e4", "value": "CL + PL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec666a8d-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644822514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822514, "uuid": "29ab204a-cbb9-412b-a75b-27af3d60dd8c", "comment": "Malware payload", "value": "298dfc83c6e227af5f1410175f0e350c", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822514, "uuid": "cdfd605e-17bf-49ae-acb9-569289e47b42", "comment": "Malware payload", "value": "c8bb5ce2995868ff808fab176af91d734187bb9c5597082fd1bd8f13a0a1e52a", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822514, "uuid": "76d5cb78-eb47-4bb5-b94e-dde3ea14e1f0", "comment": "Malware payload", "value": "9c7589c450b4fa2481fb8b64ed1f500fa46df078", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822514, "uuid": "375e37ad-9665-4828-a24b-26a2bfef9acc", "comment": "Malware payload", "value": "a12555d03c374ff65a419fa36a26c0871a50bb0b904cb5738fbfd99f8e70e907fabbc21d8935d15c980779648f5aa15c", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822514, "uuid": "68c146c0-5540-4a3e-af84-5693c852cad1", "value": "T18F14126FFAE1C5E2C1A71EF05350560BC59DACBC696B80C23139B9DDC8718A4386E74B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822514, "uuid": "a191e310-9cf5-4c30-b14d-2e4ef51260da", "value": "3072:Z/vRPCp0lt0g9nr3bCsjafBcZ9i0l4X4Hzx7TOgixSYjgJwWVX4SLrRiQuAhViOI:NRPCp0l6gR2OUBcLHz5FixSYjWws4SZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822514, "uuid": "d0b08858-3ff6-417d-899a-837e20ed149f", "value": 191752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822514, "uuid": "ead3cb92-db3d-48a7-9225-e55883ecfe4d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822514, "uuid": "115a16af-bf4b-4a1c-9ca2-366871c06081", "value": "Draft shipping docs CI+PL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae10bd88-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644854622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854622, "uuid": "976677c5-6521-4f55-9cdc-50bda62e32c2", "comment": "Malware payload (Formbook)", "value": "e6906998073df876e6c193919790b6ee", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854622, "uuid": "2a9e8b9e-f857-44f3-a603-2347eeced4f6", "comment": "Malware payload (Formbook)", "value": "c915e7f8f829d69bd358e6f8b8d12ffef668c82b44a1bd7b7069f14cfeda12c2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854622, "uuid": "cba9f990-cc2e-497d-8942-99365cc29950", "comment": "Malware payload (Formbook)", "value": "aedeefea700bc7ef54a11922cdf15499b0fe7c4a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854622, "uuid": "7ad224b5-0747-4568-a697-ae1625922587", "comment": "Malware payload (Formbook)", "value": "ef2e2ee68b5cc3a06b13f45fcb03686fb1009ebde75d44e45190630c1877d047850ed2b5c773c9f939ef7043347bff7f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854622, "uuid": "112bfca6-2340-445a-a63f-1858a80cf789", "value": "T15514121035370516F2EADB721EA0194C159E5E28225E6C6E35A0F37B127BFC9F1CB6B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854622, "uuid": "f4b6a831-9b2a-4762-a87f-ad63dd2d922b", "value": "3072:AcoyeOx/3eeX2cede7kDbKQ9Sh/am5JoliZHE3Eyh9cAWFz3eSwgXkx0AePBTPVP:9orYfeeX2cOWYuQQhy6XZkv5pOXkibP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854622, "uuid": "cad04b2d-d041-49f6-ac78-6023f5ca40ea", "value": 191864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854622, "uuid": "44d6798a-ca13-4eb6-b033-f7dd68d87ff0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854622, "uuid": "4a77de25-55b0-4ee7-af87-79bcd285b56d", "value": "Wine Inquiry.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f0d361-8d9e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644847416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847416, "uuid": "b9f937d3-21f5-45a7-84f6-68e5a6c8665b", "comment": "Malware payload (AgentTesla)", "value": "cce92201a3da2bc6f553710fd89c50d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847416, "uuid": "79f024ed-b7b8-49f2-ba68-992bd723f191", "comment": "Malware payload (AgentTesla)", "value": "c9aa68138db2efbe40148efc8c8805d0d297eae793b0b7bb820acd52917ecd78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847416, "uuid": "48782f2d-15ee-4acc-8752-14767d63091f", "comment": "Malware payload (AgentTesla)", "value": "6c25b9fb31ceae2fc1e1d551a61c6514f4462c29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847416, "uuid": "28967162-37b6-46a1-a2cf-03915f63302a", "comment": "Malware payload (AgentTesla)", "value": "6429d70603381fac852dcff1f0de55f6df1f9a7098fe6c2f2fd83f8b71612e89f238dc60b74691453c26fc61aaf1dfe9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847416, "uuid": "ca96a3de-4336-4624-8bad-ef8425dd7680", "value": "T1E3250200B7EAAB13C5BB0FB7D8E551426B70E60A911BD77B94D0369C5C8B36C1D3227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847416, "uuid": "4ce6a85e-d0f5-4d8f-9d37-af157c637de9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847416, "uuid": "4c834874-0fb4-49aa-a04f-ecb11026ccda", "value": "24576:tTzmCSEKBdjXPEEtvfpcS+EFri46ayJy9zFX:tqrRc+o+idajzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644847416, "uuid": "7b29ff8c-d42b-4095-b58a-b26219f68dbc", "value": 964608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644847416, "uuid": "8bf21d18-252d-453e-9a04-0103e1542962", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847416, "uuid": "40482c07-9169-461c-9cca-ff320b1c970e", "value": "AWB5032675620_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda426c7-8dc4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644863748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644863748, "uuid": "4c800283-46bd-4e3d-a242-56366e9f9c97", "comment": "Malware payload", "value": "4bede6bdfbb7f1c4e4877be807a33ed5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644863748, "uuid": "b59e8ed0-0337-4051-9be9-1cc707ec2644", "comment": "Malware payload", "value": "c9e2821f3e10c7c2a012d0926f25826c402bd5a6a1e6a1879212b9241cfad8ea", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644863748, "uuid": "5feb1573-419d-47aa-a47d-279986a6565b", "comment": "Malware payload", "value": "2027f79371ce16fdd44328223065f50302171255", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644863748, "uuid": "afe6c246-a80b-4596-b854-31309e6d161b", "comment": "Malware payload", "value": "40c2f40eed6d639829c0acd59bba2365480158a578167792c9dd6d4068f07cc8cf97cbae6be131647a1d7ddcebf7bd27", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644863748, "uuid": "4ebac610-9457-4249-bf46-d3149b1e9205", "value": "T181C2657DF58B0E48EE56D66C16067BA9064DF41D72C440E23BBCDB387A5885B8B23D38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644863748, "uuid": "c837b5a9-8647-478c-8a50-1bae014d22a9", "value": "384:2yddanWKbg02NSXZBL9UXT5mLZgQ926DaXczz3ykIS7ZXud7JWo8WLWdfThswOxo:2yddJyUNS2sV926lIGXudLL8Lhkxrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644863748, "uuid": "750e4eab-3821-4dbd-bc23-7377a8ec5c0c", "value": 27254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644863748, "uuid": "a9afabb2-fa2a-4eee-bf60-7f5313cad4b5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644863748, "uuid": "f7c04735-ce54-407e-bd17-a1d7e55ee4b3", "value": "shp_441.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97c7eba-8dc9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644865834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865834, "uuid": "e63c8914-d714-4794-83c6-7005773ae420", "comment": "Malware payload", "value": "e6db112fa5dcfe99e1fb8db01d7b8877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865834, "uuid": "39a710e9-3381-46c7-bb34-a3de37ecfba9", "comment": "Malware payload", "value": "cb53b1c63e40be27b7aa7cd458dbe467e6b6e887fbac6b373374a124c0253caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865834, "uuid": "bedf328e-5512-4187-a9e7-047b51e5c102", "comment": "Malware payload", "value": "95c8e49f80180c352281c2b8ce8c51ab167ae43c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865834, "uuid": "549a4c91-e8d8-4ea5-8f98-3489e644d62f", "comment": "Malware payload", "value": "891bf76a80daeb3f8dd5f77e4c11408efbaf8207da504268ff3bb99fccebd3c3a59364b7c9cd5265a0195ff00c26f910", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865834, "uuid": "20bdeaf0-36ce-4453-aac6-033ce1f526d9", "value": "T1ADC3AE45F3E202F7EAE14A3200A6712FA73567249724E8D7C34C3D839953AD19A7D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865834, "uuid": "2c4b000a-cbf8-43f8-87b3-1c324190f504", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865834, "uuid": "0c189ec3-1abb-419a-b423-9f73ff65debf", "value": "3072:Iq6+ouCpk2mpcWJ0r+QNTBfMhl9EKJ3FSwCPPsY:Ildk1cWQRNTBEBF1gPPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644865834, "uuid": "f8d618a3-bdce-4020-bff2-eb487a6a5fc9", "value": 119296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644865834, "uuid": "14b82a69-4185-482c-ac08-7b4f3ae93c48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865834, "uuid": "f9b2de20-da29-4c03-8645-b532f214bcd0", "value": "paymentinvoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1792563c-8d6b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644825163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825163, "uuid": "390b74ef-05f1-403a-a632-18f7afa051e2", "comment": "Malware payload", "value": "590824b6e7d18addca8498b77795ac2b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825163, "uuid": "188dda55-0b35-4356-9944-aefe639930b3", "comment": "Malware payload", "value": "cc420277ee026dc020cf69becb71400d74220c1ec2669c04e393cf7d5156b875", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825163, "uuid": "1e71dc25-03b4-41f4-bcdf-48162492725a", "comment": "Malware payload", "value": "2a3342ba4efec9177f1185dbe665012ffda1b9fd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825163, "uuid": "bbf8004c-5ff4-4a40-86d1-1312722781d8", "comment": "Malware payload", "value": "58a6ee10c481c579a7f1f786609eff1d659b125a99faade882241875be4079f39b8ae46f7ca3d23e9f9a0bc1a1ec9c23", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825163, "uuid": "ad79a552-6b06-4c58-9d71-a98faa0b8c03", "value": "T13134012B31DA946BE8A7C1F290E5750A282D2ED5F60396203DE47FCA3D36E15BF11247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825163, "uuid": "be858764-fae9-4498-9d37-02d326822ff6", "value": "6144:BstrjIAZ0CY1yQTRABC+OGYa/WukDExaFzuzFVDcDNd:utqtT2BCjq5x1ENd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644825163, "uuid": "7dc526bc-9a4b-4e98-a8a8-9e22e847aa77", "value": 238614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644825163, "uuid": "cc03638d-c703-4175-b602-8c71db97abd7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825163, "uuid": "80c4d9d5-9e6a-43b5-8d54-b68a7d9b86a9", "value": "paulscode-cristalix.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb6408de-8dc0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644861972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861972, "uuid": "7533b272-8b15-40ed-8011-2e491f252b65", "comment": "Malware payload (AgentTesla)", "value": "5e4bf5ab06b7b7e9bf1a40c6c7b4f84f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861972, "uuid": "67cec4be-f682-4466-b993-2d6629cdc4cb", "comment": "Malware payload (AgentTesla)", "value": "cc5313731cc90260365ff92927cdb316bd2d3d77a68622216e117c813a77af56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861972, "uuid": "81a33acc-0737-4ae6-95dd-d20820f3a895", "comment": "Malware payload (AgentTesla)", "value": "34e04d106df90bf5da98fe7f47d1557379d58e12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861972, "uuid": "eed31e4c-8d9c-4eb8-8321-0da1349dd9a3", "comment": "Malware payload (AgentTesla)", "value": "af6f03fcdc1a92f40f63e40028b55b0d26631dcd7746cb370711c82aeca4d7c7986fa25fd1409236ca69c05e90c36301", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861972, "uuid": "2f31351a-735f-4f33-af6e-66053f9ad334", "value": "T144151205BBA3E556C6F60BBAD49142502B74ED1E4507C7BF709E3E8D2FAB3664432832", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861972, "uuid": "2bdd954e-be5f-40f2-b02a-41398aa2f38c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861972, "uuid": "2bbd19a6-7131-42a2-8184-0c6d2983f2f8", "value": "24576:gMqnWaK/LZTjWqfW5gN9IlvKkvTpXN+1B6Yj:gHWaKtfJHXTEou8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861972, "uuid": "da75c9e7-077b-49ce-b0cd-f69c9eb33d97", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861972, "uuid": "841667ac-5366-4714-9f05-fc7687879345", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861972, "uuid": "c0ac7174-4a27-40b8-90a2-97471f919995", "value": "5e4bf5ab06b7b7e9bf1a40c6c7b4f84f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73113271-8da1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644848510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848510, "uuid": "98bd2115-a2a6-456f-9589-450661fa32e3", "comment": "Malware payload (Formbook)", "value": "7b2fe94552abd6a5f3884b0482ce87f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848510, "uuid": "ca734271-c303-4cee-8fbc-bf0914e352e3", "comment": "Malware payload (Formbook)", "value": "cd30e51c16ef352cdfba1ad603db192e1267fd1e7315fc50f741cd43782b6026", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848510, "uuid": "23809aa4-b782-4556-b9bc-00e86d7cc9ea", "comment": "Malware payload (Formbook)", "value": "4c6e282f4503f7b8c9d42298136ff17641283714", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644848510, "uuid": "034603f0-787a-400a-9868-d5f8cce2ef34", "comment": "Malware payload (Formbook)", "value": "da49220b67cadef065bdce185d8beb6d1a79ac93fe98b93de2f78ce49c1947bfff7128a93b384d2c33f88e767671108c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848510, "uuid": "64cd4134-4b60-434b-8ba0-9692e29e5387", "value": "T185B4134836C4E437D8860E752E76D7B56339AD021FA40BD72358FFBF7E7A1841629284", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848510, "uuid": "639044e5-da85-4043-ae5e-7b0a617a2063", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848510, "uuid": "939fde12-17a0-4ba1-be6b-1326b2400ba3", "value": "12288:YrJ/sqdUMnvnz5aXBpkGsDYJQHooXOuwCvt:YJsml5axpkG+YmIiFwCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644848510, "uuid": "abe8fec3-3467-463d-8caf-b1a3e724b6a5", "value": 514149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644848510, "uuid": "b9094aa1-889a-49c3-a05b-e1730ab1f8b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644848510, "uuid": "4192b441-340f-4849-9443-f52020cac276", "value": "RFQ#505 & Photos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4f120d5-8d5d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644819441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819441, "uuid": "2fc09210-8d62-48e6-8589-8b820f56f14c", "comment": "Malware payload (AgentTesla)", "value": "d50ff186f932562734991511fced1f32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819441, "uuid": "850caa86-e825-4a1d-9b0d-5854c3c0acd9", "comment": "Malware payload (AgentTesla)", "value": "ce15eadd3af7703867736b713feec2d9186a5b8484e0212b4c53e92dd68b2775", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819441, "uuid": "d5f8f2c3-eea6-4111-b890-ba331cf51a79", "comment": "Malware payload (AgentTesla)", "value": "4618556847448e2ccb32dbb7970637777d4dc129", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819441, "uuid": "c090f3fc-a75b-44fd-a4d8-dd4677db88bb", "comment": "Malware payload (AgentTesla)", "value": "4ab12809bb51620cc534f18a096c63841d04f31684270fb5414f576e3b5365bac203f540f288fc68713585523c2cb2a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819441, "uuid": "65a4fc13-b9d5-43cc-8276-fea90eb7a0d9", "value": "T13C14292931877025D0005F3FD991992256EF6C89FAA0E77E2BA133F93DB226DD879D01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819441, "uuid": "e60dfa3d-a0bf-40df-a405-5f30c4d231ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819441, "uuid": "69a5ceac-cc9c-4e2c-b6b1-caaa7ad8d1e6", "value": "3072:SnM/oP61UsbghFA2R2LLLLLLLLLLLLLLLLLLLLLLLLzSm:aM/oi+K8FA2qS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819441, "uuid": "a61d54ed-23c1-497f-9bef-07c29e3a7e23", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819441, "uuid": "6664d6b4-3345-4f22-9292-c0f846218d10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819441, "uuid": "7d571b75-ea50-4df5-8d34-b1163b649bf3", "value": "conocimiento de embarque y factura comercialz_XLSx.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c457ead-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1644822809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822809, "uuid": "32598cad-fde1-444d-a585-54234e68ced7", "comment": "Malware payload (GuLoader)", "value": "51f67dbc6ec49398e7ab10a15aab6c85", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822809, "uuid": "10979e65-b001-4430-85e3-36f5abdf1981", "comment": "Malware payload (GuLoader)", "value": "ce5c54ac577153e15fb793c022b54fb473752b876525111d6aac97369e72e85e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822809, "uuid": "a153a5b2-df35-4841-ab95-b53a70e1e562", "comment": "Malware payload (GuLoader)", "value": "0df37fc08be54473b10eb19b58217174979267cf", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822809, "uuid": "4fbb87cb-fcbc-42f9-80e2-37277473525d", "comment": "Malware payload (GuLoader)", "value": "fb725900aa396ae412b68abb4ebea56027a938b25d9bb5293af63ed5cbf2c12a1997d0c780d52e9c9adb14c0ef5e41be", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822809, "uuid": "ab021475-c800-4d24-99e2-357e8bc84021", "value": "T1AAE46C55BECA6EA1EFBF47BB8361D62D0226735D03A1A6CF760305993951FC2443EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822809, "uuid": "dc0aacef-9e31-4c1a-b880-048ca629ed89", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822809, "uuid": "e938bd40-1e86-4bb7-9b13-cd7aa6ab27e5", "value": "12288:R0Ws7IMtR4yVld8bzbBSreDozgFK/UqWc:R0bdkX1YcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822809, "uuid": "ba91623c-4e82-4850-bed9-c977518a6473", "value": 670208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822809, "uuid": "67b72306-7a45-443d-becf-1d19df216400", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822809, "uuid": "db077270-114b-4e0b-8beb-27479ee62d43", "value": "shipping documents.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82130d27-8d5d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644819329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819329, "uuid": "27883f10-3617-48e6-a18f-6f1dbb9dd58a", "comment": "Malware payload (Formbook)", "value": "9643960c772d77b558469c4bac6f4d64", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819329, "uuid": "c461f5f6-0d4d-4bdd-a6a6-3d6d58b4e800", "comment": "Malware payload (Formbook)", "value": "cfc5134af689fab35d907fd4388bdd41ce21db3cd1d1f11b6e99ca6518225429", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819329, "uuid": "e6ddcec8-3eba-4031-ba5e-5f46cb67aa4a", "comment": "Malware payload (Formbook)", "value": "9f7f7abb8153c2be8b596daa68a31a9acc1f067d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819329, "uuid": "4d7bdf10-e42f-4685-8254-d37361af27f4", "comment": "Malware payload (Formbook)", "value": "41bb8478f0451f3de9d04a0bc659311d5bba2f26fa657b39f9c4f523a023c1e817cf473e8bf5e1249e87400d74343cd3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819329, "uuid": "5f656e34-1189-476a-b8a1-e39c9bb80572", "value": "T181E4333D1708906751394313B3A13107D59E2EA62C6D87C3723AEFB272ADBF1A2A7D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819329, "uuid": "8faeca5f-4d37-4094-9681-1c73df1939c3", "value": "12288:PmKy14ShLDIZnOb4LYz6EhuIUKwWCZ6blIDgQhhzhhYDBoL+e3j:O3j61g6OtUuXOgQhhduGL+e3j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819329, "uuid": "db30afa5-45c7-4b8f-939c-973c7195055e", "value": 717238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819329, "uuid": "6d6310e3-a513-4532-ac1c-500ee4f899ad", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819329, "uuid": "bacccfd1-983f-47ed-b65b-18b97cd5bc22", "value": "carta de pago.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b288d4-8d85-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644836327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836327, "uuid": "bd5d6f12-dcb6-45f3-a29e-f46820c08a30", "comment": "Malware payload", "value": "953c7db655e14f7356c3bd5feb66009d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836327, "uuid": "579e4773-9b45-4309-b6fa-67ef2a2dbab2", "comment": "Malware payload", "value": "d00d85589908ba95536822dea356afb5a9148628a7e2207c6e850024c0ba434d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836327, "uuid": "5c76e277-6c03-4fd4-a8f9-daa9ec8c2c23", "comment": "Malware payload", "value": "8785a7539186685835b2914a43c96d54c5c5e03e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836327, "uuid": "2c94e6bc-8008-41b8-a71a-debef6b6a55d", "comment": "Malware payload", "value": "94fcba273426602e318d8c7742431b1290f48145cbc2f2e6445fe2b3655ad58cd69c3effa7b14fc0169df051722f6cb8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836327, "uuid": "042e67cf-91f9-4641-9eb0-3d67886e3071", "value": "T103E49C2136C79B32D483127146AEA3611A3EEC704B718287729C779E6FB27C0673579B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836327, "uuid": "c9a7c5ba-5582-4687-b5af-7e072a6d9f99", "value": "12288:IvfDE9Q23Nn7ByIuyBlpOuq+8wAb1jX5A:IvAq23Nn7BjlpOu3dAV5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644836327, "uuid": "ac892f83-c8f3-4b81-abda-0081bf03c4b6", "value": 673254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644836327, "uuid": "8cc027a2-9b47-4146-9ee8-fe7203adb146", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836327, "uuid": "73b5d375-8806-42f3-8d17-8841d1d6e45b", "value": "953c7db655e14f7356c3bd5feb66009d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d5602c-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644846045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846045, "uuid": "7763f5cc-61dd-4c43-8ee3-82e79e17446e", "comment": "Malware payload (Mirai)", "value": "c0a5f1a051b7ddcfe397265e910577c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846045, "uuid": "3af7983a-2a96-4155-9280-d6dae68a1c12", "comment": "Malware payload (Mirai)", "value": "d094480f6c4e6022a59e874a5bdb47ec3dec252593f091430053e362409d7e6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846045, "uuid": "510a1a83-c639-44ff-9cd2-c0b52fbb71f1", "comment": "Malware payload (Mirai)", "value": "60c831334135dfd8f0eba8656f86c7f41c1c4ef6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846045, "uuid": "4078fb42-cf99-43c2-971c-fdfccfb96760", "comment": "Malware payload (Mirai)", "value": "a3c4a58a3d7b45fac3029bdadf04f3d0abcab277ba3b4c7c6ce1a5bcc4c401d4686b89b1038fb35955ceafa9080d6b1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846045, "uuid": "abea0936-0baa-403c-8324-7bb79d36cefc", "value": "T128A34B47671D0B43C24B5AF12DB733F0979AFE7116E622C1A40EBF801B72AB41626F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846045, "uuid": "c5cbf6d1-f826-4fbe-bd1c-15884cb6a04b", "value": "3072:YV6PDnZvM3FAsd5hvD0MWkNUZ09DRDWQfgm:YVkZvM1/d5hvDGkNUZ09DRDWQfgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846045, "uuid": "8057d015-64cd-4bd1-a13e-7cc462b445da", "value": 104103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846045, "uuid": "1f199c52-b28e-4ac2-a38e-95fbb83dfdd7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846045, "uuid": "ffa63478-5e03-43c6-b6d5-570d38e1c84a", "value": "cron", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bbe166-8d35-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644802107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802107, "uuid": "250b2287-7e9a-4beb-bbc0-8b00bf2fcae0", "comment": "Malware payload (Heodo)", "value": "2ade95e7bbce7c3b6c16e9c7bb8aa08d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802107, "uuid": "6da7d77f-bfd4-4870-b4ad-fa3aea9112b6", "comment": "Malware payload (Heodo)", "value": "d0a5e7e625f1fca0140b187d13080f8e889ccf3ccd436bfd3757a3820974ed01", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802107, "uuid": "a9d2ed15-8aa1-405e-abd1-32f39887e785", "comment": "Malware payload (Heodo)", "value": "39a095cc524edcadc57abb767e547a58d67c228e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802107, "uuid": "6a76f5a4-0123-4f7a-a0f7-73a4d3e1ec94", "comment": "Malware payload (Heodo)", "value": "2b95ba74fc962b8b9fe9059d17eb2deb858a16eb302e252207e76a435a6078aff1e4f3a4815f136968d0ed9f1af32648", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802107, "uuid": "a984647b-29a0-4577-b5cb-c71f55fac811", "value": "T117446C12BB829076C36231B09ADB7379B6ED87316B385BCB47911C356F744D2A63C21E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802107, "uuid": "36310ae2-8a04-4025-8fbf-946b71d13008", "value": "6144:2bRgWUD7E4G8V5EqcACe/PMjQ29S0PmFLw5D1Y/O+TCJJUYdcjd:agvTeqrCeX329Soy/O+TCJJU2Qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644802107, "uuid": "deb9d8a6-69d3-41d4-a248-7ba1851c4452", "value": 271629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644802107, "uuid": "94e23954-eeb7-441e-9e6f-1bfe202a7e57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802107, "uuid": "b564882e-6d54-4bbc-ad37-b5751066c307", "value": "emotet_exe_e4_d0a5e7e625f1fca0140b187d13080f8e889ccf3ccd436bfd3757a3820974ed01_2022-02-14__012823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba64d7fe-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844764, "uuid": "4d6c8831-1888-48c7-87d8-083f3ca03e41", "comment": "Malware payload (Gafgyt)", "value": "b1f20b0555c0339c7932fcd0395b28bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844764, "uuid": "e5571016-d2f5-46cb-997a-1c760bef6bf3", "comment": "Malware payload (Gafgyt)", "value": "d0ab4b537e9748c713358f9554715bd85e7adc304078e187477d12cac47e22ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844764, "uuid": "06ce380a-f500-4ce5-9f55-a88b4909e4a8", "comment": "Malware payload (Gafgyt)", "value": "3f32a1fa99b5f8659921d3cbeba9f0e267deacdc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844764, "uuid": "5b535f7b-5c31-4026-8921-32dd2893312a", "comment": "Malware payload (Gafgyt)", "value": "423114855a62f8c5e654a1aaa9ab7d8df678ee1310fc4d8104155d7a5a88497bd9c312bbe8deb69b4f29a672d2ddb763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844764, "uuid": "88762e43-123c-4e1c-b984-1f8b16945857", "value": "T1F1734B03771D0B93C59BAEF02DF727F187AAF96112A66580A10EFFC41372AB02515FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844764, "uuid": "21bdc044-c861-4252-8ee4-ac15f457f51c", "value": "1536:lotQm3qLiuNGOHBIeFaBXzI23mJn2vobXqNaWKZZz1k8iVmX02q2//8fBgj:lotN6LiuNGOHB4jI23a2QzZI/VmX02qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844764, "uuid": "e6da0d46-9ac2-440c-98c3-13fee78fd191", "value": 80349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844764, "uuid": "f47e3b98-5b17-4bcc-80e5-815506555a15", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844764, "uuid": "7981e358-b151-4418-aff4-488847867608", "value": "Demon.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a769f65-8d89-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1644838268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838268, "uuid": "3d0fb8ba-7699-4096-97c1-c18190adf52d", "comment": "Malware payload (AsyncRAT)", "value": "9c917054ae23ff2061a43ea013bddc29", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838268, "uuid": "fc2314fe-4eea-4b7b-ba55-c930ebe2e178", "comment": "Malware payload (AsyncRAT)", "value": "d1bb3096cd920d4c3ca880bb368cf0a0aa4b74b4afc8defd01fb472952f40a15", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838268, "uuid": "11256289-3514-4ece-badf-cb0973cd9847", "comment": "Malware payload (AsyncRAT)", "value": "44bc91e06321dc60f8b072c62161eb6abb788bfb", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644838268, "uuid": "58cc1cc7-e817-47c3-9223-21f713886144", "comment": "Malware payload (AsyncRAT)", "value": "f10a36fcad11ad425fdf7a3b04a956278398ab2db7e31e9aff6a6b3b9a60410a44f919a6cd38aafce41efad22a7c360b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838268, "uuid": "258c6d58-017c-4a22-9815-60232a7ee998", "value": "T114F4F10177A7AB23C5BB0F7BD8A5424166B0E54E5117D73F68E132EC0C8B3685E7227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838268, "uuid": "58670009-be7d-4185-81e9-5e533f537f5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838268, "uuid": "84b719ea-142a-44fd-847e-1373b34c3a14", "value": "12288:cpg7TigS2FhPoYXhL4x9K7tU7kcchdYoPfEqVrE7zEDAmz6rBSNsC/0DyqKqQeN4:0gnSrqLy9K7tNVLYqfEII7ziAmz6NSNr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644838268, "uuid": "343603ef-5449-4065-8d47-036c02e3b2a0", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644838268, "uuid": "31d966a8-0c16-469c-bb5e-a6e9bd7d96be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644838268, "uuid": "15d036cc-5542-4515-ba7a-1386199e9c82", "value": "SOA- 14-02-2022.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03f8b353-8d6d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644825989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825989, "uuid": "8d123799-40ac-46e2-9eae-3c492222079a", "comment": "Malware payload (AgentTesla)", "value": "b6fe1eb65ef9a2db9b86d2ffb6b4de28", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825989, "uuid": "25ee0882-7b81-46ca-9709-01a5fd233f0a", "comment": "Malware payload (AgentTesla)", "value": "d1fea52507fc97ff419f8dd2ea8ecf689fb7c066cf8f18453378e95bf399c3d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825989, "uuid": "44ef9d33-1f53-4cd1-9edc-2c19d65c0b5b", "comment": "Malware payload (AgentTesla)", "value": "f6534b3e7a7e88300b699f45f9f3c8b28519f0fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825989, "uuid": "af428c8b-8253-40d8-a5c1-3ba7a417b707", "comment": "Malware payload (AgentTesla)", "value": "f8b8ce0d43e9f11f4771d8b6e2248564b0ef3392c8612ee4de49e06a49dd222bfbd56ece45c86e58fafbf1fc96436bc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825989, "uuid": "50e79274-c59c-4b7d-beed-1f0f3c345543", "value": "T17F15F20177AA6A23C57A0F7BD4E151016770E94A911BE77FE8D436FC1C8B3681E7223A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825989, "uuid": "e514194e-8a0d-4c27-aee2-0e1bbfa66985", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825989, "uuid": "41f65dfd-d6d2-484c-8a0b-d40c91766a83", "value": "24576:18byWx9zTyqgCUxN/g0qhn9aRGSkJcrzeaAOASWUN:UyWlTy+UaymO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644825989, "uuid": "7253de52-e8cd-45e2-bb2c-8a17dfb784fd", "value": 937984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644825989, "uuid": "96c2ac89-57ab-436b-ad32-3585e8b514fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825989, "uuid": "4078f134-acc8-4b3b-b59f-c3aed12e93af", "value": "SJ Revised PO Feb-14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd097f0e-8d9b-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1644846110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846110, "uuid": "8a14bbe7-51cb-4dc7-9383-fcc2954034fd", "comment": "Malware payload (NanoCore)", "value": "3deb9280886451db10295aa489fa2cd9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846110, "uuid": "6250a74e-ffaa-4775-8168-145e24e7d8ab", "comment": "Malware payload (NanoCore)", "value": "d21cd13fb58f219e9cb28ba7e4a4bd36387a714834b11dc19594e10275c30f5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846110, "uuid": "fca91560-328f-4a4d-b1b3-928a06ae3087", "comment": "Malware payload (NanoCore)", "value": "5094ed7be003f6a77af9c24a3b4092e7a2e4486c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644846110, "uuid": "dcf9f625-7f28-48bc-96aa-768c38bd12dd", "comment": "Malware payload (NanoCore)", "value": "17b82e3870251fcdac7e5e0fb08229b175e77673beb9ccec919d8ee24c573cb67b2a6fe50447568d09f7827307fef756", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846110, "uuid": "02dc9ff7-c36a-42d9-8d0a-0e3bf3ace384", "value": "T181150205B793A949C5B60FB9E8E001905F74EE2E5647D3BB709D3D8C2F9B3590932A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846110, "uuid": "84c6674f-eb9d-41d7-9a1c-0a04b9a69c77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846110, "uuid": "9561d5a1-0b4f-4866-a4bf-6d4ed80d154e", "value": "24576:xxN4mlHsLZBT9zbTq4vcClwh80e9e6R6M:N4mlHstBZ3TRdlJS6wM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644846110, "uuid": "5e6afda7-bf7d-4fac-aac0-098ea95a10d4", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644846110, "uuid": "c2eda111-dbc8-42dc-899f-ccf8bed65b56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644846110, "uuid": "4775fae5-b016-466d-98f2-e3b626b20853", "value": "RFQ 2022.14.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01207f1f-8dc8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644865069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865069, "uuid": "a7dd273a-38de-4369-9b5c-cd4fb62ac58e", "comment": "Malware payload (AgentTesla)", "value": "ebc3088b37b01a814bfb0ba0a1fd2419", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865069, "uuid": "4daabf2a-031e-4f3e-a5ad-c648862718db", "comment": "Malware payload (AgentTesla)", "value": "d2a36ca4d8814d77c4e73f8cffb16a09a3651402fa560dc6265681ad3289803d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865069, "uuid": "27271240-19fe-4930-b024-7c276502e010", "comment": "Malware payload (AgentTesla)", "value": "580e89233d674a5450032e066c5647ca7f25c96b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644865069, "uuid": "1d91d996-ac99-4586-b776-27a3d0c0d891", "comment": "Malware payload (AgentTesla)", "value": "c2cd6a6d6a33fc3a28860d0fa1b0d6e3abf49567755c9dc2eb1ba0c6b4a70f6bf39bf4e677b979ed5a20a9e1771ee81c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865069, "uuid": "e32d9870-f0f4-4d23-922d-f316d7664bbf", "value": "T1FEA405963B5B6460C3B1A173B1D1690E3234D90586FF0067FBE27BA76930B96C62E0DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865069, "uuid": "35acecb3-b1d4-4a20-a023-a3e5ce58e223", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865069, "uuid": "38b2e539-afaf-4f29-96ef-14c7e0802e1b", "value": "6144:JwpDjWNeP6UMeAg9j9R7j9vdQBkm8sW5sppC9mXvqS5B2iP6W1rpIp2kyJe1z:OP9dQBd7ppCKp7fP6W1ryfyAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644865069, "uuid": "2372a0fa-e55a-4f6c-8d58-1666d94d2ff0", "value": 492661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644865069, "uuid": "9255f3e5-4e93-484d-b2cc-b1eafbcea7e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644865069, "uuid": "b553d368-3077-48dc-ac29-c3f53030d20b", "value": "o f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5e95d5f-8d88-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644837938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837938, "uuid": "4f082f1b-7c73-4266-ba91-9e30ba13aa70", "comment": "Malware payload (Loki)", "value": "5cec420a870988209c8f09f1d160e3a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837938, "uuid": "2c466864-d689-458a-961d-040aaac5851f", "comment": "Malware payload (Loki)", "value": "d3217fc16fe7991314f5f0fada36ed506921272105b0e230a0a37c1c1ae3f83d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837938, "uuid": "b95931a7-9107-49af-8302-e70020767553", "comment": "Malware payload (Loki)", "value": "4be0c3ae0a135e2de582c63a42ecc3f03296638d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837938, "uuid": "2f34eb4d-58dd-40ab-8705-56fe8180a099", "comment": "Malware payload (Loki)", "value": "eb0cd444e6676c4bc06bcac9278ca963822a64549bfd421e79eb2eaef354a5408f610bae973892845825a45718552b02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837938, "uuid": "193d4028-5210-40e6-9a18-5f8d07db8372", "value": "T13105F10077AA5F27C4BA0FB7E8E1524153B0E917915BD77B68D032F81C9B3650EB263A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837938, "uuid": "73f7d4ae-58cf-42fe-94bb-20a168f3e8bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837938, "uuid": "2c275130-3cce-47f7-a0a0-4db1dbdf1f7c", "value": "12288:1LVuXHs6qrsn18mBq4CvnIyLi2Yssu5fXHnLWEqt24WlUnakXX:1Lqs64govnHcssu5/Htqt245V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644837938, "uuid": "43679eea-74b2-4acb-9fe8-7aac9ba98f51", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644837938, "uuid": "d451ae60-5487-4b37-9568-0ca48aab01b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837938, "uuid": "ba549620-25ce-4ad8-9135-e6eff7ed09b3", "value": "FedEx ReceiptAWB#5305323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81163f1-8d5d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644819420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819420, "uuid": "78b43353-2b66-47bc-ad38-390a1e53462b", "comment": "Malware payload (AgentTesla)", "value": "b8d17f86a4c7d90fd9974a9c22355cf6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819420, "uuid": "73ec9551-f11a-4071-8f94-28c4d2a7de11", "comment": "Malware payload (AgentTesla)", "value": "d32c2c7ba858b6fea5e943b58247a9c8bc8437966d7e682085ab150e18101b8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819420, "uuid": "0ac721cd-070e-47d1-8465-8bbfbf257270", "comment": "Malware payload (AgentTesla)", "value": "f90e095a2ceea937dd2296db71572763717dc22e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819420, "uuid": "8e18ed4b-7b91-4328-8e1c-cd5f42a47203", "comment": "Malware payload (AgentTesla)", "value": "861e32c63d4a20b2857e497783c59e02ac4f298615095fd6387d4809733ea2b92fa33eb93ec05afb155cb09db3cff18a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819420, "uuid": "2539a19b-4d4e-4d17-a363-0536f58d5fba", "value": "T10305F1EC76503ADFCC57C67ADA582D29AB60306B530FA60B814355E99A4DAD3CF240F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819420, "uuid": "faf1c9e8-646a-4fd2-ba9a-4960235c4536", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819420, "uuid": "5adb6c73-1741-4be6-ae51-b64cc2cb547b", "value": "24576:+hATP69pzHyaNk2A6d5HJ23/L5kCQ61b:+oPMp7yaa05st", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819420, "uuid": "3cfa5d4a-eb3d-44ec-acbc-48d20858cab3", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819420, "uuid": "01b68e08-1864-42b4-9998-abdaba8a7a1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819420, "uuid": "01604e41-9573-4d86-bb57-aff16ad6fe8f", "value": "REQUEST FOR QUOTATION - IJ1WxaBThxDnTxo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac03ea3-8de3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644876896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876896, "uuid": "5a1c25d6-aaa3-4c4d-8bfc-b72c6c6780fc", "comment": "Malware payload", "value": "e5a5b696a24910332190997c48805b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876896, "uuid": "8b9bdfd1-1e2c-4b17-92fb-ad6176511c93", "comment": "Malware payload", "value": "d3f2af10b61a57b3ef2e636c048fdbce7a1a9a92f80e9540767cb877bd6a6506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876896, "uuid": "4b05ff35-1ae8-4106-8bc4-a193d0c49398", "comment": "Malware payload", "value": "9e9e0b0c3b6478caf17c259a4b8dedd028b3dead", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644876896, "uuid": "835b8582-43cb-4281-a7bb-dd129de231b3", "comment": "Malware payload", "value": "e30d786af847a109e5d6b417e8537be89bcc5d46861b60c8c6277b7b5fc074bf9f3577d5f8546642ba215e5e1910bf66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876896, "uuid": "e9e196a7-4c18-46cf-83cc-9c61fabc5709", "value": "T10EF45A5271E49198D1778234DD6342B2F6727CA49771DAEB6160FC293B33BD23A3AB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876896, "uuid": "57a3c4e7-2946-488a-ac6b-477f9d8dca33", "value": "cafecc2b74d5a23dd43a95518521d2ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876896, "uuid": "290134c7-4bd1-40cb-bafe-dae3f70c72d2", "value": "12288:j7dc3k8PQoJYRXP2oWGUdv0ezvOLf13buZatUZhziqBdypLFU6aGy:6rJmXuoWGUdv0ezvOLf1ruZatyhzPyxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644876896, "uuid": "48aab2f5-7d6c-44df-ab28-d9f4977cc640", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644876896, "uuid": "a54eef1c-24af-471c-82f2-e62899dc53e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644876896, "uuid": "3f9adbbf-8c67-4b99-b5ba-7b5ac30a7533", "value": "simplewall.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3928d71b-8d41-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644807181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807181, "uuid": "9eb39ae6-ba04-4660-a11f-90bcebc1e269", "comment": "Malware payload (Formbook)", "value": "abf183eb397213a2f781fdde0a7740fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807181, "uuid": "82feac43-db61-4f08-98c4-fa1af98346c6", "comment": "Malware payload (Formbook)", "value": "d647a2e8ff08785b542bd885e62aed69fd43ea2dd801f5144bd990ec8719f3ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807181, "uuid": "1e1dfc4b-f879-4613-98bd-dace4186300a", "comment": "Malware payload (Formbook)", "value": "8c096b969627ae93588daeab1b27e29be56b566d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807181, "uuid": "df543eb4-780e-4a8f-a586-4e2f41120f30", "comment": "Malware payload (Formbook)", "value": "babc60eb7aac2aea797ec4b345034a381676bb6e9b0b511406a8ab9a048dc8e2861e849770aa4cfde2ad9af321481450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807181, "uuid": "2f980342-291e-4ffb-8751-5b28c96e1aa6", "value": "T1E1B401247784E51ACB544B714AEACABA5770FE445C119D0B2FD83FAFB43E9C2ED16202", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807181, "uuid": "6d61a199-a8f9-4edd-8db3-5327dd194106", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807181, "uuid": "cba8d12c-d2f0-49d3-adad-9ddea8ad83de", "value": "12288:hHTA8EAoJQq+64dwfKiPFIkhzoJrN4EsECSVn4r:hHM8EnQq+bdcKiD8pN0SV4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644807181, "uuid": "0082daf3-3e3f-43ee-9be6-80a7a2514544", "value": 541229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644807181, "uuid": "d8c2602f-9c84-4fad-ba03-283400f6f49e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807181, "uuid": "b7e47104-b35c-414c-9537-987e20f021d0", "value": "PURCHASE ORDER_PDF___________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60806d2-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644854608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854608, "uuid": "586f13c7-3416-4698-85ae-81ab478ad687", "comment": "Malware payload (Loki)", "value": "22670eca6708a360d955649c24b4eaae", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854608, "uuid": "778e5850-6be5-400f-9bd6-fae284a6045b", "comment": "Malware payload (Loki)", "value": "d6a11c65f0232122d4ac3ccffbc17ab1728f8913b5fb4c36c8cff0e0a649f349", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854608, "uuid": "54f59bb8-990e-4073-8c82-f4619c48946a", "comment": "Malware payload (Loki)", "value": "6621e248f1ce6f320cd3377f8d91dfa18c8a81d3", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854608, "uuid": "5dcf9033-21c7-490e-8aea-0dc473b9fc46", "comment": "Malware payload (Loki)", "value": "6dc4245a358e1cc77061e7b0c0054e89c59e1abbcda8d7447ade0f4cd68ea8655acc1f622f753b228715b3796d6b0402", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854608, "uuid": "c148bf5c-66c6-44f5-8256-3c40d47dae4e", "value": "T10C141250F9696826F39004B96BA0DC03C37CEFACD84D609E66C9B6DF3671401AB1B57E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854608, "uuid": "d7048201-d54b-4aca-8fc3-93a1307b437d", "value": "3072:poiI6OStfigk1WI1ruLqDjO9Hr6Wt3IQ7X6Up6CnYpX7rRSoERDw:RIqtqvgqyLSKJ6s3IQ7KdV7QoAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854608, "uuid": "df811a18-b527-4484-94e9-72ef2d65ce79", "value": 191704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854608, "uuid": "acddf5b4-fa00-4f9d-ac96-90fc3f1c3b88", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854608, "uuid": "eca4096f-a1a0-4f40-82da-2bb1d90c49ec", "value": "\u039b\u0399\u03a3\u03a4\u0391 \u03a0\u0391\u03a1\u0391\u0393\u0393\u0395\u039b\u0399\u03a9\u039d EUI894BU4633.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae38e9c-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1644852173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852173, "uuid": "4e01d131-2851-4f8e-8e23-aa62735d1f30", "comment": "Malware payload (Quakbot)", "value": "5bbbf314b9a3de15e51ea38187c3c3c5", "object_relation": "md5", "Tag": [ { "name": "EtterSilent", "colour": "#A9B976", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852173, "uuid": "baef7eb7-9991-4acd-a0df-bf7dfb97e992", "comment": "Malware payload (Quakbot)", "value": "d74b00dde228d80e09d1c2a9144216de68b8a89ac1966dacfcae8e9dc3f52738", "object_relation": "sha256", "Tag": [ { "name": "EtterSilent", "colour": "#A9B976", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852173, "uuid": "5e8cec7d-02dd-4b81-8d08-722f8eea7500", "comment": "Malware payload (Quakbot)", "value": "e14b9563eb241c7582dfc4cfdfdab1d960b2c5e6", "object_relation": "sha1", "Tag": [ { "name": "EtterSilent", "colour": "#A9B976", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852173, "uuid": "0f3f91c5-a8f3-4a50-a3ba-2e765869bafa", "comment": "Malware payload (Quakbot)", "value": "453a6f9821b17395bc4d161884fee99ee6a555fceb6f3b6278d077e7509c3017c1f899b054bc0cd468824438fcd1d809", "object_relation": "sha3-384", "Tag": [ { "name": "EtterSilent", "colour": "#A9B976", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852173, "uuid": "b45b1e9a-1c52-44d2-8a99-1a8ff571b349", "value": "T14534029FF2CC691EC39FB53A827958AB5B85441FCFD2202E128577811D7857B0E4EA0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852173, "uuid": "dd7fbe19-4c40-4c40-b8e9-1ee97f783b73", "value": "6144:LbT98S2VO5qcLLQ6014NGa1sWZcMIFtspIIK:3qS2k5TLc601RAcJFpIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852173, "uuid": "4b24c655-9410-48f3-afb3-8dff3d993174", "value": 234993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852173, "uuid": "be5f52c1-6f28-4e04-aae7-39207aec895d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852173, "uuid": "7a5a4229-ae7b-4793-8a81-6bcf5fb7b614", "value": "PH-1577391140.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "816f5958-8d93-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644842521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842521, "uuid": "b9fea6b1-6785-4269-aae0-2b5d9ef8249a", "comment": "Malware payload (Mirai)", "value": "adb0ed689748a3c60c5e9e3ab32d4c62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842521, "uuid": "291197e6-9bde-493a-9e10-8cda27aae386", "comment": "Malware payload (Mirai)", "value": "d8101cef2353a8062bfedd3f5896488a4259333bd0598eb324955100777c0e31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842521, "uuid": "91d7064d-77c7-4432-aa0e-5d4730c82427", "comment": "Malware payload (Mirai)", "value": "619b494c123a29f53f2ae2e6099ddc7d98e79ec6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644842521, "uuid": "48cce630-cf92-4464-90f3-2204cba011fd", "comment": "Malware payload (Mirai)", "value": "cca2c597b168cc209d4f165eff356637d101ab75fd7a33913d6d5610272843de0563d8abd85601594024cd2dffe91187", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842521, "uuid": "f14f6c0a-64db-47c0-abcc-f7f055e439a0", "value": "T194C22A70291EB2B8D4EA127DF04B156226C24A487CEEE7D3D1BD9461F9D134CBD62E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842521, "uuid": "6108ad64-1802-4873-92ca-c546de8d4356", "value": "384:2THrzjb9lmnIYSGXB1I3cwmAnWVch6wCZmt+shf2vj4JYWfr:2fr73YSU1I3cwmAnWVchrt5h+vRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644842521, "uuid": "6aa7f67b-3f3b-4d83-9527-18aa5466942b", "value": 26168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644842521, "uuid": "3b8a187e-3ae7-442b-bef6-47fbf5f5d6aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644842521, "uuid": "edf20803-51d2-40be-962b-fada47ef0ec7", "value": "ahsok.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97677329-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1644855013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855013, "uuid": "d9575a81-1d4a-40da-a1a9-d1d8c0548018", "comment": "Malware payload (AZORult)", "value": "47f8484ec477d3e4a22ac8a93c20653f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855013, "uuid": "f6f33e3f-860b-44a8-a366-418c8341a3a5", "comment": "Malware payload (AZORult)", "value": "d8c4fb5e1c854c9362c4129efbaa6b72435b8e93df66fd418f288650d360ff22", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855013, "uuid": "cd0b74ca-16b4-4902-8db5-7e3f04563f67", "comment": "Malware payload (AZORult)", "value": "7654636d4ea487f5e91f190e5027567b1100de63", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855013, "uuid": "7118676b-7a50-4299-867b-082210937c6d", "comment": "Malware payload (AZORult)", "value": "26760d4460402f65e7a6ce220250b699bc973d4d8707b8dd9b2bbc4e08b5f5a27c9bc686045398c1c5e817feca4f04c8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855013, "uuid": "d454928e-ecba-4068-96c7-1b13a881152a", "value": "T146050101779A7B17C97E0F7BD9A1420247B4E95A911BD73B68C036EC2C8B3941E7227B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855013, "uuid": "c2da8f73-642e-4c78-983b-4084023db8e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855013, "uuid": "6aaf176b-b756-473a-aa88-1bed68a9fdf5", "value": "24576:Z7gp1knvMcGaVapOkYfPlP3jojhTPE01kGG:Z7GcGgapOnd0PEckGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855013, "uuid": "49fe2b66-8821-4eed-9c50-34473c375ca0", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855013, "uuid": "97d81a81-ae73-4f23-be26-4d3843283817", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855013, "uuid": "e51f9d25-202e-46e2-a76a-c3d9e7dc2c2b", "value": "kendrickzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8099a91e-8db1-11ec-9275-42010a9c0029", "comment": "Malware payload (Chaos)", "timestamp": 1644855404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855404, "uuid": "773b6dfa-c72b-4f1a-9a94-e3f792d48a2f", "comment": "Malware payload (Chaos)", "value": "668a6e809dd0554cde27c3a28ea01c43", "object_relation": "md5", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855404, "uuid": "cdaeb6c5-2380-4d18-a793-d9a53582280a", "comment": "Malware payload (Chaos)", "value": "d9771a04128e50870a96bc7ac8605982205011b723810a04a3411a1ac7eba05d", "object_relation": "sha256", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855404, "uuid": "2641de64-6c03-4657-a860-b1922d0d54b4", "comment": "Malware payload (Chaos)", "value": "aa02e2999168ee64f6d3ccc3218a131881fa7c37", "object_relation": "sha1", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855404, "uuid": "4d6336eb-6037-4ca3-83c9-09f1923328fb", "comment": "Malware payload (Chaos)", "value": "793c53b0b33ab8ea721a49dab1f489780b7b40bc4eedd4ab894fd5f5a824e822c19169dc939f27189706ed42d48768ed", "object_relation": "sha3-384", "Tag": [ { "name": "Chaos", "colour": "#0AB855", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855404, "uuid": "4de28b84-afa7-4ed9-81dd-d027a894db74", "value": "T13D84DF3429FA501AF173EE7D8BE8759BD56EB6A32703945D20B1038A4723D43DDC293A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855404, "uuid": "0ad4611a-7741-485d-8af9-6772a18e6c0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855404, "uuid": "916f1c8e-4169-4766-88fd-9c02e69b604d", "value": "3072:JoZBUdr9Tw9LZ/wOQfZ0CQSveeSl0EpDwJ3DwGcgaIuC4uOe72teA+x3choO7JRz:Br9Tw3/c95crCoj+xcBAU/w6pwYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855404, "uuid": "96325c77-d22a-4f14-98bb-34c30c3164eb", "value": 387072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855404, "uuid": "c9bf75bc-b796-40b5-b883-506d73f0f252", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855404, "uuid": "6c5949c8-a8cb-4710-912d-67766d32e3c6", "value": "Comprovante de dep\u00f3sito.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dc151e9-8d6d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644826006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644826006, "uuid": "5d19710c-c174-4a0c-ab9c-6b56d45642e7", "comment": "Malware payload (Loki)", "value": "8d2374ca90b2fa4c236af40e89de41a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644826006, "uuid": "ebbb603d-9742-4f9c-8cdc-ccf9006178af", "comment": "Malware payload (Loki)", "value": "da3208711d472f6c9af1141faa1272cab7b80cbaef1cfe0c24c5b1597f7a0c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644826006, "uuid": "d871364c-c1be-4e04-b825-0e47744c9045", "comment": "Malware payload (Loki)", "value": "f92315f8bb635d7934dd77657a11b482bd70464e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644826006, "uuid": "48217eda-66eb-4495-98ce-eb5e9b71f78b", "comment": "Malware payload (Loki)", "value": "2b1ad7d2203b2e217953f6f63fbf6efe34a6469399a8c13e50207143bf75ae110bd92429327e97e8298f328c6db0ef85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644826006, "uuid": "a9abe8d9-3985-4da7-9391-a556c714e676", "value": "T1D0A4CF2D0B3CC856F0B02DFC6822EBB97EFC5E11621DF96753206CD718F52925A8919B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644826006, "uuid": "d6134c4d-1a1f-4144-8dad-2abbff710c9b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644826006, "uuid": "940442eb-167c-452c-8d3a-1f3ba5a1f423", "value": "6144:obE/HUsq8j7IjYLjVrH76Brup88h8h+843ggbxfNSXNISJSdIX3y:obwq846jVrH7pv1bxfUdIOCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644826006, "uuid": "ab01101d-69a0-484b-a36f-ee55a8078404", "value": 457944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644826006, "uuid": "d4a5bc3f-2715-4b89-a73b-86670830e6c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644826006, "uuid": "d4bd851d-8a58-44f8-8411-50825a111542", "value": "Demande d'offre 14-02-2022\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611a8e58-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644822710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822710, "uuid": "7dd90d69-acd9-4fd0-af40-a67ecb7045de", "comment": "Malware payload (AgentTesla)", "value": "a0727d1a34a9d02c46c443e7d14eb477", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822710, "uuid": "a8211e44-20f6-44cb-b04e-ac5bcf07501f", "comment": "Malware payload (AgentTesla)", "value": "da599a875bc329ff6666771a7b7df56e40a4727fd7e6261828aa8cd545a7a587", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822710, "uuid": "ae0d79ac-6288-41f2-815d-f391fdb8824d", "comment": "Malware payload (AgentTesla)", "value": "eb71a3857dbeb4285b16bd509be75029e395cde5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822710, "uuid": "67f86b7c-0948-469d-bf14-3632bc9e366a", "comment": "Malware payload (AgentTesla)", "value": "cbf8e5cb6e65255cc27adddb064b9e8a312c1d8c7a9e54c2a70aef0a729a0047d9b9a3fdf60092914d0d2dbee4eb0d62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822710, "uuid": "949dff5b-26f2-49f8-b30b-cd3296e3d788", "value": "T11E2501017BEAAB23C57B0E7AD8E1420157B0DA4E9107DB7F54C036EC5C8F3695A7227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822710, "uuid": "6180d4aa-f4ff-4f7d-a868-13e4a4ce03bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822710, "uuid": "523192f3-a46a-4790-a1cd-03e161367850", "value": "24576:6w1VGqSH/n+Iyu4c3i4RR6/xUMBj8M27S6P8b8BgMc:N1a3Oa4ZUMBQz8b8BgV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822710, "uuid": "f46bdce7-550b-41fa-a349-033bb0fc61bd", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822710, "uuid": "56e8fc04-bb8f-41cd-a7b0-693536eb8311", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822710, "uuid": "c8e9b774-3d71-4080-9c54-44c45aa46ba1", "value": "Halkbank_swift.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e925fe-8d40-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1644807041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807041, "uuid": "5c74f0ee-658f-4a50-99c9-11471f1b2d26", "comment": "Malware payload (Pony)", "value": "b7b86225defaae424aa2e447fc784088", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807041, "uuid": "d8d9cd42-4080-4bdc-991a-d8c2ce4a0e9e", "comment": "Malware payload (Pony)", "value": "dab8893b6a8b67b41ad07bd0d01c6d9ba67bf3f80ff414ef7a85ec2a1f991c75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807041, "uuid": "2aa29492-c7c1-455d-9769-0360597e21bf", "comment": "Malware payload (Pony)", "value": "4cb5d0afea368c7668fda827d5c8a0fea122520a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644807041, "uuid": "5448f21a-ff18-4b0f-95ce-57563b2a4438", "comment": "Malware payload (Pony)", "value": "1955cf6bb6df4313a5b2c7435d62e4f3c8b0da9a35c506f80d0949691a75e75f26e7f33b58c63af971a5b608298a8fa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807041, "uuid": "f562ed52-c8a7-46b3-a6ae-507a20486ea6", "value": "T15EC4F2C3E733E8CACFB119315962FF2B6746DA7D0014144E21ED2C5136A72A3217AE9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807041, "uuid": "3c6084ec-ea0c-4c5b-89a0-e1474c547046", "value": "4dfcdb4dbbdca9e41ad6b80af6f44e34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807041, "uuid": "c613e450-c25e-47d5-b34c-4e70c07190c8", "value": "3072:ML3kgS7wJnWRsfC9TYa5+sCyD2Lm7OLwL3kgS7wJnWRsfC9TYa5+sCyD2Lm7O8:LgWITd3M2CqzgWITd3M2Cq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644807041, "uuid": "c8de5d24-aa96-4291-9497-c47571a822cf", "value": 593408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644807041, "uuid": "3e51631b-39a5-4377-93d4-70b8a6d9cfb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644807041, "uuid": "3184aaf0-238d-4f83-a7c9-447fb19554ea", "value": "b7b86225defaae424aa2e447fc784088.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aac0b84-8d71-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644827853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827853, "uuid": "384c7fc4-a13f-40bc-baa1-59ca29dfb2d7", "comment": "Malware payload (Loki)", "value": "4745ed71fa319a01cd5223a975fb6194", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827853, "uuid": "a645ef2b-6ea5-49cc-afb6-c4a27bc55b01", "comment": "Malware payload (Loki)", "value": "dac5d5625c6e1b3251daff6818609ac7c86d77ea3e1d2cff4ab391cc35e5cbfd", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827853, "uuid": "45f25d2a-4033-4a4b-8321-f6da271451fe", "comment": "Malware payload (Loki)", "value": "f64d151ba0ee60b3e0141cdaa04b5b3ba845f581", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827853, "uuid": "6ec144f9-587b-42d6-9883-4501c1852004", "comment": "Malware payload (Loki)", "value": "5a4fd64b1eb065d1614dbb30ed378c98c1abbc119c58a6669420dc2004857272ff45a9bf16673a0a0725a007a88cca8d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827853, "uuid": "2e686b24-7690-4d17-a031-61888b7370b7", "value": "T134E43351AEDC83AC97B8C6CC64172DEFBD409A49689430177E8EF568F180F3B458BD58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827853, "uuid": "fc7e89e1-cde0-457f-a516-f170d496c7f0", "value": "12288:mfTcxhbL0+fyGNdnmZ/t9whTIw268EenU1WXsCkOFX1GMFj6F8BR6:mAhbJaSdnmZ/t90T/268Giz/Fj6F8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644827853, "uuid": "8d37d29c-0820-43bc-adad-937bca78b8e1", "value": 667826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644827853, "uuid": "8089180c-6a23-4b8c-a3f9-b0e2791a4029", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827853, "uuid": "4ac3e699-4d06-47d2-929b-79e7cfc68319", "value": "FedEx Receipt_AWB#5305323204643.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3127b35b-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644822629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822629, "uuid": "f6a7bbda-b30f-45aa-b295-b26d2a48149a", "comment": "Malware payload", "value": "63c6ec6b042bcb00d2d832c0e4f25dca", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822629, "uuid": "a45ddab7-59a0-4906-bec9-9168feb4e4e2", "comment": "Malware payload", "value": "dae968f47476ef79b122e771ccd0a2bacde2ac3535f68047239682fefa3dfe50", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822629, "uuid": "fae8bec1-81d8-43a3-b1f1-2f3e74941afc", "comment": "Malware payload", "value": "a904a7c3fc89ff497e91384a63db3282e00d31ce", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822629, "uuid": "011cd37d-987d-425a-bb77-70fd32c9520f", "comment": "Malware payload", "value": "cb0f69f09c37b784f7a8b4a41f6f6b0d5610c6bac477ba167668e755ba17c86474becf99710b2a255421470d33b93ee7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "MEMZ", "colour": "#49A113", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822629, "uuid": "809b10fc-64bb-41d6-8460-04bd3062e0dc", "value": "T11C528D3236784E132D3026C99C0AD246FCE463F7362A5E62E413C9FA50AAED3725F705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822629, "uuid": "b37c72a0-54c0-413c-ac72-d1e182bf0f92", "value": "192:E7N3ODNPiwc205VjF+Ijytxd+7yxpVtLoTKihWn5hhHxGtHfzf+H/0Nz6hcbXR:E85qwc35O1+7y/LphxxGtHAhubXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822629, "uuid": "b0b370b7-32c9-46af-96b3-192ef5d92389", "value": 13614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822629, "uuid": "fb24e696-fa29-4217-b5d4-538b43c9073d", "value": "text/x-msdos-batch", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822629, "uuid": "6c80dec2-1a53-431b-8fa1-3a8979cb96ea", "value": "MEMZ-Destructive.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fca1393-8d77-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644830438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830438, "uuid": "22dd5d5a-4109-431b-95be-9c1dfd001f2a", "comment": "Malware payload (AgentTesla)", "value": "6416c0e536dba1398a26da79cd533803", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830438, "uuid": "7c38459b-6a0d-4d96-84a5-438e05146eaf", "comment": "Malware payload (AgentTesla)", "value": "db52b31204308e9d4716b239ca8a4c4106cb596d6e905a7d45fad60512c7fa90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830438, "uuid": "ca52998b-e777-4528-862d-a674d3de55e6", "comment": "Malware payload (AgentTesla)", "value": "bec535ce6ba87afb465726345a6984182413a3f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830438, "uuid": "b4b1191f-b700-41af-a80c-8bc0ff5ce8e4", "comment": "Malware payload (AgentTesla)", "value": "ef1da564d42495e9c2d571626908259fb6550b2130c9661b2377ebc1417713a884f8b9ffbf4379a9dbd61bf2c824862d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830438, "uuid": "a5f81aca-d6e0-410a-bfbe-793777b3929d", "value": "T16F0533926CE894D05F678732BD4161CBF16E9499843CDBB772A9DD62E220D63D303E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830438, "uuid": "d9a27edd-279e-427a-8b16-fe3e2c8dad08", "value": "24576:SZ7nLdlEjkWl8c34Jm0yL5dggu7jd38ARYl09:cnzE5lHoJm/56guVsAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644830438, "uuid": "b9696950-006d-433a-aab6-cc579eb0fbd6", "value": 830082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644830438, "uuid": "ca5ce2a3-0370-462e-a3b9-6832f341d17a", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830438, "uuid": "1cb1cf25-fd8c-4824-a2c7-486dda4c81cc", "value": "db52b31204308e9d4716b239ca8a4c4106cb596d6e905a7d45fad60512c7fa90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6090500a-8d35-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644802093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802093, "uuid": "a20cb491-5fa4-4d38-9ebb-bc0b41b53690", "comment": "Malware payload", "value": "606a7265da76560f4bda31cdf85fb43d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802093, "uuid": "9e0c0a13-17c8-495b-9ecb-0b51b61d8fb0", "comment": "Malware payload", "value": "dcdf3c11c960ee1385ef693b70deb39857ad767928b3bd39cb7e4d80a94455e5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802093, "uuid": "2d86fcd5-52d9-4318-94c4-205c98b5e533", "comment": "Malware payload", "value": "c9076f5f9de043ddbcbe6021368288ee6d2332a9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644802093, "uuid": "45213972-8a9c-4273-9a2a-823bbc8ff9fd", "comment": "Malware payload", "value": "4477c44bf14b4f6ea1d444ba9c38c0926e9f36aaf292ff327017b18cd500e2ac5f827ece11465fb9731b51023af09d01", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802093, "uuid": "c4544a10-7d4f-4e7e-974b-b9430601c9d6", "value": "T15B569E46F192A5F4C6E34170535FC7B2773276398213B6B7AA04EA343EB3A515F1A322", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802093, "uuid": "fec141f9-41ac-46fe-abf7-50304f729d26", "value": "98304:tVWK7qKRXI/Vnfrlkiz3+cSKaALC20K4/gf/KWqZzVIPzhNIhdUhTh0jFnfrlZ+q:tXIFz3/KdzVIPxbgb+Bgxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644802093, "uuid": "82af8c37-a85a-4079-9c5e-dc86fde2a250", "value": 6289561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644802093, "uuid": "f68e1a61-b107-47ef-981e-acb45fecc273", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644802093, "uuid": "3b505a1c-9e8d-4ee2-b12d-91c7031d9124", "value": "dcdf3c11c960ee1385ef693b70deb39857ad767928b3bd39cb7e4d80a94455e5.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598ef962-8d6a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644824845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824845, "uuid": "2a704027-b28e-4df8-81fe-3989aa91834f", "comment": "Malware payload", "value": "33caf636d5bda04d29b86319182502b0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824845, "uuid": "8260cfa8-2710-4eb7-a5b6-01f0c45f9f92", "comment": "Malware payload", "value": "de3903d631179514c2035b5ca4dc8f603253ef149f02d9aee72ddacdd1f8785b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824845, "uuid": "089a32e2-277e-4088-9974-fd7ce633f3d9", "comment": "Malware payload", "value": "a78e2ac12507cd30940ac8f527f4e3dadf539992", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644824845, "uuid": "a433c5d8-d412-40bf-9a22-e2ccfa2004e7", "comment": "Malware payload", "value": "c70f5a710f950675baf3f5d129131e767bd453ce4ee132d48a1bdacf28ba9c5ba0e2650bb89e7a96b16f9872f4dd4f7f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824845, "uuid": "f53bdc4a-3241-4e16-8f21-34e3fe677a31", "value": "T1DD55BF27F55D8811D2130A3DC5425D1134BA82D8D08BF4BF2A5C367BCCA99B79BC3B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824845, "uuid": "94e21367-5ece-49c9-8189-e807cf881466", "value": "24576:zmzN5SVVQ8bKpmZPFLlWmxdXtxOrI6luAq2cluenXylasWEoMJGHXgwT:zmzSW8br7wmxdXtPeLqnueilasWEoJwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644824845, "uuid": "98f129aa-9def-42b9-85b9-96f178452dc5", "value": 1372472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644824845, "uuid": "2a15c3d6-1ac5-49e9-8432-58e68fa84dc7", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644824845, "uuid": "749729cd-8b57-4861-9562-c69e4ae5d41b", "value": "log4j-core-2.8.1S.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "782807af-8d8c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644839499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839499, "uuid": "8bf30218-0a79-44a0-98d3-9a1dfbd9b459", "comment": "Malware payload (Formbook)", "value": "67e35aa265604077c05cb33ce4faacac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839499, "uuid": "2bac3a93-7610-42ac-a984-e3f348ef2640", "comment": "Malware payload (Formbook)", "value": "de84eba1dbe2c9b339c91d9f90180478b3e84a190f566d3c667d6490caa92601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839499, "uuid": "fc080df4-77b6-4363-bca6-a3f95f084936", "comment": "Malware payload (Formbook)", "value": "8bfd5d51b8416fb747e4c486b9c9691b28b47bcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839499, "uuid": "d805114d-2eec-43b6-8ac3-08da1e8babf1", "comment": "Malware payload (Formbook)", "value": "1c4e0dab06d89dcc9df6010dc66fd22fb6d3701007381ea2f80bde426b997c48b2d68621915fb3058745fcaab4b24e6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839499, "uuid": "40f6afd1-3c9c-41f6-bdf2-cc9d0532a5a7", "value": "T1D654130AA4D48CF3E6C717B231636627CB7EE11112420EAB7B606F7ADC984C29E555B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839499, "uuid": "125df7de-e7c9-45bc-9403-d4ccebf5e3fc", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839499, "uuid": "24b17363-b6e3-459b-87d5-c33ecd6e9e1c", "value": "6144:owy9M99JVuPJneJ+HSWrizcHeRFomMA9dWeUr5KSCVt6f:0Q9Lu8J+eI4Fom5oeK5KSk8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644839499, "uuid": "d89e437d-ac7e-4e28-bbe8-d7af985928e2", "value": 298854, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644839499, "uuid": "4a38f7c4-5b00-4b2c-a8bb-db87e2f2e696", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839499, "uuid": "17c88424-267a-420d-ad66-6466bfc4d931", "value": "Order-317585122-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47edfd19-8d87-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644837270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837270, "uuid": "12e162e9-94d2-4e61-831b-ee7302ba92a5", "comment": "Malware payload (AgentTesla)", "value": "3804873e50ab6147ad5169ec2dd1459f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837270, "uuid": "013b40e5-78c0-40cf-a28c-e1d141b3467f", "comment": "Malware payload (AgentTesla)", "value": "debef14cdcaa144fbf7946e9abef3a2495f43f784d20a4615c1e30a288194009", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837270, "uuid": "a6a6a3cd-06df-43e9-9740-ca568a41fd1b", "comment": "Malware payload (AgentTesla)", "value": "3b5bd00575788e03a8d55fcfe728290e7edd4b26", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644837270, "uuid": "378c3bc7-8c6f-41cc-a9d6-15c35f2425b0", "comment": "Malware payload (AgentTesla)", "value": "c9d8876e9abd46a201cc7a5aba5aa6db52167df230e073726bc2ee2054aad2ffc8871229822cfff8c7a529ed886314e2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837270, "uuid": "ad9ae276-28e3-4cf5-8f7e-23437d2de411", "value": "T16515F101BBEA6B23C56B0F77E4B141416770EA4A511BD77FA4C036BC2C4B3295E7227A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837270, "uuid": "fb0dc80e-5cda-49cc-85ba-c8add07b74cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837270, "uuid": "97cdaf43-1894-4411-946b-7a02f186a139", "value": "24576:JHI+8svYselGgPogDH7QcCAM6WZbB1P8UJ:58svYsk8/gaB1P8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644837270, "uuid": "c8e102f6-8ee1-407b-9759-6975cc5de897", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644837270, "uuid": "7e526933-9c35-40b0-bc25-f3c37e343174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644837270, "uuid": "c2947780-0107-41a2-80e5-20c142df418a", "value": "RFQ 14022022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a0e61f4-8d6b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644825382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825382, "uuid": "e8b4c812-ac7a-4e64-995d-cf1235c9ead9", "comment": "Malware payload (Loki)", "value": "ed457ebace5e92818a8863088c2d5bc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825382, "uuid": "e837f00c-269e-40dd-a987-1b092021e92a", "comment": "Malware payload (Loki)", "value": "e02e76b801c04fa9909a938660de5a477fded8303b54d7a51f6a5bb2a8177398", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825382, "uuid": "f5f071e2-4239-4ead-b339-cce3ab0877f5", "comment": "Malware payload (Loki)", "value": "43c7fa12d8ac0b778019a7dc6923b6de627f19dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644825382, "uuid": "179b86b5-d390-426b-9939-49df0d6dc8c4", "comment": "Malware payload (Loki)", "value": "fa873ddfd8cc7dfaf63bec5d2c4c2c469bffda5a5f5d3973b9f722df799d1fdb05b402d54a4a9dcad89f9b4510565047", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825382, "uuid": "110b098f-da7b-4cd7-8306-b53c4ff0ba29", "value": "T1B25422035CC94CB7F24998BA29569735D2BEE3090F0A06EFB3785FF57AB26C71906052", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825382, "uuid": "89e66555-169f-453a-8a95-0cdc24dd3490", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825382, "uuid": "eb779a55-20b4-4c2b-9572-f4169a9fb9d7", "value": "6144:owfHGNP8nI724Y6cOMIkmM+Qkxvm4K1uZHUUouFqEnkjl:6RZa6cOzQkxvmr1uyBuwEkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644825382, "uuid": "462c84c0-61eb-41fd-a1df-2db045b98c98", "value": 287796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644825382, "uuid": "aff8dfdf-bf2e-43d3-ae9d-ee2670cf21ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644825382, "uuid": "5873aa9b-ff8f-4dd6-aa5d-80924dd9aa96", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec7475a-8d9f-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1644847643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847643, "uuid": "1172ebcf-a304-4463-a720-27803522258c", "comment": "Malware payload (IcedID)", "value": "d89ee700d288558d5b5d4f118df4aa25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847643, "uuid": "51261ade-f837-427b-95bf-0de3e4fee67e", "comment": "Malware payload (IcedID)", "value": "e0677236472f95f6c2570c02c885d0fbe459a8b9da0f77d826061c9d0537ccd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847643, "uuid": "26f51b4f-99e2-4b44-82fe-98ce08488034", "comment": "Malware payload (IcedID)", "value": "7bbcd9f8b97b6471a3c65289c0951b36d194c131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847643, "uuid": "142df3a2-551f-4e73-b453-f277b7c3a51b", "comment": "Malware payload (IcedID)", "value": "055b2893e90a4cd600d44df6ea93afbedaff63b79f6d4f48e8b4ddc98a7bdd838676e3d5edf2b0a1c1e1cc28a1e36a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847643, "uuid": "6a175037-1777-48e6-b989-5bb6832278c3", "value": "T12ED4AF39636507B5E0739434C9734943C6F17CB117B095EBA3A1325A0E3BFE5A63AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847643, "uuid": "e877b842-06ee-47e0-ac79-586fdab32a61", "value": "01f87ec9e1e36146b71b7ffce4fd5fa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847643, "uuid": "a1caacc1-94a4-4587-b12c-2d2ac32136ee", "value": "12288:FTsor70Aeojgc4+o07OCi6HY7FpW0zm0pF:FTXjeojgc4+lDZY5pF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644847643, "uuid": "28183de3-2c8e-4ff7-9180-a3d085945446", "value": 621973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644847643, "uuid": "a86b6cd1-8631-44b7-a3aa-d9696fe21b2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847643, "uuid": "28bbca6f-37a3-4c7d-ac09-44c6cf2dfd15", "value": "e0677236472f95f6c2570c02c885d0fbe459a8b9da0f77d826061c9d0537ccd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "682fb02d-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644821863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821863, "uuid": "dcafecd8-3b0d-4743-a177-f688b432fd2c", "comment": "Malware payload (SnakeKeylogger)", "value": "7a8d6519f6a56a68834600af94e68441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821863, "uuid": "85f95adc-c850-43d0-998a-2d939e9c5fc0", "comment": "Malware payload (SnakeKeylogger)", "value": "e177a1fcd5da72fa555287f282fb82d69bb8a040767ccf2edcb7bf95ca8dac6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821863, "uuid": "17109a15-c99a-4e67-9e50-be74c510ca35", "comment": "Malware payload (SnakeKeylogger)", "value": "a74e7a98ab62d4cb8b737e34e1dca07f13979c54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821863, "uuid": "39cff5a7-3e0d-4964-ba1a-be47f63b2c83", "comment": "Malware payload (SnakeKeylogger)", "value": "e2b38f26e5d392427caa3e11e2e77c2967fd837a3f40fdbac9c35773b8037b69bb39f4c59f506d3cfbbd6b115e8aee8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821863, "uuid": "546522ea-5c56-44c4-908a-67bcbc8e6861", "value": "T107050205BBB7A514C1660B7AF8A142C0AB31EE1D1547D3BF70AD398D3FAB35A4836532", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821863, "uuid": "43e06fb7-1265-48f1-afc0-dfd7963c9774", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821863, "uuid": "51d0181d-9257-4427-8263-8fa0f14fd08a", "value": "12288:cqTV1ELZYdLOU7Dcn0f6qLkBOl3eNPmjYhp5s87jUQ9pYwYXIkBZCa5iN0V1Nk:cqTV1ELZYXo08BAgPmUX7z3uIkF5iNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821863, "uuid": "6e6ab297-6173-4fbf-bff3-e4c18eceb5c9", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821863, "uuid": "422a526b-aa5d-4d5d-a758-1fae7be9faa6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821863, "uuid": "a9dadad5-9915-47c4-83c4-9807194e3704", "value": "Halkbank_Ekstre_20200521_082357_541079.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21fe910-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849904, "uuid": "10c3dd2b-d05b-4ba4-94c6-6f7e60c811d0", "comment": "Malware payload (Gafgyt)", "value": "9d7aa6b7ce8701fa644b73e11bb02949", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849904, "uuid": "2c4572af-9df2-4dd3-afdf-8836a601b5f4", "comment": "Malware payload (Gafgyt)", "value": "e1cb5eae3cec8cbf7636490814e2168ea477fe469514b39fb9b932868be9230c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849904, "uuid": "7d3b3529-0d05-4858-a6cb-6c0aca680c51", "comment": "Malware payload (Gafgyt)", "value": "ce8d3e5ad737fbddf92cb8014d226c3db1c29608", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849904, "uuid": "3deb09ff-a081-43d8-932a-655b4643fd98", "comment": "Malware payload (Gafgyt)", "value": "b4ca98dce7e3bc4cf9f1e8677dc2a1d86fb5e076cf1301db637e710ac34ab0592d8115a30fbe88a15c3d574b87c7e752", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849904, "uuid": "03ad5ef0-5ddd-4f51-bbca-43b29d7bf770", "value": "T100A31893B900EEB7F40EE77608D34B257230BF664E93162273177966AE362D42827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849904, "uuid": "d156615e-e087-4ae1-8a1f-cbb532e88843", "value": "3072:RqXKRy1TDor3P0KO9ylyt7CrXmm/HpbxGCnKeND:0Por3P0CyterXmm/HpbxGCnKeND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849904, "uuid": "5864d323-7c81-4c40-b177-53da442e890a", "value": 100488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849904, "uuid": "32eb2a7b-84f9-4eb4-92d6-835f25f6e679", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849904, "uuid": "7653f88a-7592-45bf-b6dc-ed44ca1b1904", "value": "nv.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59c8ac8-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849883, "uuid": "16942bfb-bdca-4c49-adda-5cff6b077d7f", "comment": "Malware payload (Gafgyt)", "value": "2a482fa6bd498c8f20f3a3a1eb3b8e4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849883, "uuid": "cad3735c-a23f-4568-992f-5e99837e0d7c", "comment": "Malware payload (Gafgyt)", "value": "e2be741d8dd3f255c9d2999b1398827fa1c65f948ce01965b674b9810c5914ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849883, "uuid": "8ceba266-827b-422f-8119-90a9bb5d7aa4", "comment": "Malware payload (Gafgyt)", "value": "184e726ee4c0948d9764ce4f3967fccb2f433d66", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849883, "uuid": "64908469-949c-46ad-b997-ccbe49cb8631", "comment": "Malware payload (Gafgyt)", "value": "2c6f943f70c5e8961bb93b6354e48c4b35c533c3e6b05716bb272e54bedd7155dcc34178d88ca8da7dc55692a89d8288", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849883, "uuid": "0356fcfd-2e2b-4248-92c6-9f84b4ae93e6", "value": "T1D2B31A45E905471BC2D327BBF79F029D3B362E54979733066A357EB02BF27981E29220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849883, "uuid": "5cc4d6b8-50ca-40f6-a246-1e2b000d2638", "value": "3072:vyLVlD8+0hwJolJmZDJVt/MuXTvmP4dZQ1F4SfuRND:valDEGJolJm1mP4dZQ1F4SfuRND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849883, "uuid": "767de191-361f-4888-83af-9ce357114ad9", "value": 109587, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849883, "uuid": "18c6ff9a-7c73-4fab-902c-a2dfa61816de", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849883, "uuid": "c7fcc118-a1a8-480a-8d73-43b7499998e6", "value": "nv.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0158be73-8d72-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644828133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828133, "uuid": "62cb1272-9c0f-42b9-b428-150e1681aec0", "comment": "Malware payload", "value": "0f76e87ac01aec35967cedb5fec96994", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828133, "uuid": "d9fe2e53-cebc-4f87-9bf1-c323bda61afc", "comment": "Malware payload", "value": "e2d9150b8215219f69f8ad4b8d3ca59ce3f7c145bf023a93bf599ecf1dfe3377", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828133, "uuid": "220042d3-f5f1-4a43-acf1-3b5f3f06f53f", "comment": "Malware payload", "value": "4cc9d6080ede0147615d9fc9a00cf9e3193e0b02", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828133, "uuid": "553fe7f2-2459-4a9b-8bc7-6d7118200ebf", "comment": "Malware payload", "value": "028b34a861bd3244da5e2d606192bf734996fdb3ba35aaf4dd2da3b6a415aa0ac37b92570a9b6dad10656658131c142d", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828133, "uuid": "ce68d322-318e-49af-9117-ad3e449d5981", "value": "T11E642349578EAF0C15F9AF927BB9BCB930543515A1DB87DBA00BB1DC6C03924F62C643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828133, "uuid": "6e9ac7c8-f844-433b-8716-89de07a322de", "value": "6144:9u6bRE7saZEsJNehcQ5TeY9rS2jo8Z03gvd6IWC2jpVcjNX195IUab878pj:5RE7sYEsjG5TLpE8ZmgkIW1yX58d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644828133, "uuid": "323c79d7-fff8-4c0b-b48c-4f938b440d48", "value": 310487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644828133, "uuid": "c792cad5-72e6-44c8-92b9-e0fdaa7e9a15", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828133, "uuid": "f9bcf656-1011-4d00-a223-eccc2918c067", "value": "INQUIRY.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba5b61f-8d68-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644823935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823935, "uuid": "4229d169-e220-44bc-bff0-498957f395a0", "comment": "Malware payload", "value": "6825fc36ffad5a319e4b3b2897b694da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823935, "uuid": "9f051a79-6d57-4395-b4b6-3a2613d20b8b", "comment": "Malware payload", "value": "e2e08e9e645d6acce19bebdf4321b830525e9cd2ee409bb468a81bc35cc6f8bf", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823935, "uuid": "c4b063ee-5f67-47fc-8de0-cda60a9b37af", "comment": "Malware payload", "value": "c6f424a19e0df57992bf2994ff4effb2f246da08", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823935, "uuid": "7d912027-c971-4bf8-bc1c-8703d47492eb", "comment": "Malware payload", "value": "a636d0b2a0611da78569400ce8dbbf658b3950ce7fa22b143637faa3af107d85d447ab379cad78290204234966c03167", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823935, "uuid": "a97fed9d-4063-4b88-99fa-82e8a61d205b", "value": "T169428E3DF44C88E9C78DE2F41A07BE52A09D795813D2D2D3B7ACB7715B6256F2325820", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823935, "uuid": "9597f2f1-0056-48af-89b5-700882575ca9", "value": "384:qT8SxsndfT7lcucYXOun0ZByu+98Ggetf5:k0ndfT7lLn0ZB3+uVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823935, "uuid": "c70c9159-3026-486b-a783-45899b29a693", "value": 12647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823935, "uuid": "3bacf0da-15ec-4c15-b1b7-1e73688a6787", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823935, "uuid": "31fa7ab8-f167-40e8-9ebf-1ab74952fba5", "value": "NNXdocumentXforXLCXreceipt.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b586e36e-8dbe-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1644861077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861077, "uuid": "0da04c9e-c89e-431b-a4d5-22e6c386e882", "comment": "Malware payload (RedLineStealer)", "value": "24383b654f69eec93abc1eab24088712", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861077, "uuid": "3c4b49c1-c40b-455d-81df-37a177ce5c82", "comment": "Malware payload (RedLineStealer)", "value": "e316a2df7796cac9a0f6dff3cfa3ae63083e6a7208e95e7458d2fcae9dbf3535", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861077, "uuid": "720f5e10-221b-40df-8600-5bc55307eff8", "comment": "Malware payload (RedLineStealer)", "value": "b4e381e92f4e3fce79678b65260997f6f51b64cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644861077, "uuid": "4e559015-b62e-4529-bafc-3f61dd4b7c63", "comment": "Malware payload (RedLineStealer)", "value": "e03d570c70b2b687453b5a21f2b6f244c55b32da6a500541e92c8feb6936f052b7de3e0ae361045e05096b0ea0d862bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861077, "uuid": "a1c7cf5b-b8bc-4073-a710-889e9c013a73", "value": "T1824523627BB5C48CC00B21B63263464B11EFFD5B4228448EF5EB7A8B5331C5B66D9F4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861077, "uuid": "befe2496-032d-4ff1-b504-f82fad34e8f9", "value": "d5dedd27752d7e46a83672fd8b6f0b59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861077, "uuid": "dec91f6f-7082-4744-93a1-be8e66cada7a", "value": "24576:EKkKtsCXiRQa8USqfrJ/gsh+2fDn3u0unC9ybOiGj:EKz4Qa8USwdIshvfD3uHnAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644861077, "uuid": "a3376d82-baae-40e2-8ee4-e3faa6e66b67", "value": 1243296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644861077, "uuid": "1a6a49a3-92a4-4856-9dab-1fc6df0b49da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644861077, "uuid": "b1c1c0ad-c016-4df5-975f-ed4f5d9d89f8", "value": "24383b654f69eec93abc1eab24088712.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1248efd-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845715, "uuid": "ca7b3bac-c597-404a-9e00-2855fd0d6003", "comment": "Malware payload (Gafgyt)", "value": "7a622e514f72096775c4a155e53f62b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845715, "uuid": "65ddd177-eb00-4cd5-bf8a-53e5ae07d99b", "comment": "Malware payload (Gafgyt)", "value": "e344ff10c82bcee9f3d2d5d94fbd27917e251de8880b358afbcf2b66a32eaa4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845715, "uuid": "ad28fbc1-eec4-4fb3-9828-e0e2d385a02c", "comment": "Malware payload (Gafgyt)", "value": "636428eee8fa0146dc83bbd1c4c753bb1cea8eda", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845715, "uuid": "68d6d8c8-1570-49a2-8142-58ac19bbfb16", "comment": "Malware payload (Gafgyt)", "value": "4f77e2575c7241ebdf1148839995164bc5e5218c774268d8e4d6b7dde6d0dd1348aac533932b72d22a07e7ea1b6e7fc6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845715, "uuid": "ca875cb0-7f97-4368-a76b-cd575e552633", "value": "T154931903771D1F83C49B6EF12DF727F18369B96112A25280A11EFFC45772AB02526FA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845715, "uuid": "ca91bb20-6906-403a-b186-5ec5a7be8ba0", "value": "1536:oKtX//uqevN0XrkninNyX8WaAtjM6ar+o3TmN33VUiP/sbVBT:oAPk1/ninNyXMx6ar+o3TmJ3VUiHsbVN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845715, "uuid": "70556d49-fa3c-476f-aaa0-226b1aa584f4", "value": 89667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845715, "uuid": "0949b519-bdea-4a8c-8c13-3384fa27254f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845715, "uuid": "7377664d-ec00-4116-9085-ff0734bf2d3b", "value": "qbot.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a8225d-8dc5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644864048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644864048, "uuid": "e945400b-d134-4091-ada1-69eec4dca8ba", "comment": "Malware payload (Loki)", "value": "48bc936af190c9011b9c33e45dfc7c23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644864048, "uuid": "2277f62e-4aca-4ca2-ba24-72e9fb4da051", "comment": "Malware payload (Loki)", "value": "e3651f5bb9fa7f29846c2c4de863867c46932c88beba48f1bcdb22f54af78545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644864048, "uuid": "8659f3f8-e6d8-437e-9470-d08fc7086d7c", "comment": "Malware payload (Loki)", "value": "a97bf0434a2625f91eebc2254936a16891b2099f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644864048, "uuid": "b4bfca3e-877f-4336-966e-ad4ffa5b04e0", "comment": "Malware payload (Loki)", "value": "34b2b1b268c7985afa3849031332f0aca283d0e241347325fffef5cef30906a44ec4dbc5978bf6b5beff20f886a652ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644864048, "uuid": "7110dc17-f53a-4ee8-bc71-ee826316ce42", "value": "T14B539E3A5BA8C5EAD715A575E043F321232B6EE2DB41051F33A03E8F2CB66858DED491", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644864048, "uuid": "a0ce90c4-dccf-4073-9c63-83c4ef051348", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644864048, "uuid": "36e8c68d-90f5-4e36-9be1-cc006488e0c9", "value": "768:dzSnP5H2YKcYeFehyJrkcvPhOS4/Vi3xnehErtX+GsMEQ:9AHJKcYesQzPhOvVihneW9+u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644864048, "uuid": "587a08a8-aaa9-4257-8cea-1326817fe3c8", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644864048, "uuid": "6c25aea9-038a-4061-8254-5fb77ad0c860", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644864048, "uuid": "1d475e4e-a2c1-4a87-9a69-36f65d0c5197", "value": "factura 7685 doumentpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e1b89fc-8dae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644854138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854138, "uuid": "7d71d094-e167-4322-b1a2-8872089e1cab", "comment": "Malware payload", "value": "1db0a8972716904e6f63e62bde05ac07", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854138, "uuid": "eec9c114-95f8-4c8a-ad4a-2ef0526a9f3c", "comment": "Malware payload", "value": "e36c27ba5669d4b1f446ac56d75451d16ba188472dd3e050043ca1e374ddd239", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854138, "uuid": "d95c3634-c267-4e13-a4bf-691455255dd4", "comment": "Malware payload", "value": "e12b4bb5a807c6e8dddc5b56d2960fe0598301e5", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854138, "uuid": "2dc01289-b2e8-467a-8dd4-40c238ec0ba1", "comment": "Malware payload", "value": "0a96afa4167981cc05e3a0525ff496acfb1c4d304379882a764fcce52e3571f6639f9469e97f5d17639638412c4405dc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854138, "uuid": "b1555866-923f-4f7a-9aa8-01c88e2ae58d", "value": "T15C0633CE003B3C9D5AFF051282E3E4669825C9784D700FFBB36E198A6DA7466D317B49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854138, "uuid": "85238e6c-b729-4a1f-90e0-d63e22f43acf", "value": "98304:xguZzyElN6sY5Za2v6RrvOWGiUGhJ+ZScoLoa:2aytG2SNOnsb3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854138, "uuid": "61793ab5-430d-4fea-bd25-e54285d5b98a", "value": 3862670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854138, "uuid": "367dfda2-1480-4d15-ba40-2768d27dfe39", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854138, "uuid": "8126bbd6-052b-4e58-9ec1-6d9e1586441a", "value": "0d6ba9d946569a22b6905c0d8a54c5e3-sample.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6099e1-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1644822700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822700, "uuid": "44b06a3c-8df5-4f0d-91f4-e1b4b1414aea", "comment": "Malware payload (NetWire)", "value": "f00a0488e36311c7f68821c6aecd6717", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822700, "uuid": "179a6eb5-9717-45d4-9057-40efc66948ef", "comment": "Malware payload (NetWire)", "value": "e4715658b6981b37c06e063e6b59af6d82c8c5edeb93e339e367d497332b7b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822700, "uuid": "d884373b-c104-46d7-87bf-1d46aa356191", "comment": "Malware payload (NetWire)", "value": "88b017cc2231895fdb283a9dde7430f7627a229d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822700, "uuid": "ca0e3303-4e3b-45c8-b7b6-235b4f426b0c", "comment": "Malware payload (NetWire)", "value": "96797c361d016f2c78b7c7f948f282954a03ceea1495d29653bc282f8509530a817250095e1bc60ceeb31773a97e60f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822700, "uuid": "d300c11b-080c-4eaf-8934-c98956d39ff5", "value": "T1FDA4E4B3D35CC8E1DD9211F4220ECEA71A517F9FA4D462C959ECB63BDB38065E0E4892", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822700, "uuid": "41f817ac-aba2-4785-a5f2-8d1f6be8bdc6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822700, "uuid": "45fda7c0-8818-4c92-a33f-a254cd73f414", "value": "6144:fw1nduwdSXyXLj2vg+ZZXbtcGNRuIF6YVYVML/Kv2VBj3D8TToQ6yAhZRQNb:6VdSXy7j8ZXbOAI+6YzMyBjTK6TJYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822700, "uuid": "16f97e02-f722-46f4-b062-5ec50927886a", "value": 465047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822700, "uuid": "0d9a873e-72bf-4038-a774-22521c84e8c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822700, "uuid": "e6f2f75e-ba1a-473b-9e5e-fbc591d66a2e", "value": "HSBC379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f2c899-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845689, "uuid": "be7167ef-7471-4e2b-b9dd-616e14f0a0ae", "comment": "Malware payload (Gafgyt)", "value": "77e6dfb63abb0986b6e32769c527645a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845689, "uuid": "c304c48a-0027-4953-a0b1-097726f6c8b1", "comment": "Malware payload (Gafgyt)", "value": "e51e4c1efa3ffa183783c0f314d57dfaae0e93a6e190520620e887fec86ff69d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845689, "uuid": "f1c46a66-a23d-4728-86dd-4e9d908d8a03", "comment": "Malware payload (Gafgyt)", "value": "6327902a0632bc71f190078059e0d4658c3daeb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845689, "uuid": "983cad29-91d9-4703-944d-ddb2bf624ff7", "comment": "Malware payload (Gafgyt)", "value": "a6a0295f0c320293cd809cc129d9df6dd8d4a13f4b08521cf7df060fba45e74ca8ebe2780eb829e613cfcd0d3547dd5c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845689, "uuid": "68a42928-c35e-47e3-8843-b258a5322939", "value": "T1B17339026B81DAB3D0831AB516EF9B110532FA3B1E56DF86F31D3DF48F15184B226B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845689, "uuid": "24591243-2227-4251-bd19-edce43815e6a", "value": "1536:nfNMU2+NfU/9qkjZWSJUSWQdAlR1Hw/z4JfnY8Bk7nYmAgliFmd7eVg3PfsbKRp:nfS+NfU/9qkjZWSJUS3AlR1Q/zKfnYmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845689, "uuid": "9822cb76-7023-40fc-8fff-c70dbcf3d787", "value": 77325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845689, "uuid": "bffc1c2d-92e3-4a49-8355-a668c2a9f884", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845689, "uuid": "793ba9c3-414b-42ba-9820-ffb9e70c6152", "value": "qbot.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59440c04-8d45-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644808953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644808953, "uuid": "4681020c-2502-43c2-b392-f808f4f9d246", "comment": "Malware payload (AgentTesla)", "value": "2692d72819fb46eff1a19d1dd00881bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644808953, "uuid": "9fd24429-ee35-4aeb-a05e-748dbc99dd3a", "comment": "Malware payload (AgentTesla)", "value": "e5a8176770ea11671eb417ac3f8b999b18b3d2e2be555798729f4742fff52215", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644808953, "uuid": "25be39ba-7bc0-48e0-890a-c6695a7bc453", "comment": "Malware payload (AgentTesla)", "value": "208c0d2b7f53ef8b2dbc86b170902dce8c086134", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644808953, "uuid": "e48ad0c9-586e-46af-8451-346a1ac8301b", "comment": "Malware payload (AgentTesla)", "value": "8e68313a88e0d45d2f77889cf312a7f6f816a7767598992c032b07a0bb3e2485c11802b9dbe46861325f8380d5fe43c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644808953, "uuid": "4358cd37-3279-48fd-8f1e-cbd2a0ae3052", "value": "T1A3C32150E90DACD9E7D8C1B3B93A9B100575BBDB92F8819F2265371466B37C320B7D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644808953, "uuid": "5f903752-c518-403c-9d4c-ebb28d078ec9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644808953, "uuid": "6b9c1aa1-ff09-4f8e-b95e-172b3cb105df", "value": "3072:bh2el+8ry8o05lhUqrAMgTPA1p8Dja+auDOLQyDl9hFDO4rQ6ZQY7j1lQ7wXVA0v:QewhCvq4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644808953, "uuid": "e7cd1213-097a-4f75-910e-fbd5089f3906", "value": 121856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644808953, "uuid": "4866dcde-0c3f-4333-ac72-bc8d50d675e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644808953, "uuid": "1eb57225-f23a-46db-a8c4-81f62a07342e", "value": "016-26404851.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a334717-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644854535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854535, "uuid": "75e79da3-7600-4b60-bb12-21ac91216206", "comment": "Malware payload (SnakeKeylogger)", "value": "be8cdb3d2b44a3e92eb663c47483665b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854535, "uuid": "ea332bb8-80ad-404b-9b5c-5af740b80080", "comment": "Malware payload (SnakeKeylogger)", "value": "e5f494d01d602476507f811362aaa44a56e64416126b32a095bf70cce4b45e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854535, "uuid": "1f807a42-618a-46b4-8d01-d8f0a9c43261", "comment": "Malware payload (SnakeKeylogger)", "value": "5f0e34f119372d7d5e0e51b90cd260fdabff5992", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854535, "uuid": "03b3d2d9-657b-417e-a15f-43d0ae20438d", "comment": "Malware payload (SnakeKeylogger)", "value": "6f9d7044bb6f75517c316a161b8708728e536a6975b038a8da13fb7c0df507fa0b31aaa6878083f3e198f3daaf863ef8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854535, "uuid": "bc230f90-b047-45f1-88eb-f55101c1e6a6", "value": "T172752222B30977CEC754ABB05A11F6488326BD272CE6F036613DF59E16B22004A5FE73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854535, "uuid": "12cf6a0f-2d2a-4d2b-b462-14dfb30dbf98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854535, "uuid": "3f1d75a1-256f-40d2-af86-8b3f1bfa785d", "value": "49152:bQxL/59tEuRlArZ4T1TCI80BshWC0iKvPu:UxN96uR24T1Or0qZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854535, "uuid": "306ee40a-98a6-4421-bb22-e8f138bcf2be", "value": 1647616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854535, "uuid": "9b82928a-cf98-4658-981b-b2020a087e27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854535, "uuid": "83527165-ab32-486b-9911-2bd6a0ed8094", "value": "be8cdb3d2b44a3e92eb663c47483665b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f843dc-8d71-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644827788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827788, "uuid": "863af8d1-dd51-4930-a450-8d5e0ed74081", "comment": "Malware payload", "value": "9630be541eecb025b97cd939e702201a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827788, "uuid": "4b3e7444-60b8-4e11-bc80-4de6c57429b5", "comment": "Malware payload", "value": "e5ff52d12ffb0a0d948f1ca07c64a7369c92b9a9a5a200287085597266e3e848", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827788, "uuid": "0735475a-105a-48c0-b440-4ded7374854d", "comment": "Malware payload", "value": "97777f895dcc2eb45b9dea20e614d2820de1d282", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827788, "uuid": "79eeba94-546c-414c-be1f-e6a74bcf056b", "comment": "Malware payload", "value": "96a2ae9c0e71b90748b19309c58f753696c12f2b05add1e02ee4714c3794b432ba540d1c54943ddb9bd8d069b3a83d83", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827788, "uuid": "680e83ba-3f7e-4cc2-8a69-6e6c28015e81", "value": "T18C424B3CE7684EB8CF88B2F826197D4940ED7C9497D5E0A27A3CB7A06B4237DA617040", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827788, "uuid": "488e4c78-d00b-49fb-9c26-f27142763c70", "value": "192:80C+9b+aLCLNENooTW+QjgTZk9rmDez1LC4aAJ1xD/AJ5fkj3a8AH38XDRRWqD7O:80dMo2NEsvrD1zJ1NAJmqkRta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644827788, "uuid": "e12c2ee7-685c-4f39-a564-961efc3f5fc8", "value": 12557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644827788, "uuid": "b3433bfe-594a-4ac3-897f-c533770ee9e0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827788, "uuid": "6539c8d3-1b44-4884-84a3-1ca770cc8da4", "value": "SURENDER BL.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ff71f8-8dbb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644859552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859552, "uuid": "5e843f41-0156-4c2c-8bef-a2d3dd1e4b41", "comment": "Malware payload", "value": "9132ee2003218f01c9a0298ca487e939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859552, "uuid": "a8ec2cfa-742b-4381-88ed-a8cf69e8c66b", "comment": "Malware payload", "value": "e635b74086fa0eb20983c690ffbe87e62fd424d1e10a01405bc27a396e1200c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859552, "uuid": "4bf75701-57d5-40a0-9bbd-422af8586c4d", "comment": "Malware payload", "value": "14d9bf6188eca0521f897b35abc5d74d821d5ef0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859552, "uuid": "b5ac66bc-2188-4a91-bd99-42caf5997215", "comment": "Malware payload", "value": "a1cde9e9fd60f6bb1b16287461f3b6622073d36e12561d13edbef7e6d0a1bf697260a52499d9bed00a8aa15a416ada23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859552, "uuid": "9c977324-2051-4560-8e6d-23a5f6345bb5", "value": "T12A54129502D84420FF7FFEBC44B2099A1476E30BD857AF4E5806292D97773039A76A3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859552, "uuid": "72cc5047-223d-4cc0-95c7-563e4959832f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859552, "uuid": "6a3ae764-9794-49a4-a65a-4e1d8cdf2c5c", "value": "6144:OxvRZVLlfh7rZthO+JjkuHEEAt/wz/60baxHU:IZdfrXg+JwuKt/S/605", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644859552, "uuid": "ad1c1ed8-b3c2-4b94-928a-5c868ed4dc04", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644859552, "uuid": "5bb828c5-6e47-4a64-87e1-24e41a43ce72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859552, "uuid": "c183265b-ae84-4071-844c-90575c8d4bdb", "value": "Feather-Client-Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ff2347-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822503, "uuid": "6ff276bb-41f7-4674-b625-ded2a08743e8", "comment": "Malware payload (Formbook)", "value": "b1787e2a30e43bfb3ac26e8cff712f2c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822503, "uuid": "b11dac39-1532-4cbf-9f76-877aef589faa", "comment": "Malware payload (Formbook)", "value": "e87c46bb9dcbff05fb216a46f3415d8e8361ba9b16666a5eeec7b78b0d6b6c36", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822503, "uuid": "bf5db659-3192-4e49-85be-eef23738333b", "comment": "Malware payload (Formbook)", "value": "0872feb8cb115748a136cec1846764bef5e2b2f3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822503, "uuid": "a5c8aedd-99bf-42e7-97c2-1dd04a6849d2", "comment": "Malware payload (Formbook)", "value": "c2b81e683c68e40751a25384dc89b1df9c03d279aa0ccdb42ca02fcd895a7b2ea48749c4ae1a9ce82f8882ecfe0a46df", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822503, "uuid": "4c9e7e64-49be-429f-a7a5-60e6eb36a4f9", "value": "T1C614125AB55F9B41F81A5C7BD021EC605B16CE85585F38460CA3336EE9BECF1230E4BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822503, "uuid": "831bdca9-33ad-4956-81fc-e98e54e38785", "value": "3072:KMmbL2asyWEMxHGX9FkZCsZf6Q1bqPYu6ecd0/NtQqnSHsRjU8nKxdT:ZmbqaB6HGTkZ/Z6GqPYu6ecdB0SMBfKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822503, "uuid": "9e66c4d9-5b6b-4023-a4c0-d85433fbf167", "value": 191848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822503, "uuid": "88f1acdf-416c-421b-bbac-bfcd9263a086", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822503, "uuid": "58a68390-2065-467a-8e1e-2df3fc5ab70e", "value": "RFQ CW SINGAPORE PTE LTD - PRODUCTS LIST AND SAMPLE IMAGES.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ee22e8-8dab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644852908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852908, "uuid": "1cfe16b3-8ef4-417a-9975-3845fc042fd8", "comment": "Malware payload", "value": "2c43bd3a6d0107f54dcb732ab4237d23", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852908, "uuid": "b9f464f5-0006-45db-be21-bab9fd36d80b", "comment": "Malware payload", "value": "e8e5e2deced946614bba0f8524e7e852cf654bff3add55a7e16aba87fdc03077", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852908, "uuid": "053c31d2-6973-4e5d-9847-06352c5c4606", "comment": "Malware payload", "value": "ab40f69b8aa412b4cf01c383758ff84f6984f53b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852908, "uuid": "c033165d-81b8-4ce8-8621-ea80ed5f9a1d", "comment": "Malware payload", "value": "e9ae34dbc66c0f535f4dd43c7f0cb14053f7c96434532e722b4b2052d7af886a298edbcbdef1e0d83a39c831803c9333", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852908, "uuid": "06a96479-5eee-4a6b-9fa4-0752512522c2", "value": "T1A813F2C9035E6764FC5ED3BA07748F546DBBCAADF565EC8A19C4E677EA014608C027C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852908, "uuid": "03dec5e4-305b-49a1-bfcf-fcfc8180c836", "value": "768:X0BQsmq4EmuVdwclOXrXSnSzH3Mlyry+seItqO2KSlJgGlzDpxYsLfEbImKXYO2J:X0m1q4EXdlwLSnwH3iyeZqOEVrYImIm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852908, "uuid": "88e0122b-bb06-4e53-a169-838bb676b289", "value": 41964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852908, "uuid": "51d377e6-d3cf-441f-8bf6-984143d4fed1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852908, "uuid": "bb2b1ce5-5730-4c76-a463-997364149e1e", "value": "2c43bd3a6d0107f54dcb732ab4237d23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b447d8e-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851959, "uuid": "4915e4f1-b566-4e89-81e0-18441964ee5c", "comment": "Malware payload (Gafgyt)", "value": "22135b6b3de43ff68b6e44aff12dcf84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851959, "uuid": "a72cc445-ca6e-4df5-8780-604179796975", "comment": "Malware payload (Gafgyt)", "value": "e97b8dd3b185a4fdd182432bf76dbba42f2c504ca6b293ae2cd0e8cf1953c84d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851959, "uuid": "d2ffc284-8d1e-4cbe-978e-4c67ff4c9eb5", "comment": "Malware payload (Gafgyt)", "value": "f34977f8090d4b041ccf78ec16b29147f1718497", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851959, "uuid": "97733336-9ccc-4e76-b4b3-3d14d34090f6", "comment": "Malware payload (Gafgyt)", "value": "08c104305785c67ed84e909c0b37930645318e14bff6d21eab17d382ae2d1a929b1b690b7568cefc2854e882e44acd91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851959, "uuid": "d8cc4a34-0186-4ef7-a5d9-90d18b5e03dd", "value": "T1FD831B86E742CAB3C4830AB11297AA650531FD3B4E3A9F4AF35D7CB4AB338C87125755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851959, "uuid": "53f11dcc-d389-4d0f-ae9e-628563d94d72", "value": "1536:UthG4xYqSXv+xWrMhxwCZKl9jaJGwUuwcQkm7WAgcJjmAI7Hp:P4xYqSXRQhxwCZ6kLlmqAgcJyAI7Hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851959, "uuid": "49200b0d-fd50-4a7a-9a8e-243e5c7431f4", "value": 86338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851959, "uuid": "53f16202-74b9-4c93-ab62-64037c8f7d43", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851959, "uuid": "abea39ef-05a2-42e1-a428-44777cea0ac2", "value": "cc9i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cc4b782-8d63-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644821870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821870, "uuid": "8d8ab687-4faf-4cf0-9547-162db3f12000", "comment": "Malware payload (Formbook)", "value": "2295e8293ae10777216f7593f336d23f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821870, "uuid": "6e6892ad-3091-4868-9403-8cd233a8d04b", "comment": "Malware payload (Formbook)", "value": "ea222f4ca18d4bd57e605742a68c0f6b40436d9219700a75ade966e9488db34e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821870, "uuid": "963d9430-16ec-4d9b-a1b4-2b87717816ed", "comment": "Malware payload (Formbook)", "value": "ef7b9b766c61202ee17e2ffbc294f54210609d79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644821870, "uuid": "34306e0a-85af-44d2-884b-a93fac953cf8", "comment": "Malware payload (Formbook)", "value": "478d56e239122bde3388f80c79106c2950bcd62e960bb4cc3bd2f8edd706bb11afa9ddb5254900b69433bf4ffa2e2f0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821870, "uuid": "73d9e40f-4704-4954-8bc5-1a89c9141c71", "value": "T1E7F48DF6BF62787ACC672E74BD46832948D96E7E1C18185FA4D7FF4C4B7824024209A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821870, "uuid": "6572f2ec-29ea-41eb-b185-b827e08f7bbc", "value": "9b06cf375e30c898b20fc2afead24220", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821870, "uuid": "2734df48-616f-43ef-a5c1-646f72763084", "value": "12288:8FGDC4uBWDPZL7MqzZiRZl1dN7PlC8gngSws5vR0i1K2KqZ:8FcnuMPZL7jzyLNCngSws51KqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644821870, "uuid": "81d9f127-79e7-4161-8722-11776bfabbdb", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644821870, "uuid": "35034bba-37de-4da6-9128-1833007fa3aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644821870, "uuid": "d6e0c894-1359-4c00-acd5-6f02701a2c0e", "value": "Statement of account, 2021 to 2021.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc9aafe-8daa-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644852339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852339, "uuid": "db8c59eb-216c-4657-908b-9629beae8669", "comment": "Malware payload (Formbook)", "value": "82bb851b1eed9c0d6734c8dc6a098dba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852339, "uuid": "515aeb9a-3827-4262-bd99-8a43b86c0b18", "comment": "Malware payload (Formbook)", "value": "eaf8e616d7608cb817b693d98b74cc185071ed8cae8baf803c377a43080b8d67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852339, "uuid": "1b40e90e-efa3-4e7b-b060-55713bfd0b38", "comment": "Malware payload (Formbook)", "value": "ec45caf6bdf2694b3dca481eae7a9c62a16ce84e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644852339, "uuid": "1d28123d-2eaa-4b6e-aaa6-1436391c79cf", "comment": "Malware payload (Formbook)", "value": "a2da62976a15913a81bef1df331305a75b1225145608d2e16eda851bb7fa8be4a972a063faf87d7ef45100ac62b08be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852339, "uuid": "5d670c4f-92e6-4e49-896b-6b69591daec5", "value": "T1A3151209BBA2E515C5620BBAE8D052516F74EE2E4087C3BF744C3ECD2FAB3994532536", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852339, "uuid": "98198a48-b1ea-401d-aaff-7b87c1023f2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852339, "uuid": "82bff1a4-16d6-48a8-a8cf-3054b3ff6510", "value": "24576:Uyh1FeLZRHFQIpQtP8+4CLZhYtIR4X9mEqfRjsIkZ2K:91FetRvU0CKW4X9WRjFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644852339, "uuid": "69186559-06b4-4ec3-ad67-b317c5957616", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644852339, "uuid": "624d35ab-2666-46fa-bb4a-40a9d898f71f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644852339, "uuid": "97df1f7b-a462-4135-b950-364a5d146dfa", "value": "MXAcN2l7MCqRLNY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad14c15a-8da4-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644849895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849895, "uuid": "69c2b545-0c27-48af-9043-e6e4a6fd3f38", "comment": "Malware payload (Gafgyt)", "value": "337cdb2c73ce7660087d44d7f1401750", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849895, "uuid": "cab6bf4e-aac8-4365-bed1-c196e259d1bc", "comment": "Malware payload (Gafgyt)", "value": "eb28c35945172e540c9fa75b3f281d0764f77ca1fc2677e07b44bebaf240eeed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849895, "uuid": "6c839af8-7fbf-4553-9f67-2de998203e83", "comment": "Malware payload (Gafgyt)", "value": "f8898a1d8ac08ed217d29cbd8f4fddce083bbad8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644849895, "uuid": "ad0aa713-831a-4611-9983-713685a6f72f", "comment": "Malware payload (Gafgyt)", "value": "d39e8d475e7ed1711895300a2c45726f85eafae56c444e107c91cb4802323ce168e80d6017172b285a167624d2a2ae92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849895, "uuid": "f7bb358c-d6a8-4a61-a66b-e176ab5bd95b", "value": "T173832B026741DA73D0431AF616EB9B260632FD3A1E1A9E46F35C7CF46B351C8B1267AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849895, "uuid": "81ffd774-94cd-4a3b-9e18-a9ff3e270add", "value": "1536:gsFimXBbOOOKljT+PKZ53/LVT4X56J+qlmzMyPq09mmiIkp3MyaLnDU7:gsFi6blL+PE53DVT4pVq8PqammFkp3Mq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644849895, "uuid": "109762df-e3cc-446f-99e7-0b4b28f2c104", "value": 83449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644849895, "uuid": "dd52e42f-6c8b-4fb0-9f75-e4571c967a57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644849895, "uuid": "2716e654-c0e9-425c-953b-e5623518456a", "value": "nv.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f575eb-8d98-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644844736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844736, "uuid": "f543b19f-3bd4-4b4e-8151-d50144b81929", "comment": "Malware payload (Gafgyt)", "value": "0cb2d83b7488291ff61e866fe6be1131", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844736, "uuid": "0e712c85-6949-4b23-ae17-dbd2c691d854", "comment": "Malware payload (Gafgyt)", "value": "ec915cba02354d83e0a2f492545bda7dff8e0ffd5d235e48a7591cae0e3099bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844736, "uuid": "266596fd-93dc-4ae1-9fd6-c206a7ec5bac", "comment": "Malware payload (Gafgyt)", "value": "a0ace9ad9a4cc830c9de7bbccb3c81326b8f8f33", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644844736, "uuid": "f273b892-785c-4d31-ab73-431a4087ac8f", "comment": "Malware payload (Gafgyt)", "value": "e30e03292b735bbd6c7ba9ac1db707a238ae2d2b2d1228d5a14ba0879a860bee8eb62aec8472e75a6e3051fb6306e7d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844736, "uuid": "e1e43d71-93a4-497b-9a16-44256e7ff593", "value": "T17DE34B05E7408B57C0D2277AF7DF424A33339B54A3EB33099928ABF43BC27A95E26515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844736, "uuid": "6b125008-0bc7-4ccb-bc3e-ae82d50bf711", "value": "3072:Ib2NQviuoSKTe1a83P0BBCaJQM/9ISWHFwmhwfCHQC2W:Q2NQv9oVTe1a6WBCaqM/9wlwmhwfCwCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644844736, "uuid": "5499e3dd-c15d-4369-b953-e430603d55f1", "value": 144778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644844736, "uuid": "7bdd4da9-0a00-4f1d-8f9c-285e3be3295f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644844736, "uuid": "143b6e2c-f304-4172-aa6f-5793be6d1022", "value": "Demon.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a488ff-8db7-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644857968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644857968, "uuid": "f04b6be2-9b53-4022-9aaf-b260fdacb63b", "comment": "Malware payload (RemcosRAT)", "value": "3fef04402d8be1caca240a82b160ecc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644857968, "uuid": "f9416ada-6208-4a99-951a-0f4e7a08c2d0", "comment": "Malware payload (RemcosRAT)", "value": "edae9d57ca54a66ec71baef31fff690098c5196b44f1140f897f3bc02caeef1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644857968, "uuid": "608f9cda-8dc6-4d5e-8753-296ad743fb06", "comment": "Malware payload (RemcosRAT)", "value": "87e24df1b16e378cee41e3b4deadd07bd11eae18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644857968, "uuid": "722aecca-e97d-4e88-9128-a351a0558763", "comment": "Malware payload (RemcosRAT)", "value": "4ca51bd6963ccfcd68259a033a7e5b03bb33a8acb9e2622e8fbcad4eb979b6cfa854bf7b99a02573aa565e2f25668ecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644857968, "uuid": "0ddd21e0-7543-48cc-98eb-06b30f23b99a", "value": "T15B25AE1371808476D93266B4AD1B57A4652CBD216D28AD473BEB3F4E0FFE68038362D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644857968, "uuid": "557834e2-f15d-4f84-b1fe-d356ed699f7c", "value": "ed7200529d98ae266be09ddf8296ccc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644857968, "uuid": "aa27fcec-502f-4cb4-9e52-6dd5b798c6db", "value": "24576:fxnYW9BukboCqOMlfczkYY/5wtAb81KdvT+SN6:fxnYWbWl5YYhH8Qdvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644857968, "uuid": "526db444-5077-4302-bc7f-228751b962f6", "value": 1009664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644857968, "uuid": "4e711e4e-e678-4dd1-8c43-7b0b56063141", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644857968, "uuid": "0e323dd0-13da-4e94-ac3d-d47cdfdcc158", "value": "Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cef75a5-8d90-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644841252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644841252, "uuid": "86e3f0ba-af9c-4880-b362-e31a9b8d40dd", "comment": "Malware payload (SnakeKeylogger)", "value": "23115dd3faa567b3685e14f5e5f8b4c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644841252, "uuid": "89b2f046-901e-42c5-8d4e-9f7419caf1d8", "comment": "Malware payload (SnakeKeylogger)", "value": "ee643573b6c459331e833e00629da9643b47da0f661a82020dd2c0db5ccfa259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644841252, "uuid": "8136c75f-9837-404b-a607-bc52737c0cd3", "comment": "Malware payload (SnakeKeylogger)", "value": "204815106b3d0356e4fede29e323b22862b683e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644841252, "uuid": "56d51766-7ab6-4c0e-aaa3-237adbb039ef", "comment": "Malware payload (SnakeKeylogger)", "value": "2a887b203495cb8a3f50514ca3fbc1abc4ab93fad5bd56c1e9c5ca2f336a5012c5649b23c024f4686d115a760795d865", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644841252, "uuid": "9142bd7e-f073-443b-9bfa-38df32183d36", "value": "T10605F10177AAA723C96B0EBBD8F1014157B0E94A91ABD37F64C132FD5C873681E72276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644841252, "uuid": "527d82f4-af7d-4baa-8e2d-3ea86a47aeab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644841252, "uuid": "f8b04f3a-f2a8-4201-9682-0f119350bfb9", "value": "24576:CieXNe53fi839EzBrRpUrQa61IoS7RJMG1:MXI5vVoBvUz61YTMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644841252, "uuid": "2b69425e-ff18-475a-b398-82b09f69ff73", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644841252, "uuid": "c26718a3-6d69-464c-beae-b6d0c2a91208", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644841252, "uuid": "9dcc5ed6-2761-4175-a31d-bb9fc298325b", "value": "01.02.2022-14.02.2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b13a47-8da9-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851942, "uuid": "e2f644c6-ba8c-467b-a1d7-a568b94553a2", "comment": "Malware payload (Gafgyt)", "value": "fcaad7817d9c410ab65e4cf55cb32c1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851942, "uuid": "a3e65e48-6ff6-4102-9962-65575762f8c3", "comment": "Malware payload (Gafgyt)", "value": "ee9a24ae8d899c2b97a1136bfd0ef4a34813ed658c7561c4b8b53c803312520f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851942, "uuid": "9dc2b5a8-c061-49bc-a056-d4489975cbda", "comment": "Malware payload (Gafgyt)", "value": "cd257f183fc016f16666ab9772c9729e58abe399", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851942, "uuid": "9c322362-d4ae-452c-8e93-504e586cb022", "comment": "Malware payload (Gafgyt)", "value": "0d02e511585d2e85ed22c9bcb2d0d49ec435af43d30b1fb586d51a03f53f0137cef0a99d491d41e83e37759321f60cbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851942, "uuid": "6fd2f8d7-fd7b-40df-a13f-5bb80bc8945a", "value": "T148C31801D5508B97C2D227BAB79F425D33336F68979B33119A247FB42FE27991E3A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851942, "uuid": "0401723f-c361-48bb-ad30-feb15b08d37d", "value": "3072:aC6aHm6zoAQSQoyl4n3GJKtmCQA/FXRy4:aC6aHm6kl4n3ztmCQA/ZRy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851942, "uuid": "92a5f3b6-35a5-4b9a-acb2-1aba4771f986", "value": 125200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851942, "uuid": "9e093035-e886-450a-8575-2f647d93763d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851942, "uuid": "e8c24293-46f9-4afb-b300-8746fdf56e34", "value": "cc9arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75998d4b-8d77-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644830475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830475, "uuid": "9105dba7-189c-4849-9be5-531777944768", "comment": "Malware payload (Mirai)", "value": "64cb6cfb7157a3615c576e0d87a1a7b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830475, "uuid": "120582c5-1912-44d2-8497-3b73ef02fdb8", "comment": "Malware payload (Mirai)", "value": "f04525b51cec26e840f228c2fa08f3ca545abcfd9cc5e49f43c56fd90920acd0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830475, "uuid": "4c2a52d0-7f58-4abe-8df3-736f85025dc7", "comment": "Malware payload (Mirai)", "value": "f312eb6bf0dd2f4bb470a2ec861de70410c7b3dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644830475, "uuid": "8179e21c-8792-4ceb-a630-83dfe917e277", "comment": "Malware payload (Mirai)", "value": "e7d51d7ed8fd82fe68f375f0cbcd6a35ef295ff8006a395b106db56be5f4c1c807f0898b912f3b6ea97c6c992a0335d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830475, "uuid": "7947df34-bcdf-4c26-85c1-f16c147fb364", "value": "T158735A01B3584A47E5A61EF4393F1FE197BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830475, "uuid": "df89aaf3-543c-4446-917e-80657ca6e1a9", "value": "1536:DNpp9RXI1vgi0uvc8zomzmKRyxOReqpNiSejOjNfXM:Xp9djCDomzmE2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644830475, "uuid": "ec9e08ea-6f75-4619-92ce-abff56432c71", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644830475, "uuid": "66bdf332-88ec-4cef-a770-e9de69e9d4ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644830475, "uuid": "19db30cd-98e4-4800-b00d-12c117856593", "value": "64cb6cfb7157a3615c576e0d87a1a7b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d36019e2-8d6f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644827196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827196, "uuid": "1ff952d0-f70a-4389-9c9b-0abc270aea3f", "comment": "Malware payload (Formbook)", "value": "a53f278a2b849d91aeaae771f7211d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827196, "uuid": "26aab410-bb81-4d75-8156-753f5bd8531d", "comment": "Malware payload (Formbook)", "value": "f063ae729bb23759fc8acbe3929c295d87ab5e7e72e67e9701cb82182f000af2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827196, "uuid": "b4efd8ba-543c-464d-a982-987fc57de693", "comment": "Malware payload (Formbook)", "value": "eb63b82b754117584b93832ac5e25e3f4a7f21b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827196, "uuid": "24c52254-1284-4ddc-a0b4-0fbff47a399d", "comment": "Malware payload (Formbook)", "value": "baddb9f8d23cea849748513470e2ee113687461f5b8b02c0c4a4fca060c98a2331d22e983319def525bb4099b691be16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827196, "uuid": "e3277dd4-814b-417d-8d64-2c84634792a7", "value": "T12954122395C2E8F5F15076B2193FD7B9FBFE6A000613056B9F521EBB34720C5A666302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827196, "uuid": "38c8de85-9fd9-4fcd-bd60-d9d5ff853536", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827196, "uuid": "97e78444-9223-4e1d-8b82-bf676738d3ef", "value": "6144:owP6ZLO8iklUztQdihis9GIIhSag80spKxjTHiNRta:j/8BlUzOQhis9GI0VsJFHirta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644827196, "uuid": "a593d011-c9cb-42fb-aa6e-47adece2ba5c", "value": 301880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644827196, "uuid": "eccf523f-164b-4a69-abd7-370f3abbe920", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827196, "uuid": "fa042ba9-d641-4bb9-b6ca-8a7a091a029e", "value": "IMG-000-382623.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6599016b-8da5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644850205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850205, "uuid": "1ab8fffb-c8d3-4a4d-b114-366482efaf24", "comment": "Malware payload", "value": "e3b9026894ef34ad1d7ae5b76721865a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850205, "uuid": "3d305b73-4c21-4783-b14c-dd4804dad7b5", "comment": "Malware payload", "value": "f17fda9dea90ed6c04bd61176c26b8fc32f00124f47f36ace241597a8b1fa7a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850205, "uuid": "d0a03a7b-959e-4f2d-ad72-5d4ff14739da", "comment": "Malware payload", "value": "6a3c03241660936169d1730fb1922ac539e663a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644850205, "uuid": "061c6682-82ea-40cd-9ee2-d09645833bbc", "comment": "Malware payload", "value": "bf8d33cc000684e5df66c0184ea9324f45c977d800c4f6fe0303840b12738df109559f298833d5aa9feaadea560ecb34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850205, "uuid": "6c60abd5-89fc-4485-97a6-5e476fe91f53", "value": "T130F46D0DF683A5B5C43744B0028BEBBF5A24F93580568DD7AD8DED3ABC239E1194E712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850205, "uuid": "cf88cdea-695a-4b06-8e66-23d988070816", "value": "12288:lTurEUKhROhnCzrwsrsNuRIHZB62atXtjBIuMAI0VpnJJyeVxy5la8AJv:lqrEJhROh8rwKsNrDK9xM3cJyeg0Jv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644850205, "uuid": "6cd8d894-d26c-4aef-b2c4-66d057592f48", "value": 754492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644850205, "uuid": "77861d73-e540-4ba2-987c-220531e2aff0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644850205, "uuid": "6501e3ad-2acd-44f0-b89b-b1fabaf137b5", "value": "e3b9026894ef34ad1d7ae5b76721865a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "897d5fa3-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1644854560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854560, "uuid": "8f04505c-e025-4d46-a338-30688f5ad944", "comment": "Malware payload (RemcosRAT)", "value": "3c889ce363ccd94e6a3248dc56d8296a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854560, "uuid": "54d4fa1d-4c45-45b5-a9d0-466ceb12b930", "comment": "Malware payload (RemcosRAT)", "value": "f1a61a31c172f4b21d34d099ecf544609dfc528a981ff8572e7b4c393bef84a8", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854560, "uuid": "14bd1781-832b-4980-8c58-90999e48adc3", "comment": "Malware payload (RemcosRAT)", "value": "b59fe633bf7f587f461b8e9c6db321d3f62f6019", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854560, "uuid": "a2340809-2d7c-4e7b-825b-f41bb8fc76b0", "comment": "Malware payload (RemcosRAT)", "value": "9b475d23682d6ab990576c916120418971d261a75c4cb483ef1c2d1e203c3ae328c094e9d93a63695890b78c98a4b78b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854560, "uuid": "2d9ed73b-fe68-4eae-9daa-c67e9dce2026", "value": "T14A0381A2B7D6D80AD995037A4CE6C7E62627FC615F53834B3289F70E1F71AC08A03657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854560, "uuid": "378e4ac0-e4a2-4f87-98b5-652430242c08", "value": "768:22mk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJyPs+mt23++7Dsq:Gk3hOdsylKlgxopeiBNhZFGzE+cL2kdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854560, "uuid": "d9a77b1e-80e0-4507-b39d-606ecc8f06b5", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854560, "uuid": "adba58a3-2c67-4ec3-a5d8-9c06508bba41", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854560, "uuid": "8c93383f-7d5b-41d4-b413-bd3da01737eb", "value": "payment_remittance_feb14.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8baddf70-8d9f-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1644847692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847692, "uuid": "d4df625e-995e-4ceb-8298-b353d005799a", "comment": "Malware payload (AveMariaRAT)", "value": "39be34cefdc207aa948a106bf94c96ca", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847692, "uuid": "7de69e2f-bc04-406c-ba94-714877d2bec2", "comment": "Malware payload (AveMariaRAT)", "value": "f25ac1c17bb170352277c96b80cc6a336ce08574882a279b0d71043a9b586679", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847692, "uuid": "5254d4ec-a7c1-4abc-8980-2306ac51c4a4", "comment": "Malware payload (AveMariaRAT)", "value": "64ea7172693113b3c22a54b5ba4025e8bd050cc1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644847692, "uuid": "ceed551c-8f32-4a90-8380-bde3a1699e0e", "comment": "Malware payload (AveMariaRAT)", "value": "fcfae51af65798a37018a6f8286a785869c6bc97792e03dac4a8ea6b0a457ed69d21a04593274b18f44d6bc1e8884b3d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847692, "uuid": "6301e95f-4d8a-4d8a-81d2-1ee4cf1a8d37", "value": "T12E05F1017BAEAA27C56B0F7BD8B1424157B0E54F614BE73BA4D132EC1C8B3585D7223A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847692, "uuid": "587d113d-974c-43de-a5e6-ad124bd9a8c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847692, "uuid": "7c561e6c-fa86-4294-89ca-4320350b9431", "value": "12288:vnIY8BgEvXuhiRvNwaMRDD4XHwwkmLEN2BY3vK5YcxiGjbUZakLX:P8BZmgRvKHv4XHnkmLUIqK5YR5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644847692, "uuid": "47fdd8b8-8f87-409f-bd4f-90cae927c78b", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644847692, "uuid": "ef6414a3-99d1-4749-81bd-4c9a0dcbb255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644847692, "uuid": "efecda38-75b7-4ab1-a807-f6d682304f16", "value": "RFQ#JDM-P14-22 ASTM A36.jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff6b9be7-8d67-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644823834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823834, "uuid": "67a1981d-91a2-4cbe-8e39-df9b5e3e0bdf", "comment": "Malware payload", "value": "a19a17218650ab9e54d38032a47e1b03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823834, "uuid": "b1323650-bc2a-4d34-b3c6-5415b21308cd", "comment": "Malware payload", "value": "f2f23d9965931308c1b523c8f9ddcab670a5dfbd11d090bb4f280e657a33745a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823834, "uuid": "1c6c01fa-e175-4b08-89a2-b19b1d436425", "comment": "Malware payload", "value": "12319c8ba8a0b839c800c215c29bea9444659457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823834, "uuid": "03751eda-4dc2-415e-9d9a-b12c5f03fe45", "comment": "Malware payload", "value": "9c7688e42a1dcc9fb085231458945fe9759d20000883be0d3c90fcac1d4aacbbd8fed18cb92585de6a6d089945aa5bc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823834, "uuid": "e0716836-17a5-4193-a2d0-dd7cf0cf1406", "value": "T1E7357D06729408F5D47381748BA39BE5E77ABC221761C78F2398A72A1F372D1BD39352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823834, "uuid": "b9455d78-211f-4507-b8e6-cceb9947fe56", "value": "b941ddedcc51e5706d41335adb4e6b2a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823834, "uuid": "fc77b213-1e71-4438-aa37-0facc4a3be49", "value": "12288:jKJIP2QGmbahzVCTuEeaKYE5Tf/4Ey1DX3Vjeca9KSBCnzbkP8KmCOrp:OJYdGmSITuCKY0TX4t1b3XNvP5rp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823834, "uuid": "55362cad-7cb4-444d-a5b2-dcee97eb926a", "value": 1114964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823834, "uuid": "3d85098a-8dd0-415e-ad96-2bf753b2bccc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823834, "uuid": "45874ad3-9115-434b-940f-74867024c4d5", "value": "autorun.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbb29ab9-8d99-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845249, "uuid": "533b8d00-83d8-4720-979a-77445d726126", "comment": "Malware payload (Gafgyt)", "value": "96926a4e6a980a66142c9e42f3d1cb91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845249, "uuid": "d33c6caf-3761-4618-bc68-28d8a33c50b0", "comment": "Malware payload (Gafgyt)", "value": "f40fca547112d9eeba232ad82554b1475f183433bc0b47aba3c56ea55979ebb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845249, "uuid": "34e1c726-673a-448b-b881-90852e1d3fd1", "comment": "Malware payload (Gafgyt)", "value": "f28e81d043f24d0db51fb4bcdfa715293c112e1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845249, "uuid": "56cf0641-0f71-45d1-8e91-02b0863adb56", "comment": "Malware payload (Gafgyt)", "value": "b6f659ce4ea342caa7dc058485b853738e13fac2848df6b12a268d3b00a877de1d518dd37226ae3beb94a6ec1548994d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845249, "uuid": "cd3b5072-c8d0-4cf5-9dcb-1b1de714f319", "value": "T148034942EA4384F6EC1705B1123BB37FEB31D16D4025C66ADF1AC921EE63956232B7D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845249, "uuid": "5b3e8524-0810-494f-8728-0cfc80b8a968", "value": "768:LTXDkVC2PW6ToOh4ZoDlgqXUvK4X8SwuG+jUdp3IRDnT:LTHUW04mlgbvK6JjUr0Dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845249, "uuid": "4d0e4cb8-4514-4c25-8d24-2562799db56c", "value": 38484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845249, "uuid": "5571484d-b884-4def-9fef-4b15e8f444f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845249, "uuid": "121fc133-5f09-4a11-8a09-1b6521b8333d", "value": "pop.x32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec3236c-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644823028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823028, "uuid": "d78f48a8-6026-438d-93f2-a40f2585c441", "comment": "Malware payload (Formbook)", "value": "c6016281cc5bde3457c885a238257cb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823028, "uuid": "ce4511d8-0e79-4da9-a407-5801f8c236e5", "comment": "Malware payload (Formbook)", "value": "f477ff9ff2a431f168d2defd7c9b62ae9f0648488e9977479e407468d5cdce1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823028, "uuid": "9c167c03-0635-4f55-8e6e-4e94146cade6", "comment": "Malware payload (Formbook)", "value": "c6e8db181a8e6aa04ab5b51244cb23d9fede55c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823028, "uuid": "cf5b43e1-6ce0-40c9-b226-d00efc0615cd", "comment": "Malware payload (Formbook)", "value": "17ae92bd81b09b150d7f716ced9868870b697f839d742ece3684fa337e3ba2ebd070c7d2459c8a52109a6db41f1e78fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823028, "uuid": "7819f022-fe98-4f37-bae2-bff0be47c0a0", "value": "T19CB45CD87D7502CAFAFC0AB17F4763153AF12628C8C65247F8B72615A753AA53C08B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823028, "uuid": "4c0bf1a5-baa7-45fd-a790-6ee8bec4950b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823028, "uuid": "e75cb421-01fa-4e5c-99db-0b7d50c0ac8a", "value": "12288:LxkzcZ8YjkRl1NKDuhH8SOv3gT6Ri+BbJne+ox1bbbbbbbbbbbbbbbbbbbbbbbbx:ezVTNK6hDa3g2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823028, "uuid": "68d2faf7-9a41-4de6-b6cb-ea34394e656e", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823028, "uuid": "ce1d6d33-21a2-4230-acf8-b384ffbab9d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823028, "uuid": "eef58bb8-632c-44ce-8da8-1cfa72b9083e", "value": "c6016281cc5bde3457c885a238257cb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b880f3d4-8d64-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822427, "uuid": "0fb0ac34-c550-4db2-a37a-b083f5ef1c31", "comment": "Malware payload (Formbook)", "value": "1d1c1168713a1693c4b2ef695708a530", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822427, "uuid": "1883e4c2-1e57-4d09-831f-e779595d01c4", "comment": "Malware payload (Formbook)", "value": "f63c18a538ce9483982948bb96acfd9513efa8b6336b117ae9f1a4601e333ea1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822427, "uuid": "fb227e00-cfc1-4393-a501-e8b3832099d2", "comment": "Malware payload (Formbook)", "value": "8987f7224c241eaeb3f30cf65702c77f01fa0d62", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822427, "uuid": "ac8ab654-f6c6-4d32-a52a-923c8676a4ac", "comment": "Malware payload (Formbook)", "value": "f50d256652fc4f0db971b11150a48ebcea858702af43ee8b5af7767c76e10e2168101752496d447089c97f8cbd898a83", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822427, "uuid": "22cdc4a7-4887-4995-803b-30fab27d8dc9", "value": "T1DD0402992A84CA2FDE257E35C18267976CF5FD917E900A1098123DAEC03F7DC6A4731E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822427, "uuid": "e9f82b12-7686-4ea0-b12e-b91f695f191a", "value": "3072:hmNHr0H+auwD5V4krX75dTEh5LvIP4Bk3K6Yc6lYwabWi3r6z6rd6v:M9rFLwD5V95qh5LwQBbcCZgr6urs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822427, "uuid": "de49d948-d8b4-45db-b088-68688f6cccd2", "value": 181368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822427, "uuid": "fb48d27e-cc8c-4637-926a-f770f7bd51c9", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822427, "uuid": "3fb9ed54-0c34-4be5-964d-53d852e01116", "value": "PO 12096_8144.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081b8f5e-8d86-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644836734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836734, "uuid": "8a7045fa-387b-4ed4-88e4-6b05b0de26bd", "comment": "Malware payload (AgentTesla)", "value": "f700e29d508f1d677e58584108e68782", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836734, "uuid": "579b3c66-96c0-4b1e-99e2-a6f583f89aba", "comment": "Malware payload (AgentTesla)", "value": "f665057d1f3cef9e82936c166e43ee45a61e0ee39f95b7aece0f47baa9dae34f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836734, "uuid": "27634c83-f5a4-4869-b550-7f5f8255f179", "comment": "Malware payload (AgentTesla)", "value": "27269bc0f121483c50449cce706125bdfae3bdd9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644836734, "uuid": "d548cb8b-aa67-4f33-97c8-e3fb1f8afd10", "comment": "Malware payload (AgentTesla)", "value": "15ca50ebede76388cc916de15cd96c16cecc62726b4b5a5baad3169869a1781837fd9e1e59c2619aa6a09691071e5f9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836734, "uuid": "b433027d-9f48-40fe-818b-ae62acee7457", "value": "T1F5C3E1D33B8C5FB4C33B4B3E80E6DA70A7FDA79B15468C0A5A61678F3A92719C411C05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836734, "uuid": "9f3a61f2-a2ae-41fd-8a5b-cf0673a982d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836734, "uuid": "5bdbf20a-c59d-4e14-a08b-85f44fc1ca65", "value": "3072:Lja1P9u+UbRfk+svrnRpy/eTgxdm0Cur:Lja8bSRw/GgxQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644836734, "uuid": "513f56d1-5c32-47e1-b955-eb078ec3993d", "value": 126976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644836734, "uuid": "e0d9ee95-163f-42dc-999c-9f54c956abc9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644836734, "uuid": "5c716c81-574a-4f4e-9bd4-271aea51ce16", "value": "quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7236c2c-8d6f-11ec-9275-42010a9c0029", "comment": "Malware payload (Tofsee)", "timestamp": 1644827122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827122, "uuid": "ca360fcd-609a-4018-b83a-e7db7910ef4c", "comment": "Malware payload (Tofsee)", "value": "04f335bea828079dbb509f34f8dca2c5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827122, "uuid": "dd45f902-f3c7-41fc-8a9d-fd488910167f", "comment": "Malware payload (Tofsee)", "value": "f6ca96e0301249fbada0e52bcd3c9b2b6ee0cec95f13e8984ef747d513651fc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827122, "uuid": "63c36766-5540-470a-9b82-14fd94a147a4", "comment": "Malware payload (Tofsee)", "value": "c49bd3e5dce2530a6ce429c022f752b06eee9004", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827122, "uuid": "77039bdb-1c64-4a5a-bc14-0449888e751d", "comment": "Malware payload (Tofsee)", "value": "a652ebac31b38d30ae23ddb70ab9318394534406d449170531d8a13f08733bb9b22609aedcc0d32576b38465a0574929", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827122, "uuid": "db1d17e8-35eb-4de8-a171-b6d14b5b59b3", "value": "T1D154BF1136D0DC32C9825E308427EBE54A3BB8725D6191A7FBA8BB2F2E703D15637356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827122, "uuid": "2f2dbdf3-9fc8-4ba1-a9e1-ad0846fbfac1", "value": "0b9720143020bc87fe12346d653d6a51", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827122, "uuid": "22a13d9b-1c74-43d7-a791-5d235571bf33", "value": "3072:bgamxzyAJWgZkl/md3Jz5I6HREKsxkgaBChbw47dO:bgamVtl1N06HRE3iga4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644827122, "uuid": "b89b81ae-4771-4303-bf43-90661eaafe41", "value": 287232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644827122, "uuid": "30b5a71e-8021-427d-887c-15d1f9b0e411", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827122, "uuid": "073c9b44-3f01-4f25-bc00-ec0cb29b38c7", "value": "04f335bea828079dbb509f34f8dca2c5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764d4dc3-8d8b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644839066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839066, "uuid": "7507541b-216e-4527-98be-4ab78e285c95", "comment": "Malware payload (Formbook)", "value": "bbdfebb621068de0e4957b85022cde9a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839066, "uuid": "72db3312-d757-4e70-869c-087ccc4c7540", "comment": "Malware payload (Formbook)", "value": "f70613d765ca8e8cb63f09bd936d34a01f367fd7467def0c316ad2093b1cae96", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839066, "uuid": "eee7c100-5ed9-43a1-9a12-385b480cf5b2", "comment": "Malware payload (Formbook)", "value": "33df51f8e9a6a2e5cd553c1287362dde5720b11e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644839066, "uuid": "15a5dfc1-9b32-4e29-a969-451da07925a7", "comment": "Malware payload (Formbook)", "value": "58791a316c0903c59ca2816f22055ca43a1733c7415a2d5a467b42f44b9c8a337aaf9243b440ee9ce197a42503e90a36", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839066, "uuid": "1547cfaa-ef0e-4cf4-8da6-154297b2d468", "value": "T193F423D21D64E7D64385695DF8AE7DD593B484E200E53CA0C0E50AFCABB8A7F85A034C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839066, "uuid": "3eaa5d09-979b-4925-a9f1-963ed88b2c80", "value": "12288:wvT/L/xuvSpv1/pQblL3cDeGU/ObB1kyQB3Ady2hRtxuyoGcbA28usMCL8oyGUPR:k/8qOblLMSGUcB1/dy2PpoGcs2+Mg8oE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644839066, "uuid": "09be9dd5-a2a4-447d-8d18-41fbc7100f9d", "value": 752900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644839066, "uuid": "40e2277f-3b2e-4101-9dac-eff8484a4d6b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644839066, "uuid": "73428aae-e43e-4355-bd7b-a505de052592", "value": "1644833443.Vfc11Ib63f37M636564.dynamene_urgent payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c575c829-8d71-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1644828032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828032, "uuid": "3a20157b-de12-4376-b5cc-9b179bce525c", "comment": "Malware payload (Loki)", "value": "59b3408c3c63db84396ff62f5b69ab16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828032, "uuid": "8193937c-3e5c-486a-b0ad-9e94dc0bfc0f", "comment": "Malware payload (Loki)", "value": "f82e30316f06beadf8691d8fe1de845a81c0f33fb263f7131155df96a3a7733e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828032, "uuid": "60968bce-0e3a-4e84-af7d-28bd9c3d4ed0", "comment": "Malware payload (Loki)", "value": "e8e704b7eb08139711a635ddcef21e37f17415e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644828032, "uuid": "c7791fff-f645-4e76-aa21-3a069021e82e", "comment": "Malware payload (Loki)", "value": "247837eb87bfc6eaf82f40429f182e71d7e69f1c1da9ffe392369ccad9f99ecd51ffe27de69121f46d854c133bcf741b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828032, "uuid": "39c0b9c3-3e71-482d-b5c5-0065f4cfc373", "value": "T1625412D163C5C07FFDA207F349B3EB296BB46B024B261A1B2F70DDEE2011857D91AA51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828032, "uuid": "1230a6db-dbea-4e7a-8756-706841308554", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828032, "uuid": "fc920aee-e498-461e-aa01-20be860d9f3e", "value": "6144:ow5zWEFdrXfu/0RQKikO6T+0FTF79WS/1qhTejL7:tFFxvmuikO61FJ9Wzhy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644828032, "uuid": "2643c05b-1d76-4ec1-8851-f08238141670", "value": 291018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644828032, "uuid": "ef5eb25e-1c3c-45f7-884c-0fa9ec8cf7ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644828032, "uuid": "87263bb9-abbc-46fe-909b-ced605f82061", "value": "59b3408c3c63db84396ff62f5b69ab16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3feba4c-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851706, "uuid": "216806e0-ea15-47f0-9aea-1e37f1f3193d", "comment": "Malware payload (Gafgyt)", "value": "25d2adf7f7ca279fc5ed4af1e8dab103", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851706, "uuid": "0c6f3303-c0da-4d51-a8ae-14533318adcf", "comment": "Malware payload (Gafgyt)", "value": "f8677157d445b37d47de54b17528625918c3830ad79fd8f9d857b89f7b397d90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851706, "uuid": "65b20a86-9a1b-40c4-93c0-c40021dbd6b4", "comment": "Malware payload (Gafgyt)", "value": "452e4f0cdd80ce44cb300c153ee108516629eebe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851706, "uuid": "61b31933-ec1f-48e2-a79c-6e53c889d883", "comment": "Malware payload (Gafgyt)", "value": "60517ce59a25cff4e3bde07d735432ca9c4d621bf581a7f2d744e2c9d739418ae5def8db4defd2c48d88d72985d03642", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851706, "uuid": "b162d6db-b03a-431d-a0d5-d93ff7d85e2d", "value": "T1D0931A41F9418B27C2D227BAE7CF439D77351A64A7D7330169297EB42FC27992E2A120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851706, "uuid": "c3b93e1f-e27e-44c1-a988-002faf49d5d3", "value": "1536:0R30B8P6VLfzPY8niZZapjnwI04OrHvUGPnP/PY0yxYgopmCVrQAFW9OXkYe:b8kzpw3IiUGPQ0ySpmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851706, "uuid": "f9abf24c-c664-4030-b106-50d790172cf7", "value": 97162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851706, "uuid": "130f75b7-38f8-4751-ad95-aa03a373b6ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851706, "uuid": "6d2c9bae-dd7f-4c8e-89d7-7c3cde6e8db9", "value": "a-r.m-4.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60d65359-8d5b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1644818414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818414, "uuid": "87bd8c80-0ac1-4997-a4eb-036ee1459740", "comment": "Malware payload (Mirai)", "value": "d713ea746e5cd3776b3c10c80550eb41", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818414, "uuid": "48bd994a-a1c3-41f4-b65c-6d3fc316dba2", "comment": "Malware payload (Mirai)", "value": "f8ae973528089a29ca30a53c0caae3a02f9db27f2d1ace94e0c6407cefa28b8f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818414, "uuid": "2398ab19-a688-4b99-9b56-216b201d01c0", "comment": "Malware payload (Mirai)", "value": "b300c922a6eb735041a5478421d7bb7c5d387446", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644818414, "uuid": "6bedca2b-714d-4a6f-b84a-7f13827d06af", "comment": "Malware payload (Mirai)", "value": "d8a32c28b71aab4e127d4eeeb23f7efe568db443036491b8afa3c78e8adcc15791b46abd48e6d604e1cd611ec9e44c7e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818414, "uuid": "be9f2784-78cd-4437-a010-553837f7b4e7", "value": "T185A33985BC419622CAD152B7FA5F028E372553E8E2EA3307CE245BB437C791B0D76B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818414, "uuid": "03eb237c-591f-42a0-a756-c0cf87e6e96d", "value": "1536:J+NX8ees1JPSpzINQj+OwS2fU27xBIgRHpmOsKiavo9V9V9YR:J+NX8ee6PQvF2M2NBIgR4nMJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644818414, "uuid": "ed9df7a7-2e34-4d9e-adb0-5af328d0c89e", "value": 101544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644818414, "uuid": "828c40e3-2bb3-45c5-a88e-f6df436076d2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644818414, "uuid": "e4c3ac1e-3134-4f7f-b89e-862bd1555d76", "value": "garm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70306eb9-8daf-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1644854518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854518, "uuid": "fc89940a-a099-4acf-956d-f3da0d5cdbf5", "comment": "Malware payload (SnakeKeylogger)", "value": "a3bc86bf17c4efc7bc2f16c77441a5d2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854518, "uuid": "61243fe5-bbd8-45ed-b5f1-55db18f53efa", "comment": "Malware payload (SnakeKeylogger)", "value": "f92be50d0a57f2d0e10d31c364fa63ae8083a383c929b878b606213ace248cc0", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854518, "uuid": "f3bc61ad-2192-4888-bec5-abe9fb888c03", "comment": "Malware payload (SnakeKeylogger)", "value": "ddd9a7ba58edf339abfa88e99818db44ae933e09", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644854518, "uuid": "8d9dc0f7-5dec-4277-8df3-2451c34c26e3", "comment": "Malware payload (SnakeKeylogger)", "value": "562c819724cc23129d419740c83630d6d964db6e38c5541ee3d1e6e5678779a8fc007c80e7908944582a74f8482cdcf8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854518, "uuid": "8c4f9050-7e05-4ae2-9e3f-a4e36019f5fd", "value": "T144B40C1F3A710B72EDED90305D620BE4BB660A0322C76983539B15FA8B8FC67DD469D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854518, "uuid": "07538d80-2262-4ead-b94d-03d2747ada6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854518, "uuid": "e963b44f-c177-491e-8961-43654254d181", "value": "6144:ElNa+Hqv4Au25zhYGm9aI9fBjmyRRUR3c+Oti+8KxD6SHxGaqkrHJB1tgNO:SNa+Hqv2cz/mYIZVRRBYpcRxqWpXtr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644854518, "uuid": "9ce90727-8fe6-4970-b847-2eef471a63b7", "value": 504832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644854518, "uuid": "009ec446-14c3-4972-9243-8c4c1ef015a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644854518, "uuid": "b3ec7598-46fd-41fd-92a1-ae1fb8a9f35d", "value": "file.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf4ba7a-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644851719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851719, "uuid": "1f06e922-a5e0-4652-bd75-86f0c5913a7a", "comment": "Malware payload (Gafgyt)", "value": "8995b38f1e6dba47725f403c2adbffbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851719, "uuid": "a2d3e3ab-d71f-4d07-b0ab-c939a4efd0f4", "comment": "Malware payload (Gafgyt)", "value": "f96808330a6fa93f162d51ef1bed7e6153ae1a8899760692c38c7b66b63f0b45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851719, "uuid": "37a01ed5-0733-468f-b1b4-1d5f903813d6", "comment": "Malware payload (Gafgyt)", "value": "9eb227efcc5eb2380dc2b48d49f29d7e02299f1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851719, "uuid": "560d7d3c-314e-4db7-a9c9-839410e40ed0", "comment": "Malware payload (Gafgyt)", "value": "4e8bb519cbe5ffc47a66870ee1e9e7a98890c2c7319261cf35c9414afddb84231addd1b557733e9abbe53fd2e3a6878c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851719, "uuid": "4ed75d83-014c-41c9-9476-5a2a7d5be26a", "value": "T122B32901D5508B67C2D2277AB79F825D33332BA897DB33125A24BFB42BC279D1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851719, "uuid": "d7812dda-26e5-4608-9883-67b74d52a292", "value": "3072:PtaZrNEth2hKJUwoQDa/ahvbmTQOWsXAOn:PtaZrNEYwoQDaihvbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851719, "uuid": "2456dd3e-c4b9-4f97-b428-7c3f84d7a02b", "value": 111152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851719, "uuid": "d319fbb4-8176-4dbf-a14c-71cd0c76295e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851719, "uuid": "15478ce8-8433-4e80-a91c-0ec79d6ee49b", "value": "a-r.m-6.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a648cf-8d65-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644822714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822714, "uuid": "2a96d00e-bd34-44c9-9ce7-e1c81c406adf", "comment": "Malware payload (Formbook)", "value": "235cfac32180bb40ce5c379fcaf75c27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822714, "uuid": "83043871-7ce4-4db2-b478-05c6fcc2d0ae", "comment": "Malware payload (Formbook)", "value": "fa0c54af42af10dbb34626554f789c0d00d392a6bca0017f97babda9e17ef785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822714, "uuid": "7dbc2b43-fd1a-4999-96fe-66fa0e6d665e", "comment": "Malware payload (Formbook)", "value": "1bdef262e81ba80d8bd4b94abf106444754f1cb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644822714, "uuid": "bf6bb92c-60b9-4328-ac0f-0dd0a371f437", "comment": "Malware payload (Formbook)", "value": "062a78e67b552d7ae725594a54dbebdf1670c61bafddb34c7996f3916795c6c611f9a4ec09e6f0c4765ceafff8535bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822714, "uuid": "4954e879-0851-48dc-9cea-45c29d8226dc", "value": "T19794D02550F311B6D8A887FFF861D60C2F78FA6F8517B6FA0448603808BDBD4468A677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822714, "uuid": "8665becc-12bd-47ca-8e51-23ad4bbf34f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822714, "uuid": "5e7dbaee-9262-4326-93f1-bd6aef22501c", "value": "12288:zJyasVrlZrRWOt0YYECiG/hw2vTBayRzUoK:zJHshnrYd6u/y2r1RIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644822714, "uuid": "534a34d7-1f51-4f39-a8ca-d8ff8887e40d", "value": 445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644822714, "uuid": "2034f419-1cc9-4b7d-a851-5bc7d68a3197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644822714, "uuid": "24fe0376-0588-4b0c-83ca-d0dbd657261c", "value": "TNT Original Invoice PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d88f5ae-8d66-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644823080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823080, "uuid": "f6532e1a-7b58-4e28-be9f-a4916f369283", "comment": "Malware payload (Formbook)", "value": "b0f02d1f93ed9515737aace325fc602c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823080, "uuid": "e2e6ce24-3093-4f03-ad75-75191785ecdc", "comment": "Malware payload (Formbook)", "value": "fa3b721595b9e5571bcfd42767aa563f6e363a3fff9e9cdbfb525d0f28e62eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823080, "uuid": "71ebe12c-df16-4912-888a-135ce2bb3682", "comment": "Malware payload (Formbook)", "value": "7659deb7b036736bba0887e8748b1fc90792f46a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644823080, "uuid": "19965a1b-c256-444d-860f-ea01b02d2d04", "comment": "Malware payload (Formbook)", "value": "05112b926813baa0ab1e695a61812d4af7b2158b51535eb9ce5375fe851ba77874ad38e7bdc1d8b89d8396f8529a0ad6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823080, "uuid": "5acf2cb1-2c85-4742-8832-16b31d547f9e", "value": "T131051219AAB7A544C6380778E48541D01BAD8A1EA197E77F706F3CCD3FAB393453207A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823080, "uuid": "24c8c151-2a92-44b2-b6da-a9de5a7ef3fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823080, "uuid": "3989997c-0bb0-4557-855d-f2ac08c525dd", "value": "24576:HlzK40LZtEh41CgW0xJwyqBEln7J7Gldb:dZ0ti4YWqHBEl1GX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644823080, "uuid": "07edcc39-1607-439d-891a-99a4a0509e90", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644823080, "uuid": "00c2c6e3-2b77-43df-8bb6-c46d1cb2dff7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644823080, "uuid": "d9bebda7-56dc-4d7d-96a5-874aa9cb8860", "value": "b0f02d1f93ed9515737aace325fc602c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f19912f-8dbb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1644859670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859670, "uuid": "cc0c7ff9-a1e3-4c76-bc96-4672b6a72bdb", "comment": "Malware payload (AgentTesla)", "value": "219cf933bcbbccd0ca3e4cfb3034ceea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859670, "uuid": "c2f71e07-5392-426d-8871-cf9516a5d00d", "comment": "Malware payload (AgentTesla)", "value": "face920d3eb1a3ad96e3fab710d57f52f866d2d8d8ae4ea53b9e62c7dd25a989", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859670, "uuid": "dcc3de81-3d98-49c6-be4b-784685921843", "comment": "Malware payload (AgentTesla)", "value": "3bea0f4242d36615920543a66e1fc83eb8b40a8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644859670, "uuid": "5213045c-16f7-43f6-a004-e57bab77f9ce", "comment": "Malware payload (AgentTesla)", "value": "33aa3bc96575fe1e53ec7cebb5e99ec834a4e285491cf07fa40dcb98e9d409cfdcda931a393ffca6d900736a4d08e54a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859670, "uuid": "3bd881c0-15b1-4e28-a97f-727151e3f548", "value": "T123151209A277A511C2BA07BCE0A540949B786E4D915BD73F70AF3CD82F7338789351BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859670, "uuid": "7ace1c92-997c-45a0-aadd-81671a4c9b5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859670, "uuid": "371b112f-d32b-44ce-9e9c-5c85a5fe4752", "value": "12288:alZ92CYnNk0LZkM/mI66KAQlBGEx+18yMf5/+AmG7v3cT3YQU/7RhI:alZUW0LZp+ASGEfyMB2A70jU/7Rh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644859670, "uuid": "ed4605d1-9405-4740-8834-65010e519377", "value": 927232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644859670, "uuid": "fe61f007-7227-405c-8712-6aa13fe64667", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644859670, "uuid": "3f6b7735-e7d5-43bb-91bd-3a30a418c985", "value": "DHL awb 002142022 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3727e5fe-8d5d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644819203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819203, "uuid": "9bc5ccfb-9023-4bed-a3dd-f45fe4f30d9c", "comment": "Malware payload (Formbook)", "value": "e0591edc91ec1363e586daf5d52ed6bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819203, "uuid": "03965825-6414-4b9e-bc3c-585c469e9696", "comment": "Malware payload (Formbook)", "value": "fc792e284d199432e43c53981ea344529f95883539c5b5fc7be52935581beaf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819203, "uuid": "b93a6cf6-4cb1-4e48-a8c9-73a22fecd310", "comment": "Malware payload (Formbook)", "value": "d0aac48972e5393f01756eaef700e6d840517d2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644819203, "uuid": "b784a5aa-d420-466e-ab3b-81ce867463ce", "comment": "Malware payload (Formbook)", "value": "e2bcee8f44c32dcd43239cea62668a7ec122438d0a1af47d13271b389223b1c28736e98eded7a9fafb5581b78cf4b776", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819203, "uuid": "01c24761-a081-414a-aa4f-f236fa4893f2", "value": "T1E7A4BE52DC40C4BAE47D27F14356E338A7AF7A6827C3440B71582EE63DDD90346AAE93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819203, "uuid": "064cbffa-38d4-4c55-b0bc-47622515bc94", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819203, "uuid": "a83dc106-041a-4223-960e-5796608ad7be", "value": "12288:lrvFS89AfdSyBtZwNgvdGh6U7ypUExXstHLcY:BKAzWgy6gst4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644819203, "uuid": "c0750217-d146-47e1-8e2b-92c1fd1481a3", "value": 483900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644819203, "uuid": "c2934e76-0dfd-477a-93f3-b7a9dff0323d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644819203, "uuid": "9dd452cc-cba4-44f4-a116-913b751e02cf", "value": "RFQ Ref. No. MS-DGP-220137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb09224d-8d9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1644845704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845704, "uuid": "1e9893ec-8345-450d-ae2f-06e17ad18674", "comment": "Malware payload (Gafgyt)", "value": "b03d9f3c2d162d215a9ae41c8af43d8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845704, "uuid": "68060054-ebe4-449f-acf1-85114e1c5010", "comment": "Malware payload (Gafgyt)", "value": "fce2b8e167ec3c8eea6791ec41c9de8e7b83ebdbc62415aa25918fdd958dfb58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845704, "uuid": "5f275c4a-23df-4aa6-85b4-db896675bce0", "comment": "Malware payload (Gafgyt)", "value": "90abe8d4bfd4127868bf672502e8e0250671854a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644845704, "uuid": "39371486-bfdc-4f98-8544-a69adec98e7d", "comment": "Malware payload (Gafgyt)", "value": "44d706f2739c4ec7e67d306163a7cb140137540c8d7ccb1d0f2d5e61ae0d343934e41fb53e99977a4c5d8e5aaa89b558", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845704, "uuid": "b4797110-e0fd-4bf5-9fa8-ff8789f97202", "value": "T1D3C3842A7E22AFFFE268863107F35F7087D5219226919385F26CE6181F7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845704, "uuid": "781b11e5-faf9-44ea-81bf-dd100284a45b", "value": "1536:qOTbKtAClm3ea7UENTcGOMZWdq33eL7T6I6HSm0C8hHIsmF4DKFBJNkiST:6dRkcMWdq37ym0CNsmFkKFBJNkiST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644845704, "uuid": "081f61f4-83b3-471d-ba2f-b490e8fa24e3", "value": 118665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644845704, "uuid": "67f0a76b-2241-482f-bb15-2983d5f040ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644845704, "uuid": "cfd079ed-eb76-424c-a970-dd6942123246", "value": "qbot.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ab0046-8d34-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1644801597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644801597, "uuid": "34c49880-c510-4b7a-99ed-1e39d3d0980d", "comment": "Malware payload (Heodo)", "value": "495de508837529516277bda81f96de50", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644801597, "uuid": "83a55a10-b6b7-4c67-a0ab-616897b62f8e", "comment": "Malware payload (Heodo)", "value": "fd86539ce7c5ad7f497d3d5cd14a8a4fc14e512e14fb6ebeab4dc400cdc79d3f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644801597, "uuid": "271b205a-355b-4cec-bd7d-bbecf0109e9a", "comment": "Malware payload (Heodo)", "value": "5ef41b861c7adaac2d8e30f12c8c6d821f40920f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644801597, "uuid": "ef0573fc-8246-4c23-8177-41557f33e5c8", "comment": "Malware payload (Heodo)", "value": "6a8d365a08bb80b3290eafb6eeb9a2a864458be98afaef7356b86b315ec9cd5d782fee491e843467d7190a1f258d68cc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644801597, "uuid": "d4e37d5a-cba3-40fd-9576-ab7c1d49821c", "value": "T116946C9EF105DC71EBFE63F561E1CBA3C19B9430236445EBEBFC51361A2C8948638296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644801597, "uuid": "4942ff4f-ef4b-4f53-aa96-4d6b4553d6b7", "value": "7f57698bb210fa88a6b01b1feaf20957", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644801597, "uuid": "02c70479-cfd0-406f-bfbb-9a8ed8f6fa38", "value": "6144:cNUBsJX22222GgngDrDRVyYli/ci2tEGW78ODQiEptvOSk5DKXOW14IkFxF:xB/YM/cYVV7EuOpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644801597, "uuid": "899b19ae-154c-4478-a3c5-9ee8841b4296", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644801597, "uuid": "51f52a7b-fe89-4927-a492-ff4e5b8212dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644801597, "uuid": "6448d8e9-a0b4-4cb7-87f5-a3c4d9c16b63", "value": "emotet_exe_e5_84e657fec9fef222fb8fde513983429cd332188398721e3aa71193863784fde3_2022-02-14__011952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6de0d6a-8db0-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1644855093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855093, "uuid": "6ae3bb4e-af79-491d-b6f2-96fa31cabf21", "comment": "Malware payload (IcedID)", "value": "602d1f74d126ae0487f8980995d7a5b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855093, "uuid": "5bc4b48a-4c0b-4c54-9fca-448315637528", "comment": "Malware payload (IcedID)", "value": "fdae004e66cf3dee59380f06e27f286fc5772ce658c9e1765867c07a6fdd131b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855093, "uuid": "75e329ca-52d8-472f-bcf5-0512b4d282f1", "comment": "Malware payload (IcedID)", "value": "54c6c967c5ba6ff12a56c8298daaf84b663d409d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644855093, "uuid": "b1d536ba-81c1-4d54-8427-dc1215d8e330", "comment": "Malware payload (IcedID)", "value": "a9b5cf049cd5378ecf4870f87d1d9b23999d7e158e182b63152cb1cd06ea8c5bce6136d4166a29b0bc264694e8ea2eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "spy", "colour": "#472410", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855093, "uuid": "51e35ae1-cf1b-4ad3-9fc5-2e8d5dbff418", "value": "T129C4BF6523750AF5E063943889735A06C6713C711770D2EBA7A1335B5F3BFE06A3AB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855093, "uuid": "f2a0ec6a-ff0a-42c5-8d58-1d087756f973", "value": "350e0c7e939cd71cc06e27891f0c70c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855093, "uuid": "05fb4b87-52b8-4665-95fc-dd3420f0fc24", "value": "12288:FHqxnfarFykpclTJHoi3o86ApxTB9t9LnI65:8facwcl9HP9xTvfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644855093, "uuid": "525cd379-5a20-4c11-9b8f-a65c67c4faf3", "value": 592384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644855093, "uuid": "bac9f411-c84c-4552-a4fd-4fcc9c00113e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644855093, "uuid": "e26b99e8-92c4-4263-b170-8db9154fac25", "value": "loadfsc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c38cf55-8da8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1644851478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851478, "uuid": "2336fc32-2d8d-4285-8f85-5314ba01d853", "comment": "Malware payload (Formbook)", "value": "aa2e590885b1efb1ef1f1cb0dd7e1ba6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851478, "uuid": "f83339f6-476d-41bb-9964-2f698ecb795c", "comment": "Malware payload (Formbook)", "value": "fe0d8d1d135bf254632ca5c8ec51ff131b75bb67c635236d144b3ce991183896", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851478, "uuid": "788a11fa-188d-427a-aac1-533c2c57b064", "comment": "Malware payload (Formbook)", "value": "7bdaa1da19202c1a7065f30dac2b13857729de45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644851478, "uuid": "bf1a0cb9-ae82-4d9f-9b6a-fa4d726ab39f", "comment": "Malware payload (Formbook)", "value": "32c039261218be00666af7db431277dcc81e0056da698d309c526f08c8f8698d08dbe26e314009cdee8f2856cc2682ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851478, "uuid": "fb3a961a-9de2-4280-ad85-1cb284aaae61", "value": "T1A9F47D12B6E086F6D12E69748C1AF3B4942DBE112D295C873EE76F085F3E680353919F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851478, "uuid": "7b92e3eb-4365-43a7-bcb0-39a9fd287993", "value": "50e822ed4b7a82a71d116b8c7e2396d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851478, "uuid": "8c88c284-f47e-4703-92b3-de954806286e", "value": "12288:FlZjc75hO32cpuG7NVM1/vcDy50eVmZyqGz2PASl0i1K2KzJr:3iz2puG7NVM1/kcVNqGzqFX1KzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644851478, "uuid": "9b894e96-0517-4b98-a3a8-7cced19eef42", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644851478, "uuid": "c85d8ed2-e782-46a1-8dc7-3b689ba4e5e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644851478, "uuid": "39839186-16a2-49d3-b0e3-4c7a039c990a", "value": "TransferenciaInternacionalemEurosparaPaisesSEPA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66638483-8d6f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1644827014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827014, "uuid": "4fcfbe26-680b-4502-ad3f-9d88471c96d4", "comment": "Malware payload", "value": "627533ff71848b71fa31de3e64a15ab0", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827014, "uuid": "dd4a7310-e99d-47c2-80f4-cddea244a67e", "comment": "Malware payload", "value": "fec3f08023e5ffb7777a6df4e67e92556a0e753b725ad8b9748ef163fec913c5", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827014, "uuid": "ee7aebfc-a449-407e-96fd-dbddf2b2f3dc", "comment": "Malware payload", "value": "e9d3762d81bfd98ae715ef0517bb1dc3c4e685f2", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1644827014, "uuid": "a33d2cdf-6a3a-4565-b13e-87234037a742", "comment": "Malware payload", "value": "3abe36f70b6241c067328109fb6d1e78ae93e5c7fa4c9a1a33fe6c5410cbb9a9c4175c1be78e603c31f4cc899b32dde0", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827014, "uuid": "093be267-3c87-4374-8a8c-fea52b6ba892", "value": "T14E515C621B3DF516A3B3086FC1F814627C3E3B41160BEF407323BDA284FC668657645A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827014, "uuid": "7e0e2f63-dbe4-4c84-8173-5927178ed6fc", "value": "48:XhjzncEP8A8hkFOzqPHSMMfvFGT2wG52K5BuvngPpZUT1uNQRr3e60toE2ziJq3:xjznc88AIqKB1G/mj/u6sT1OQBBnxec3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1644827014, "uuid": "d026739f-ab96-4a44-9064-9176ac135e97", "value": 3119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1644827014, "uuid": "d60b22b3-3111-49b4-b5a4-0101653ec47c", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1644827014, "uuid": "254dcacc-e3f3-44b4-b19e-1763a63f3244", "value": "new order 000398586866 02142022.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }