{ "Event": { "published": true, "date": "2023-02-13", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-02-13", "timestamp": 1676332982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d6dd30c7-e26e-4918-9f5c-52acc743c2fb", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e98db2a-abd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676315875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315875, "uuid": "95c71678-f98b-4908-aab9-6cf8a0ae2f2a", "comment": "Malware payload", "value": "b180c2b0f45c345b31ff0c1358e940e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315875, "uuid": "40a94bfe-11cb-428d-87a8-3225e7f32698", "comment": "Malware payload", "value": "003da5c1cd8bdfa0eca8788b6d75749c1967da48a9658dda07e1aabdd368a0aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315875, "uuid": "458574a3-d6c4-4c19-a52e-187d58bb2c99", "comment": "Malware payload", "value": "ab447a587efe10c628a240ced82bfd74576c14e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315875, "uuid": "a9f5823e-2522-47d9-a726-609f6d295f37", "comment": "Malware payload", "value": "1a082498bfd195de83c1533361e502dcd8054aafb48bc8ad93b33330662ba19324d7e3671bb67ad18ff7b7e2609e1563", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315875, "uuid": "68064cff-7f00-4498-9af5-f5c11df099b1", "value": "T12DF41203B3E88132E9A127B05AF503D32A36B8644F38869F274F6D5D19326B1B17577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315875, "uuid": "c2d3ec5b-2fa4-46ce-96ac-f25379050275", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315875, "uuid": "cf697aab-7c24-4949-a167-dd7cf72f3101", "value": "12288:2MrQy90YuI7ujhjF22v/86ph1OHeGRhN1lkaeGNHQeJffWiyFalvhhmP3Qx9degw:2y9ajhBjX8u1GewhN1aaekhfLyFamPYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676315875, "uuid": "a3f2dd82-d280-4e2a-a0c0-e2678c05b41d", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676315875, "uuid": "d7398f29-47a7-40c6-ade0-15ab3892fc05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315875, "uuid": "a8de3423-64aa-4bc8-8a53-a68c29a3c1de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd71513b-abbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676305834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305834, "uuid": "79221135-9fc6-42bb-8161-f5da0e5095fb", "comment": "Malware payload (RedLineStealer)", "value": "1536387ce01b5357de7f50f973fbdaf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305834, "uuid": "eca4ce64-0c22-4e6d-b520-35ef51addfe8", "comment": "Malware payload (RedLineStealer)", "value": "009001e547814e418ac6a0fffdb62e2b1ef81e44ab587b760644afe74555b490", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305834, "uuid": "2f9c8f92-4346-409d-9bca-85648cce3d47", "comment": "Malware payload (RedLineStealer)", "value": "709f5f4510e687d250ac7cec1063bccbb430ff62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305834, "uuid": "6617fe5f-fa34-4d72-88db-5c5da78e03f3", "comment": "Malware payload (RedLineStealer)", "value": "5d5214558c0f0b163cf7e7656fa2e55391c1332ff1458da847693f646ca9d26efc27c65687051b450b96e08dbd937666", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305834, "uuid": "f7c30371-b753-46fb-9d80-5926b543ca00", "value": "T18354F11332D0E471D1B62BF25D24D2E46A3EF87249B9655B37542B3F3EB06E08A36352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305834, "uuid": "becf987d-f824-45b8-95c4-8db7bed2a07c", "value": "a915562f5b4dfee9fa3c29b2972ad3d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305834, "uuid": "4835a718-eed3-4578-ae03-2d2bc6abb2e5", "value": "6144:Q/EQcWuED6NUN270V1VPdeiHCWZ2yGqC5Hd3M059DG:Q/EQdyUNY0jei7ZcP93Z9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305834, "uuid": "2dc0ff61-6fd7-4d6a-9f32-9bab01eee97b", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305834, "uuid": "e13b0d31-1108-4945-9d52-2d1d276e6b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305834, "uuid": "0be83e27-bb8a-4cea-973b-04a16bfa35d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5976fe-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676280631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280631, "uuid": "162af0e0-1328-4682-8f3d-ae2a6ed8b411", "comment": "Malware payload (AgentTesla)", "value": "5519d771cb1a4002da7e04ce47faca17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280631, "uuid": "ebd48bd1-690c-4423-8231-d1a6d4a09122", "comment": "Malware payload (AgentTesla)", "value": "009f077593b2b4ec01c3ebe13aa8ffc991b666108392e1353c522d5047ed6bdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280631, "uuid": "32afe4b3-c180-4c32-bf93-f6741ffd9385", "comment": "Malware payload (AgentTesla)", "value": "81b3747bb8408343d9f1fb7aeb9f2d77290af539", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280631, "uuid": "3fe692d2-5c77-4104-8dc3-c09be036223f", "comment": "Malware payload (AgentTesla)", "value": "918d793936dd3eb102f1a08b830579a9c6f9ddd51ae6429179ef96c5a8a350af21e61b5941bc96ec9ba70421ff568ee1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280631, "uuid": "d4306b9a-11d3-4fbe-82cb-e5b540e47efb", "value": "T1CB7569B0BA41A060E9DF86F5AA63425E7810D9235F34DD86E34FE5839F6C393E461F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280631, "uuid": "ec172438-57ee-4b36-9a3f-db07de947b9e", "value": "396c902890b802c5ec6bae321a9a9c71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280631, "uuid": "73c7e1e6-68c6-4a36-9968-38d533ed90de", "value": "24576:vh0lcYjFLvES7GAvfuwAo1bXMTz+PbvqYCc+3Aidm/NDDEVwAkuD4:5evN7tf9ZoowAiMdywAkQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280631, "uuid": "0b8ee698-8a91-4cfa-811f-1966523112eb", "value": 1647632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280631, "uuid": "f2acaf78-cb23-49fd-bbf0-ce4ffa89e091", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280631, "uuid": "ab53aa3a-361b-4103-be8b-6f8f6cd85f35", "value": "DHL ORIGINAL DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8af336-ab94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1676289030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289030, "uuid": "3744a8d6-ad07-4b2c-9453-7c8d17851bb0", "comment": "Malware payload (Vjw0rm)", "value": "3cbcc574b184d5719059b21b9786bbf0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289030, "uuid": "ffa9d112-da0c-490a-a7da-a2fb35ca2caa", "comment": "Malware payload (Vjw0rm)", "value": "00b6a46542f80c34df42fe3d9e369eb7c39566e902e9ac92238dc90166446a6c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289030, "uuid": "e90de38b-d9a6-4cca-9256-f6ffb0751c2b", "comment": "Malware payload (Vjw0rm)", "value": "9ed29659b5b54cdf60cf2b9495224aec1a261e67", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289030, "uuid": "5e8b9706-0b09-44c4-8e3c-fd5bc49d2799", "comment": "Malware payload (Vjw0rm)", "value": "a2fc4b8ecabcf2216d31b0bcd772e25e73ebf59bcca86749e53c2ef790049af56b9c6813300fd9c96b795cc417cf4837", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289030, "uuid": "f0c5ec9f-ba5f-413b-8486-813819a2589b", "value": "T14B26F6C87B88C8072B8D5D43AF26BEE5417AE162DBAC66C3D5693EDC10F89C34455CE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289030, "uuid": "4d6da0ca-db1f-4644-8584-008422b5cdd0", "value": "3072:2GRbdyiMKBDjY086keLyVXiQp7IayQ6Q/27SSi8s2ag6N8TiwzccqhWM307KIiWW:R06HV4dbI+eeHbESp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676289030, "uuid": "b654afa1-9f45-4d4b-8587-906d77a3e3ac", "value": 4803171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676289030, "uuid": "9937ea2d-fd93-4758-9f68-99a2be25635d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289030, "uuid": "e9765dec-3e6e-4b88-9e94-1b3ebb3569b4", "value": "HK SEMI CORPORATION CO,,Ltd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d47c9aa-ab8d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676285835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285835, "uuid": "ba83ba26-9520-4f1c-a447-7f355aefc103", "comment": "Malware payload", "value": "4ff7e7fd1b3d1f0d65d26d78c6e68679", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285835, "uuid": "2d003ec2-38de-42f6-b50c-c44b4d914792", "comment": "Malware payload", "value": "012114a8c74ebe73a4790499e26e134cd78b4241611ae09fbcdf99cd8ff56f78", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285835, "uuid": "97c03474-2eb1-4af5-8293-ac0c73e877c0", "comment": "Malware payload", "value": "d3e9f01854d821838a00faca8981b9cef4f99e10", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285835, "uuid": "8e856d7a-2ad7-49a1-9a7d-93eaab628d1b", "comment": "Malware payload", "value": "f83bd819b8c96aa28228825279f8f247fe71d56e087308b2bf8a2476e15e6361a6c4ae5119e315dabc8dc144dab85b1e", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285835, "uuid": "494fa269-0fdf-4d1d-b141-a42108cd5a79", "value": "T1D555F1503AAD9B14E52E5BF42875B080A3757E562A35D31C7DCE70CE1F32B468722B2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285835, "uuid": "b94af54c-c9b0-457d-bfe6-47093fe5c3d3", "value": "12288:/mkvzZh6q6/TKPzG7dQg3wNMWXvlmtnV2emEXCqaJTnu:/mkVY/TKPzG7dx8MdRmodaxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285835, "uuid": "7caa5f4c-bbe4-4c73-a4f4-01b83e3e8c7e", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285835, "uuid": "1c90053e-96f6-46e9-ad67-77a6165ade62", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285835, "uuid": "46ca1a30-5e89-4ca3-8052-5b30486fde35", "value": "zaplata.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34eb70c9-abc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676309900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309900, "uuid": "86d94b44-db39-42a7-b1d9-5c829710721b", "comment": "Malware payload (AgentTesla)", "value": "6f447b17f0e62ecea9e4e5df2cd4b9a6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309900, "uuid": "04a7df11-6949-4779-8b66-a3e5c25fb13f", "comment": "Malware payload (AgentTesla)", "value": "022ab6d6d30d4e85aa232a5724ff43f39aa1a1819e42569ef0d2be3fe9732c0d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309900, "uuid": "267fa92a-956b-41c7-b2c6-f5820b60d6a4", "comment": "Malware payload (AgentTesla)", "value": "a50cd40cf810e0e307656bef22cbb575b26776ac", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309900, "uuid": "1d98936a-538a-4177-ae56-041b21c012a4", "comment": "Malware payload (AgentTesla)", "value": "b6ce6036d078acb79cafc65862234d343be5facc33d92decccf62a0e9558ae53290d8d8268c6197048e09b5376ae2f6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309900, "uuid": "e160515e-0952-47d6-82d3-48e028504453", "value": "T12925121737894765EAF11ABAC2FB493907F2BFD69573C242BB0C3A464706267DEC2601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309900, "uuid": "6c84d790-a5fe-4ab7-92fd-5ff6d2a17a3c", "value": "12288:86Y7c4Wp0n2RaEBx2A9wIgEv5Ip1hCCN2+aQT41DBJXFMsC2Ah6z8qhNcri2MyI:4BEF9LHuCS2+hsy5FhAuFMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676309900, "uuid": "01d46735-8937-4a38-ad61-3d65850d8da7", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676309900, "uuid": "9b4c2a57-a25d-4f32-997c-56d66a546721", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309900, "uuid": "28285fd3-32f3-44ae-ad34-486dc40624f4", "value": "fedex shipping doc.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f657d01c-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676271999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271999, "uuid": "e871abe1-0285-45f0-8999-79a4f717270a", "comment": "Malware payload", "value": "5f3d3465c17c030109882923b03eaaf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271999, "uuid": "40dcc80b-5b5f-4ef3-ad50-494bb0b726ee", "comment": "Malware payload", "value": "027df72cc7732d14f7b3b9a6cfeeade0b04e0c9aea7b1a7e8fddb4ac8cad5688", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271999, "uuid": "aa212614-f401-4142-9878-2a940264f867", "comment": "Malware payload", "value": "22a75ecd9a5f728c78fc4fabe66ceb11dfd74002", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271999, "uuid": "db099610-72da-44e2-938e-be556ea8df32", "comment": "Malware payload", "value": "3487903aa2cf7cd24d914c7e3c960d03d5b6e7c39a01f2347fda4107e24766f373c4f79d7d44043103f4d001a1614808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271999, "uuid": "d96777c3-87cb-48b6-a09d-9a520153316b", "value": "T1F08308227BE0A170E0F116786D7D6220467ABD721F35D1CFE7018ADA7978B82D834B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271999, "uuid": "0e3658ca-6df5-40e3-9c1a-e49cfd8b2426", "value": "1536:J9vy4UHLJJ3+O0A4/ssgDpDdO/n/PPMkqH2RciU3:JRy4UHLL3+OesRBUPLqHacik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676271999, "uuid": "86504a3a-4937-49cf-94f2-18dcd188072b", "value": 83456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676271999, "uuid": "c4fc5056-b61a-4993-a9ad-6ff7c7f207af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271999, "uuid": "0aec8f14-2e82-4a04-9e7d-19712c583be9", "value": "027df72cc7732d14f7b3b9a6cfeeade0b04e0c9aea7b1a7e8fddb4ac8cad5688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4ce4d93-abc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676311376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311376, "uuid": "a0f0a8ab-a055-4f79-af3d-d8274337656c", "comment": "Malware payload (GCleaner)", "value": "78bc9e6b8f54759b0e794f53ef3cdb1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311376, "uuid": "f9df705d-4b91-4c62-ab0a-37624debb0fc", "comment": "Malware payload (GCleaner)", "value": "027f5be3a4581f03ae89654c543504913f6d8e0cde4a8ccf9f10088097d2f8b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311376, "uuid": "feee74bb-7005-435d-a4f3-c499d54cbf28", "comment": "Malware payload (GCleaner)", "value": "a09e556df5d1e0317d457d87ef6c890fdd565750", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311376, "uuid": "890811ca-53ce-43a5-8151-e88799370266", "comment": "Malware payload (GCleaner)", "value": "53ee39672d0c36f31255a2f6a290f23d5688c08d5b3a501fae6adfae765370c2725f6cc2f0d801d72db854dc5e3c6997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311376, "uuid": "0cee2319-9ba6-48fe-ab6a-35c54c206991", "value": "T19BE5127C710589ADC280FEB48D39D4F75DE66EE3E9A4A46230D8BF3E52BD1849B09113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311376, "uuid": "5767b9fc-b46f-4d9d-821d-c507b05b95af", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311376, "uuid": "1af4cdb5-5bdc-4ec7-a77d-47043e057288", "value": "98304:JH6lBpoF4mZmTiwxb/PCsFJa8nwlTvPyMZC9Iv2MR:d6l/oF406iwF/qsztwlbZC9IvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676311376, "uuid": "4b1965d3-572c-4980-bf9b-3be7a69938dd", "value": 3314922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676311376, "uuid": "1b91fbe1-38cb-4bd0-a409-a782f96a0628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311376, "uuid": "cadd0c5e-2841-4af4-9dcf-3b187b63c117", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa4cc4f2-abc0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676307949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307949, "uuid": "21a0dcdf-e1ad-4396-a5fc-622247c2ccc7", "comment": "Malware payload (Amadey)", "value": "d644b2ae949948e540249d8120ec77c9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307949, "uuid": "ed7872ba-df1e-4d70-b33e-30e07e06b405", "comment": "Malware payload (Amadey)", "value": "02ad3fea856d1e25b831dab377c70d6bccd64867bb1fc27a089f34bfa68acef0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307949, "uuid": "90296f7e-6014-41d1-b2b7-d565ad8fdb24", "comment": "Malware payload (Amadey)", "value": "05b2e6163596a1eb2d3328f38eec87db559280b3", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307949, "uuid": "994ece6e-836c-4ee4-ba34-7d5c1f447306", "comment": "Malware payload (Amadey)", "value": "0f7cb232a42da35f60e525d1412f6b0ba38da0fed1c4abd8803dd824de00523345a88aa56b2a49b0216276c42a6bef0c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307949, "uuid": "7c3ba25a-01c1-44a4-9678-f383b790214f", "value": "T13EF4120BA3E90123E8A4AB705DF203D31A397E609A38C35B13CFAD9E59725606735777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307949, "uuid": "42bc5b46-82de-4d0e-88fb-73bd201bcb53", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307949, "uuid": "77d36cb7-e6e8-4759-aefb-a250e0a80b98", "value": "12288:gMrAy90BA/IXAWvP+9iGbz8FqjbNeJaSVP/6Sn3Vl9lLdf6X:wygb2MGcvaE3BfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676307949, "uuid": "c03dd738-b48b-4bc9-8dd0-c573541b4982", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676307949, "uuid": "067678da-a2f3-411d-9054-bebc14f90472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307949, "uuid": "4162074a-139f-4c52-ab2d-21c2043b1abb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb0b1ee-abd5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676316810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316810, "uuid": "4042d377-b675-4793-8f84-ed4a6d7a98b9", "comment": "Malware payload", "value": "85c2ecad9f918ad661aee4d579259990", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316810, "uuid": "99615093-df5c-4307-b936-0afedda980c9", "comment": "Malware payload", "value": "03089a0860b5ba452ddd8660d62c7f4d10d338944967bf7e81a2288d71952d35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316810, "uuid": "d42e975e-571b-4bbe-9fd8-bd3f5db71ec1", "comment": "Malware payload", "value": "737f26da783ab5a3d0a85652413c501a9946a3ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316810, "uuid": "af1a396c-ccfb-4cdd-89d1-1bb9d4dd4721", "comment": "Malware payload", "value": "73180c58a97fb82baf15a0de5998941254d69f9b1c2c61a808fbd8eb573eb0b919ce2642082da018780d5b6027c52a68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316810, "uuid": "07839687-5d72-4156-ace1-ee14c902532a", "value": "T173F41217A6EC4062EAB90BB11DFA53D31D36BD716B38439B234EAC4D18B3171663136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316810, "uuid": "0acf44b3-8c9f-467b-8379-9eeb7ccef92e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316810, "uuid": "016ad380-497e-4709-81dd-f58978b6ea55", "value": "12288:cMr+y90Yv1jV7AWgOILcDUezJf88KGfIPKqitZxoz3PZ3QBZKDY6eTPe:yyxV7WOIaPzF88KGfICHtZxojPZ02Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316810, "uuid": "2f49a05a-e68a-49e7-8075-fda6a446b56c", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316810, "uuid": "aab99580-344f-46bb-9c07-57360949e9ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316810, "uuid": "a6af69e7-0bd5-42a0-97cb-58447f22527f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d137c84f-abbd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676306726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306726, "uuid": "7b6d271d-cea3-4e2c-b2dc-c40fdf6c91e8", "comment": "Malware payload (RedLineStealer)", "value": "89cdb9fba63508585269d419421e2520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306726, "uuid": "746c82ec-0b85-4951-803d-401578c6c5da", "comment": "Malware payload (RedLineStealer)", "value": "036de122bd1fdfd35447ef647cc6140bf380d11faf7d1b1a34de4ad78e89bce8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306726, "uuid": "ef2dbcb4-d89e-4771-9235-0e355c92de0d", "comment": "Malware payload (RedLineStealer)", "value": "a998741ac25da4fdd3855cac98cfc1847d142ad4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306726, "uuid": "6acaee64-0266-4940-a1cf-4c67db0a3276", "comment": "Malware payload (RedLineStealer)", "value": "c4a7bbe52a7ac5744627fdef1780627dd5846a5379e61cd96fb71c64b9bdf4911654888e9591419af71fad3957483b5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306726, "uuid": "c4776a29-be92-4f62-a33e-441330b5cd29", "value": "T1A3F4125BB7E88136E871273069F243D31B367D508A388396278FAC1E58716E0B63577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306726, "uuid": "a6bca650-53ff-4e15-9b13-329a1f954770", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306726, "uuid": "e04e478e-2766-456d-9f20-1ec4d7772bc2", "value": "12288:sMrEy90uIVf00S+4DB1dKMVZQoNYFnqvWJkYeJ3cjeQYxpqE0bw0qhBajK/jDZMI:AybEf0l+4F10oZTNYns7rdqdc5mjwC5S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676306726, "uuid": "3eb0ff21-9050-4662-8f59-71e6c5abd0ab", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676306726, "uuid": "d32251ac-c9d8-4afa-8680-02c86dccc479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306726, "uuid": "2a69114f-23a3-4f65-9d2c-72058f1c772f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990699b4-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676299760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299760, "uuid": "7baed65a-2daa-4e76-87a6-1890a991343b", "comment": "Malware payload", "value": "c056998f5cde8a3af62f0791e3137abf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299760, "uuid": "359af1e6-4dd6-4aca-aee1-5dd8e909dee2", "comment": "Malware payload", "value": "046afe5e3a58641ea37f6475d54ea94d0668d66bb6138f495f49d23ad05956e5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299760, "uuid": "aa3917cf-1717-4c48-b522-3ace761acb78", "comment": "Malware payload", "value": "5339a321b4b97eae3f5d984ce57079381a67f268", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299760, "uuid": "a469fcda-0844-4e98-bec6-e4cd6c29b021", "comment": "Malware payload", "value": "ada94075711ee57726026c7ca1996620191ceb7b11ddb5803a094fa83887786826742462be53bc01540e2d07ee4c8c22", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299760, "uuid": "6818260d-ff87-4b86-bbf6-6199ebfe198d", "value": "T1781318C8E75A059880FFAE9743BCA253E52F81250D310951FE7AF7008779E69B36F446", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299760, "uuid": "615aa074-169d-4843-97ad-429b8b9d8582", "value": "768:MsbEU7CePdFJO5m2BPCXvE4+72HLYMKT9/oe7Ac/7Gk5Re9kHO9QLLGVTPOziSO/:MqWePdFJO5m2BPCXv9+6HLYMKT9/V7Ar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299760, "uuid": "5911b62a-674c-4852-8c9f-983b878e65f6", "value": 41875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299760, "uuid": "088ec7e6-c3c0-4d80-a4d8-f45668dfdffe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299760, "uuid": "8e9601d3-2cbb-4c87-8a5c-95d9f170b834", "value": "DocuSign-Feb13-2023.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce9de873-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1676301568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301568, "uuid": "f6e7af06-558b-4579-9cd9-fe8f6e928d26", "comment": "Malware payload (Fabookie)", "value": "2c5c54a990db2104a219a432fa6c9ddf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301568, "uuid": "7a002213-905d-401e-8e73-163d04fe4081", "comment": "Malware payload (Fabookie)", "value": "049cd9c4000ae59133dc94683891e83f48cb427d34552b4da2a4de0b0970a7f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301568, "uuid": "56de6c6c-ff56-4767-aa12-3be769758f22", "comment": "Malware payload (Fabookie)", "value": "166666bb57bb069f7b8a783000d373d70510aebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301568, "uuid": "a123cd01-0271-47f6-9eb6-c7c2ad8da6ef", "comment": "Malware payload (Fabookie)", "value": "9fa11b7ae41aad4ddcc621e8bb7c8cc9437b5fbb12fb26fd6b63343cf9a714c231cfd2c225e66da8f0c6440b0af1c2e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301568, "uuid": "d9191999-ae4f-4d7f-bd29-4aa4703f1c5d", "value": "T1C2F501FD6240379CC02A8D70C523ED48A2B5551E4AFAD47AB2DB77B07FA74309A22F45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301568, "uuid": "0058bd23-2175-4fc8-a53d-30e0728396db", "value": "245fbb05d3da4d7c6badd5cc3e1f9b98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301568, "uuid": "38b4c434-d2af-4cb9-a540-d056fdcaf7e5", "value": "98304:ocio410Wzmizg68hmsbx1YyqfaU3nuJwylWu:niBslhmsbx1fqQKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301568, "uuid": "79f763df-961e-469f-8113-bb89f0a539d4", "value": 3638784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301568, "uuid": "a9bf4e6b-e117-45ec-87c7-55a001ba04a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301568, "uuid": "e74f8002-6a9c-4651-b614-22a4bfd0553b", "value": "2c5c54a990db2104a219a432fa6c9ddf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7de5301-abbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676307167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307167, "uuid": "35c33e6b-b8a6-405d-89e6-455363e4fd19", "comment": "Malware payload (Smoke Loader)", "value": "a1a171a30c74fa43c5582d405807b8c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307167, "uuid": "37d26117-83cf-4576-a6c7-eac903de80dc", "comment": "Malware payload (Smoke Loader)", "value": "0541315cd5adc7d41f8db06577d0d38024083e13a7c0b7c0720375f237a470a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307167, "uuid": "5cacd4d9-2f3d-445c-8c06-d5710a7bbe53", "comment": "Malware payload (Smoke Loader)", "value": "320b6a055d09a2dfddf42f964984116d9342b64a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307167, "uuid": "22313fae-a4da-469a-9bc6-ec53b389eeb0", "comment": "Malware payload (Smoke Loader)", "value": "57c05edfab624ea848d8b1b65413070f3d76badb40c610d1507aa0880004dacd24f4f0c20be4b85c57840397bbfdcf8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307167, "uuid": "0e73a23a-5e31-4d5a-ae63-c7a2da6f8976", "value": "T12D04C02332D0D872D57256318DAAC6B176BEF8224A79AA4B77C45B3F0E702D0CE35395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307167, "uuid": "e1a4635a-b4e1-4a84-9a38-47a9489e1623", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307167, "uuid": "ad38d429-d512-4798-8ade-7e0ef3c70bc9", "value": "3072:0od04M2v6yqIcyTwwbISQLMTMn1dT+Y2etC0Cq:0e0iyyhcMbISQJ3ls0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676307167, "uuid": "f9414c81-df08-42bf-ae46-15a3c09ef94c", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676307167, "uuid": "0ec32603-74e7-45d3-8ffb-db3f389c5884", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307167, "uuid": "23d7b850-685a-4798-a175-8cfd3402fc09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5becfdb3-abc3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676309106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309106, "uuid": "1fb4e5dd-1ad7-4713-9b72-6da1fd10cc7f", "comment": "Malware payload (RedLineStealer)", "value": "f320fada53a1c654d09d81cbee57a0ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309106, "uuid": "3d51a656-531a-473d-8c2d-db445d656e28", "comment": "Malware payload (RedLineStealer)", "value": "055ebaa300eea10ed2113ec97e3f1ae088b71deb91101f94c8e0aa69f0bbeefe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309106, "uuid": "d97e0d72-537d-422e-9f2b-c995a0479ed1", "comment": "Malware payload (RedLineStealer)", "value": "a24eb4d46c82d32fa07dd2e4060f5d253c50661e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309106, "uuid": "1401c456-971c-412a-9c82-da2b7c273dcc", "comment": "Malware payload (RedLineStealer)", "value": "fa9e6bdac43c86354023b49f5434365466cc8a067663a012ed2c73d6d168cc3bb7ead276b0ad1d51fd98100b9468b255", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309106, "uuid": "b472cd15-6881-4792-857f-9862d2b4f211", "value": "T1C6F4120BA3EC8472C9B567B12DF207D329317E615A34839B238FAC5908735B5A53637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309106, "uuid": "e867b1d5-f68c-433c-988e-e84fb9c51a3f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309106, "uuid": "2444c767-b7d4-4938-ba27-e8b30ead018c", "value": "12288:KMr8y904eACDV3Nqidnmx/tugxI4PeJddoiH8gUnlRlZeN2dupv:+yDSV35dG/P+58gUaN2duv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676309106, "uuid": "2d82c2f1-3722-4262-921e-0feddd0496ae", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676309106, "uuid": "f0a1921e-1230-4365-9b37-07fc6517d386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309106, "uuid": "5959a0cb-57b3-4364-a24a-b1ba0591aba7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070701a9-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676251411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251411, "uuid": "de36dde9-d255-4836-a7d2-bb5a54ab4223", "comment": "Malware payload (RedLineStealer)", "value": "c6d6879b53074e70c6a750d191a83e50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251411, "uuid": "b583c9e7-b0ae-45ef-b80f-b689c06566a7", "comment": "Malware payload (RedLineStealer)", "value": "058b61ea015d828b37a09d3a2b49a2761984c9bc5152cd7ff2da0ad81387167f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251411, "uuid": "01da6e6b-3426-4257-bfa0-85ac12a3a62a", "comment": "Malware payload (RedLineStealer)", "value": "35f204b9df99eb1681b20d6031f8a96df1a5ff1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251411, "uuid": "11dc1b2e-b8ac-4933-b27b-e99defcbc182", "comment": "Malware payload (RedLineStealer)", "value": "9dbd536a7bd35fe8f2d2e5a153565d1dd9fdc2f79cb549a425e8d0e76d55cf8d02f5659efeeca8b2add1f8df4c38410e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251411, "uuid": "53f1a9e4-3fc1-49a7-9d67-cffca4c38c68", "value": "T19AF41207E3F89022F9F15B7018F303C32E367E615A39979E574E6D1A0C326A5A079B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251411, "uuid": "07c03a22-bf7f-41f6-9ca3-0c8765651878", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251411, "uuid": "cee374ad-e216-4663-bee4-57c45776ee83", "value": "12288:EMrey903xGFVe2MalfWa/TxN7B6udmeJ70v6FjUYma8P+qb2CuxYv956:yy42VeoNN3hxd6qDxMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251411, "uuid": "142ce759-253e-488f-bb8e-7a743ec927e5", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251411, "uuid": "3582279f-98d4-4348-afa8-d8eaba4b6ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251411, "uuid": "8c34cc24-5946-4455-b992-9f34e75fd114", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f6a21d-abbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676306955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306955, "uuid": "51261f99-fc99-4b32-a6c8-9498c61dd1cf", "comment": "Malware payload (Amadey)", "value": "87bef7e7ba0432a3e38735f75c9f2678", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306955, "uuid": "9c0c7825-f728-4d05-bc74-fd380d5d0c23", "comment": "Malware payload (Amadey)", "value": "05ab2642368c4f186aecd0d572b0e32dbf4c3def955dd2a7e319a8adf4c1a86d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306955, "uuid": "33a4ddf6-6edb-4c8c-8adc-96d890c0382b", "comment": "Malware payload (Amadey)", "value": "4db3fe903edfcdfb1ac57007575d3140be5462d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306955, "uuid": "7b569bae-7a81-403c-8020-19bf7ee161b7", "comment": "Malware payload (Amadey)", "value": "9d7a2f08045d50bef4b4ec5aef769ee99110f85b53c9272dc2e2ef8cbeb0ffabeda8cf03395f6d06e398146af2e8171b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306955, "uuid": "dda5918d-62ed-4697-8d76-d76d050e9c4f", "value": "T1A8F4120766F98073E8B95731ADB603C30F367D609A3893D7275E6C6E1871261BA3136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306955, "uuid": "178da5ed-89c6-4043-a971-7299017c1316", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306955, "uuid": "8aeda54f-2faf-49da-9b83-b320d2bbc47d", "value": "12288:DMrOy90qfIef0gAxt0gt2YUZKWv288D75IPaHG8IGc8V9rTc1w0qTBwwyB8EmxCb:9ybnf0Hxugt2YUZKY288D75I+G8IGvLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676306955, "uuid": "103155bb-5d72-41a9-8e04-12b27ed9fd41", "value": 742912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676306955, "uuid": "36cc1131-5153-43ee-aaa5-008e7300e04d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306955, "uuid": "768c4111-956e-40f1-b9e1-1d49e5217436", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f7ca25-abae-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676299990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299990, "uuid": "94ae002e-cfa6-4350-b5ee-0e16543af73b", "comment": "Malware payload (AgentTesla)", "value": "fdc82d4f696e64a4a9411f29c7c50c4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299990, "uuid": "37c30d12-20a9-4b74-84d2-704fd0f97328", "comment": "Malware payload (AgentTesla)", "value": "05e3e8f41083031007d3d6f7a510f1bf5e2adda5d0bcefaa310559b3536f070f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299990, "uuid": "7c29c163-2c1c-45e2-b2fe-58b3fd88b480", "comment": "Malware payload (AgentTesla)", "value": "55eec22f6efd4cf25e7115ea2c5a2eb37ceada9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299990, "uuid": "8bfbec1f-771f-402c-9f91-ebc2512bae04", "comment": "Malware payload (AgentTesla)", "value": "3f2c15bc9a5820a1898abb917b2f82dfe8efcda5741b583eaa8854394b5c4d9bec37fa2c4d3ae6e9f69e36fa5b1afc96", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299990, "uuid": "379b227c-c7aa-4221-95e0-1a4cbc1a2afd", "value": "T18C05230A1E48C7A7C8ED97FC1D318468E3617C2D2972E1631CDA3EDFA4367A5C819947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299990, "uuid": "d5ee0188-56b2-4813-af0f-e673719f885f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299990, "uuid": "3af9b6d3-021a-43d2-b82b-4b7dbebea083", "value": "12288:hh6q6EMrYC0ND571Vd8wKA0D9JN7g1PWlKB5zmpDO8I1hGE6c1:hYX5Q57j/0D9JNEZR/qT2vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299990, "uuid": "3ba1dc76-3085-40f7-8635-433bf09987e6", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299990, "uuid": "3e920be1-96a7-47c0-9ab1-22220804d549", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299990, "uuid": "edf73cef-f46e-47ee-a999-7d5533046c1e", "value": "SPECIFICATIONS 20230213 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23118605-ab65-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676268638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268638, "uuid": "8cbfa306-c202-4c6b-9ccc-9d5ad9da6246", "comment": "Malware payload (RedLineStealer)", "value": "e413c75e534524ffa7457b6b588fd7db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268638, "uuid": "342f3a38-ad5a-46f7-be75-cf2c870e9862", "comment": "Malware payload (RedLineStealer)", "value": "06f70b24600c327b43ed7702503016fd2924a99de10b59e34efcba0465b6bc1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268638, "uuid": "6adedace-8ef5-4532-8db0-4af5e83227f5", "comment": "Malware payload (RedLineStealer)", "value": "05c89da321a8180176ad129847255ee44587cceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268638, "uuid": "f4a29ce1-fb50-4a5a-83de-5a98a840daeb", "comment": "Malware payload (RedLineStealer)", "value": "54b04d27d0a28e1efe7037e790b0a586a3d9b0a1302eb21cfaf123c9e24afae64f1a9e99bf62519b86c5f049e84684e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268638, "uuid": "e517ebdb-b87f-4e43-a1a2-4fede5988269", "value": "T1FFF41287ABE89472E9F667301CF606C316357D604738879B278E7C5A0C32670B63676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268638, "uuid": "d27b0bcb-4be7-46ef-b15b-35191a01344b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268638, "uuid": "2388b5ec-6eba-4605-978d-cfa0ac8124fb", "value": "12288:oMrby90miUQsdLz207Dgu0tq/mHeJKPas/pMq5q9k5qedkvyrfo:Tykav207Dd08/zKChmY6kWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676268638, "uuid": "91e1fdbc-3c40-4176-b6f5-96f0d1af34db", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676268638, "uuid": "7f0d665b-e656-4d2b-97b5-795882dba181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268638, "uuid": "a2acab0e-f66c-4479-be73-71b7faaa5c88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f71999ec-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272000, "uuid": "fb926ae1-812a-4206-a612-3d590763eb69", "comment": "Malware payload (AgentTesla)", "value": "4e43b5592f088b64cb15cadf0c9e2d93", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272000, "uuid": "64eb64db-a3c5-4b3e-8955-845ca994e79c", "comment": "Malware payload (AgentTesla)", "value": "072cef530c65a045973670b655590566ed1ad17488199f29fda4ffeebefc14e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272000, "uuid": "91c712cc-ea82-44fe-a911-2862d68d636e", "comment": "Malware payload (AgentTesla)", "value": "8aed6c215635c854c8a432f0a6ae2b981704cf6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272000, "uuid": "e56434b3-3a68-4948-8a62-d7d684a6bfb2", "comment": "Malware payload (AgentTesla)", "value": "6fb68ba4b34ce473b75045a7961e9085ecab367c85bb5768b16685f3b5b3cb57181d7a132addfdbce431ebdec298c7c5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272000, "uuid": "a41887fa-d2c6-4a9f-aa9b-03c7544c2b1b", "value": "T1EAF3296892899DD3D32C4174D8E01348CBB2A2465217E79D0EA1ACFA3F467D3363F967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272000, "uuid": "e13e272b-fcd3-4863-9f0f-3dda6e1d34e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272000, "uuid": "6ca2b942-ce71-4582-b7df-e0959690c8a5", "value": "3072:NzqMyI0Fc5l1+67wUAOJP2Y9kiHV2FUC1+EpKRmkI8pOpE:90FuL7wUpJPL9DEaC1+lc8Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272000, "uuid": "0e2958bc-9ed5-4b5d-af84-dafcf6d44ebd", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272000, "uuid": "c0819a27-f6a4-4ec3-ac87-88fe0933c057", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272000, "uuid": "8c34fb89-1d30-46d7-93f4-cf1f5debce0b", "value": "072cef530c65a045973670b655590566ed1ad17488199f29fda4ffeebefc14e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18b5e9ff-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676280647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280647, "uuid": "4ee217bc-062d-4733-86dc-ca704d32978b", "comment": "Malware payload (GCleaner)", "value": "dca4caa64f309908d984c2115b5e9425", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280647, "uuid": "9cf3af87-4041-4f96-8b01-cc693a03c9fd", "comment": "Malware payload (GCleaner)", "value": "07a93b9077f6aab341b5b095ca58fa2cb593fc6bbbb28f0bc00717613bce5ae5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280647, "uuid": "7cde0e74-70ae-40cc-a796-d01f8379ef73", "comment": "Malware payload (GCleaner)", "value": "2d15e0ee145d50f15033297d17d4422ca80ef757", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280647, "uuid": "d1658cc5-5682-4f0f-8d89-2148932944ba", "comment": "Malware payload (GCleaner)", "value": "c10e22d6afa8168c7be3d481fa7d98c6ec614ac80720951f8c6ec4ffcf821f48982cb040b127b33f2ed820cde32fd660", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280647, "uuid": "f99d9b76-6db6-4b17-adc3-e3afe9317291", "value": "T1CFE512BC7156C5ADD280BE788C2A98E75CD22EE3E9E4902370DD7F3F917D284561A243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280647, "uuid": "f364313b-2c3c-4cd2-94de-8c6f31c62285", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280647, "uuid": "3fb4804d-9a7c-4119-9be3-a2e837c52d68", "value": "49152:rdHjNcfR+ka2nYuB1v9rTm3HgU86VmgvJ/5ybvpCEkQLv2PlEw3L8LCgv2MR:JHjGfw/u3vVC/869yCEzLv2PlEA4v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280647, "uuid": "2028d32f-e097-4082-b400-893a1baa5905", "value": 3145464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280647, "uuid": "32bb4c71-9f18-48b9-be3a-cd0ae07fda6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280647, "uuid": "191c42c2-715d-403b-8e88-00dc3c18e4ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae832c29-abae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676300225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300225, "uuid": "7a59387e-bd0e-40b7-8952-ab4c3f90b16a", "comment": "Malware payload (Smoke Loader)", "value": "c9751c9e8b33317fb5320cba9d2b5e13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300225, "uuid": "21a88069-385c-49a3-84c6-5dfb6992cefa", "comment": "Malware payload (Smoke Loader)", "value": "081b9ffb61df7ddc4de60a1d387c757a5804cfd28663b57ca7db01e6f307f8a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300225, "uuid": "f2bd9151-0f23-454e-b53a-a64407868be1", "comment": "Malware payload (Smoke Loader)", "value": "edcbd64cca7ea857463db1d6d95d7e88a1b14280", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300225, "uuid": "d40edcfe-371e-4453-8a74-8600e23799a9", "comment": "Malware payload (Smoke Loader)", "value": "582e20e92ad24cf1c529c87dfda290c78f505849022317e8ef8c0d9c92cb718604db49301b8c9e6b37d0c8b452597779", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300225, "uuid": "c0e5070f-ec69-4d7f-a6a6-385b3b62b920", "value": "T19514CF233290D4B2D1A32A31DD29D6F42AFEFAB14E74654B3B945B3F0EB02D19672351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300225, "uuid": "ed193441-ddc4-4a5f-bbd2-82d4697fd443", "value": "096c57a489bc9be05d307c86ed0497dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300225, "uuid": "ee6f62ab-4610-4457-b191-b188e6a4edea", "value": "3072:y6BNwpTDvjtC8uXaE8MkRV9ZyboVZQiqg+ivWF/y3C:yO4T/tFuXaEIV9RVZKgJ6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300225, "uuid": "72973d15-cffc-4597-8b38-d79e9853ea35", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300225, "uuid": "8d96ec62-a6cd-4352-bd14-4e86fca47984", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300225, "uuid": "1ebf1c8e-f6b3-49a1-8ed4-e5ae7ea84cff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14775bbb-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272050, "uuid": "c5ce4ebc-a01c-4287-b695-318d258e5379", "comment": "Malware payload (AgentTesla)", "value": "889ce644fc58e8493c76fdc886340bb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272050, "uuid": "85a9164c-2ed4-42e7-802a-73d9020e62b8", "comment": "Malware payload (AgentTesla)", "value": "08477ca70902dc2098c13b61d3661c0defe17a1e42195cdc6b1bdb7af2d98e2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272050, "uuid": "569922bb-0dfb-4d04-aaa6-0439ee6cfe02", "comment": "Malware payload (AgentTesla)", "value": "11826787f0f2fcf9d2c959b9e992f1639b4938ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272050, "uuid": "8de44e61-fe86-4ead-8bc9-c5e2c59085cd", "comment": "Malware payload (AgentTesla)", "value": "357743bcf0e7a5e17874176a11ba60f5d77ee9604ccc90972ad56d8d9fd9b7ecb227a26809f5c75d68478243fd59c5b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272050, "uuid": "9a4a8daa-8e3b-4f27-aec2-a9e1f0caff21", "value": "T19E74121E2114D4BBCA724B7A1FB623E86FB299625034620FB7405ADD3831583C72EBF5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272050, "uuid": "a8d17011-9f57-444b-af37-186b5e37dd65", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272050, "uuid": "321c89b4-706e-4a82-9552-379a6be80fdf", "value": "6144:vYa6vOKlv2G7Pqj+tDlfhnQjbNKA/eYaLJMqTqoFZOR79j208j:vYtxlv28qjYDpn/XTJ27R8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272050, "uuid": "f41d2e99-c86a-4ce2-adb0-05845012c2f9", "value": 340563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272050, "uuid": "97aa311b-69f4-40b1-a607-4e1670bc93ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272050, "uuid": "904a25ca-7bd5-4614-8960-83be3f212c96", "value": "Meidoh RFQ IND.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2c47b0-ab8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676286107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286107, "uuid": "1fffd0d9-346d-4754-85e6-1bcccd908446", "comment": "Malware payload (Smoke Loader)", "value": "09895122822d629f2c5f9165f11297b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286107, "uuid": "a7e5d1d5-18bd-4433-8928-6f778f16f58e", "comment": "Malware payload (Smoke Loader)", "value": "08c0f78ca25f7fffb45222d3ddaebb4fcb0dfb9be46580e177f4dbb0470663c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286107, "uuid": "11d5956a-79dc-43a3-be32-8e0a41138ed4", "comment": "Malware payload (Smoke Loader)", "value": "745da9bfaad4cfdcc89bbf8523388b39b5064e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286107, "uuid": "e909995f-b31c-4860-9349-a95198150330", "comment": "Malware payload (Smoke Loader)", "value": "298985d435193a7a33bc3c26894a01caf2e71472dd882dbe5d6fac3aa6c9aac0b9c14a89a93adfbe9d7a3e09db38251b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286107, "uuid": "82ead934-f45e-4ab4-abfe-105e21076d2e", "value": "T10774080393B17C45E9258B72DE1FC7E87E1DFE509E49BBA52218EA3F54B10B2D263610", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286107, "uuid": "36272e52-0c96-49cb-b20f-96bb8531052a", "value": "2874bda093b03f6d6f8f1371fcfc37a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286107, "uuid": "88fd273b-b93c-4b16-99a7-3d779bff9df7", "value": "3072:3/0RJccQi5P7ZT644knlMBBBkAIEQwryXj9nf6NeNpUUM:PUFP7F6pknlUeAIEdcpnfWeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676286107, "uuid": "742c2535-aba2-425e-ab99-d5492c7f4cc2", "value": 355840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676286107, "uuid": "99884979-6480-405e-9bfd-19b27e8e60b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286107, "uuid": "ad8dc06c-103f-4ccb-99f6-f47e2a80610e", "value": "lab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91967a40-ab90-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676287292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287292, "uuid": "c0e0aead-014f-4c53-a93c-cf81e3337f1e", "comment": "Malware payload (Mirai)", "value": "e8e8d67c87f3b803e2ecaff1bf79cfa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287292, "uuid": "9f9fd80d-1572-461d-b552-af4097365b4f", "comment": "Malware payload (Mirai)", "value": "08c7eaca6452805140b4e9b43e9853b2072a2d54df1c5cac095b3520d472ea97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287292, "uuid": "f19b2f61-37c7-41e1-b65b-44c4c5fc4d46", "comment": "Malware payload (Mirai)", "value": "2602ebd1e60adfdb1954de69d0c594bcecf52cf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287292, "uuid": "515b4fc2-5042-4052-86e2-cef0ec303172", "comment": "Malware payload (Mirai)", "value": "51b005127345e27963b8973c61a0214db94ff4ec3da7da04127355be122d86fce49128791adb910987814548091a7bd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287292, "uuid": "120a84f5-69eb-4a53-8edf-c117135cf6a0", "value": "T13BA3F90EBE318F6DF798867557B39E60D68823A776B1C581F45CC9002D6034E282FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287292, "uuid": "b859638d-936d-459e-b6cb-c16ebe7c6393", "value": "3072:ZK19OsLd5KWm1ZyGmnTRweoS20efiVtcA:ZfnW+QGmnTWeoSrefiwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287292, "uuid": "91e5f834-9717-4982-9656-ab460920dcd6", "value": 103316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287292, "uuid": "70421e4a-2f12-47b2-8802-668f20501449", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287292, "uuid": "92ed4552-ac05-4518-a424-4922f95fd961", "value": "e8e8d67c87f3b803e2ecaff1bf79cfa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a73b539-ab70-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676273429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273429, "uuid": "11d8bc14-ed3f-4204-bc5d-3676fdcb41e9", "comment": "Malware payload", "value": "db21ed7d19149a615d7432aca9c8f6ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273429, "uuid": "e79f8853-60ec-4f98-8ddf-c6ec12b869c1", "comment": "Malware payload", "value": "08f8ae7f25949a742c7896cb76e37fb88c6a7a32398693ec6c2b3d9b488114be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273429, "uuid": "b7f20ba6-728f-46bc-b9a8-565dce9d6299", "comment": "Malware payload", "value": "4137739d48996b0d9efd7bfbb5db50219ac4aeb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273429, "uuid": "ce1ede05-9bdd-4f0a-9d0f-d5435987cf84", "comment": "Malware payload", "value": "bb7c6faf8ebbe8a37ac3bdf2ef2d92a619acd27b27382e8546819ed385d169ffa618f9f2be18a69e26ae68adbcc23b6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273429, "uuid": "27947069-354f-444b-912b-04d0276f00a5", "value": "T1B0C5E012FBC2C573E59305745166AB7F893ABA205738C5E393E00D6E9C312D2A63F3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273429, "uuid": "bafa791b-6c23-4d01-a4fc-1fa5abe6c6cb", "value": "48a78037b4f23e1c89d5cf9d56d095b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273429, "uuid": "0fe2a06c-83c1-4ff4-80db-ed5d88f876cd", "value": "49152:s8qq+8I1QqOcsVfuJFfMmqtP1QHPwy+JOf+ZXJo2iHgqS:s8qHH4yF0mqc5f+ZWHgqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676273429, "uuid": "c1ffd7e9-ac4f-415c-8e8e-c79f1af5a4cb", "value": 2691724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676273429, "uuid": "64c2e01d-670d-4934-ac16-754e583b5a6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273429, "uuid": "4313ecd4-36c0-48a8-a6a1-529f8c1d236b", "value": "08f8ae7f25949a742c7896cb76e37fb88c6a7a32398693ec6c2b3d9b488114be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d11b92-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676272002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272002, "uuid": "c5aa1825-fb71-4cf5-904f-addeb94320cb", "comment": "Malware payload (AsyncRAT)", "value": "3f20052fe3f194d1de2f74b3dd7f220a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272002, "uuid": "e403f34e-228e-426d-b491-f3b4045f437f", "comment": "Malware payload (AsyncRAT)", "value": "097f3eff1c7812f0b5cb7ade2f9bb791bb39785c4db62afba2323a64cb6c0f90", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272002, "uuid": "b8d188cb-1120-4081-9ea7-670fd8688404", "comment": "Malware payload (AsyncRAT)", "value": "ec66925b5bbbde6d9665fd5055fa898d3e632871", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272002, "uuid": "70833fd6-1ae4-4873-9d5b-7d01bec5b091", "comment": "Malware payload (AsyncRAT)", "value": "39f2e60266681ca558f13979dc329432163355eca71822c0062ca29bd94a4783525b2db53f1ebdb647ed16244c989e95", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272002, "uuid": "798d9d8a-a206-4765-b7cc-f81f3e628205", "value": "T140333C203BF8C027E1BE8B7499E21173467EE5236276D54A1EC4678B1B13FD29A025FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272002, "uuid": "f491335f-0dd2-4c0b-a721-5fbb85f1f1c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272002, "uuid": "7e6f134e-cb7b-4d20-a1b5-82b830aafaeb", "value": "768:1uwCfTg46YbWUn8jjmo2qrnUPIt2OFPIwzjbzgX3i46wqKJNqwBDZme/:1uwCfTgp/2QH2OCw3bsXSRYxd5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272002, "uuid": "20253b2c-d8fd-4097-9a94-554028aa3c3c", "value": 50688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272002, "uuid": "e6c0821b-0c3a-4b39-820b-ffc4e9cfab2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272002, "uuid": "f9ca3ca4-254e-4c12-be98-9f0b7095f82d", "value": "097f3eff1c7812f0b5cb7ade2f9bb791bb39785c4db62afba2323a64cb6c0f90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9ae4c2-ab84-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676282104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282104, "uuid": "d5112426-992f-4f5b-bdd3-5b7f0c709a4e", "comment": "Malware payload (RecordBreaker)", "value": "3e50e32c63e2441350b89b51faf0c475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282104, "uuid": "8baa0cdb-581f-4c6e-be0a-b9af1050e68e", "comment": "Malware payload (RecordBreaker)", "value": "09e405a8d36a5ec253787a863c1c0ebb4c278bfa1e943e030a5c545546dd0f2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282104, "uuid": "c3806ba1-75d1-41fc-afe7-8f0cf1be0682", "comment": "Malware payload (RecordBreaker)", "value": "3042276a587c6baf6aea3ff2d550c76c1ecbf001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282104, "uuid": "7a6682e9-b04d-402a-a8e5-bbe19411554d", "comment": "Malware payload (RecordBreaker)", "value": "d9f328624948ec246461fc2b9e839ed9bd63d0f2b314166623d4465fb7c6ce7cfda5102782f70f8da4ea3e5936b18c33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282104, "uuid": "bc708aba-af3c-4d17-8fcc-1a4da3e7d946", "value": "T15E14CF9372D0E472C4221630BD79C2F56A3EB8B10E79659737882B2F4FB16E09A73355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282104, "uuid": "a3b1d9ce-d5ba-4380-89a7-26b2c7755390", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282104, "uuid": "74119e1a-302a-4aec-a552-025c40d54c3c", "value": "3072:/rkqpKMSjTKIsS3fr6wMyuR/nw1+GcOqqd/2kOcr7U13DyFvto39t:/rFp+K3S3fr6wMy+nvYix8U1IFst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282104, "uuid": "cba53ef4-6467-4d37-a36b-6f0595615772", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282104, "uuid": "75d834ed-c30a-4f5c-bd7d-b7efe63022cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282104, "uuid": "c5996f7f-2efa-405e-bcdd-8b8f3c74e6bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87503e6e-ab8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676285127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285127, "uuid": "a08fcdec-207e-4aeb-9cf8-929e4e0e789d", "comment": "Malware payload (Amadey)", "value": "49d2bc124178549773ee55f28a0fb5ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285127, "uuid": "ef942e94-e69f-4857-abb5-0fb32f13f7a8", "comment": "Malware payload (Amadey)", "value": "0a8ee82ded85d7e71edcf64cfc0fc5cf6896d7025d4116946e65566ca62b0624", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285127, "uuid": "49069e40-bbda-4b83-bdf3-0fb569d1f8d6", "comment": "Malware payload (Amadey)", "value": "ce0176936781fb73cda4a5455a2d0f25522a140f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285127, "uuid": "f03799ec-55b3-4c92-bf82-5a1bedecd12f", "comment": "Malware payload (Amadey)", "value": "20498a03266ba72924647c853f807e3591a1bbf70e6149cd6e4e9ff0e6a1df6736e63091d805a88d7aafb5eee59ccd3d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285127, "uuid": "4fbbede0-5b26-4df3-a730-ab51e2e93305", "value": "T15F86236B22580509E5EBD87CC637BDA971F71EBB8C81EC34B5DDB5CA23725A0D203942", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285127, "uuid": "4176a682-af48-4304-b081-63ed1344b277", "value": "d5a662900536410eb605254597db5bbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285127, "uuid": "bfe96454-a656-4444-89f4-c002765bcc6f", "value": "196608:za1Kve17gZfbPZwwg+6AOXb0tW1dhVsOXkM68kTkSYMkYZj0:9W+5yvAOLyidEOXkkq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285127, "uuid": "ddd4a401-b532-424f-8a1f-10f8c85da65c", "value": 8031232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285127, "uuid": "52e27269-81e4-4387-8756-91cf9647ee13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285127, "uuid": "6fea1057-446d-4941-989b-ead813cc943f", "value": "49d2bc124178549773ee55f28a0fb5ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b03a4373-ab7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676278324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278324, "uuid": "81bc6f74-3f18-4aa8-910c-422331a1b337", "comment": "Malware payload (GuLoader)", "value": "ac4094700cbfd909ab9deaa4150930f1", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278324, "uuid": "9e97b804-1d46-464e-b0e1-85272c5307da", "comment": "Malware payload (GuLoader)", "value": "0ab1738a8ba44a78f7d7fe780e99f1e5c9bf80d61106534acc46d227ebf111cc", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278324, "uuid": "b86c3560-ede5-4dee-891f-c187165abd62", "comment": "Malware payload (GuLoader)", "value": "787ca753527a529f4786fd0ef62d5ed921c00906", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278324, "uuid": "85c0bd2e-1598-493a-a29d-0582d3343b04", "comment": "Malware payload (GuLoader)", "value": "4aa155e665b7ffb41376c89fa5a216f7bb92330f3e4bf36f16d4e399b3debe5c712ce2d5de7ab3e7528cfa29700a3106", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278324, "uuid": "9294308b-da82-45f1-9b8b-c76c07c352ac", "value": "T134C2E1D1F89F5593D0483D7DC19CEED99239B975E38040B12E4C22C29697E4A49F816B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278324, "uuid": "0df8bba5-1647-4dd8-9193-68eb016eeab2", "value": "768:lZvNEiubRe0pVh+2XsAOwYLknXufwpYlZwEa:rvrubRekk28AOpLQX8wqlZO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676278324, "uuid": "10827591-9502-4314-a42a-1e16c9650626", "value": 27948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676278324, "uuid": "ee3adaec-6e0c-44d1-aad5-d097a6220315", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278324, "uuid": "edf8fafc-b0a8-4d91-a9c0-d9de309cbd59", "value": "Payment Slip.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd7b0d1-ab82-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676281404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281404, "uuid": "e39f26fc-a38d-43a8-a948-b7716ad478d4", "comment": "Malware payload", "value": "b6ce671894725e6662e29fa7a6b1ca71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281404, "uuid": "a5d63e5b-b4dd-4765-927c-2cb849a7b2e3", "comment": "Malware payload", "value": "0aed3882e07ef8574cdbb90140442e038e11eff10df31c84025daceeaf50877a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281404, "uuid": "b7556f58-2bb3-41ed-b02c-36e5bade1795", "comment": "Malware payload", "value": "03e900c44d210cf71d2d68c0be7650f03e907ffb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281404, "uuid": "49f7a07a-3598-469c-bfe7-8f4e3366cb4d", "comment": "Malware payload", "value": "186cd296bd5e9aec66591c5c17cf91f570673118535ba4c8f62226bdaba79d517d2ee4058d449e7c54d63051df3375ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281404, "uuid": "d07f96fb-ce4b-45ac-9a2a-672634d2499e", "value": "T11C65231276C55672D07228376B365B216A7DBC305B72CDDFA3E46D1ECE220C09B327A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281404, "uuid": "6a0a3f43-c06f-418c-b096-7441aafa2238", "value": "aac51396886833dc961fcd7aab7711e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281404, "uuid": "bc33fb87-3199-48ad-a05d-abadbfed1d67", "value": "24576:5eRz2pFX1dEEAnUpLPtvUNrlhsYrGKpRe8osgJyq+fBlPMizz44BNS9nLs/NO:NPPqNDDpnayX5lPMQS9mNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281404, "uuid": "cf182ceb-6657-4178-90e0-3192faf01aca", "value": 1482268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281404, "uuid": "87121486-631d-4ea7-bb35-d93f026dfabc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281404, "uuid": "a6d3c24f-ad14-4275-9f9a-208de845b657", "value": "b6ce671894725e6662e29fa7a6b1ca71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a4d026-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676280640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280640, "uuid": "80ebb082-325a-4f83-aab8-6e9f16ca1691", "comment": "Malware payload (GuLoader)", "value": "93f483dfb538d680f44b8a15d26a9426", "object_relation": "md5", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280640, "uuid": "5e6e79e4-e546-4083-b2df-37d41f2b45e5", "comment": "Malware payload (GuLoader)", "value": "0c09174880f7ca0d0d521dfe118d5077c78270973a1437490f91b60c39095927", "object_relation": "sha256", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280640, "uuid": "7dec89fa-700f-429d-ae3e-b60c33049a2d", "comment": "Malware payload (GuLoader)", "value": "93a346dc639c3f0331b0d2395c37d67611125696", "object_relation": "sha1", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280640, "uuid": "79fc9bdc-ff52-4f9c-9560-db50c67c55a7", "comment": "Malware payload (GuLoader)", "value": "b12a39e72ea3f6a080ae1b19b754de20dfba0e170a864fc22f2666d387c3adcf78e358e64968d4c96086cb7a84d24e7f", "object_relation": "sha3-384", "Tag": [ { "name": "com", "colour": "#1D22E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280640, "uuid": "67b962d8-11fe-40eb-ba34-3087f10cfa0a", "value": "T1C774120261DFB8FBE29221710422E339637557AC1633EA137F58AA31FF623576D0AD49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280640, "uuid": "d35ab820-9ee7-4c58-81cc-e6c36e468e8f", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280640, "uuid": "8eeb5f15-712e-4e04-9abd-99f01cd069af", "value": "6144:/yIBlG9LDOYvAJmHhK7PDvMCRMTBm2jbUaEgKLC2Kd:7lGpx4JmBK7DMciBmKbGTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280640, "uuid": "a02c2219-9126-4b63-809f-53418824423e", "value": 360816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280640, "uuid": "1f6fa55a-c398-4381-8c85-011f8888145d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280640, "uuid": "fafc6250-ef78-44e2-9104-c01f4cceb19d", "value": "HSBC Payment Advice.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b929848-ab5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676264894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264894, "uuid": "b2daa4e6-c939-4a82-b1c5-7da16a49b13b", "comment": "Malware payload (Amadey)", "value": "6bdc9a428770c0d98b2b6c4f1abd9434", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264894, "uuid": "0e4d15f4-d681-49c1-b3b9-5d035c4ae591", "comment": "Malware payload (Amadey)", "value": "0c0a997e0af0e177a5ff4ba3e40c5f9d8466a01b543482dbd686053a4e01af2a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264894, "uuid": "7a51e6b4-1f7f-4b58-8142-428cfc637908", "comment": "Malware payload (Amadey)", "value": "b94a4b15f84f3a4af984c93c2266df91becf0613", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264894, "uuid": "8663bb2b-2cce-4dea-94eb-ac2bfda5b904", "comment": "Malware payload (Amadey)", "value": "d6242f9a85fc715cd440fb810c5c7f51b711656986033b5a7744985c803f01bd42e81675252179bebd12d89509a21285", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264894, "uuid": "ed349949-f6c9-4259-8777-ea5c5bd93b27", "value": "T150F41207F6FD9131E8A0277059F703C31A36BC515774829B638FAD1A18326A5B2367AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264894, "uuid": "162001f9-f60e-4caa-a023-50543cd15820", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264894, "uuid": "397e2224-577e-4216-88b3-2b840a9b869e", "value": "12288:KMrJy90jgZ852F5gfiskAtiHOYpdp+L0hDcQeJSAk+HL7eP5PpU3uyLjWqg7uv:TyOJEF5e0gkZXZo66L7eP5PO3uUWqTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676264894, "uuid": "ed7b032a-d74f-4f45-868e-2cdedadb497b", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676264894, "uuid": "7bf6627b-3a9f-4726-a19b-d12f62bcfa4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264894, "uuid": "706d51e0-f0d5-48ba-8e94-757d2a559eec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37e88788-aba8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676297449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297449, "uuid": "c7e1a34f-4c95-475b-b992-8739a0990f23", "comment": "Malware payload (Smoke Loader)", "value": "3017411d25c4e01a26bb132300855db9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297449, "uuid": "df34befc-9f35-45a7-900f-66171abd2ab7", "comment": "Malware payload (Smoke Loader)", "value": "0c5a8b9476d0dfac33e144f79e1cdcf5aeb9c54dd30d3ebdcff10f25abab3c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297449, "uuid": "a396aa29-b277-480d-a078-968efb8039de", "comment": "Malware payload (Smoke Loader)", "value": "d1e4b9dcb0c4ee076a7b7ce4ccf1bafa04862f66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297449, "uuid": "d5c39a36-2cc3-448d-abae-82c1969515ce", "comment": "Malware payload (Smoke Loader)", "value": "6aa86e16135bccae1cb8f4f0455c3e2bbbe4c2ef1e80e31b1de874f710c9aa612355b497de9fd2ab240e6c333853d533", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297449, "uuid": "13748204-6996-4c33-bf0a-6a70de39c8b7", "value": "T13714C02232D0D472D2622B314C69C2F57BBEB5B24FF86A8B37681A3E1E702D19577345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297449, "uuid": "7b11b419-8864-4e77-8b24-4a6e789b0e96", "value": "096c57a489bc9be05d307c86ed0497dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297449, "uuid": "1d2387c8-177e-4961-a8b2-44e00347da09", "value": "3072:nuBNcLDk9N3tlQoxx8QtbjQ5/PfzUunMggsDsv5BEg8xHCWPy3:nCWD63bQoxxztbUhPfz3q5G9CW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676297449, "uuid": "9cfa544b-51b7-4468-88cb-c3f7a7c57609", "value": 198144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676297449, "uuid": "2b426cf2-8cae-478b-acd6-f883fe25f417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297449, "uuid": "0c6def78-9469-4e6a-841f-f539438377d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b555b0-ab52-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676260650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260650, "uuid": "71e32922-be6a-428d-8cc3-3cdeb3daeef5", "comment": "Malware payload", "value": "b254dac1f7fe0632ed09eb5596113729", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260650, "uuid": "2102d2d9-ddac-4413-9aba-7c9405b5aefa", "comment": "Malware payload", "value": "0c909591660fd4873b69060d75972b5e950b3d2cc0bde526c0645fbde0dec36d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260650, "uuid": "ceaa0fca-2a32-4087-87bf-dd474e759cbd", "comment": "Malware payload", "value": "8a131cb7262ca89e5c245c8ba9b88b7f9450864f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260650, "uuid": "9371ea7a-c7e2-4806-bb15-af81bc7b5307", "comment": "Malware payload", "value": "ed936019165afa11b947a7c7c7503b9237cfe197afd45bf0f64517d65d6a6e286067fbef4d2ed602d7a8e3339909f65d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260650, "uuid": "77a7a969-5601-4d65-b60f-0c36de7fe9e9", "value": "T12895127B41B8721BF0766272DE7D3324E80B8015CE62D7F2F71A1E420A7B9D7A785924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260650, "uuid": "d14a1164-0491-4c53-b5b4-98135f5aa0b0", "value": "24576:eHlSGtPcGSxQRZEQVVZ4Pgi0WHiSJY4wjpkwLr/5I7o7KgFp:YlSGtEGSy9UP4WCSm42pkwnEtgFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676260650, "uuid": "dfc0bcad-8056-4259-9b62-79e09a6f4d81", "value": 1983172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676260650, "uuid": "a7c44024-64df-47a7-a2f0-c0fe63096d8a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260650, "uuid": "15b9611b-3bac-4029-a633-4caf33503e60", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0231f20d-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676300366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300366, "uuid": "120a46ea-3ee0-412b-bd2d-9bb2ef05d38e", "comment": "Malware payload (RedLineStealer)", "value": "f94cebf98be9b35b38ff0340380ebf18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300366, "uuid": "6dc303a7-0a43-4e43-bb20-add683afab8b", "comment": "Malware payload (RedLineStealer)", "value": "0cbadbd5e1a42c41bd9ef07ce6061029854b9dd4b6082e0a92e4297587c40c18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300366, "uuid": "93e6aa34-d794-4928-a56c-3e0e45522e69", "comment": "Malware payload (RedLineStealer)", "value": "762229f0f99d9456307aee1eec5bb432f9d19cef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300366, "uuid": "088e376b-1afa-48e1-8158-aa3d92ba0937", "comment": "Malware payload (RedLineStealer)", "value": "06907f4bde6e10e46e2912e1858c7e2193354cc7cdeca439eed8f1f3f9dd7d23cccfaa613cd90b9201738bb1a386d045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300366, "uuid": "21d12ee5-a94f-4d32-8f5e-677e1c5c62e5", "value": "T1C3A52313F6C288B2E1230A3A4D29AB54753C7D301F208EFB97DD6D9ED9B4591F128276", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300366, "uuid": "a4193356-a3df-444f-bf5c-4518e98b14f8", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300366, "uuid": "0be91685-6cb1-4dae-8416-def611a4f659", "value": "49152:V5OTHV4b+2hfbTk5eejuHJ7Nz0EmkHhlN3+:V50nUbTkPqHrEMlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300366, "uuid": "c432c56e-a068-4468-b945-ecdc376402bf", "value": 2150033, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300366, "uuid": "0173a860-4320-4752-a89a-274f6aa4e683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300366, "uuid": "8b8eb3f9-9ed7-432c-b14d-6ae9edfa63fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e744d01d-abd4-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1676316641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316641, "uuid": "17f635fd-c828-4d8e-9888-f6bc283e0b36", "comment": "Malware payload (ArkeiStealer)", "value": "4571fb11c79d58c069499b08fcc9fbd3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316641, "uuid": "542f3c24-7d23-4602-b0bd-a2fc854fb3dd", "comment": "Malware payload (ArkeiStealer)", "value": "0cbf2fe8af22400e10d8715dea4c550d6afb75e3096b435db76eda0815719c98", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316641, "uuid": "f7687b07-89c4-40ef-b82b-566300e7f1bf", "comment": "Malware payload (ArkeiStealer)", "value": "5ccbbf01bd8eb3617cb3820eb037458c1be0d3e8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316641, "uuid": "875b8e96-2e63-4916-92f2-ed337b941602", "comment": "Malware payload (ArkeiStealer)", "value": "ecadf1171cc4aefb03f3b80d7a744c5eb5287aba7e4a07398de2a3bb190a7d718f8e72729cd0d0d210bf8da41db7eb0d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316641, "uuid": "ee5f3c6b-47c3-4983-9a2a-f1ed76a372eb", "value": "T1EE059D75F592D072F88201BA93BE6F7758386612532694C7F3D00E996FA01D27A3E21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316641, "uuid": "b39a18cd-6120-433f-840c-6a6f01e17c04", "value": "38ea6f39f66a13952d0df81911d291fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316641, "uuid": "d85cb09c-7667-4036-86ef-d8b8f8b04e10", "value": "24576:090ArGKlAbM+7tsBdP6BumiLWG+n3MQIayV88M8Rh9Ct:FgeB3ER88hhUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316641, "uuid": "6aef1132-c116-4eb6-907b-f965e96e8f88", "value": 850944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316641, "uuid": "d28ffb75-ed10-4769-bddf-3cca83a8c43b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316641, "uuid": "db3a7144-4a7f-45ed-8db5-fa9111879667", "value": "0CBF2FE8AF22400E10D8715DEA4C550D6AFB75E3096B4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a8f15e-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1676276855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276855, "uuid": "72e24de1-944d-4842-abf2-fe95b0b7d5c7", "comment": "Malware payload (LummaStealer)", "value": "e423336a6931c0ef690935458b62d75c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276855, "uuid": "04fa5b15-5d1c-49d2-80d9-86df7f947af8", "comment": "Malware payload (LummaStealer)", "value": "0cd1c97c405a01a4f7b54760f30aab6ca71396ca7a473b27fa85320e66f319c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276855, "uuid": "b00fa118-c5fc-4fe1-965b-980b8a8de299", "comment": "Malware payload (LummaStealer)", "value": "8464c6d258f14f3002407e76359560a53e8b223b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276855, "uuid": "6bedfd90-a57e-4924-8d0b-7160b4682eed", "comment": "Malware payload (LummaStealer)", "value": "9391e6728b0dd18f40faee133812d9016fb672cb07dfb07fc2ac6e361c64d8db95c5e4851bd93b9acf141e1d093791cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276855, "uuid": "147d6e31-7de3-4213-87ac-c1bfec69a033", "value": "T1BE35BF0F75D2B433C0F21438F8E0AA7B4F3E79A10AE58B6B6B850E6D3F632519571169", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276855, "uuid": "0f362bc3-1d37-48a6-8549-a760839ca1d0", "value": "0992ce2778ae787bb96d086c5eb37d54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276855, "uuid": "0f2cd86a-3f14-4cbd-9918-3d90b61750ff", "value": "6144:Ze7RhGRRskQlJzXahRI5AOZ0Ww/GF5O+xL3q3xSL1TH8x8l3c:07RhGRRsVN555OkruxSBTH8Cls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276855, "uuid": "ba425000-d3ed-4313-b606-68e413787344", "value": 1073168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276855, "uuid": "981b224c-8d4d-47e5-80b0-2ecdd6fd9794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276855, "uuid": "f4b66d7d-0eb2-45f2-8e8a-57583f0615af", "value": "e423336a6931c0ef690935458b62d75c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9747c209-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676276994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276994, "uuid": "05962034-1aef-472e-a6df-65871ef6b6c1", "comment": "Malware payload (SnakeKeylogger)", "value": "64ddbe59c47c359bf4913efbdcf51a76", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276994, "uuid": "e731b6f2-dff5-4d5f-acea-5b6cc66d2491", "comment": "Malware payload (SnakeKeylogger)", "value": "0d4e18520bbc8001264d8c40ee65ee9fbd03b385a42feed95e040b74c04644fb", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276994, "uuid": "425edbbc-3d51-41de-a840-90afd72279e7", "comment": "Malware payload (SnakeKeylogger)", "value": "4bcf1ef7fc968c362e668a4e77c82da9dc1f6047", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276994, "uuid": "a17eaea5-2525-407c-ac16-6c3b42afc2d5", "comment": "Malware payload (SnakeKeylogger)", "value": "e602b458edef7c311dbac753c86d0d95a4090a8cb23e91dc703bb2842e67d3578cde13468b3f14e595adb2fe5da747e2", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276994, "uuid": "b3ab2a2d-83d5-46a3-91d9-261707bac096", "value": "T1C635DF07E679A937EC16C17CAC4F50828252AC39B815CA0E21C77B1FA732BB15D7EE54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276994, "uuid": "d3e918a9-d2b1-4800-a943-0e67efe89669", "value": "24576:vFejZ+zNY0jnFeyLFRuZL4KjXIzY/9mkXGmbZu:NuZuJjFZa4EeY/SmbZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276994, "uuid": "331af3ff-48e3-40b3-9f06-de607cc2257f", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276994, "uuid": "43fbfe84-0aba-4c24-93b8-a7aa9f2fa92f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276994, "uuid": "82a93bba-cb36-427f-9316-d9b5def5cece", "value": "order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882568b3-ab90-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kutaki)", "timestamp": 1676287276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287276, "uuid": "43b8227d-ea46-4766-8560-c9c71d2f9a3e", "comment": "Malware payload (Kutaki)", "value": "f34a256a2e32c10b4b5dfc2b91d7fe9b", "object_relation": "md5", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287276, "uuid": "87da7b4b-a8f0-4367-9bb8-9b768470079a", "comment": "Malware payload (Kutaki)", "value": "0de82e043e73e715a6e982e4162f932fcdbb98ac55d2c7a75b4efb98538e47a1", "object_relation": "sha256", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287276, "uuid": "08fdbd6e-8668-4908-b38f-2f0a35e1f175", "comment": "Malware payload (Kutaki)", "value": "e8092bf51f7d0af60dc49d63fff3f6de8b81fe1c", "object_relation": "sha1", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287276, "uuid": "557aff69-5ae1-4a4f-b7e4-f8cdd802196f", "comment": "Malware payload (Kutaki)", "value": "4bfb821fdfc7ebc408c5b72c7ddf17d10d8ee893a2716ef3010f87a4ac51ce2f2cdd26cdb38b8b040d5af06327078b38", "object_relation": "sha3-384", "Tag": [ { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287276, "uuid": "1a7bceba-0559-4107-91fd-744efd7407e1", "value": "T16FB533FD060B0F8545CA3038470AFCED43D757EA6B98EA894641B3F1C969622F25AD1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287276, "uuid": "91d19b9e-71e1-4a1f-9d34-eee165a65740", "value": "49152:ii5i/UeX1hqz+HKnuIZqZZFl2nONyyDi7jPwR7ypQtilzfUHmr/y6GNFG0Tm9/6H:fihqzlZkwn45sjLQtAzMHmr/y6GjTm9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287276, "uuid": "265fe68f-c9f7-4722-af9e-ead175039a8c", "value": 2420706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287276, "uuid": "5802b588-c99e-47fe-9446-894f8befd04d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287276, "uuid": "d6591bb5-4067-474e-8894-94883f0ccc94", "value": "f34a256a2e32c10b4b5dfc2b91d7fe9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7b183bb-ab83-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676281746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281746, "uuid": "039b6880-6b29-4c5e-9e99-448a5df045c4", "comment": "Malware payload (AgentTesla)", "value": "d1268d5a1ee1ee65ac69fe44f56974ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281746, "uuid": "2c42e99d-885b-48fe-962a-26efec1fb359", "comment": "Malware payload (AgentTesla)", "value": "0debe6b083294c2308e8262670203e2c729d71cd2eb5a3927ded4827a2f2ae22", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281746, "uuid": "507aaee3-0b9d-4ace-a5f3-522fc7201014", "comment": "Malware payload (AgentTesla)", "value": "d8d5619a2f68fae433d6d1c1e9dcc4d83c733b4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281746, "uuid": "009d32ee-c53d-4dfa-9310-1e1b1fe96119", "comment": "Malware payload (AgentTesla)", "value": "1ef462dfe87b92ae44f9d8e463c2ee9a1511ac0c2de8fcf4b57ce9855f5b666a760725cf3bc4dc596f09a6a475dd8153", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281746, "uuid": "333e4230-2343-45df-b4cf-1ee6eea5ece9", "value": "T1069423B9F229B75C2CA2045BD8504E18C633989077FE7190B4B17BF24F3A6A65CD1673", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281746, "uuid": "99fa7070-695d-446b-abcd-049f1b0f6f0f", "value": "12288:ESuCxpZrvovxOTMybLeHTu10wBz5szar5:ESuQTQ9o2fa5sg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281746, "uuid": "99584d23-6a5e-40e6-beb1-009f25dc1456", "value": 441375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281746, "uuid": "81a01854-1b72-4560-b911-b4f2d6f63aef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281746, "uuid": "6e60ca69-1341-4688-bb03-d499282a718f", "value": "Shipping document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275a4463-ab75-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676275517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275517, "uuid": "33beacbf-d049-4982-accf-1fa2aaf91f3a", "comment": "Malware payload (AveMariaRAT)", "value": "84c98705cd7b1b4122f24d928bdc8c3d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275517, "uuid": "ed8fb606-f2ff-4f8a-8bcc-7addfcd66112", "comment": "Malware payload (AveMariaRAT)", "value": "0e8dfe39684cc71e9d3ab6dea8482a8dd11c313360f023ec7e4fec879cb1d50c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275517, "uuid": "610681dd-9701-4359-a568-c137a10604ae", "comment": "Malware payload (AveMariaRAT)", "value": "562aaa738303a7d184e233dc34efc2698ea33dd7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275517, "uuid": "3697b699-93d5-4ed2-ae5a-10fd840a1fa1", "comment": "Malware payload (AveMariaRAT)", "value": "b9e8e9560b0c9da0ff50a8c3c08ae05ab7dc32de565419b9fcc3d6f6abd2decdc1c6e279db86822117a0ac0d314f13ce", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275517, "uuid": "327cf7f4-97ba-4ac3-a9ba-ba5d241f7206", "value": "T185F4DF50E95D9C89E3EDC2B7B836470003BABADBA1F5E21E0A55379056B77C32077D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275517, "uuid": "d6280748-0c02-4de6-bd04-0e57ea1f70bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275517, "uuid": "c2750cb4-8b91-4b60-8e70-9ec1b4263162", "value": "12288:ZZtkXZbxgLDalPR1U35FaLlVcf2WU1Qj9pEcBQMxlQlQXmu:ygYPR1UpFSluur1ODEcBQaQlQXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275517, "uuid": "ba957d44-011a-48c6-9e94-07c21244a013", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275517, "uuid": "0a27430d-3ab6-4abf-857d-73d1b06eb2a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275517, "uuid": "a8b343c7-17c3-41f6-9137-7ab95d385565", "value": "84c98705cd7b1b4122f24d928bdc8c3d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2158fc79-abd4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676316309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316309, "uuid": "b6b3fa1e-d547-4bfa-b734-f6b0d02bb66b", "comment": "Malware payload", "value": "b0e50123ba50bf69c5aaa319b9804210", "object_relation": "md5", "Tag": [ { "name": "89-32-41-231", "colour": "#F84F73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316309, "uuid": "ee6c7a99-b746-4c27-a7f3-527ffd28a661", "comment": "Malware payload", "value": "0e9897fd86ef718d4ff9e73768ce3e660743a5485a7d9c216b7eebc8d908f221", "object_relation": "sha256", "Tag": [ { "name": "89-32-41-231", "colour": "#F84F73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316309, "uuid": "2a4082a1-5072-459a-ab50-a0493723cf27", "comment": "Malware payload", "value": "9d54fe69de74f3ac3d4f185dd2d228c4f8d37332", "object_relation": "sha1", "Tag": [ { "name": "89-32-41-231", "colour": "#F84F73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316309, "uuid": "2e669994-d4f0-47b0-8329-42bfffe9f213", "comment": "Malware payload", "value": "c200839f3c23eae1b9dc6b233b7ff75bcf415be7388f6e1f5c52c198b4740ce0dcd834e42acf743d647d8b9d84270dd8", "object_relation": "sha3-384", "Tag": [ { "name": "89-32-41-231", "colour": "#F84F73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316309, "uuid": "62ace75e-f3ce-4068-b3e5-e0456e363d3f", "value": "T1ABC623C11FDA82E8C0EA6B3069C7436BB4A173DEC0FD8A5F35C24C1A7691E565D4B1E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316309, "uuid": "d652eb13-5e52-479d-b020-977bf187f728", "value": "fd87f79fc1bdaef4e66bba3ab9909015", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316309, "uuid": "a4abf0a4-b703-4e84-a830-5c721a623f3c", "value": "196608:uQdYPJJTZbT3iRiTk6DNvk8FD2ijYvCfqjdZ55zVqKntCSjlE9KfWa2NYRuwE5K5:b4Jd5SMYWN/jUCfOrjbjXYNm3sKJqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316309, "uuid": "4acf5105-8e54-4ed2-8235-cbe466c883be", "value": 12364800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316309, "uuid": "cb30bb35-e08c-4e38-b660-e2065bf7207e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316309, "uuid": "667bff84-78df-4020-bc21-7686e08b8fde", "value": "l2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba632880-ab89-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676284354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284354, "uuid": "e5158009-2e59-4be8-8d64-eb28f1d62406", "comment": "Malware payload (Loki)", "value": "84f8c0e114eaedf255b41eb10d7b58c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284354, "uuid": "fe416b6c-2f96-49c8-a268-0d731b0243d0", "comment": "Malware payload (Loki)", "value": "0f6c781c2dc7f41c7535faf42d7b4913854652642f3d21edc3af781c57ee677f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284354, "uuid": "0e188755-a0dd-4512-b79e-a34ff0a9f4e6", "comment": "Malware payload (Loki)", "value": "5ae739bdf4c47373f85d8c6bc3bd4b074f2ab5cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284354, "uuid": "e07eae9c-475b-4c8a-9f7b-000c1995b2e1", "comment": "Malware payload (Loki)", "value": "0fe364f8177e60bc79213dd13f9c1849e57e14eece451017493db9184899e4bbc911e9018cf093c518b2ad662732e25c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284354, "uuid": "7286a01d-78be-498d-bde3-6e43e0a523a0", "value": "T1B724125599E1C157F8A182B21975879AEFF8F92218A8131B13D02F89FC71783EE1F361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284354, "uuid": "a4f76222-bf51-4223-87c6-17376db87581", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284354, "uuid": "7aa06d2e-8eb7-4942-9780-6293921ff7b8", "value": "6144:/Ya6ah2Lk3XtKP9Y8L6ouNlMPp9w9bl+8PCLjn/o2:/Yc4LYtKPhhyMQ9b1PgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284354, "uuid": "4ada2bec-63fe-4254-9ab1-cc36519bc399", "value": 219200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284354, "uuid": "c7f06555-7025-4dc4-882e-ea90c214268a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284354, "uuid": "07532d26-b37b-4793-816f-45791099d374", "value": "84f8c0e114eaedf255b41eb10d7b58c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273786bd-ab42-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676253613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253613, "uuid": "1ccbd7de-b402-4068-bcd0-944fd1297f08", "comment": "Malware payload (RedLineStealer)", "value": "5907ed5f7b58b56b1e62885dcba37bce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253613, "uuid": "2a8371c5-0fd2-484a-8c70-676bac00ee44", "comment": "Malware payload (RedLineStealer)", "value": "107b5a4747c308d150b033f50ea771bcbb4ab60581639bd0f959f89b26bb22c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253613, "uuid": "8f95ca1b-0163-4261-95d5-d42671b9092d", "comment": "Malware payload (RedLineStealer)", "value": "9ca71f284ba12f02b34b378ce470e8d35d75336e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253613, "uuid": "17bf2487-5af8-4737-bc78-13d3fcbb3b74", "comment": "Malware payload (RedLineStealer)", "value": "b8278b2c08858e53ede6fdac600b9226ab55d6bbf44d8c0670beb492267264aa764041387b6a029a8af31789be210b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253613, "uuid": "3aa81c51-a9b1-4258-a781-2cad087c5e2e", "value": "T197F4120BE7ED4422E8B597700CF603D32A767C925B3882AA53CF6C5818B25B1767177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253613, "uuid": "bf7aff23-5b97-4f7b-9791-4af38bd13f55", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253613, "uuid": "e2d0c435-5d03-4148-a1c0-5494030f6aab", "value": "12288:WMrxy90Wiy5LepkVHt96J5tTOvISFTguOePA+4veJXXLlmzaeCyObomD:HyFLvVD6JriBuwA+NXXIzaFy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676253613, "uuid": "f4ddb2c8-8b6e-45be-9af4-0ea7ae208ee5", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676253613, "uuid": "5fab12cf-57de-4d8c-beea-03f0d6b4b780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253613, "uuid": "2672be51-1bbe-43c0-a60d-b707742ddd40", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae7b71d-abba-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676305105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305105, "uuid": "096e641a-6169-43ac-b5fd-df1cd7131c62", "comment": "Malware payload (Smoke Loader)", "value": "b679d4cdd229183401e1a6c7c762910a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305105, "uuid": "68a4cfe0-f17e-412b-9530-c79d1236b5db", "comment": "Malware payload (Smoke Loader)", "value": "108dcb5352069fc25fabee42da10f632b08a15194f6ef74328412d6f473526ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305105, "uuid": "93127230-dca8-4d51-9883-e29fc3badcb5", "comment": "Malware payload (Smoke Loader)", "value": "abc9868beddb23ac82005f5eabdb60cc312d5fa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305105, "uuid": "cabdd8b8-1ef1-4de8-a52c-ad0cfbc8be7a", "comment": "Malware payload (Smoke Loader)", "value": "28763338150ef29c060e93dac79fad74d396c60e3172c2e2f837d56eea1ceeaaa86930dbdfc71e98318b8bc09bbde159", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305105, "uuid": "f398cc63-5f2d-41e7-a8c3-8f9bc4210c7b", "value": "T12714CE233290E4B1DD7316315D79C6E52A7EF8B14E749A8B37582B3F0EB02D1A672352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305105, "uuid": "1c0d7875-b94f-40d9-abb0-043406c0d9dc", "value": "a915562f5b4dfee9fa3c29b2972ad3d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305105, "uuid": "8c19d499-94b9-4126-ab26-722a15d4b1f4", "value": "3072:b/9TYuRaLglcL0iFa1BYVYP4VJtaqJTnOwWSjWXP3+LfJ:b/5Yq6QcL0ka1CoqjWSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305105, "uuid": "e2d1bd90-a731-4ed6-b07d-40627a6c457a", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305105, "uuid": "38717b59-24b1-4c7a-b8c9-190034401ce5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305105, "uuid": "ebda3c0a-4344-4976-8cb8-f20e54e4416f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4330ac-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272059, "uuid": "6b64a013-b0e3-4000-bb86-78c4db53c3ef", "comment": "Malware payload (AgentTesla)", "value": "568537a64f32ba3340f8a9c89e671a0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272059, "uuid": "5858304c-67b8-4e4e-b8e5-2267e8b623bf", "comment": "Malware payload (AgentTesla)", "value": "109ab22facc3a3a85fdddd60a7a4e921afc18b1f0a4c9d9990f24411a56f4bc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272059, "uuid": "8eb9aad4-6d9f-4d33-87f5-b33c1da0e601", "comment": "Malware payload (AgentTesla)", "value": "f2d5313b830eb9894bc3680b32fd926af15303f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272059, "uuid": "9ab6690f-f4fc-446a-bf50-ac25bc6a4fe4", "comment": "Malware payload (AgentTesla)", "value": "2e1e33cab14a18e3d00c24bf8d192577f6f08a135852e20c5c93b50be16d4082d972962b2e8f406d68fd505b901ead70", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272059, "uuid": "e8fd19f0-53dd-4113-b6db-d11c1ff845a4", "value": "T11815C03033BB5248D86A5BB10D7A91D527B73A2B7F00CB5D688A164CDE227634B11BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272059, "uuid": "3bf54ae3-625a-4398-992d-e6f6fb060e15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272059, "uuid": "1a88c4e1-5e43-430e-9bd4-37ac6379f7ad", "value": "24576:liNKQPSDLYIZ8292uMn2enlYVZireueD:wVcuJ6Yeue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272059, "uuid": "2405a547-2196-4048-8e92-03ad655a0103", "value": 887808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272059, "uuid": "1b03317f-0820-4fb4-aad2-abd07d402fad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272059, "uuid": "58193662-7402-4262-b89d-fe871c739fdb", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151eed1c-abd8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676318007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318007, "uuid": "3320dbca-1aff-4606-ac88-3de0b11e4e66", "comment": "Malware payload", "value": "fb65ce233269549a7dafbe59d6d8de13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318007, "uuid": "d8cc3550-c2bf-4c12-9dd4-e5ba2b01eaf0", "comment": "Malware payload", "value": "109b0127ac68e3272df2096e593f6cfec58babfa085d444c6e9e116d4526d9e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318007, "uuid": "ba676424-9b5e-4e5f-95b0-7f112d40c451", "comment": "Malware payload", "value": "a216929d4984c7613356284e1a84d1277a3daaf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318007, "uuid": "418ddf76-e312-43e9-9e31-def23ffe1cad", "comment": "Malware payload", "value": "076a6203325467dbdbeabf2b4619a1a1c4e57d15594abd558071ed14ab2602746a20d2e14d8b704d74ed3dc501da6678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318007, "uuid": "23f4ed66-8c50-42be-a175-4f0154cfa5a7", "value": "T1CFF41207A6ECA072D8F16771ADF603C319327E52863486DB27CE6D056C726B1A23537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318007, "uuid": "893738bc-d379-4b52-b4c3-1620edcf7b5e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318007, "uuid": "3440b1e5-4b40-442c-bc14-e9c283a5e5f5", "value": "12288:lMrXy90l42zIJVUD2wNbYzZbLNsWkyeJEvIIWiInzUfW0EvYI8:SyX2zkVi2wNqZbOW+UIfVzaEvJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676318007, "uuid": "1b222681-c02c-4d5c-aa9f-2d896cf44748", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676318007, "uuid": "82240143-6528-45c7-8fae-f886d90c2b25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318007, "uuid": "1831b8f0-e87d-41d0-b736-fe0de3416f7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f1aff8-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676272003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272003, "uuid": "b72ebe9f-3c00-44e6-8133-195e3f2bd542", "comment": "Malware payload (RemcosRAT)", "value": "5a62d41c251715b9cf665e9d8a15387e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272003, "uuid": "bc699d35-fcf8-468a-a2c2-4f4927023db6", "comment": "Malware payload (RemcosRAT)", "value": "10e7d385a77db70e2905f90926006e74f0a0d5b4cd205d761056d84f70276daa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272003, "uuid": "1de4ab56-7c44-424d-b547-e3ffdc9a7a2a", "comment": "Malware payload (RemcosRAT)", "value": "aa6e8a58ac01bdaec78b5e5c721f5406ae2b24dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272003, "uuid": "a49993b1-8872-43b3-b92d-1bc4e80d66b1", "comment": "Malware payload (RemcosRAT)", "value": "f48701eee36274735fc7a2e89a4ac5e1a904289ffced0e3fd8ea562219509ffffa3c8747c791b6d0db2f0dc91efca903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272003, "uuid": "0d2cc118-301e-4bd6-9191-4e631ce9a311", "value": "T1DB25233D35B89A2EF2ED47B969F0420697F7B146B152FB1C0B4438D02AF6BC141179A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272003, "uuid": "4e7b84d0-a7b5-469f-8d8e-2ffedbed9d69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272003, "uuid": "ebc678fe-1359-40be-a95e-200b3ec0c683", "value": "24576:JlFzV0YQTxx9ElT1G8re1CvCxSiiEGQlQX:Jlv0YAxxqtr1ISKbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272003, "uuid": "43a87c7f-88c6-4545-b78a-84c604b33f1a", "value": 1014784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272003, "uuid": "f355672e-d19c-43d8-a652-8ef6aec4a9c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272003, "uuid": "84784f28-c4c9-4c9c-bb95-119f917f1c48", "value": "10e7d385a77db70e2905f90926006e74f0a0d5b4cd205d761056d84f70276daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "269c9112-abd9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676318466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318466, "uuid": "8f9d6139-cea8-4af3-93c0-bd3fa1a8c332", "comment": "Malware payload", "value": "25703479ea3340fb8c5d050d12dd97e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318466, "uuid": "3a0eb8e4-b8e4-4a54-a203-a741ca2e65a4", "comment": "Malware payload", "value": "1175c4379fec68d79d5f592c12fa7560722062bf4b66979c70cbb3cbec6c1beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318466, "uuid": "0a5a925a-62da-48e3-8afb-79003281fe47", "comment": "Malware payload", "value": "f42857a098a75e60e738e544d6be268f346d1b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318466, "uuid": "14cf4963-0ffc-4cd4-8532-d908c4df7d82", "comment": "Malware payload", "value": "8a2ef5935d4ae3d5e542c75461cc08f92cc268d64e17bea67a1efced5e961dd4f8c5da973e5d323b2a94b280095d2fce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318466, "uuid": "7cbdaf07-8578-4b65-a42a-a65606fc76ea", "value": "T13204CF2332D0E472D56216318D69C6A17A7EFC224E78968B73D45BBF0EF02D186763D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318466, "uuid": "3af69380-3188-4561-8bc5-e7585ee4edc8", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318466, "uuid": "103d46fa-171c-4c76-86e4-018857bfcfb5", "value": "3072:eoEB6bTCj8W2WEzT4HEPnhJUx+vnltIFOXWZjiNZwrpKle:e/B4y2WEJP8x+vnliFZbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676318466, "uuid": "0fd51a39-0ef1-40ee-9c7a-71864af2531c", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676318466, "uuid": "1204f01d-fe20-4d6b-b003-67726eed95b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318466, "uuid": "e73bc54d-0a9d-4fb5-82d6-ea1dceaba5d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810bab28-abcb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676312605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312605, "uuid": "6c81a086-01c1-461e-a19e-f07e6c75d136", "comment": "Malware payload (Amadey)", "value": "15098a78a512852c4d28234e2edd8213", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312605, "uuid": "e1809eee-2a43-4429-ab23-eba2adda18b8", "comment": "Malware payload (Amadey)", "value": "118c758f9477a8e74ae9e75b116524cf82377f1fc4400ec3058efaf11dfaaf50", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312605, "uuid": "09b1eca2-4407-4533-89ea-830c516bd0a2", "comment": "Malware payload (Amadey)", "value": "b348e62293b241a792ad15978d104a478a4a6204", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312605, "uuid": "f33bb62e-6226-45dc-9f6f-07548a99a55b", "comment": "Malware payload (Amadey)", "value": "2a44c305ca5a2f5ddf8165dfad63d4671d063abae98d9d9d11c7a34a4e2e1170e619a2501434fa7176248fbc707a6022", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312605, "uuid": "da6f1099-8ab2-4534-9f2a-f176ed867fba", "value": "T119F4121BF6EC9432D8B5677018F603D31A357D605A34C29B238FAD6A0C72A75E23572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312605, "uuid": "7fb366e6-c313-49d6-9488-a2d956b3e518", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312605, "uuid": "17b5e3b7-0119-4a6d-b06c-58d798c0369e", "value": "12288:GMrKy90v1D+s0ufuW0ZKUsUCe1i0UN9wHhXcJxaPGZJeJw+nC8C4lWlhMLYdiOI:0ys1D50o0ZsUCO2NGKJkPG808CILYd3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676312605, "uuid": "da4454ef-63c5-4986-a72a-372385c627e8", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676312605, "uuid": "6db32c80-4149-4568-bc57-d07a2e0ffbd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312605, "uuid": "5a0e3f8b-e581-4908-ac10-61aba5541eb7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47ce9231-ab8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676285450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285450, "uuid": "c9af980e-d446-4a4c-b145-b7d65dfce707", "comment": "Malware payload (RedLineStealer)", "value": "3e3e56af4687d6ff7499586d66fc1782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285450, "uuid": "0ee0c3c9-0d80-4356-b5c4-d4cc4a1c2466", "comment": "Malware payload (RedLineStealer)", "value": "11ad94041896b6baa302c396cef30f236db9018478b4475f6572f82a3dc1e150", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285450, "uuid": "af893c50-0914-4c2d-aa9a-342130e6aecd", "comment": "Malware payload (RedLineStealer)", "value": "cd221abf98ef2f8421644808d09096c85cff7999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285450, "uuid": "e111d54c-d11e-4e16-a28c-7bfc3f6edcc8", "comment": "Malware payload (RedLineStealer)", "value": "f96b1998703fd6245a49913c0d6445e564003816a8d283f3032f5c17d3dd908490c7b4abbb1bfa16ad4d7de465547691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285450, "uuid": "8b6b1261-bf46-450f-bb2a-077a534fba1c", "value": "T1E1F4124BBBF95532E9B177B058F306C31A367E615B30528B160E5C5E0CB2AB16231BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285450, "uuid": "ed2758a1-6f00-4b3f-8b93-3b3ac0805a74", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285450, "uuid": "7c4de59b-406a-4be1-8bbd-df14b75827cf", "value": "12288:lMr7y906ADgWBMf0WFTFIetWIteJgvRkO+8pCaUgHQY8:6yKDg9jN0xgJ5+8pFtHQ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285450, "uuid": "cd20e8dd-9b03-47bf-a9df-b6da7ec000fc", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285450, "uuid": "d3c29997-2dae-4b23-957a-2ff312d3fbc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285450, "uuid": "0284c69c-3255-413b-91a6-d21660fb947c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edbf4fc-abe8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676325083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676325083, "uuid": "60679297-f18c-46bd-b2cc-aff319463740", "comment": "Malware payload", "value": "95a95d033125cd09f97a421781b718dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676325083, "uuid": "0f341adc-3dca-4f4a-aebf-93c663595391", "comment": "Malware payload", "value": "1226d86e485f17e81b8b51c19f2c74a6b59643a6e453adc706a5fe640f12b8ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676325083, "uuid": "0379e356-637b-4c1d-90a0-45d3b8bb2e0b", "comment": "Malware payload", "value": "da76263b5cfbb4e40483fd7e745313f00cc764c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676325083, "uuid": "97147bfb-0cd1-4db1-8236-48669503c588", "comment": "Malware payload", "value": "a5986796f0b8d793ca8e8d9671e9e3397d3f6d799c38cb1e97df1b43a4e0e84887a0082cfcb970124af79aaad53326c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676325083, "uuid": "a6d29e36-091a-4535-90cb-0c6f1f1c6fe6", "value": "T1AFF41207E6EC8432E8B56B7128F703C716307F606B3482AA73DE6D6A1D725B0A57135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676325083, "uuid": "47f52d9d-cc93-4dbd-8915-95ab0a87eea4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676325083, "uuid": "2de45992-1de7-4abd-a1d5-be9b52986eda", "value": "12288:bMrGy90J9u0f2Jhnf7hxIFgio62+AT5Nnwi9W6eJaPbVvJApghxV374zgZhy:By6kddx9i92HTHp9q2thL49", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676325083, "uuid": "efb41dfe-01d8-421e-92a9-742845e34815", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676325083, "uuid": "182491a8-3297-4f09-868a-19e89b7646ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676325083, "uuid": "9d9295bf-2628-43b3-bb35-f39eecf4032c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e24122-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676280399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280399, "uuid": "0796b899-e930-4855-aebc-4a79d1ff4fe9", "comment": "Malware payload (Smoke Loader)", "value": "0dba9bd4231f6807570d59c5f627eda3", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280399, "uuid": "2e4351d7-dfe1-4484-bfc6-b3f8e9eeb73d", "comment": "Malware payload (Smoke Loader)", "value": "12944f865ae794adb12d08c5593f853fe21a05ede595b71d793f3a67d73e759e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280399, "uuid": "72ebc1e4-3fc4-43da-bc33-3b848e030f31", "comment": "Malware payload (Smoke Loader)", "value": "384b87aa3a47b0363375280223c2688567c4ec96", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280399, "uuid": "e81cbd1b-f889-470b-8617-6efc7e293e6a", "comment": "Malware payload (Smoke Loader)", "value": "1e6135bbf042296ca17d19c35c8bb4542a9a95db79fee8430c609c43ac148505e1dd3970794ebedb46b1af52239bf8e0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280399, "uuid": "091eb277-ddda-479d-b0a9-3fa11484a619", "value": "T18D35E107F172ED2BDE22C57CE84F24428213AC39A955C64D21C2732E6B36BF0597EE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280399, "uuid": "d5d06fc9-75d6-443a-939d-eb700a409b64", "value": "24576:mzZFexvZ59NVfFeJx5wBHGkcPrBIdoz4GBbQlNfu:mPMZ39U5YGnydoMBlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280399, "uuid": "fabd878c-e9a3-42f0-955b-0125f51447e5", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280399, "uuid": "6ce7cc01-f3f6-40b2-abcc-f4f4eeefce91", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280399, "uuid": "d62c2444-5c96-44ed-9039-2a90fac71f1b", "value": "RFQ# RE-485.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13fff27-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676299827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299827, "uuid": "0530f1ff-6c13-44dd-9deb-8fd77d4a3608", "comment": "Malware payload", "value": "13edd903cb382434a64e08888818162e", "object_relation": "md5", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299827, "uuid": "b96c64e1-6323-498a-8a0a-60f42e38241e", "comment": "Malware payload", "value": "12967c80237e6d4eb19643cb8e365735e4ae6277f2457ea4e204a767d77704b5", "object_relation": "sha256", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299827, "uuid": "7d6b6705-737d-40b8-9e84-46f22dfef5a2", "comment": "Malware payload", "value": "ffd40637266e85effc83a392cb0e3826e9df1e34", "object_relation": "sha1", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299827, "uuid": "e5394271-d47c-4365-af06-5f73158c0918", "comment": "Malware payload", "value": "4f72c1950b838144e5766eb252360ef456ad764470863a699027a80652741ab2303a54c42801e1d44bd789635529d159", "object_relation": "sha3-384", "Tag": [ { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299827, "uuid": "5f7e93bb-3ab1-4588-a262-cbd448520352", "value": "T1E7F35D162EF1056BD33A873AABF28D52E231AA71B7558B2F56C3055C0C76700DA61F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299827, "uuid": "c494d122-8b4a-4d12-9e42-a3364fcc4aed", "value": "1536:Aalrx8RL86fZ1i7oGSB3u3QBhEFy/1Kp///Bgf0XAnEwwZIyFzTexE9PlY44P9xv:AyWRHGohBeQYy1URyVy+xQCxFJl8DMmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299827, "uuid": "c0d01baf-1f98-45dc-9ec3-23fa556e8118", "value": 171225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299827, "uuid": "4c1aa111-0851-458f-86e7-132d44f4a865", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299827, "uuid": "fa63a860-572a-4986-8db3-ac0c19ce68d8", "value": "Document_2271_Feb-08.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda9abb4-ab41-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676253543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253543, "uuid": "fad63174-65cc-4919-a368-86bb92099410", "comment": "Malware payload", "value": "23d1c3635e363bd960e8ed0c62049113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253543, "uuid": "60794dca-afec-4d30-9988-59c3975bc69a", "comment": "Malware payload", "value": "12b71b648d7b07fcd01b954e2615e21548e7c818effa5748dfa20fbba08d2ef2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253543, "uuid": "a2d6f2fd-4682-4834-8450-e738db2deab2", "comment": "Malware payload", "value": "93d6443602c8c171d3989a40d1717f847a32bbc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253543, "uuid": "779ed441-40d6-4c6e-a63a-bedc178d35a5", "comment": "Malware payload", "value": "b98f857b924e3d60d07913c9c17d8342314150fe8cc4388c823bc80b9d56d16d6129ca4c57121fc610e9d0140cfbae7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253543, "uuid": "fa7e8205-f1cf-48d8-bcef-fc78728e0d8a", "value": "T13CA59F22B64294B7C53302315A0D733DA1BEA6714B3D55C767884E2D6E706D3EE3CAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253543, "uuid": "f5fa9ee4-9fe6-41f4-83ee-b9e99478916b", "value": "ce251bd6aa88e16b6c4689a8bd5867bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253543, "uuid": "25bdc170-772f-4710-add4-50d09ba8f0ce", "value": "49152:vaHUyO0N2Z1uUJk2/npCyUhCRZtBMHtSTuA7RtXuTwq:gfO0NkuUJk0wphCyHtSTuA7RtXcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676253543, "uuid": "c72e9881-37a6-45f2-99a2-7604e670c65b", "value": 2125584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676253543, "uuid": "3445b027-0f75-4acf-823c-98c2fae1c67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253543, "uuid": "f4c8116b-fd23-4833-9f43-5f7177420ed2", "value": "Server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ba8823-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676301038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301038, "uuid": "02994c8e-4d9e-4c1e-bd9e-572e3ff009d0", "comment": "Malware payload (Formbook)", "value": "939efc0c0dcf3ad3d05aef7e565a7c32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301038, "uuid": "7df83a3f-0669-42d8-979a-26dc2ba36305", "comment": "Malware payload (Formbook)", "value": "12d38622f7319731f4ff01c6cd2cd7a9cf458658f6a7438e1d1d1f2a5c2edfe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301038, "uuid": "aa3b0136-2b1f-433e-be5b-9c2c651c46e2", "comment": "Malware payload (Formbook)", "value": "dd438988f553c957c7e4694ef819949d89639b10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301038, "uuid": "90a37d35-ec34-4848-8ce1-8d0149ee8e9f", "comment": "Malware payload (Formbook)", "value": "37c2d5bfc135882e7cd9af73b468b5e636d17d25c360cc0525557d8efb6059abc2ecb6cf7cfea5b8caa0503f1a4947c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301038, "uuid": "179061a0-f44a-40b9-9e86-84d5338b939c", "value": "T1060522972D0DD777C63DC3F85C1AA8A883B16DA52C32E1552DC73EDF163276240A2A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301038, "uuid": "491a5b5d-17bf-4e20-aefb-4548d0a9d4e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301038, "uuid": "b070019c-6147-410e-af08-18d32c8388aa", "value": "24576:TYXpQ57jm9D7+78w9NSZ9XuUtmj8iouMe:A+5Og78wLyxuU8vouM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301038, "uuid": "60f6db56-c5f2-4765-80a9-08ddc6c9bfca", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301038, "uuid": "47814b92-df20-4759-8f39-119e90a3cc25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301038, "uuid": "e019c7b1-ff34-4448-b305-6cf6f9914c42", "value": "939efc0c0dcf3ad3d05aef7e565a7c32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da4f34c-abb4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676302559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302559, "uuid": "7c51025c-d6e2-4829-a47c-193e8b9e222f", "comment": "Malware payload", "value": "f20dfa1d98a77583ebb383d978ab5ac5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302559, "uuid": "52d52a06-e7fb-479c-9c9b-7400d6eb30c5", "comment": "Malware payload", "value": "1321ca427568fdf315b0e1123438094ac48e538d1e569fa19dd8aa9750a7fed4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302559, "uuid": "e813183f-8554-4042-a407-90abedc42d8b", "comment": "Malware payload", "value": "4477d6764505865b3ea5dfac6f50c73e56ecf471", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302559, "uuid": "0278e706-3dc2-4a9d-a6c6-79e73a761381", "comment": "Malware payload", "value": "50c25696777622cd2bdae22ea084a8028af7de8c7d7cbfa984ebf3aaf4b3d6200c9cefb309145728cbfe1bd4b4767dd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302559, "uuid": "eaed2b44-3f60-4bc0-bee6-a66f5a37b413", "value": "T1B362D046FB59496BFC33A1B968B017763A5939C898809584D97425FFE80301D7572F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302559, "uuid": "3c325540-c07d-42ed-a1b5-ac6faa2927e7", "value": "384:ZB+DMT/u74vEoTaaQkI713fs0LKBR4MoBXtfm/B:ZtaQTaH713lKeMM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676302559, "uuid": "81281d18-9920-4bf8-9e0c-7a8ad90f53f3", "value": 15840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676302559, "uuid": "83997e72-9835-49c6-84d6-1e60417502b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302559, "uuid": "6bec87d3-cf93-4951-92e6-1c2c223e4b0e", "value": "SecuriteInfo.com.ELF.GenericKD.3721.tr.29007.6248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32868fc-abdc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676320017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320017, "uuid": "64f7bd95-3160-485e-84e8-8076f552cc1a", "comment": "Malware payload", "value": "5f89ca58256b2048f7daae0c3092314d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320017, "uuid": "c24e103a-75d7-4cd6-81ba-64b7627f602c", "comment": "Malware payload", "value": "140541f5cc5881cc1cc3af4b4243e148924d52313cfc218d3b6d12f5ba25d67f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320017, "uuid": "f7ef42b4-eb33-4218-916b-85a30d52e948", "comment": "Malware payload", "value": "68b21e5277151421f37bbc15aec058defd1aa6a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320017, "uuid": "d245668b-b069-4dcd-83cb-7a61e509064a", "comment": "Malware payload", "value": "9a56d4e39d0f1188a3c5cf71fae0e964e2efb51f9984be7b3778a888f8b81658b6c857f9d42d581d0b7ba6cadbbb7a41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320017, "uuid": "0e119cd6-5afd-452b-9118-e979bb4dea52", "value": "T18CF4120BA6ECC032E5F553B12DB203D305367E502B3543AA67CE5C6D6972BA47270B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320017, "uuid": "639ccd9c-95f7-41db-be52-bc36ff9773ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320017, "uuid": "ac7a9933-e978-490b-97f2-1eb98d40e82a", "value": "12288:bMrcy907mGDsFBPHto4lYnyXnGHB6HWeJFvGQVw5VwcUxJYp:/ymeBPH0nyXnGsXFvGl5VBrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676320017, "uuid": "8fbd780e-7d2f-4162-bc31-615346a14250", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676320017, "uuid": "3273c2b9-d64a-4587-a653-b2ee779160a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320017, "uuid": "14b72b64-be73-4d76-88bd-e41e05a0f811", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0b4b9b-aba5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676296146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296146, "uuid": "fb6196e2-93e0-42b9-801d-722f588a43b1", "comment": "Malware payload (RedLineStealer)", "value": "d449e4ae7b523bcb089310b1330fc686", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296146, "uuid": "e589614b-9a72-4237-80a6-460b439ace10", "comment": "Malware payload (RedLineStealer)", "value": "1581a69b06b741536a885842ce5d31a3d53d33a70c973bdf6d17ff8156d2e9c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296146, "uuid": "effebe5c-60c0-4139-8446-2ed4ac1ee31c", "comment": "Malware payload (RedLineStealer)", "value": "9eab13daef3149fd5cc952255f7063cdac5803b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296146, "uuid": "5477638e-dceb-4e9d-a978-f13cc5c8f69f", "comment": "Malware payload (RedLineStealer)", "value": "45f2a58911318c7f4f4eb10b0141f89cfb8ccf77bca8ab567923663b7b0c0c19833d166e2dab1459418030f325a1f0db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296146, "uuid": "55b17ac3-e83e-4925-8afb-04a001b3e4ac", "value": "T17EF4120BB6ED8422E5B45BB024F617D30A367E518B3CD38B674B9D5828325F4B13672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296146, "uuid": "fc6566e1-1583-4edb-845c-07cb3377260f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296146, "uuid": "e255233f-04d3-41f6-bc87-9a3d2d51afbf", "value": "12288:BMr6y90SDReVpfVTGQE/lqsm5eJYt6f6j2EJO3W+bKlNRlJzAP2P8:nyvDm1VTStquMES2Emb+R7Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676296146, "uuid": "ccff9aae-76fb-4254-a612-1690e44cd682", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676296146, "uuid": "cc217ef5-f6c6-40f3-88e9-92d9a7689862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296146, "uuid": "fec0edb4-6693-4a72-b689-36dc74361d63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bd3e51-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676299842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299842, "uuid": "03dda47e-fbc9-4462-a06f-59b218c31c65", "comment": "Malware payload", "value": "aacf7b65816326e35fa762fec8c57d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299842, "uuid": "319e4837-aaf2-4224-832e-62b4a10ec69f", "comment": "Malware payload", "value": "15ca443bd8c6f9b87d249d85225b12f35381ab7958544dd85b5b3eb843b5cff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299842, "uuid": "fb1af1d4-94eb-4261-b70b-408f66261a18", "comment": "Malware payload", "value": "f4044cc4238bc0c1c9a745f3e837cb5d23fe053d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299842, "uuid": "e9816d66-1901-455e-b3cf-2c59613e7c0b", "comment": "Malware payload", "value": "df990baa3e76d35c517d0286d7eccc6c7a98c81f24c1049eb758a33c035b20b09c68a287e93d2ac1d84d7fea39e762a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299842, "uuid": "3ef04eb9-a3dd-44cc-84f6-8f883585b83a", "value": "T13DA3124AFF358D0ADB1008B727DA9E8EDC6D7B6A46DBB4B86DC2948F57900C97C53204", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299842, "uuid": "21eca43b-95a5-4225-a9ed-4318d6aa9e7a", "value": "1536:pxpJNlEYvXndUt/afLuZmVelu9eoCtcCCzNbC4RWC0CQFW3RLlNCzgb0OmfPF:phNlHuBafLeBtfCzpta8xlBIOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299842, "uuid": "769a64c9-3a3c-4ade-a1a5-b67bc87f70d0", "value": 99968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299842, "uuid": "31a3633e-e051-4b5d-88f5-10a206ba7df9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299842, "uuid": "fdc51264-3b5f-4456-bffd-a109802ad31a", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.50294160.11718.3088", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68e667a-ab50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676259839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259839, "uuid": "c2222c3f-7124-40fe-af19-886fa5ecd988", "comment": "Malware payload (Amadey)", "value": "df513c08a4321b480c1a657e5c6b3401", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259839, "uuid": "2f74db9c-63ff-4269-8ea4-4da5177676b8", "comment": "Malware payload (Amadey)", "value": "168a5aafdd235ad95537304b782f3891147982138a6f1505b6d5ef7609634899", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259839, "uuid": "9e6a88ce-5a81-4cef-bef3-5a96e1924b8e", "comment": "Malware payload (Amadey)", "value": "331dfbf21b15ef39b69c4c404e3a370fd28df283", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259839, "uuid": "b93012f0-bf9d-4fb1-b37e-e7416a0bf8ef", "comment": "Malware payload (Amadey)", "value": "2c192d8757b80f1a4690c3ebd1506a94602dfe6b99e1f3084a1f0d4122f51e469bc9202179b4cf2154a3a34bcd9bf33d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259839, "uuid": "242606ba-f55e-4d83-a746-a6e09df9626a", "value": "T1E4F41247FBD84161E9B15B7058F607D30E39BCA06A74839B178F7D6E4832690A2347AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259839, "uuid": "aa8570f2-079e-4279-9703-fe35114cf4e4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259839, "uuid": "bd17ddf2-445a-4af2-9396-1185940bb495", "value": "12288:OMr3y90rOMcbPyarsCGYgtCgTqz8eJ+usHYYoMg8n7TOCXbgnNYKvz5:py25Z0sCjOCgI+us4YFgoTlbWNYw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676259839, "uuid": "73047f7a-6926-4d08-9f32-3108d6f402c9", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676259839, "uuid": "60925a00-4b31-4b86-8d9f-622c00c04b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259839, "uuid": "0d2f07a5-a027-4ca7-95e0-2ad7f5b4333e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961becf0-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676299755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299755, "uuid": "188a35b0-19f9-4b69-8b2c-5790fd70ea5a", "comment": "Malware payload (Formbook)", "value": "ecbfb5fb0eda1d1f9bbfcf88823257cb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299755, "uuid": "29d6cd70-3c9f-4ca7-8e51-d13127bf2db8", "comment": "Malware payload (Formbook)", "value": "16c90d0803ddb8beafa954da60ae5463fcf943e7bc8ca9d3cc235e716ec37c9a", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299755, "uuid": "5ded3dc6-ad26-410a-908d-6cb164bcdb2e", "comment": "Malware payload (Formbook)", "value": "3d43da3458ad1f770ac555968a4dd1832cff3756", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299755, "uuid": "24f60236-36c7-4f30-8877-187c4d5dbe0f", "comment": "Malware payload (Formbook)", "value": "704351a0b630cb92b8c4fc032d1d68a9b63aa6e2ea23b6de5705ac04a20a6ee97f19be715e2fb12c3c57258ecb54a310", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299755, "uuid": "482cd2f6-a7ca-4baa-9169-fd39e65258e7", "value": "T1F075AFF875047DE62A6F576BDA96ACDC03B617639ACBA4CD80647BC305A3375EE02C04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299755, "uuid": "1c41038a-85e8-4ded-a74c-5fbbd9292022", "value": "24576:sxlfo5VrmY2IYF4duSF5b2dwI2HUBvXjW1M90OuYFcy6z/f4Z69IMz6Mb5nEoK8g:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299755, "uuid": "7108fe6a-ecfb-4b4f-9470-484e7034e873", "value": 1702793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299755, "uuid": "3067b5c5-b1fa-4000-83fc-b368da74993d", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299755, "uuid": "35dd9a6d-c190-47bf-baa1-f9f1ca7aa564", "value": "Quotation QU126211.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4496d1-abab-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676298693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298693, "uuid": "fd2e8d78-800e-4420-a422-0ea7a122d267", "comment": "Malware payload (AgentTesla)", "value": "ccd8294a52951b5d69232ce346c023be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298693, "uuid": "149aa1e3-c85c-4c4c-bd76-5f3b39aa2ac0", "comment": "Malware payload (AgentTesla)", "value": "16db78132073099ce05777f960816acceb2c7a652fb32bb6c65c3a062e5fc3b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298693, "uuid": "9c2019a5-d59c-4b6f-9d85-990f16a9695a", "comment": "Malware payload (AgentTesla)", "value": "6e43302c72d07d8f5aa11add900415800d3fb90c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298693, "uuid": "b6441e16-4389-40e4-b87d-131231bde807", "comment": "Malware payload (AgentTesla)", "value": "30c70db3948056fbcef794fca9cce892ce9f4d062de0a50d44508d7728211c32414c7ebbd35f32f462d26961940c4639", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298693, "uuid": "9b57d046-1fab-43b6-af82-f08dc3551d12", "value": "T103F40290374D5BA7C66D4AF83425A18053701E452EB5DBCEBCC635DE0EA1BC783226BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298693, "uuid": "7e80f567-97c4-44ea-99a2-501c7059ba47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298693, "uuid": "f111d62c-edbf-4dd7-8ca3-d3c18b53e1c0", "value": "12288:XLDJyHnh6q6PTKPzG7vTVRjMyfHLPkiVA7wxlzJBdhkckpiy02GfggPbcQQoAm:fsHnYPTKPzG7LVRIE9AstBQlH02GIgP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298693, "uuid": "2be6a6d1-520d-4f40-9983-b6e20c89b8b0", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298693, "uuid": "b5d607c1-b59c-4651-81dc-b6270b1d4619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298693, "uuid": "3b5f20d7-d9e0-4c28-96fe-f35ad6cc8f3e", "value": "sale order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f9c2d10-ab6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676270860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270860, "uuid": "fc4fa640-e35a-435f-acbe-253fcf8e4bb6", "comment": "Malware payload (Amadey)", "value": "504b727e1314f2d519704519503dc570", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270860, "uuid": "bd7ec39c-41f5-4b3c-9de3-53131cba2946", "comment": "Malware payload (Amadey)", "value": "170b8017febd8839236125baf231e015ee3fae4a721daec4ff7f11780f7ff265", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270860, "uuid": "8e54cb80-7cec-4387-89e4-2b09a111dac7", "comment": "Malware payload (Amadey)", "value": "046a556d0d37d480aadfd940f9d53cf888eba45f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270860, "uuid": "85f53a10-3755-4417-b4de-74e1dda83699", "comment": "Malware payload (Amadey)", "value": "a7b15f6a60144969fe383201393eefa3331d8679cdf882f49c1552a3320e50d8ccab03f7cc9b6686603670e95f05a930", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270860, "uuid": "25c01a71-67d3-4dc6-aae9-e4e0631df70a", "value": "T12EF41207E7FE5071E5B497B10CF203D31A317D619A34979A27CBEC6A0872AE1223576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270860, "uuid": "fd098c2c-2fec-48ac-95b2-4eb95954974f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270860, "uuid": "893937cc-6fa8-4612-9608-65c154104a40", "value": "12288:bMrOy900lXVw5HLwEWjkVho4Dlc00mE9ZHXEWhpeJp//LHbJGO35qeuek7Vvh0v:5yxZVwRkPjLZ00NL3EhpX7bE2Y1ekwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676270860, "uuid": "24d4fb71-9a5b-46c2-96ee-f41461f65c5a", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676270860, "uuid": "491a29b7-98e1-4190-834d-880bd589e1de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270860, "uuid": "0fabcb56-1a1f-468d-bcc8-9b39cf17c9b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66f6c26f-ab53-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676261021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261021, "uuid": "035533b5-4d4e-4a4d-8e0a-47634088b2b0", "comment": "Malware payload (RedLineStealer)", "value": "dfca272b5f695d31fa54d33229fab5a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261021, "uuid": "8c282cc4-1472-4dc1-8420-ac9d2a9c7c52", "comment": "Malware payload (RedLineStealer)", "value": "17534341e78b45ded135968460c24054cbdd5bb6772cb13375d47abc9b62a169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261021, "uuid": "d43be4b2-59a6-4759-be1d-8266569fa20b", "comment": "Malware payload (RedLineStealer)", "value": "f2a9bb38991112c35d4bd399804f39f18a479178", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261021, "uuid": "0a9305ef-0036-4874-8c7f-afc1bd965071", "comment": "Malware payload (RedLineStealer)", "value": "581d68121f678f96cc5a4ec51905ccfc80d665e4a68c06e1a92ee466fb40b9134fb747296832b7f38b45339d8f5e6a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261021, "uuid": "5a2663dc-200f-4410-a217-6d26960eeb6a", "value": "T1F754F11976A4C032D35786716A35FAA06A3FBC726FE38487364C169F6E303D19F29316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261021, "uuid": "e25159c0-1c31-476f-a581-4f71c385693c", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261021, "uuid": "4fc706e5-36e0-47eb-9e14-8555287dd93a", "value": "6144:s+xBJeXfj3uWbbtv7uNL6TDomM07pAuJtWuJeXFon:Bofj3N9Kg1vFAuJ8seX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676261021, "uuid": "fb65595a-5943-47cb-b38d-d978e2c675d3", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676261021, "uuid": "b462e9fb-2289-49e9-90fb-af4a276ce9b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261021, "uuid": "ff5a1193-c5a1-4ed6-a7e8-80200762e93e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b51acd-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272005, "uuid": "3252050c-fc8f-4bf4-a8ab-756ed3554d05", "comment": "Malware payload (Formbook)", "value": "347a3d46cbbc2d1455dbd273eefc1d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272005, "uuid": "64308e46-e83d-485c-9ba1-eaa68795818f", "comment": "Malware payload (Formbook)", "value": "175afe9e12a511bbd4b611c0c8d57c2279ba00357870187d7bdf8cb20fcbaf82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272005, "uuid": "ab8b8b3b-2bc2-4263-9651-de19761768b2", "comment": "Malware payload (Formbook)", "value": "0193824561023a31cbf57888f7fcee045235da59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272005, "uuid": "e0bd7bb3-a8d9-43af-baaf-c2194826c6bc", "comment": "Malware payload (Formbook)", "value": "18d3d2c88b27c905df2d7de6f8fe2babad91774241107233a522da91cc672dc0261d9459bce9a396f9ff5e14cf42a714", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272005, "uuid": "de050a86-9407-4c39-890b-da76802906e5", "value": "T13904AE32D641C031E2B251B5F6BD1B7B883E0A353255A1E6E3E216E16EB49A5F03D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272005, "uuid": "e7bf8774-1466-44ba-a6e7-79534b953869", "value": "3072:P81ZkcOYX2iR3h7+gMJOTKjgtCjoEilKag3Tx+Cf9:SRNhig1TKjgtCMPST4CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272005, "uuid": "ce9197cb-b6f5-4a4d-bb5b-c6b7181333b6", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272005, "uuid": "6d79adfe-2a4a-4342-95ed-a6074ebdc12b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272005, "uuid": "b4a647d7-0780-4d61-a03a-b8b1c54a72f7", "value": "175afe9e12a511bbd4b611c0c8d57c2279ba00357870187d7bdf8cb20fcbaf82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16044548-abce-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676313713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313713, "uuid": "d35eb661-6d75-4b11-ac96-d3e2c2c07af0", "comment": "Malware payload (Amadey)", "value": "c202aacf586778100d998c7b039fa512", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313713, "uuid": "394ca60a-9e7f-44da-ad5e-66cc5d88a000", "comment": "Malware payload (Amadey)", "value": "18f702a446439eccf82b475d3b0e7031b1096a18650b36ed0049ba1bbb1ccd6d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313713, "uuid": "bfa80d32-e6cd-4b48-99ed-2930645d0c17", "comment": "Malware payload (Amadey)", "value": "cbbcfb4cf438f2b02d23f67e40fbf140f6b3bc63", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313713, "uuid": "ffbe991c-ad18-47c4-bdeb-875c47aaf57c", "comment": "Malware payload (Amadey)", "value": "f4f7cbe888f6473e4757929aabca4b3fa13faeee7888332afd2ee337c1da6b163e9cf0da7fc7f44397bd09148f5643d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313713, "uuid": "7abd3d59-ccda-413b-8f45-91c40b4d7587", "value": "T1CAF41207E6E89127D9A967B01DF603D32E317C905B78836B678FAC480D336A1B53076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313713, "uuid": "90d41e43-030b-4a0d-a220-22c30657b9b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313713, "uuid": "543c3fdc-0c52-40d9-bd3d-0a6a5e869766", "value": "12288:pMriy90j4cr6aWVDzZTqaSQkUKAPeJ4AYAHsPY6Nf3Q7T6MQSTfD:3yerpcHIz0K7PMNfuKSTr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676313713, "uuid": "631c30fd-f6e4-4416-b511-f96288d24759", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676313713, "uuid": "3dbe7e0e-c6a9-4ea6-86ca-d9f6c471cc26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313713, "uuid": "a4e2b689-8f39-49b6-8015-df5ba0da7f8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d398031-ab5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676266132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266132, "uuid": "e0bc255c-13ac-4e70-95a6-9da05fb8ce06", "comment": "Malware payload (RedLineStealer)", "value": "a534a323bae01686de25609f30b397df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266132, "uuid": "af7f20a5-540a-494f-a0da-6f783195a29a", "comment": "Malware payload (RedLineStealer)", "value": "19d70551ddc29c6152c2bf29a3330e2753e39595374f08c1c500a795203352c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266132, "uuid": "77d02cba-10f7-4cdc-acce-1bd8ce772882", "comment": "Malware payload (RedLineStealer)", "value": "cc993a84da5f694f360fd3d6ba12b5581805fb83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266132, "uuid": "173f5977-67d6-4a3e-b703-57a9ad2549ad", "comment": "Malware payload (RedLineStealer)", "value": "f53157cfed6e1e8f84bad2fcb722fae22257d1de3f55f36a79db32e4c7f61cb844a349416d4749a877eb655c980c7572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266132, "uuid": "758c62c3-6b08-4fb2-b508-d3b339130aa1", "value": "T135F41207E7F88522E4B0177059F602E31A397E621738869B238F7D5E1C71AA0B67177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266132, "uuid": "3024f2f0-a936-4b16-9775-fcc0763aa81a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266132, "uuid": "09c073a6-c9ba-44c1-b984-15dfea721ed1", "value": "12288:iMrPmy90xpHL2q2lFpwpjPeJOgUZvf3aFrkQfux:8yWLN2VOgUt3aZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676266132, "uuid": "3a910e2c-eee0-4a72-9ae0-8b63a9ef672b", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676266132, "uuid": "5d43eb96-2c69-4f9c-81e2-4ab987a65648", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266132, "uuid": "6a1e38ff-535a-4eb9-abbf-3019682a21c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10db8835-ab64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676268178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268178, "uuid": "6e21aeb4-ae7f-4ba5-8e9d-00522ded4a53", "comment": "Malware payload (Smoke Loader)", "value": "b16a005c7a7f6e08e92627e2cdc9d072", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268178, "uuid": "4ae21e2f-bf7d-4e13-981a-21ab4c8d7ac1", "comment": "Malware payload (Smoke Loader)", "value": "19dda1c2cb0faa81c9e550288891d82aa0c7f6a37decfe0e04cf935dbf525e8c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268178, "uuid": "a9adc076-84a8-41ca-8998-3b67c246a078", "comment": "Malware payload (Smoke Loader)", "value": "7509b40f622a6977d37a8f656583869aeda3b986", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268178, "uuid": "0887e618-93ba-4f4a-bd68-58b560ba3a14", "comment": "Malware payload (Smoke Loader)", "value": "565a14cb618d8d720862aaca64be71900ed4983dfc14f7650b0cded4341ee6e51e1b23bc8c6c48a39c9dc1ae2b14c50c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268178, "uuid": "f2c661b7-5cb0-4a0b-acb1-81005a06cc5d", "value": "T14204D01179E18033E16B857C1D31E6E0BA3EBCB5E7A0C49B339426BF5E306D29A64357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268178, "uuid": "5b09f230-238b-45f4-ae9f-22e1e405a3e2", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268178, "uuid": "9df7107a-6cfe-4908-b9aa-ad0c56b51061", "value": "3072:7CjuDV39aK35X53R0gezhl1pyl2v/uamsWRyS61l:7tVPB5h0gUp2uVuyS2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676268178, "uuid": "93f09705-c347-4e18-90c9-338a206309e9", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676268178, "uuid": "9a8520be-6217-4e3c-8045-d208c25951f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268178, "uuid": "022ab427-f306-47b3-8ebb-90921b405a9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8dd26f1-ab75-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676275761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275761, "uuid": "884d1461-ba08-4339-9d4a-b6b8e9662578", "comment": "Malware payload (Smoke Loader)", "value": "d13c3df9c1f3c0800da11b13d7476e15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275761, "uuid": "6ad1497d-bfd9-40e1-919e-a3c6518a14af", "comment": "Malware payload (Smoke Loader)", "value": "1a167d95fb54100b9136510f0ca10a93858873c22a4a5c4a2b9b5b75d4f45ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275761, "uuid": "0a962f18-8288-4316-ad51-ca205f6828cd", "comment": "Malware payload (Smoke Loader)", "value": "dda4a685c3319947aa67abd0b92df07195e9d7eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275761, "uuid": "d4591f3b-8820-45e0-a051-ec0e486f4280", "comment": "Malware payload (Smoke Loader)", "value": "024f9d9d2e44fa06199de5e5388ae81da3f2b1194206b3fcd37265fb54b8668aa8a4085ee663809031d69412a0a72e95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275761, "uuid": "54149091-3d9e-4df9-9b1f-9e6aa46fb797", "value": "T1A414CF1372E0F472C5721631AD79C5A17A7EB8B04E79B5AB3748172F0EB16E19233362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275761, "uuid": "1f711e7c-1378-45f2-8d06-8d1f395ffeb8", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275761, "uuid": "a79df480-62dc-4f3b-bb2f-b42e4982bf1d", "value": "3072:0rkreasJ6cOKoaWgkm+Q9yoQtuAZGRVgkgfa5xKc9K/OH70fD43:0rEe2KAgkm+Q9yVQR65a5ccc/4IfD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275761, "uuid": "ff685d91-e42e-41be-9108-f606041b0225", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275761, "uuid": "d49b130c-db7a-4634-967b-546280c653e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275761, "uuid": "1d73b640-ca90-4757-8d66-05329c64207a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fea2138-abe6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676324172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324172, "uuid": "a571159f-2321-4c11-b115-1fcfd18f85a1", "comment": "Malware payload", "value": "02e85b0c9267325101037cc2f3783dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324172, "uuid": "bd5b4837-cc4a-4b07-bf77-2b99bbba61be", "comment": "Malware payload", "value": "1aae12bcdb17390b731e01c631605d0c993ab58a1df91b49369b3884433c1fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324172, "uuid": "f59d8f8a-c720-46b6-9e80-ee91a4ea3754", "comment": "Malware payload", "value": "24229821e7b0ecfce1ac68ec092d23cdf1ba0c95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324172, "uuid": "e9ea0b2b-a145-45c4-90ef-c69b043aaf89", "comment": "Malware payload", "value": "247daedd0f90f324c4b2348855674d43d2859c861f019eef781c7dd59b0f9794e99aa8c8831bbfc47e4d2a60e0fbf372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324172, "uuid": "32608cc9-0a6c-45d9-83de-2b79658fae47", "value": "T17604CF2233E0D872D56E07319C69C2B17AAEF8214E79A68B37A4673F0F703D29671355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324172, "uuid": "49331750-104e-4d52-87c9-28ccecda6723", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324172, "uuid": "b2e95cb7-f6d1-4a8c-b9ad-9b787965a303", "value": "3072:5Ks+QkuiKN9JQ3WLh5XbpKUtvSjMQ41PL7361w:5B+Htk9JWuPbtTQ4lP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676324172, "uuid": "4075372c-c83a-4fcd-9192-342398e3741d", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676324172, "uuid": "e630e9d6-a98d-462d-be05-037b15fea57a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324172, "uuid": "cc603cbe-6524-4c53-93dc-e39f518a8d01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f2ff4c-ab6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676272560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272560, "uuid": "d1a65886-f9c0-486a-a762-da896c366318", "comment": "Malware payload (GCleaner)", "value": "2a0967cee120b43bb1038d64f2f16a29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272560, "uuid": "9bb67f2e-967d-4299-9c51-2d8df580ab86", "comment": "Malware payload (GCleaner)", "value": "1ac812bffe0bbce5d4213cfff6058ae15501ce3eeb8cb32ef4d0d8ff8d4b0200", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272560, "uuid": "cb8b4ea3-28df-400a-997d-1f4f9a2edc7c", "comment": "Malware payload (GCleaner)", "value": "6b8d6410493767161387145b895d049952370543", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272560, "uuid": "4f94f060-3802-4220-b005-7df984535d62", "comment": "Malware payload (GCleaner)", "value": "e610d7fbdfab2df881f616aa7ef7d0c9fa395641ca56b2326648111f26f386a05f6ea3a6659538f4e9028ae9a6e52d8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272560, "uuid": "c8c4f82e-ecf0-45a2-a2ea-b6a38c54b280", "value": "T18AE512BD7504C5ADC290FEB88827D8E75CD66DE3E890A06230DD7F3F95382899B1A117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272560, "uuid": "0f33377e-c294-47c1-bbd5-aca968c81cf0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272560, "uuid": "054b7ae2-f3f1-4b0d-96eb-8989503c58d9", "value": "49152:rdHb2t81MRv4OOcztihh+5WuDfilW3R9eP9ERCKEvKsf45AZm2PEirLCgv2MR:JHa+2vOcztch+B2Q3DM9EP/5aLXv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272560, "uuid": "32e2b133-1e75-41d4-bad7-065db7fe35c4", "value": 3141290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272560, "uuid": "50842436-389c-4b4b-97ef-4f537ab6c6ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272560, "uuid": "025db6af-79b7-41e7-bd9a-9803a6845a4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d07c527-ab6b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676271286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271286, "uuid": "60fa6197-1e50-4355-ac64-52f836b4c018", "comment": "Malware payload (Amadey)", "value": "1fc1d275209762491065475f16e50f3c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271286, "uuid": "53c30642-b0f0-4fe7-ba74-211d7787bf54", "comment": "Malware payload (Amadey)", "value": "1b6658ba46be693e57a26dfad05fb4a2f274a13374c69820457f6de33ba17ca9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271286, "uuid": "63594a83-e65a-41c1-b6ca-14b570b21fea", "comment": "Malware payload (Amadey)", "value": "893f12faec0fa7061c3523f045e93e835b64ef3b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271286, "uuid": "bb38ae07-69db-46e4-8e3f-aa07fad7953a", "comment": "Malware payload (Amadey)", "value": "eca5e0f0f7e7cf835b475c899d567e1274a014850768965998415561f0868f12853e102ae15d343a785f149432f6ddfd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271286, "uuid": "80894de0-d4b9-44be-a905-8873464088fb", "value": "T13CF41217DBD95032D9F1673104F702C30A3A7E755B3842AB774F6DAA0C726A1A5323AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271286, "uuid": "04444893-c938-4f37-9123-390688ef87b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271286, "uuid": "41d45453-b299-4d8c-b67c-6137b745db05", "value": "12288:3Mrwy90gYmlydm+oQo/8xIYNdgeJDZIiqSjFEC5qea6KrqBL1SEW:Xy+mlyw+usByl4YF6KuRpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676271286, "uuid": "0817b972-4071-4f5f-9d21-a77be836146c", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676271286, "uuid": "f63174d5-6a85-416a-b43c-d23f5aa90310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271286, "uuid": "4414ad7e-7226-4d7a-84ec-8a24201e179a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553cdcb3-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676299646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299646, "uuid": "d15fe6f7-8c80-4ab9-91a6-da1fce475d49", "comment": "Malware payload (Amadey)", "value": "0b7c10aba44a125615300b4bfe622799", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299646, "uuid": "884954ae-6aea-4af2-ae25-58a2d86989f0", "comment": "Malware payload (Amadey)", "value": "1bafbb4b2bca5c74fe28b26270dc85d2db2a941fae187c23f069e97e52b00d89", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299646, "uuid": "ba089da3-f1ad-4364-8d61-b2d4c106ffb2", "comment": "Malware payload (Amadey)", "value": "f6b0535c7bd48f5f68f58af177775b3dd1e00aaa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299646, "uuid": "0eac854c-2d45-41c1-ad8e-8b80904fcbd6", "comment": "Malware payload (Amadey)", "value": "52c6a6cdbfa8338b5efd93b89245c62c7a8dfbad27e2db1b8324dfed5921b658321200964d32cea6cea9f12504e39149", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299646, "uuid": "94c0688b-6a6a-455f-8d0c-40fd205f3f87", "value": "T1C3F41247B7FD4427D8B117B0A6F702C32B76BD619638238F2349A89D0C726E1627536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299646, "uuid": "1af32ed3-0ec5-420f-bcb3-20f1682b0f49", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299646, "uuid": "d2f1da5a-0fba-4710-a44f-68f59a61c900", "value": "12288:IMr6y90MOvz/o1GvUbpfHHvZEKSuFWrq3IzO88dseIPXyRWznRp8OCamhywAgnPR:SyRMz/o1oUBnvZdcOYK88dseI/yMzP8R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299646, "uuid": "cae4c066-a672-45f2-8c4a-3c5e31dad578", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299646, "uuid": "a440cfe6-8319-47bc-a88e-4ebd024fcd32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299646, "uuid": "2d6e4e0b-f84b-4225-ad26-272eba0a0acb", "value": "0b7c10aba44a125615300b4bfe622799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81bfa2b4-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676280393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280393, "uuid": "34c405c3-f95b-4ac7-8cf9-00895ac16929", "comment": "Malware payload (Amadey)", "value": "80f407a64f09ccfcac93252d0bb674a6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280393, "uuid": "8dedd1a2-2ee6-4f26-9b12-aca1c2568712", "comment": "Malware payload (Amadey)", "value": "1c09adf4675a719e92ca79cd22fb744b95e07fe394beab232addb0e3ba5c5199", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280393, "uuid": "5985fa7c-3ce2-4e9a-b07f-907192fcc6b4", "comment": "Malware payload (Amadey)", "value": "11b0036b71bb705b2f7b1d26c437988dcee53ea5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280393, "uuid": "e23f41b9-4fed-43ae-845a-66df6d7c0304", "comment": "Malware payload (Amadey)", "value": "1535dc4a2348aac0bd9a3a1d32b6b576e7c6c19c3193aad8f1b9dce06186a8321e7c82735b77e0b9ae2322f8bfd6298f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280393, "uuid": "840f1778-ec2a-4513-9284-ea9bd6846f16", "value": "T1D8F41207FBEC4061E9B45B705CF703D32A3ABD605A38836F63896D890C725A5B23576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280393, "uuid": "52515a2e-adc1-442e-8f09-e04c6e251321", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280393, "uuid": "cf9cfb5c-be5a-45b7-9e37-e8387bbeeecb", "value": "12288:RMrby90N6MmmVvwZV+hVjRKC3lneJIi1ZyDH3T7XPcvVSVXS:SySVvRhNRYaDXHq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280393, "uuid": "7ef400e3-8bb6-423d-b25f-2835c7c30d8e", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280393, "uuid": "68a073f3-4154-4d33-be4d-1900cc885ab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280393, "uuid": "6dfce0de-be75-4e12-8263-5f7c7a076005", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200d8d70-ab40-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676252742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252742, "uuid": "ab996bfd-8a92-49d8-abdc-9f860e95cfc8", "comment": "Malware payload (RedLineStealer)", "value": "62da2dfd0d2c17abbd19ab6a0823ca47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252742, "uuid": "8607e8cc-c02c-4497-af99-089ff2afb528", "comment": "Malware payload (RedLineStealer)", "value": "1c2ab08930026b6ec8680a401befc22b3630b98390426d279b7a49362c28c42f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252742, "uuid": "8f0a0451-cbf8-4abe-8024-1a60b5336e2a", "comment": "Malware payload (RedLineStealer)", "value": "e01a7ce987d2c408f4ca4ff258d51499f2aa048a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252742, "uuid": "a01ed067-c4ad-4707-9300-f41ff685dea5", "comment": "Malware payload (RedLineStealer)", "value": "aeb910c1a151d34ccd97a1b2212da79c9313e4c4a0623044dcf48b02393611aeab5725d007466e83e62e2d204605d059", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252742, "uuid": "5a674f24-48c7-4ab5-8969-c38fe4963bb9", "value": "T111F41207FBE98036ECB557701CF603C31A367CA14A7806AB538AAC5A5C72AB57136727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252742, "uuid": "7a37c37d-ee3e-4194-8c3a-ed353ac2d9dd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252742, "uuid": "3ab6dc07-8f91-408e-8482-27350cd642d6", "value": "12288:jMrQAy90tIpoVw8ey9pEEoKUFTBPsrPFS1rLeJdr4W06xbaa8P+qvGCuxYv9AK:Gyt+VwGNPUbPsbFUIdr4sxz6ODxMf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676252742, "uuid": "e34688be-ad68-4b60-884f-c8d94e42d6ec", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676252742, "uuid": "2706b416-b480-472a-8d31-ac14a94f43cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252742, "uuid": "6ebd12c5-b5ef-4d67-8a2b-c294e013e667", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e90697b-abcc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676312976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312976, "uuid": "bb26bb11-9591-4503-bd4c-94a7037c8728", "comment": "Malware payload (Amadey)", "value": "2ff5da794c0e06a9eb8bd173a643905e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312976, "uuid": "a1922181-d563-4497-a6db-fd2f8b905201", "comment": "Malware payload (Amadey)", "value": "1c6d376d059fb7f5952ac8a8508763747a0588e017cdce7f5e34e6745c4b041d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312976, "uuid": "089ac61c-1462-44dc-96c6-f821ea4c56fb", "comment": "Malware payload (Amadey)", "value": "1c4f774718ba3f73d5d930c47f6e0f62b3aa7665", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312976, "uuid": "1db270b2-1402-4362-8f95-b64a8c50a6f0", "comment": "Malware payload (Amadey)", "value": "150ce233b438378b5eeb1263b630a4937094d0f869b33ec95880a30c45535a519a9e8960e1e037e7b2299e43729ec3cc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312976, "uuid": "a6554849-a271-4d1d-92ab-c2d7214d3d94", "value": "T110F4120BFAEC9132D5E167701AF203D31E357D604A7493A7238EAE9A0D726E4A731357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312976, "uuid": "f1ad28b2-2eac-4cfc-a800-edd4369da221", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312976, "uuid": "5b7d0d1b-fb9a-4e3b-817b-7b918ec6bd16", "value": "12288:TMrAy90K1ld1fsIrFLnNFNjKfTeJnlGgIAGnlDlxiFhyknzGUp:vyZzbhxmsAgAUFlGUp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676312976, "uuid": "3430e502-90d4-4582-9aa9-c71e54c26265", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676312976, "uuid": "29a4c0f2-d5b2-4dba-8f02-8d549e1c3442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312976, "uuid": "7ab7d7f7-5fdb-4583-9656-5918a768a616", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f7bd5f-ab33-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676247460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247460, "uuid": "a4522619-94cc-43d1-9025-d93e466df8b3", "comment": "Malware payload (Smoke Loader)", "value": "a01a9e96aff4b032d3d61b08dbdf8d00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247460, "uuid": "41352b6c-de67-49d2-8f87-a8b537cade84", "comment": "Malware payload (Smoke Loader)", "value": "1ca7892f1c44b116d1780d149c43bd104cfd8361d65f1469e383bd3943af4401", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247460, "uuid": "5730650b-2f50-4a93-96d2-7284d8946b96", "comment": "Malware payload (Smoke Loader)", "value": "fd846ef39e63ced15d919a8dd2c4d65609e25906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247460, "uuid": "2433aead-25fc-4ff3-a3c0-8e5d9a761e8d", "comment": "Malware payload (Smoke Loader)", "value": "6c51c31050fc271b3ddfaaad001fcf5c7faaf16212cc3ff15ff7fb968e8a3915ee934d12d08ca7b6d534630cf3d16c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247460, "uuid": "4f2c536f-49ef-4855-b4df-84856a837af6", "value": "T17404CF217AA0F072E16781B9D910D651AEEFBC329BA4C4DB33542BDF2D207C19E75362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247460, "uuid": "38b1e643-b456-42f0-9b86-6210afb64f69", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247460, "uuid": "d5575245-371a-412f-9c52-890116e2444d", "value": "3072:5CuZnVIG5HBG6I2DuHcgcVGkGTZMVUPcHW:XX/M6I2DuHcgiGlMOc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676247460, "uuid": "5eb58199-a7d7-4991-981b-4f716ed58e32", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676247460, "uuid": "a7fb5513-7536-4a97-bc2d-eefd03ae9fc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247460, "uuid": "24a75ef7-5a82-4500-8647-440418cab718", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c696198-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676301054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301054, "uuid": "9adcd8a5-8c28-47e1-bf2d-f81f5f51fd0a", "comment": "Malware payload", "value": "6d887a4492b27015ca2eb3f828f969be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301054, "uuid": "4ae69ae4-c4ea-438e-98a5-392152ceee92", "comment": "Malware payload", "value": "1cecc8115b0c0ece81f8904bc388e396c21be9c1b0dec30d8489c1d5a560e1b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301054, "uuid": "6b739413-887a-4be0-8889-78efd251ea02", "comment": "Malware payload", "value": "8f7173edf0c135144cedfa3e8f2049f97383d095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301054, "uuid": "ce23cb9e-648d-4836-908e-cc25ef96f69c", "comment": "Malware payload", "value": "7a4db3f6d5b1ff74e2f64591a622839595fa2ba020e1967c8b5d0d1045907fc6198932be3ddb9cf28ae75bb756bf4853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301054, "uuid": "c5652eeb-85de-4e0e-86c5-0e39aea6433c", "value": "T1B6E33A1833F95F57E9FA57F60AB2711013F6BA3A02B9F6881DC650CB4B26F405A94B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301054, "uuid": "8849ac28-2044-4290-b09e-3214d8e8b53f", "value": "3072:ls040X6r4cEp62mJguzjKVxWMgNvis/IQ2iJCoSSEs:lSJgIWWMglV/v/soSy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301054, "uuid": "a44af20b-3fd5-46df-b626-b3bdc1637732", "value": 151710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301054, "uuid": "e8dde1fa-7f2c-4016-afc1-8fc00cd62b1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301054, "uuid": "b2834ba2-ed03-4917-9cc8-1b1904745d66", "value": "6d887a4492b27015ca2eb3f828f969be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19238bed-ab47-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676255737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255737, "uuid": "d9ca4488-9eef-4990-b659-d6e9d6b47d93", "comment": "Malware payload (Amadey)", "value": "003e76e9f6122a9ec9d220739adec390", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255737, "uuid": "edcae0a8-4cd7-4a41-98d8-0352a37f9d96", "comment": "Malware payload (Amadey)", "value": "1d969d9cbf94a18626b307409e04aa2f5a097c4575ef1b6841ea4b9db2062cdd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255737, "uuid": "1b46195b-7aec-4ea5-981c-7db60b2f370f", "comment": "Malware payload (Amadey)", "value": "ac0675439662a9bd6880b988b3e30a22ec23b99a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255737, "uuid": "630c609b-a3c6-45bb-8fde-1bd09faa34a3", "comment": "Malware payload (Amadey)", "value": "a4c1f3aff0cd30285fb30e1d7b4d8d661db2987f5e2b6b8e4e42dae4d8c3e9782ae6558c76102f20d92c0dd830fd53dd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255737, "uuid": "4db01439-7be8-4eda-bd78-034c1c528d8f", "value": "T122F41207FAEC8522E9B55B704DFA03D31A32BDA15638429E239F5C680D726B07634777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255737, "uuid": "5a5dc42b-786b-4507-a5f0-d66c73064b72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255737, "uuid": "549ed05a-15c2-4b31-b613-15086a9f282c", "value": "12288:CMrdy90BtdS4cV7lkuLGcQeyo4Pl9eJlb1lQGYAsk5aesjObo8xSOt:XyitdSRV7n8eJ4olBiZA95anj8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676255737, "uuid": "c72f04f8-b802-423f-ba2c-c903b6ef067d", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676255737, "uuid": "11c1de0a-0e17-4144-a198-df53ec81ac16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255737, "uuid": "c8f1d01a-2c9e-43f9-8392-6397de47d378", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d822cac-abd1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676315014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315014, "uuid": "74e6d19d-edce-4a16-bc65-897e186a65ab", "comment": "Malware payload (GCleaner)", "value": "3e510b23d8bd9a4c2a6ca2e70e21c1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315014, "uuid": "81dc7de4-bdc3-4803-b58f-c23d54390f79", "comment": "Malware payload (GCleaner)", "value": "1dc7421ff9da13e0cf1239f082f66b0aa7a5826241b4f146497a7c84cb5897bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315014, "uuid": "8841734e-2cb9-4365-8cc5-32bf4b0281d8", "comment": "Malware payload (GCleaner)", "value": "711230c858c63187014eb1ff45b1f2e9096a99e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315014, "uuid": "5b411329-bce3-4696-8880-020881578c1e", "comment": "Malware payload (GCleaner)", "value": "b208d454ecc495acd98f57390895783b1c1cc9aa758a3ce3d5eaf43849f98ffc614527548c0c5e29daee93002adfd3db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315014, "uuid": "809d5520-93ba-4282-a05a-0d17ac667ed5", "value": "T184E5127C7108C9ADC680FE788D3A99E75CD76DE3E9E8A05270C97F3F51792844A1A207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315014, "uuid": "c2deb19d-e97a-4d5f-ab50-218f51787ee2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315014, "uuid": "2ab5a251-0020-4b1c-9cc0-9fe8494d181c", "value": "98304:JHGBPHLcxvCUZ/9v7WyWjVgg6rGRRv2MR:dGBfIxvFqRjVggbTvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676315014, "uuid": "20fd1e67-0ec3-44a6-8b80-0ba8829fd560", "value": 3316293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676315014, "uuid": "983295e4-deb9-4e76-8077-f09b588bff5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315014, "uuid": "5dbfee9e-e3b8-4a48-92cf-9ac4226c9e89", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d90c1df7-ab75-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676275815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275815, "uuid": "1d28f179-e69a-4aed-8bd4-fa5118fc6182", "comment": "Malware payload (DCRat)", "value": "67807b0d4d7e06ec19ea358e3a6aa1d1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275815, "uuid": "9b9010af-395b-47e8-ae68-297fb6c3ee5d", "comment": "Malware payload (DCRat)", "value": "1de387e5e1cb55d5b61999f4ec4a534217d489cd3e626503ad4328225ef0770e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275815, "uuid": "f28310bc-9b3a-40c5-bd67-afbcedca2a61", "comment": "Malware payload (DCRat)", "value": "e5433ebf403aa6c773e5ed08c54e6bc8076f5fca", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275815, "uuid": "114179f9-053b-469e-9e26-a9d020e0cc37", "comment": "Malware payload (DCRat)", "value": "c0dead274f6bbbb3bcf70060b1db4738f497a9001708ad0d93e1d9bce89963550cd34ba2001d89dbeb4970da5b64b99e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275815, "uuid": "ddba4371-044d-4d77-a28d-48fb7c04cf24", "value": "T1A6657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275815, "uuid": "c0ba35b9-6f4e-4617-822c-a99118ef656f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275815, "uuid": "da1204ac-57b3-4b8c-8373-d7f956c29276", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275815, "uuid": "abadac1f-6d82-4827-87f6-8857f8b1ef7c", "value": 1410957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275815, "uuid": "ce23bd49-8fe4-4cc9-bd6a-155669979a00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275815, "uuid": "784c187d-449a-421a-b4af-5d21b0a65418", "value": "67807b0d4d7e06ec19ea358e3a6aa1d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b78c58-aba2-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676294974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676294974, "uuid": "770fdaa6-b0c9-4269-bfcc-509e8bc4a3ba", "comment": "Malware payload (RedLineStealer)", "value": "4f6f8ee56981d79cbc4c4abf5fc632f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676294974, "uuid": "63fddf95-0786-409f-92e7-c4e665ced50d", "comment": "Malware payload (RedLineStealer)", "value": "1def6930a7f16657797adb53b115a0fc429378f50806de46e56dcae7f8f65e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676294974, "uuid": "8bcfa89b-cef5-4f06-9629-e9d03de359a1", "comment": "Malware payload (RedLineStealer)", "value": "0b066d80aae9b1d6b408ae1700c0978f65ec0ecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676294974, "uuid": "03cf9bc0-8739-4281-b046-7e495676fa51", "comment": "Malware payload (RedLineStealer)", "value": "fcad9a14f88d4d7ae6489aef151ba08e14910ba71bede8162ba7c4a1b603be00a9dcdf0e0bd05b53072849683180f523", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676294974, "uuid": "85dbd132-7693-4ede-b747-0f1d4e673acd", "value": "T16EF41207A6EC8132E9F6537019F703C31B3B7E604B388297238F6D5918716A4A6B5777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676294974, "uuid": "a4430bde-5c18-4a77-9d62-1cc211564395", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676294974, "uuid": "800cdb87-9005-4a63-8e5a-902d6dd999d0", "value": "12288:RMr7y903wX/LW0ctPFcKemW7F43QeJlsmqNMLJwFoUvHtmn2DsIosHR:+y3X/K0csslsvYYtm2Dse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676294974, "uuid": "34fbe427-7394-42c2-82ff-c8bdfd65def0", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676294974, "uuid": "829c001f-c8b7-4adf-a9b0-f641ae536bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676294974, "uuid": "596d86ea-a620-49e9-b414-688c1fd6baf3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805e4b78-abe7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676324629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324629, "uuid": "62c2fbf7-d3ea-4908-a90c-bc9d57d86cbf", "comment": "Malware payload", "value": "e1141d2705e1b5080831f9dcd1cc3595", "object_relation": "md5", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324629, "uuid": "3dbfeb5a-2910-4f4d-aa85-0a8a5ca7d723", "comment": "Malware payload", "value": "1e6112420d4e9561e458e074dad3ebed54ae6f759d5c3ae9844c8a61ac7f33d3", "object_relation": "sha256", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324629, "uuid": "0302ce49-a647-4c39-8637-c566f46ce99e", "comment": "Malware payload", "value": "a0849ab6d74affd01e71f5580396ed622745c57f", "object_relation": "sha1", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324629, "uuid": "eca4a1d2-14b0-4210-926e-11ac14281eb1", "comment": "Malware payload", "value": "b0d70248669e8e0fc4693c1b706d66b6f4380ddcb06ba89c97853934b126bfe692c637fee869be1f18ebb90b751ad6a2", "object_relation": "sha3-384", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324629, "uuid": "c964c783-b5c6-4696-aa0a-0d37076ddf6b", "value": "T1EF1733E923988DE7C8D5653F8C1FC43D50AAED110358D9CF81A9731A2E736869937FA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324629, "uuid": "39c2b171-9575-49c2-8ada-5c20e0b762dd", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324629, "uuid": "6b5faa34-e48b-4f0d-b64a-508dd05907d0", "value": "393216:fxAlndYXAnAu0ptGT6K4/m3pFFqyoBgsSvCwJnZ4MYZizQ:mldYXAnA9ptGWK4Ky1jwNupQzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676324629, "uuid": "cfc927d2-4933-454d-ac66-2d14086153ff", "value": 20179689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676324629, "uuid": "8308eb23-4ad8-4f78-b175-27ede2e9d821", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324629, "uuid": "f264378f-0788-4fce-adf2-a67873a3dd56", "value": "nitrogen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e4a027c-ab57-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676262832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676262832, "uuid": "b1121041-b205-47ca-bc5a-6063f8bf9633", "comment": "Malware payload (RedLineStealer)", "value": "64f79d97e9f196c37a8dcbc9d70beabe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676262832, "uuid": "22b7e205-08e7-4ccf-b83d-b03352eca5d3", "comment": "Malware payload (RedLineStealer)", "value": "1e6d9cc2b734cde833105e637255fee354d3ce8e0dcbe0e062ad5bf8c0c86a67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676262832, "uuid": "16c3e2fa-2170-4d57-870a-a6ba4c51f4e2", "comment": "Malware payload (RedLineStealer)", "value": "bd1cc3985a61ce32721367b408cede85f713f048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676262832, "uuid": "c1028d11-a922-45a1-be48-24b79b1adf33", "comment": "Malware payload (RedLineStealer)", "value": "0b9657f11f62095787cda158207737be7315bb2a87474bd6459d33da3024aabc27a45ea78b26a830aa2fd5f39d755871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676262832, "uuid": "b2ea0442-f333-457f-91d4-cca7d476550b", "value": "T1DCF4120BB7E89462E9B55B7058F303D70A367D706B38835F63CE5E5A08729B1A13076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676262832, "uuid": "0ea05dfe-6239-43e7-a8d7-e268b4ea2ce0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676262832, "uuid": "e332ceea-c87b-4839-99f5-5eda23373240", "value": "12288:pMrny90jYDVJZWsEe1CzCxwM0kzdcr4NIp5eJUBmDh8qEqKuMgxwWTcxp+hdC+7:OyaSVJ5Ee1C2CSSrwjQU8qEqYgLTcv+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676262832, "uuid": "049fdcce-9b17-492b-b44d-aa4079e24954", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676262832, "uuid": "2b5f33d5-040f-4945-b65e-2323de4f8948", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676262832, "uuid": "02ff003f-2a77-4b4c-9efd-d6a7665165cc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3827539-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676284826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284826, "uuid": "fd01007f-69f0-4f89-acff-96fd127be403", "comment": "Malware payload (njrat)", "value": "0b65715bd40e91c724f6640c5e468309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284826, "uuid": "b2ec94af-2936-4cf9-af53-d4a5ec78306b", "comment": "Malware payload (njrat)", "value": "1e81893309fd926c52a5ad58872883eec58bbeadac5c4c605351db6714deee54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284826, "uuid": "d64ab2fd-b688-48d4-be41-e93c29744afc", "comment": "Malware payload (njrat)", "value": "878f555b69d549d22ce86f04469e9240c72ab32b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284826, "uuid": "b02a1cc2-a992-475c-ab33-1d2df9930b4c", "comment": "Malware payload (njrat)", "value": "b2160fb8257e81661c13259c7d94ff59493d4f5f3ff42b5e13b2ad77fedbf5dd5e2839fc3e9e84df6cb05b7d25f23be6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284826, "uuid": "5152f7af-0794-4eeb-9466-ad71794bccba", "value": "T1A1032A4D7FE18168C5FD067B06B6D41207BAE04B6E23DD1E8EF564AA37636C08B50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284826, "uuid": "3240848b-e5b6-4e0c-9281-2f898ceb0701", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284826, "uuid": "d57490e7-ce38-4675-98db-be834ca0ecf7", "value": "384:oDQZCiT9SLHHGhlbJcycPXvQJKUPDYwSoNVrAF+rMRTyN/0L+EcoinblneHQM3eW:wIJrJ/cPXoKUU1oLrM+rMRa8NuA/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284826, "uuid": "9e6471dc-6fa8-4646-9698-5c9239f5b157", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284826, "uuid": "b2ece379-68e0-4bf9-a1ed-d69af9b076c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284826, "uuid": "e3833385-4cb7-4456-80f1-3340bf2b680f", "value": "0b65715bd40e91c724f6640c5e468309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bde00de0-ab7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676277917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277917, "uuid": "b67124ce-260d-467c-9e86-d67cafc6f5b9", "comment": "Malware payload (RedLineStealer)", "value": "79f29087b398759dea999db7057989c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277917, "uuid": "be4e25a9-dcd2-4858-92a3-5b46b6087029", "comment": "Malware payload (RedLineStealer)", "value": "1e82ed7a9d804175a7b412ac27314dbdf2e2c3453aca9954a12a30a521f47a8d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277917, "uuid": "b2019eec-fa57-4096-a9c4-68723b81ca75", "comment": "Malware payload (RedLineStealer)", "value": "246f73151b02a4c27285aa7ff3ce4bcb3f63fe0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277917, "uuid": "f4493528-df5b-422c-889b-1ff791ee7f44", "comment": "Malware payload (RedLineStealer)", "value": "d303343ebc4bcf13f7e7c55933a696229c92436210896266d697f1e72d285f5a440d21cb6b6d38014b52c0a68f42f943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277917, "uuid": "500b5509-a786-48ad-b802-37edeeab44cc", "value": "T14C65DFD1FA33956AEF9BD3770F9AF07F997860637A714C83408219B248972D85824F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277917, "uuid": "bf507140-e2ad-4dc6-a904-899b47cdee31", "value": "396c902890b802c5ec6bae321a9a9c71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277917, "uuid": "1c339b09-9494-4219-93c1-ac15740a95ad", "value": "24576:ATEJn2l0Sq9c8CsQxUau+Eiu4Vk3XS4uIgByzgeGYKGb4BXy/A4H8tVytC:AE2l0e8CsQxa6v4TN0s4BXyxHsVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277917, "uuid": "adea4149-8081-490a-940a-e9216308d9a0", "value": 1545232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277917, "uuid": "6b85eac6-4966-480e-9582-a175231ce418", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277917, "uuid": "f1a1bbf2-e495-4ce5-bab1-341213e426a3", "value": "New order RS302-2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e785ce3-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676299662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299662, "uuid": "cbb1e39d-046d-4b0a-82f4-fd5e33628775", "comment": "Malware payload", "value": "8f1b80307513713a13b552f09c84c059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299662, "uuid": "b51afab3-5811-4450-920c-fe74d60dd670", "comment": "Malware payload", "value": "1ef0fe49cef266707c54468ea0113c06965f021ca19db32035d80007b6517c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299662, "uuid": "9e475814-e21e-4ce4-92fd-90991a80be9d", "comment": "Malware payload", "value": "b322e09d207866ae22a7d4bc48ded08fee80ecb6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299662, "uuid": "3c4a374a-4d37-47bf-860f-0a77e0048258", "comment": "Malware payload", "value": "3927c3784d7e99605417d5619e3576a2641663eea13066465483ee82896c83bcdba6178864fb7e997db076a91d7cee37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299662, "uuid": "d89ee636-a98f-423c-ad8f-61b2ff752983", "value": "T173C623D115A51690E4EB4720718B17AEB4A1BF9C92FC4D0C7DE14C022F45EBE368B6EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299662, "uuid": "94737fed-1a8a-4c62-aab8-0b7fbea9d0b3", "value": "4669d3101b93c0434b0a4ff67f74e387", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299662, "uuid": "3988f4df-1658-4ddb-906b-ca2c74676e02", "value": "196608:eR+IUT6ycTZrIEW04lHPan1bOWBIf05Zzk+cG1V7CWKW3j5eAb3QaNwTV/Z6jo1:ZJcTp9AHPILIf05hj9n7vv39eAb3QRTB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299662, "uuid": "4f65a2af-edef-45fa-9643-9439600bc0ba", "value": 12239360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299662, "uuid": "3e2d5f5a-bee9-4de8-bff5-5463e362bf74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299662, "uuid": "1f68233c-a1b9-4f0e-857d-f191db81c224", "value": "8f1b80307513713a13b552f09c84c059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b82109-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676280912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280912, "uuid": "c8d49791-a1cb-41e2-8ca4-06e994ff8aec", "comment": "Malware payload (Smoke Loader)", "value": "e2dcabf49b18288715a1cd844e70bacf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280912, "uuid": "34f50f44-c5ba-40ff-9d3e-b287cc0f7698", "comment": "Malware payload (Smoke Loader)", "value": "1f36f4abe57a85d5580b77154c8fcd7322edd62c9622158f09728e9cf9e115c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280912, "uuid": "d51ebbfa-2480-4060-92b4-48ab180aebf1", "comment": "Malware payload (Smoke Loader)", "value": "b12a68e26cc63e95c0cc15495979bb7610d817a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280912, "uuid": "becd3664-1059-4028-a816-a01c086e5d85", "comment": "Malware payload (Smoke Loader)", "value": "f6c2758401613a727005a30af1eaf7e87508e40dad98fa735bdcff69c80ccfad9c453bf9500638f44b4e5d54230684e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280912, "uuid": "c6932205-ea8b-49c7-af23-23213fcb8a1b", "value": "T1D614CF2377D0E473C5321630AD79C6F16B7EB8B15E38A56B37582A3F1EB05E09622352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280912, "uuid": "ed854853-ab17-4821-8697-132f364db770", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280912, "uuid": "a9898b22-d60d-4916-86e9-6986e9d03473", "value": "3072:P3Bdcf4MOacGKGBhKOYAk3Y7H4y5JeDve64wyEwkv2upg3:P3zw44K2hKOY96JeDB4wxwkvLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280912, "uuid": "e23dc51c-531a-400a-b3ec-c431e9fd515d", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280912, "uuid": "6ec3a046-1d5f-4f62-bc01-7320cde24a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280912, "uuid": "1b2995db-fca5-4c56-a8d8-6eecd76ff319", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23911b6b-aba7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676296986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296986, "uuid": "aa7fda46-0b69-4f40-bd3a-0618d2bdfa96", "comment": "Malware payload (Amadey)", "value": "3de96cee156994b4b8f77b33986eadf2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296986, "uuid": "0eb13c18-045b-4ab5-906c-f66d9ae7d8e9", "comment": "Malware payload (Amadey)", "value": "1f7e8e0706b1efaa56e1fbc7160936f3de3c20379ff2f8e736c9f5bb8cfd83a8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296986, "uuid": "b06b739a-7ea6-466a-82a9-fac62a43b316", "comment": "Malware payload (Amadey)", "value": "12ec082d3a71adc61bfb0c161cec62d311955e96", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296986, "uuid": "b6c1896d-9925-478d-b602-408f1e2ffb55", "comment": "Malware payload (Amadey)", "value": "050e3b8f6cab53680c56a656531569753290d54cbece03541cea13ffea752de9230435b2329f333fa05254808ae0f295", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296986, "uuid": "b4164952-e674-40c3-9899-2bfabfd6d86e", "value": "T185F4124BE7D96073D9B413B018F242D31E367D616B3882A727CE6C190CB29B57A39376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296986, "uuid": "6ab33205-d9dd-48ae-8a80-b8872b6bf7ec", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296986, "uuid": "5f624e29-315a-4c99-b209-748e36279eb2", "value": "12288:FMroy90hYt07YAZbGwTxQIeNutteJjppEs35SfUFtNNt3S7jfaB:9yMy07YAUxNNu0jbEQ4fuNNt3sfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676296986, "uuid": "8740805a-d71b-4ca4-85b1-084b1d48db28", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676296986, "uuid": "50c84e2f-a251-4805-92fb-bfe2e8aca73b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296986, "uuid": "7dac8e89-e5d9-492e-9866-9089eec0b345", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b27872cf-ab7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676278328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278328, "uuid": "c417d6fb-2ba0-4124-9fc3-c8a7e1e0a845", "comment": "Malware payload (GuLoader)", "value": "e3fbbd358ba94c81d8a98bf0094e0b5f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278328, "uuid": "d891de6e-a24c-43c7-93a8-15fcd4bfc7a0", "comment": "Malware payload (GuLoader)", "value": "1fdf68f0dfeebac092002cb137bd0712530486d57ee2a919bc690bc65a70430c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278328, "uuid": "ec3b8a43-24a6-49bb-abd2-ce1941db166a", "comment": "Malware payload (GuLoader)", "value": "f01141d49bc22de7b53c2f102d8258eba92b7bf0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278328, "uuid": "67000c38-ef0a-4af9-8155-7a8f1d14107f", "comment": "Malware payload (GuLoader)", "value": "f6d490df45dc46378f7bdcc297fd49c14abed9ab592e23f91b070e1e82511d32d37f48578e450178858b3b86cb04ef28", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278328, "uuid": "5605802c-3b0b-4ad9-857f-927568a95030", "value": "T1CDC2E1E1F89F5593D0483D7DC19CFEDA9239A936E38040B12F4D22C29787E4A49F816B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278328, "uuid": "99ec8147-1852-454a-81b4-56181d34d4e2", "value": "768:lRvNEiubRe0pVh+2XsAOwYLknXufwpYlZwEk:rvrubRekk28AOpLQX8wqlZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676278328, "uuid": "9dbb316c-4554-4420-8098-4466cb2c04ca", "value": 27948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676278328, "uuid": "855159bb-c8e7-40d9-ba5a-c86d69f1bad4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278328, "uuid": "0cabb99b-da71-4403-ad08-cb6f66ca5331", "value": "Invoice copy.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683e2612-abd3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676315999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315999, "uuid": "85dbaed7-cfc2-4442-b7bf-c0b89465b248", "comment": "Malware payload (RedLineStealer)", "value": "01458717bce2e9f8c051de91b21bf6fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315999, "uuid": "59329eaf-eea4-48e6-b853-b28146e17ecd", "comment": "Malware payload (RedLineStealer)", "value": "1fff503c8bcdb3e20b67e8b0e065bcbe4ed10e9545700b0857f9fbde345693db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315999, "uuid": "24213d3b-7f0b-4c0e-be23-5dc09cfbba62", "comment": "Malware payload (RedLineStealer)", "value": "c3f2daf5f1d3958d13039a7f68ce3723664ad17b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315999, "uuid": "4786066b-22d4-4294-a7bf-869c1dbb33ab", "comment": "Malware payload (RedLineStealer)", "value": "f9bb948d24351cb7f3dc08afa65c27b2e514dd7eb471e87122ec3aee04aedd1130e6846d37dc119691d3ffa8cf664dab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315999, "uuid": "9604a80d-511a-431c-afad-0f175e52c7bb", "value": "T1F5F41267A3EC6022E8B6677019F303C30A37BD615778638A274E2C5A59736B0A57137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315999, "uuid": "2b43cf95-0de7-4487-8e49-cee253d2f54d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315999, "uuid": "c88c0216-1f0f-4133-8ad5-ba44a8a06541", "value": "12288:WMrwy9072W/D8VcgC9Srxt65zBVRuT887bnIPD4vyu+jbtPL3QJkBpj/2Dh:iyqQVdC9Sdt65zBVRa887bnIUvB+jbtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676315999, "uuid": "23e058bc-2255-4846-8190-9606358412d5", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676315999, "uuid": "23a22941-ee14-4432-b08c-231ae9402eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315999, "uuid": "a95581c8-b264-4c43-a961-276609d1b4a1", "value": "01458717bce2e9f8c051de91b21bf6fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7110101d-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676284660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284660, "uuid": "2373f479-04f7-4b02-a9b4-30fdb3e033f7", "comment": "Malware payload (GuLoader)", "value": "cf68349323ec6eb8e8fb7e6ba6109542", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284660, "uuid": "e2e30cc2-03cb-4b2c-9ec7-6857bc52eb6f", "comment": "Malware payload (GuLoader)", "value": "20219d72098bf265f97a52ba7733774c7a743f5dd62c195182b60d70da5cc3e7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284660, "uuid": "59e91eb8-a6c3-4127-9549-d08da3934001", "comment": "Malware payload (GuLoader)", "value": "dd85185a3d49765a0a6851a98e494f602527af63", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284660, "uuid": "36c2a07e-6cb3-4cbb-92c7-9182e7c04809", "comment": "Malware payload (GuLoader)", "value": "e1ec27e785bd61f2d65a350c2d65fa1c747afab863d680bd72cbed7c71cedfd896fcb911a45028017a784479a3cedede", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284660, "uuid": "a8f5e21c-371d-4d5f-9ff3-30b35fa51057", "value": "T1DFA4F1308B1A05941B4D3355DE460E64BF668C171132ADF9EEDA63BE6C1374A863F32E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284660, "uuid": "73ed3f97-0428-43be-bee0-dea2ca630842", "value": "12288:4IRG7WUS5/aQvR8m1HkpIOg0iq8T2h4nbzwVAsl:dG7TmXEpIOg00KmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284660, "uuid": "b26de24a-beb7-464b-a497-4dd5b78ed59a", "value": 463776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284660, "uuid": "ce568bb4-fdd7-4542-ac1e-930f9f1244a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284660, "uuid": "9821fc21-63ec-4392-866d-4a05a2ec57c5", "value": "TUOPU GROUP - REQUEST FOR QUOTATION 201323948392 PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7050f9f0-ab54-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676261466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261466, "uuid": "b814e342-54a9-4505-93c3-adb0ae556656", "comment": "Malware payload (Amadey)", "value": "20a001f3831c00844d5f3349cb52eca4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261466, "uuid": "66a1e5a0-194c-4800-9447-eca3b3ef23c3", "comment": "Malware payload (Amadey)", "value": "203d2328085c36d847614cdba40985e267eeebca331fe5e56ae3f328fb51e9c8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261466, "uuid": "6387959b-6423-4829-9026-a4e3f5235bb9", "comment": "Malware payload (Amadey)", "value": "ef5a7bf5b9d6a8e2b384a721cfc12b9cad9b36da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261466, "uuid": "aeac843f-ead9-4dbe-9b21-9987697f365c", "comment": "Malware payload (Amadey)", "value": "5933bb7265d1cd34280413dfa99ed553e95b9de7ced0f8035ee2076de70b03fc96f6207576687b414223e60ad11c5adb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261466, "uuid": "722a0d8d-6c9f-49fc-b773-d37556a848e3", "value": "T13CF4120BBAECD572E8B1177118F507D31A36BDA45F38829B138F9D4918322B1A6317B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261466, "uuid": "4b94155d-8cb6-4eea-bb1e-4a3c0c76900f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261466, "uuid": "d0617422-59fa-464a-a22f-68c784582ced", "value": "12288:aMrWy90UoAEjkvU8GKhH5wgNDeJDX2eJBqmsrxbsCMgO+JT0nIVwVX2/B:Ey98j8Ge5wgNDeJDHBqZxoTg1T0I0Xs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676261466, "uuid": "9167e11d-9fe5-4ea2-a466-d736cd0c926b", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676261466, "uuid": "e9b00b4e-75eb-4741-aa1b-5e81b0cf1453", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261466, "uuid": "83577b35-405c-472c-b1ff-426bd7752dec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa616793-abca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676312244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312244, "uuid": "6d48eb67-8f93-4a05-a21e-cecd73246f9f", "comment": "Malware payload (Smoke Loader)", "value": "026cbde962eb58b513e209c29dc0bc6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312244, "uuid": "cc9f0e16-d2bf-4c14-ab9c-e2ed58831ca7", "comment": "Malware payload (Smoke Loader)", "value": "2211406fb6c479a9ab9d7c39d46054979b4cf2bd56b32dd6aa4ae5039de4ae6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312244, "uuid": "7d9a63c5-47c8-4ec0-b474-0fe88f9e76b8", "comment": "Malware payload (Smoke Loader)", "value": "ff0569343b9d4281e2dcdbd3162348bd1a288dc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312244, "uuid": "2eb954e7-ad38-476c-b5b2-a4248aec53a5", "comment": "Malware payload (Smoke Loader)", "value": "e9f578a2bb7333ba6e2bdfa43c89375c07b82b9413e64d7f3e6e4d10552530d568f736f043d153f57a481aacd78635ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312244, "uuid": "338e5057-069b-4cb1-85e5-dde84dd8ad89", "value": "T15204C0A333E0E8B1D46656314D69C1B13AAEF911CE39AA4B37B41B3F0E702D19B76351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312244, "uuid": "0fe5c7fe-90e0-4dae-9385-5ac4c08745cb", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312244, "uuid": "3a44ff2d-85a6-41ed-aab0-9a040191611c", "value": "3072:KoSvn1eVPZSMimTR9EGSh24TObnwRNXfB0VCsGi:KpvERSMi6p024iwRBp0V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676312244, "uuid": "1c75c8c5-49ac-4b09-ab14-3760446c186e", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676312244, "uuid": "a41eed3f-2e1f-4b60-aa4e-eeda36bbf08c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312244, "uuid": "c093daff-f056-47be-99e9-4a880171af14", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ddad05-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1676272023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272023, "uuid": "7bc2d6a1-77f3-4bed-8ab1-1a399d5af089", "comment": "Malware payload (ModiLoader)", "value": "65250f0ad2787ea8cb2e5fee7c53e167", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272023, "uuid": "4af8cc53-f461-48fe-b467-a5b8038f9648", "comment": "Malware payload (ModiLoader)", "value": "221784974f49f2b54c90c63ce6cf9550d94b15c3442c29c959300dbbf5b91f61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272023, "uuid": "d0e472d9-963a-4868-994d-1f70cc1faa94", "comment": "Malware payload (ModiLoader)", "value": "8e0a2e30c6bff77acf9e34c172110817f337b805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272023, "uuid": "617f08a3-94dc-467a-9f24-a42a6559e7fe", "comment": "Malware payload (ModiLoader)", "value": "5602b1cb6017ae8bf44c05e2a12d58ac5dba6a3768ef46172fab02d6744857d1089e275a76d8870cc73b0bcfdb080859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272023, "uuid": "57275079-cf4f-4d6d-b6ae-d7ac32fa0632", "value": "T18DD48D2AB6E0F576D2F2257C8C8B97749C2ABD91281469087BD73F486F3874134293B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272023, "uuid": "0901d208-093f-4453-b2ba-0265abedbf8f", "value": "448e010fbca86bdb636fcec3f8861ac9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272023, "uuid": "f8670bfe-4f48-4df0-99f8-7c2eebc741b8", "value": "12288:2FKycbLh7VPknGR5mXStQLZkCu+Bg0Mo:2F1ah8WAcQdLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272023, "uuid": "7c138758-f43a-4827-916a-1d8734019833", "value": 612864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272023, "uuid": "30d3b859-64cd-47ee-a1b1-354c1afa9a70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272023, "uuid": "8884e94a-1c71-4502-a0e9-0d16fd413084", "value": "BTSL catalogue_2023_samples_list_revise_ol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e38f127-ab99-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676290964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676290964, "uuid": "1a8b3ad0-23bf-4ab0-8ebd-e43c2ccde0cf", "comment": "Malware payload (Amadey)", "value": "128ca85916fade2f19dbc4617d6d5fb5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676290964, "uuid": "83483497-d8bd-45a9-95d7-3d5c4d933c62", "comment": "Malware payload (Amadey)", "value": "223d95f6c40c17ddadc7c9e588bf0511b55b03f02e56d4ee840ce3283cc8b465", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676290964, "uuid": "efe666e3-c889-49b2-afdf-ba54cac9d3e4", "comment": "Malware payload (Amadey)", "value": "54e1f12d9eaa03d10f646b330469680007ab3241", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676290964, "uuid": "70a6c67d-d45a-48d5-8da5-ad1aea4eda1d", "comment": "Malware payload (Amadey)", "value": "7e718a7ae755cc5dce4f4fba10800390dc6bc1dc1175db071c81047d63826292aaedc153890efa9953ba2ea36e982d6f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676290964, "uuid": "c668c766-066a-4dd9-a454-bd7a76f7c6ba", "value": "T1EFF4124BA7ED4463D8B8537118F202C30A363A529B3983AF278F9D591C71AF4B5317A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676290964, "uuid": "30152e74-14c8-41f5-a601-152bc2fbec18", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676290964, "uuid": "53d1e15b-98e4-4c7a-ad83-fea0bc2e8be6", "value": "12288:uMrLy90IN/w+bUk2OLOjvES+eJtw6E40fr2rroQ9R2lrMdmUwHe2M:dyL/w+QZjE0tw2UQTTdnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676290964, "uuid": "3d5af140-1792-420f-b297-4150e4b39673", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676290964, "uuid": "9ee0f6bb-d296-4395-9f21-41ebae698403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676290964, "uuid": "3c6df545-76da-4167-bd11-4e82bf51fab7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94146c2b-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676299752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299752, "uuid": "9cfe69ec-bc53-465a-bf99-2b11bb466fd6", "comment": "Malware payload", "value": "d6005c0fba6bd3ba323841900e7d14ae", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299752, "uuid": "0bfe121a-c4ff-476a-be9e-b195d40d08d2", "comment": "Malware payload", "value": "2245421c55b49a002617de64b4251a6102f0b7d5527675284821edb4e6853ad6", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299752, "uuid": "e1688979-9565-4484-a212-a0b08055f9ce", "comment": "Malware payload", "value": "ad23e1210e42e3f9aa7cc7db5ecb12ccd307991c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299752, "uuid": "80891d90-aa58-4fac-9bd1-92fa920ee651", "comment": "Malware payload", "value": "6f1ed962a1495ccce4f6b8d1b16999d20429a4b72bcf10b2319304249795024395999d9fba088fa7d759528ba94018f2", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299752, "uuid": "3248c279-61c4-4314-81ad-7b70373f1ff0", "value": "T152651207D171BE8EC43FC63CE8EF84724012BC316562D40B6855BAE955B6EA07A3E6DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299752, "uuid": "98a7068f-f81d-41ac-85ad-dfdf1188656a", "value": "24576:rYV2ruo2Tt6XZx68WQYr2HNlw2Tt6XZxp1eTumvPNs1so4xzGJ:yEz2Tt6ZmVANlw2Tt6ZteTumnNGso4zg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299752, "uuid": "7e7c4f44-9b61-4b2e-b805-4cf6c6903e08", "value": 1501184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299752, "uuid": "f5695758-fa77-4e6c-9744-a2bf0c787acf", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299752, "uuid": "9465a35b-b0f7-4a26-b2ae-dca89af12de7", "value": "37809.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c9011f-abe7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676324831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324831, "uuid": "81d467ba-78ec-4ffb-80f2-e589d4479598", "comment": "Malware payload", "value": "5ac116849e001c70a2f5e74e6b299857", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324831, "uuid": "354a2c5c-7d10-494e-b091-1999a01e6b3a", "comment": "Malware payload", "value": "2287f65b741567bf25b1b5557b1ecc8b27ec9917e24d09765e31cdf3e89b1249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324831, "uuid": "c145e276-6ade-4553-a2ec-307fa383a1d2", "comment": "Malware payload", "value": "48fd233cf3fb83e64493f18875a1c4801052fb8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324831, "uuid": "296e7a9c-4e5e-4e5e-9f1e-89c85ad1a82f", "comment": "Malware payload", "value": "4f9c48f2ba5d8a5d9ca4e8faa3c631a23ff1371c1bcff7c102fe5a7b7c550dff043c258bfa84ad48d1382f02fa08bd71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324831, "uuid": "9d8d9449-d218-4b73-ad90-5cb1f4f0c45e", "value": "T123F4124F96E84123E8B157704DF607C31635BE915638834B638F6CAD0DB2AA1B6317BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324831, "uuid": "9c0f46cd-1350-4962-bf83-119416317259", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324831, "uuid": "ec91fb3a-aa6d-4151-b604-072f77d5ac23", "value": "12288:EMrRy90qOfHEzYUKb62sc1RFv2J9HeJiIMuh22N0m6z:FyfOfk0/brvjwuL0mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676324831, "uuid": "09210f8c-4fcd-425e-8d8a-503f2f38cd2f", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676324831, "uuid": "74fcb456-acf4-4080-ba9d-eab6f14a779a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324831, "uuid": "3e9a6398-2faa-42c1-b038-7d2bd90240d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d159563f-ab31-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676246597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246597, "uuid": "a2d94611-dca9-499f-8c54-464ba4ea5293", "comment": "Malware payload (RedLineStealer)", "value": "dc7b9dbde24f726f4c355fb40fb3d4f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246597, "uuid": "7942e464-be88-4a03-a14c-38032d74e012", "comment": "Malware payload (RedLineStealer)", "value": "22b8eea77c280d8bbfe86c7a3acac4e60f11bfeb5fa03cfef44678513af49600", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246597, "uuid": "d8947418-6c0f-402a-8343-d4e44c1e0d99", "comment": "Malware payload (RedLineStealer)", "value": "1bac8b6d21b0ad8947e586a28bdb3ab9961a96b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246597, "uuid": "5aac2b3c-fbe4-4c84-a8bf-47474979338c", "comment": "Malware payload (RedLineStealer)", "value": "8f0af48d55bdf745c48a716e368708f0610b02fc23cfd84d0b12235c34b82b99f47a54b7377afc0b2b89d3fd1b033447", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246597, "uuid": "f2a5ff2c-58a8-48ac-808b-a5dc52980c70", "value": "T1DBA6335A1796C4E0DBC80D34C3476EDE73F227712E254826D954BCB19873F98BF26A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246597, "uuid": "8fb8a461-379c-4f8a-ae3f-ca493e3ca447", "value": "881ebfb4b8b20e1f3b3657fb82622ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246597, "uuid": "f5f2dfbc-f952-4e07-a8b7-eea1125d6e42", "value": "196608:oP63XnudSEw0+1vQHHYsXfTmcioeU94QmdjjetM66xUewh0iIp26XkAjsEy9VB3p:i6XudwHSfFr4BKMD9w0RbkAGx3Z37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676246597, "uuid": "263e0288-9993-43f2-aceb-e27d0fcb4c48", "value": 9976472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676246597, "uuid": "e7f102cd-d426-4a87-b1df-c88aa4a6bdf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246597, "uuid": "3261062b-8c3d-46cd-a79b-b1ef27d0a30e", "value": "dc7b9dbde24f726f4c355fb40fb3d4f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0ffcd1-ab35-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676248197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248197, "uuid": "1b4906cf-89a7-4b89-9ad2-463ff0799e82", "comment": "Malware payload (AgentTesla)", "value": "3ad7ea369e552d9a8f438826d69dd0e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248197, "uuid": "059ade6c-805c-478c-ac96-6170d4a30d64", "comment": "Malware payload (AgentTesla)", "value": "22f3463a562042a1bbc5b10f45119aaeefc6115e5c238bb0bc41b60fb5d29a61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248197, "uuid": "4a458b93-1d35-498b-8ac2-951353b9820f", "comment": "Malware payload (AgentTesla)", "value": "2ba70a39438280a1af147f7de2ca2f6b9f9d9b4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248197, "uuid": "20f20549-8f80-4830-a997-68b605b12c28", "comment": "Malware payload (AgentTesla)", "value": "f39341b16a6fb4cd065ae855f61cd4a347dc5caeac560c58ac084049d29e1f64ef92e0094be2cc295512df16cc69821a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248197, "uuid": "96692a50-1603-4f5d-9710-15824725c5e9", "value": "T17005BF48BEBCF8E2F9D36D7A0D2D76550B121587338273B686EE768C9E02277B510E11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248197, "uuid": "745def1a-581a-4b09-a1e9-b254da200920", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248197, "uuid": "2cf993c5-8d1b-4cb3-94b4-f0c6288fc583", "value": "12288:y9iIdDJkqz2iCt/w1bzfLhaDlRBPUhW/q9BAteQ+y4lMmSbgKywmD4U:yZlNT2w1PfkDQl4GlMRSwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676248197, "uuid": "b872fa41-ac03-4109-8cf4-915b1d98ad8c", "value": 818688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676248197, "uuid": "d4d67656-1bea-42e1-88f8-8250b496b90e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248197, "uuid": "f1a420b7-e85a-422b-b943-af9dc381ab47", "value": "L3_DGC100_L30ST_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "311f9f9c-ab83-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676281547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281547, "uuid": "5a6d6f1c-0ef7-4002-9651-c55abbc8035d", "comment": "Malware payload (Loki)", "value": "34a395f54c844788761fba7aac975509", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281547, "uuid": "4fe74370-0a94-4d0a-9f00-d655e6fd9b18", "comment": "Malware payload (Loki)", "value": "23a7f29def558c98b1d41dcf343901d5267c2d3bb3a7484598f33597c32680b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281547, "uuid": "9e49afc7-d7c8-44d5-90a2-55001dd24e13", "comment": "Malware payload (Loki)", "value": "088fdf435519285d71d6b70009d2fd0e5b8eefbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281547, "uuid": "9ecad51f-3ae2-4f56-b394-3700706a1ce9", "comment": "Malware payload (Loki)", "value": "a6914307acf37af32e5c1935fece659cbd02e1f953a3afac9a31fdace0c3fb45e4c84f721f520680d3e54b585eac15ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281547, "uuid": "12d4b996-4b81-4fcc-a64d-3382397bcec4", "value": "T133F4AF08BEBCF8E2FDE36D760D2972510B12158B339273B686EEB58C9D02677B510E51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281547, "uuid": "2d2b9c36-476c-49f5-b28b-4ad306fb2a47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281547, "uuid": "09bb228a-0fa4-448f-a97c-452938d4b07b", "value": "12288:qheQ+y4lMmSbgKywmqTKAMilJsD3Q0SC5W55wpOzsgp/EafRp3gvs5VpK4U:q6lMRS1r2+g1CM/7mcgvip7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281547, "uuid": "a820ba79-b505-47df-a942-1ece88f78b6a", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281547, "uuid": "da7eaffc-b5ac-4a00-bd68-24bbe377ec7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281547, "uuid": "e986549b-54ae-4274-bc0f-5cdcb14e7870", "value": "34a395f54c844788761fba7aac975509.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69343c8f-ab9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676293237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293237, "uuid": "0739a9b4-74b0-4952-9a96-5550451af88a", "comment": "Malware payload (Loki)", "value": "1da2a3911c08a10e56a66dfe6c9b3ed6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293237, "uuid": "0c9ecfd1-bc15-45d1-90f9-5e5c048dc4da", "comment": "Malware payload (Loki)", "value": "24d4f180287df49a0ac57c20ded42bd9fdbffd88504046e4e7e9b37733d7cf66", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293237, "uuid": "506d3566-44cf-4832-b96f-ccfc152bea59", "comment": "Malware payload (Loki)", "value": "156db69281fe123a7a936bc3522eb4e0f8caf701", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293237, "uuid": "db24c65e-1cc0-4567-922f-fb804c9c4f9e", "comment": "Malware payload (Loki)", "value": "767f5f80b894742fdf1d02105a9d5d51da817ffa4cd6e8d65305a07e52e1166b7a38a150223941c7e9281126ccab2e7e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293237, "uuid": "36276c12-a8b0-4e86-b85c-75dce78ca5bc", "value": "T1D1045A0275DA410232F5266B8E6BF9554F3BF7D69872AE2D41CE0A1C17EF800C691FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293237, "uuid": "bacd635d-2fa1-4091-ad7e-7f1c5da2f211", "value": "96:50zs1VkB3wTJq3Ov7fq3Ovzq3Ovmq3OveAu6Ku2ukuEuCuQuduOuxueumu8Auhui:50wVkB3wTQJhqG4PPJgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676293237, "uuid": "f5ee1e9b-58c5-4762-8223-0398d35b4308", "value": 179714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676293237, "uuid": "36da4f7f-6cb3-475d-9a97-02f93e2ae27b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293237, "uuid": "1a599973-bc39-4981-b7ef-6807dba1b552", "value": "confirmaci\u00f3n y correcci\u00f3n de la direcci\u00f3n de .vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4d811e2-ab82-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676281419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281419, "uuid": "50aad1b6-a48a-4161-9c3f-311223d8d9c8", "comment": "Malware payload", "value": "37d04457fd2559f4e6944091a5023b31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281419, "uuid": "cd423f07-65da-4b30-9d2b-fe3d777146f5", "comment": "Malware payload", "value": "254d16ea78b9098b3de3f475ef9c0b1128b0b7a045799e480441c124ac8cce3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281419, "uuid": "8c223a77-7c55-4061-ba56-13be8f857b32", "comment": "Malware payload", "value": "8d74af6d80ebd47ab5905fba81c561b74f2490cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281419, "uuid": "3cdbb705-5533-4852-a193-6d63ec4def68", "comment": "Malware payload", "value": "84ca867543415fbe67ad9b2205805292fd0267c73f8c57b90b8d3b515f14a48e202e6c5a5979e989ddb9251009529e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281419, "uuid": "358e8fd8-dacd-4a66-a828-5a87b238bac9", "value": "T161552212BAC48472C5730A351BF29730653EBC3057BA8DD753487B5FAA246C19A3BB63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281419, "uuid": "7a0a2b7a-4b6f-46d6-9f41-0c006481811e", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281419, "uuid": "2f9cdb71-5e28-4b4e-88ac-a915b89a2b3c", "value": "24576:YLeTtjJFtHrKllQwFrWp1AL6q0bu5v4shYLEerMH5ec0fKoNHdwKoG9md05cq:YLYkllQQ01HC8zQZecoNHddoIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281419, "uuid": "27bd031e-7a0d-4977-b6f0-d4f0a44f2c12", "value": 1382167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281419, "uuid": "125c23b1-ea89-4f64-b628-bb701b700d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281419, "uuid": "3b2e27f4-a3cb-4ab0-b2b0-ce934beb1742", "value": "37d04457fd2559f4e6944091a5023b31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff86a5a-ab94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676289141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289141, "uuid": "aeadda7a-d808-4432-a81f-aae198a6e7d3", "comment": "Malware payload (Smoke Loader)", "value": "dcd4adbcf2eef595ac7a7421cb0712f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289141, "uuid": "b8ea070d-36a4-4811-933a-7a1785a49f81", "comment": "Malware payload (Smoke Loader)", "value": "25b8a5855c6738ff11be879f203a4bc4f436532343ae20e7474f4afda133af08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289141, "uuid": "01426404-d66b-45a0-bbf8-277984275b7a", "comment": "Malware payload (Smoke Loader)", "value": "d74d90edbe279f669e40b1178e0c02817592aa17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289141, "uuid": "c28a18ec-de29-4b8a-98dd-fa09e5d59cb1", "comment": "Malware payload (Smoke Loader)", "value": "8b66f238766209d964203894fd70bb2d15ea9bb58d3aad0539516da98fb47d2219f3d74bcfc86ae3dfeac936a6a3f9c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289141, "uuid": "d5536ca2-d5b5-49a8-b1f9-1536551a088d", "value": "T13814BF2373D0E431C4225A319B69C6F56B3EF4B04A78679B37981A3E0FB01D1BA36356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289141, "uuid": "ad29b0fb-51a6-499b-8b2b-ebedc030d457", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289141, "uuid": "d130709a-2122-4994-9fb8-10daa59054d8", "value": "3072:/vceFvJFPReYuISBGWxDVE7BKNoofDNq0dle3gIpBFkSsrKuJFmvRYuB3P:/v5hEhI6GWxDVEdKNvbNbOzpBFEWaup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676289141, "uuid": "d2a897c5-e57c-4bf5-9bb6-d7a15d79525f", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676289141, "uuid": "023c2f71-b7a8-40a5-bb17-9728e461e30e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289141, "uuid": "c79dfc9d-4cc7-418d-82a6-812510c1f178", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f91633-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299589, "uuid": "ba1baaac-5b2f-4c09-9292-290c0806124f", "comment": "Malware payload (SnakeKeylogger)", "value": "9519b6b0663f89583f33b2a975411a69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299589, "uuid": "483d88fc-33c6-4e89-a6ac-d395e83b6dec", "comment": "Malware payload (SnakeKeylogger)", "value": "25bd23617f88911622b49194f95acd02170df1bc2ec3cfc8c43415c9d7191508", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299589, "uuid": "9f0d631b-db85-4012-a72d-61255b8914f3", "comment": "Malware payload (SnakeKeylogger)", "value": "9929ff2fdf78c5a14375c28f04e640f07fcc398c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299589, "uuid": "e5bf38a5-5fc2-444a-8998-b7d1635d2c0e", "comment": "Malware payload (SnakeKeylogger)", "value": "d11e2828464f27308074d2daeb301f43ca624e15ebb3f5f78f3c1e5feb66122595d0d88ead27bb64e189d01b101bbb36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299589, "uuid": "fba76496-5045-4b99-aa91-8469a48a39b9", "value": "T10344122872B0E1F7D8A28D311E35E1D6CFF69E153570E62B47804BA43E76144AE1CBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299589, "uuid": "28b60571-e0f8-440a-8afa-86bcfc14d0be", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299589, "uuid": "5564a50f-4ebc-488f-a49e-1839d33bc411", "value": "6144:/Ya6RUItRUBe7SveKkDqDcSttrPyHO4LCxpUZrWCgg7e+0coGr1OWxzE9G+29m+V:/YbUI7SeMeyrtL42xOZrWFg7acoGr1OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299589, "uuid": "e8f7dfb9-2cfe-444b-9080-8fa0e927ffb2", "value": 268986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299589, "uuid": "33631ec1-f249-42e7-9bc0-b88fee0788f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299589, "uuid": "953d2c82-9d23-41af-aad7-a5f5488dac1c", "value": "invoice .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3037db-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272066, "uuid": "1ce05809-59c8-4290-ad89-2a30c9a7d6a5", "comment": "Malware payload (AgentTesla)", "value": "aec6b27d605d97f243aa157a4be0eae9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272066, "uuid": "95c0e500-494c-4887-8af8-8cd3326ddc52", "comment": "Malware payload (AgentTesla)", "value": "25cc67c543d62a17307b534a43d9ba6a061d930d666373d827c8a8bc39c3f3fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272066, "uuid": "4e73fd00-210c-4088-b643-c14a4623aae3", "comment": "Malware payload (AgentTesla)", "value": "5ae6fae2a041f51a17006d397cd49d1bbae664a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272066, "uuid": "4126555a-acc9-49ec-8fab-40768f08ac7b", "comment": "Malware payload (AgentTesla)", "value": "f9b7f65e915ad25a38d726eaab8d0ce3cedff0d07493d49e56e3fa1309dfbad3e8aa7198e674676c25abf903c4651b10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272066, "uuid": "6390bb84-76a3-41eb-814b-de73abffc72c", "value": "T1B9D1B520A3D88773D9A28FFAACF2B3860378E754C853CB9D58C9911A6C0175A0F61B74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272066, "uuid": "463a6cc2-e10c-4b99-a838-f5d281c30624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272066, "uuid": "40a315d0-86c1-4fd1-a133-f07883dc662e", "value": "96:C3VGuCIEBofJxer0wZtSUmIL6kEfBsObFnU:UChUw+8Hc23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272066, "uuid": "f79908c2-b02a-4990-94ce-5c2b33143966", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272066, "uuid": "37f71e1a-177d-4e78-9286-92c8e929a13b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272066, "uuid": "127438e6-7ad7-47bf-89f2-c2d0722afb80", "value": "RFQ No. 45254245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11777190-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676272045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272045, "uuid": "d07c90ef-cd02-4d5c-99e1-0754e04df0f9", "comment": "Malware payload (SnakeKeylogger)", "value": "cf7c79531b8cff92d8954fb999f7c15f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272045, "uuid": "aeebc4a5-1b22-471d-a149-56ab9cc71464", "comment": "Malware payload (SnakeKeylogger)", "value": "263b98c749f448d51dd42f4e083ecda3e6701a08d62fa09c4f931685e52c884f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272045, "uuid": "0877718a-49c8-4833-9c2e-f1aedcc192f9", "comment": "Malware payload (SnakeKeylogger)", "value": "740adcf778d6f48c57b6fadff7cc3c17feef21b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272045, "uuid": "49820655-6f4e-4727-818e-3d51a16d2ab0", "comment": "Malware payload (SnakeKeylogger)", "value": "f114062295cd7cf0a4034083de009c8fc37180d0fb86014f07ba7ae2cde493b3117fba6f7c5c984276d9f8c2ac1dc6b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272045, "uuid": "7ba46a02-6b51-424e-ac94-02da06b98ec3", "value": "T139641234A5A0D0D7DD6517B32D7699B72BF8BE1759B2970B3720720CBA32102CD0D7AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272045, "uuid": "323722b8-e8cb-4e8c-a9cf-c9f85f1eb104", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272045, "uuid": "b92bb7cd-82ba-4cc3-8881-2835ef1513c8", "value": "6144:JYa6r47nk43hKwwZJXjafmuuMG0dw656N96c+d4oIlzEwpMZf/Fw5:JYW7nkjXjafmZ0yG6mcs4NlAkEdw5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272045, "uuid": "437e4a71-2327-4438-84f6-c50d5e9dca28", "value": 310229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272045, "uuid": "66d1438f-2ac7-4e1b-8bf3-d0dcd7ef2f16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272045, "uuid": "e88357c9-d77d-4cf3-bba4-ad32e3cff8f0", "value": "Inv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "297135d8-ab83-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676281534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281534, "uuid": "ce0c8bce-3b03-463c-ae4c-90fdc77b7443", "comment": "Malware payload (Loki)", "value": "7b942d0493a242f7caf5d4295802a506", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281534, "uuid": "255c71eb-1e20-4812-9279-087464dd2aae", "comment": "Malware payload (Loki)", "value": "27254791031b7dccc677b1234dfa8165ed0c92c2d52dbd8de521be3d91b85b5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281534, "uuid": "2e257b33-6411-4ae9-80bd-f565dc6a34ba", "comment": "Malware payload (Loki)", "value": "1437ff886fac1206fcf9b2e4b3c58c7c41dffe81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281534, "uuid": "43791c46-d892-4db7-ae7d-c149e8b36341", "comment": "Malware payload (Loki)", "value": "e3493dd6696f72dacb44f43337da3f9b34c81d54d7d24e292c9f712cd40ddc7b606713b6bc458c4a7ce3ab89c2dfbf56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281534, "uuid": "43af6723-609e-4aa1-9c7a-8216d9a731ef", "value": "T154F4AF08BABCF8E1FDD3AD760D2D76610B12158B339273B686EE768C9D02277B511E11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281534, "uuid": "5d41e731-70c4-4b61-9396-8170962ccb65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281534, "uuid": "bcb69eda-3913-4a38-a1a0-6d5aee17ce01", "value": "12288:9qeQ+y4lMmSbgKywmA/ZSR3UywinlDZgrqNR/pnm7wrj4U:9ZlMRSE43sGRZgrONpnm7wIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281534, "uuid": "d5b91744-bb64-4a71-9983-e2ca7b47f8c2", "value": 747520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281534, "uuid": "20a71258-ff72-462f-92aa-7c4067f6855f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281534, "uuid": "66ccacc2-d8c4-41c1-9ec8-c71a7141df61", "value": "7b942d0493a242f7caf5d4295802a506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534aeb81-ab73-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676274732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274732, "uuid": "351e4848-a885-4d2d-ad2a-b9a0f9d9adec", "comment": "Malware payload (SnakeKeylogger)", "value": "2749638ce6876798e24a4b1d9d92bb9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274732, "uuid": "35ecd3d6-02da-4b6e-872f-f36e39e4686e", "comment": "Malware payload (SnakeKeylogger)", "value": "27d87225d2c5b22a531d89640b5346d988177a8d46b41e7977430dd8e095b20e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274732, "uuid": "e4e9e023-6c83-4053-a5b9-f5d5cae757b1", "comment": "Malware payload (SnakeKeylogger)", "value": "f7e21d6ad323b917b424e197af28da24d5df6d78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274732, "uuid": "b9c93fe9-ec0b-4977-b4d2-d0faf2cf7060", "comment": "Malware payload (SnakeKeylogger)", "value": "d296d375fec62304de952740192d8596b4dc0c3098d3a252af95f59f8bb79ac567e1b8840ff9d62299932811910a226b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274732, "uuid": "083c4c0c-45c5-4e84-a636-08bff104ef86", "value": "T18AF4234A3C695B67C93D87FC1D228924D7612C786C72D7AB1CD7BACF26357B00812A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274732, "uuid": "24d19d55-2acc-4be4-826a-9e92fffcb184", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274732, "uuid": "2516eb10-b001-4530-a09d-43a4954f2f5c", "value": "12288:Zh6q6EMFYC0ND571Vd83alDB1xRc33YQW0XFrSvMTZAOUoJz:ZYXLQ57j5B1xSYEUEeOhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676274732, "uuid": "9ee2db50-e981-428c-9acb-289252acaf05", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676274732, "uuid": "0e3ae2c6-8ddd-4753-90ee-0e0913b887d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274732, "uuid": "ca1f6b0c-ca6c-4400-9b88-994e8d6af9e7", "value": "854F1E97-5DBB-4A87-A566-33D9012B05E2.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4e6476-abdb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676319284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319284, "uuid": "943a4bad-7b3e-4744-9042-35a9490f4ab9", "comment": "Malware payload", "value": "70f0c299c0a070b0d2dd4f7ac38370e3", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319284, "uuid": "6fb9a9b3-d7f7-43e7-87e5-4eb6fa823b8a", "comment": "Malware payload", "value": "29daaa6381788846146385f92073b5e01f1d7dbe5a602b466615291d13969c1a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319284, "uuid": "80c6698b-866d-4114-a203-ddd0be03cbb8", "comment": "Malware payload", "value": "400b2ccbcc79d46ddb292de5d84f2104aa49d077", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319284, "uuid": "99af192c-f66d-4ec7-9193-5a577ac005b8", "comment": "Malware payload", "value": "05ae6b8ab7ddc22d33ffaea23a556696c2e0bd954874881261e9e96b6e60cca304dc7b33e5aaa4bd3308cbe0502e02ad", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319284, "uuid": "fcb8d782-177d-4335-acc0-7ebb05a11e68", "value": "T1499623B4BE4388C6D1917674DCE71E68733AD08BDB450A03A6B9607DCDD231C5DAE8E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319284, "uuid": "1984de97-0344-434b-995d-b61dd6a3c065", "value": "196608:HkbRudGPZsFLLxO8a/HvZwHjpNteRXPABeGkBpOYPK7kU9U:Hk/CPxh8HvZwHjsRXP/GkBpFoDa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676319284, "uuid": "9473f4c3-f946-4b89-8acc-180bcd93679c", "value": 9183424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676319284, "uuid": "73df752e-61b8-4fe2-b9ac-5a0ad2bb2015", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319284, "uuid": "b58440d7-cf54-4191-bae7-05879f5bca61", "value": "file(4).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41378661-ab70-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676273413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273413, "uuid": "a06cb58f-0bdb-4a87-ab8e-4464bb342de3", "comment": "Malware payload (RedLineStealer)", "value": "7fc7660c4586ac5b6cf63d2bfa616867", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273413, "uuid": "8e5d6e5c-fda9-490f-913f-a6b15e34ab6a", "comment": "Malware payload (RedLineStealer)", "value": "2a2a05359afeb631127ebbb8d2d2f2c4c4e3f613a9e1e0fd3287e14577c2578f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273413, "uuid": "bda86377-fa5c-4bd4-aa08-ddfd8d79a407", "comment": "Malware payload (RedLineStealer)", "value": "deb463d889b6e94f57e09fe204a86ce0cad3f469", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273413, "uuid": "99af2d44-cd12-4f90-bce8-fe68c228efd9", "comment": "Malware payload (RedLineStealer)", "value": "7fd971062bc6979a11160096dedc0e60dcd5d5c89ef61512da52c56d3508576d6e338d1028a605c19bdb833c75c3451d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273413, "uuid": "bfe26a6b-f0de-45e2-abf0-bb304f006eb4", "value": "T1D674D75617F5B446E8F244BDC208AE4E978C4D873BC44265AE09FADD7778903A68CCBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273413, "uuid": "8ff11245-b291-4231-acb8-54c0cf561e59", "value": "ccf1a6a07e2c45129c021c589d8f6f99", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273413, "uuid": "0c29cc2a-f9d1-4d4f-8d74-70339a053605", "value": "6144:xxGLnDfnUeEGevHWGv1gVMxm2SdDtv01noxirU:8U6eOGv1aMQ3per", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676273413, "uuid": "f38f70a1-ef58-472f-9ef1-5d40a0d9fcbc", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676273413, "uuid": "3b6d0e96-2714-413f-a11d-7e4de58aa7cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273413, "uuid": "ce5e0ac5-b84b-4230-895a-dd00087889d1", "value": "7fc7660c4586ac5b6cf63d2bfa616867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135b2012-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676272048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272048, "uuid": "a036da6a-2344-485c-946f-03d647f3ad9e", "comment": "Malware payload (GuLoader)", "value": "8777cbc8cafe81f3372c4d005ea0ad2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272048, "uuid": "a4bff6af-ad41-4621-9066-67a30fb85d44", "comment": "Malware payload (GuLoader)", "value": "2b29ea2a7f4440db7fcc805d9b23238d6102f90154a69ffeea36d12657466000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272048, "uuid": "970c59b3-ca89-48b6-90a5-75614a5e5aa0", "comment": "Malware payload (GuLoader)", "value": "1992b225a5b16fdd40dd205392bc4253d80b7013", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272048, "uuid": "7b5c2e84-afbb-4132-84a2-3626c53be973", "comment": "Malware payload (GuLoader)", "value": "d26e83022a77c64207f96f25349fe4497d85304e9a4b88c858f80b252713ca7586436cdf1f5ea7479dada2a3bac0f520", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272048, "uuid": "01ed2683-b722-4f4f-aa2c-61cae8d02268", "value": "T135840202ABE0C2BFC472157061778365A7E4DC1325B61E8B876ABAFC58717429D0FD39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272048, "uuid": "4f5cc424-7e69-40c4-909a-0bed0434dab8", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272048, "uuid": "02f5a38d-5951-456b-abbd-921c05cf8a36", "value": "12288:BbMpZKomNC54R6DXf6pXnR8Cp0kb+fYkI:BbyZKoaEzSZ9b+AkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272048, "uuid": "a0c0f330-69cf-4a3e-b9c4-5f8b646009cc", "value": 404686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272048, "uuid": "03cb319f-4e75-41be-aa19-b24feea56117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272048, "uuid": "d37bfcce-f783-4330-a995-3d7f0dd8aab3", "value": "Klokkestber (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db85c7c-ab33-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676247181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247181, "uuid": "f1fdf206-552f-4936-8025-3bd1bdd616a6", "comment": "Malware payload (RedLineStealer)", "value": "c8696316063997eb24a93a996a657b2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247181, "uuid": "5c8d5083-8fe3-43dc-bfbd-5bfff14be011", "comment": "Malware payload (RedLineStealer)", "value": "2b785403c6e53d0cb8c3710c6a9afdff1d1e4b2d886cf435ba9a75dc5bda66c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247181, "uuid": "e3b2c718-647e-4dae-a1e7-700283332f01", "comment": "Malware payload (RedLineStealer)", "value": "a448a7943ac0cc4fa1958e8e6fe36c7bb410b9fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247181, "uuid": "789d4efb-7168-40e0-8c06-e74bba300fa7", "comment": "Malware payload (RedLineStealer)", "value": "a1ced9eadbce24bd3f897d775bdd2303f384e211029400ef6fbf26b93ee3540a4053bce23a04a85a7875fee5a2a04e73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247181, "uuid": "1651a439-1ca2-4c22-ba50-1ffa3555e30a", "value": "T16DF4124BB7EC8031F9B567B00CFA03D32A36BD51553886EB238E6C1818725F5AA7175B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247181, "uuid": "c620b25c-b2f5-4be4-9dc8-4f4527dcfee3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247181, "uuid": "0bded1e2-2387-4f36-b293-a2e4387cae09", "value": "12288:oMrYy907sBktnVUA1fQ+KZv8zE44/i4oeJU1KodVNeinMrsjE75CNx:Qywg8VTQ+KOzn4KQuKyVNU4jEED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676247181, "uuid": "519c3edc-e0ad-43df-af0b-28eb12f77294", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676247181, "uuid": "e62836fe-1d5c-42b0-9d17-8c802b8c3398", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247181, "uuid": "35d4601c-7755-41c4-bb25-dca3fe13ab21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d85616-ab7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676278389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278389, "uuid": "b8762788-e63e-49f8-b2cc-d1c142b559d1", "comment": "Malware payload (Smoke Loader)", "value": "85fbe5e5be1214311573d0bc17bbe4f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278389, "uuid": "6e1451d7-3e73-4da6-97bb-943f31725a82", "comment": "Malware payload (Smoke Loader)", "value": "2bba2f6e827728c4de90e1d5e2ddfa99e49ca8bd4df6d3b162324fa33d4802fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278389, "uuid": "da11d874-40bc-4adc-b10e-8ffd8dadf69d", "comment": "Malware payload (Smoke Loader)", "value": "6de4fb45ee815528694199d9ad61c7251aa967be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278389, "uuid": "067fb2b8-89bb-47ea-ac13-06b749928322", "comment": "Malware payload (Smoke Loader)", "value": "150e7af6e8d99762bec21b62464075f43534a20dd2b6da6d9b1e8724b4f32cf51ca0765b78359c2052be3f21a4b98a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278389, "uuid": "8bd947d0-3aa3-4ddf-b6e8-856fa930c942", "value": "T17314CF1372D0D472C4621A306F75C6A56B6EB9B15E38A75B3B442A3F1FB02D0B637362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278389, "uuid": "e308eca0-a2d6-40e1-b808-2c48b3a5e79a", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278389, "uuid": "6ff14c44-a8ac-4864-8ef9-ea2e693627db", "value": "3072:F3BdcS0JxJ4+KIKGppNFAqC8/Tln38cxFdZJp2fcDXwN4BOO6e843Ux:F3z90PKwppNFAqXTFdXwN4o1e8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676278389, "uuid": "8fb0c544-3c11-443c-94c5-4f46ec33a8dd", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676278389, "uuid": "d1d6799d-1c2c-4575-ae1f-7e819bead93d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278389, "uuid": "da872c45-f5ba-4751-8fa3-0878dabba40e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b92100a0-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676277050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277050, "uuid": "4ecafc84-b7ff-4eee-a74a-0d95d0388208", "comment": "Malware payload (Formbook)", "value": "94cdeaf96c618dccfdf017804c79a526", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277050, "uuid": "0f055ec9-c1c3-402a-be69-fba3eea9cb50", "comment": "Malware payload (Formbook)", "value": "2c2da23cd6a2d23de30d17d4cb27fc74819cc54cd1d48f7bf3ce62b634afd4d3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277050, "uuid": "883e1582-c574-45be-b7f7-1743f6516b29", "comment": "Malware payload (Formbook)", "value": "72dd89cfa70a2618415635263816acd07f5310cc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277050, "uuid": "b9ef8f36-56d7-4078-8c41-bd5269854abf", "comment": "Malware payload (Formbook)", "value": "220c825fb4f467c2e87ca1af15ecc28e5eaeebd133bfeacd535e15f6f95ae00787090290c01429fafb7edf0636cc879a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277050, "uuid": "577421c8-53f3-47f1-bb34-2063d5d83bf1", "value": "T16C13915AE74F0264CF911277131A0A899AFDB73EB35144B174AC933433EDC2E46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277050, "uuid": "5da8e1bc-55d5-4de5-b7c5-4c8bbd82a5e6", "value": "768:5Fx0XaIsnPRIa4fwJM6ukPix2j7xyDN3lh0qKHoM/DFXTnrCb:5f0Xvx3EM6uE1GN3lh0fHokFXzrm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277050, "uuid": "a1d6c374-310c-4c7f-8ce9-83062b040ea9", "value": 43153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277050, "uuid": "1851445d-2a68-470d-ba10-1730ec3bb63b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277050, "uuid": "387ae400-518e-4f81-90d0-d7ac01316868", "value": "RFQ 705125.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a39fac-aba3-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676295268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295268, "uuid": "8b1d1922-66a4-4c1b-81c5-d54d26f97c49", "comment": "Malware payload (RedLineStealer)", "value": "8e1309464710b52b240676a853e9683a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295268, "uuid": "f09811fa-daef-407e-847a-eddb0722ab2c", "comment": "Malware payload (RedLineStealer)", "value": "2cab7c9752864fff7dbf737ea622dd00eb169a0620e80a5faaee84efa3a77ad2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295268, "uuid": "872fac76-0308-4d11-aef5-19f9611a0a0c", "comment": "Malware payload (RedLineStealer)", "value": "691f35151164fed9b545e8fee60f12152943f13d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295268, "uuid": "f5712c7d-a12c-4c72-b877-150dc1544b0e", "comment": "Malware payload (RedLineStealer)", "value": "0ce39bda2b9f30f69f8521a3bb57797f4b21307884fad17f63f096485b1fdec3eea06bf9126df7fcc2166982216d6f17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295268, "uuid": "305b8a5f-b1b8-4465-9106-a62c6d72a8ac", "value": "T16C54F1127290E473D16266328D2982F86A7FB8B28E7C556FF754233F1E702F19AB1351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295268, "uuid": "a86fe4ad-8d67-45ae-8661-14c2b3a628bd", "value": "b5b37a1e2171531433caad206e98583c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295268, "uuid": "a302e734-e2c6-4cd9-9f59-3e91cc7752e5", "value": "6144:VjrSo/iUcz69JLTMU8+9NF5nM3ZdES11uTUDyE+LSr+xNErj:VjrSB/6jLTMULFS11hDyEx+xNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676295268, "uuid": "062006d2-2536-4535-af63-65c60a4ad51c", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676295268, "uuid": "f1d6a2cc-5b87-4b98-9c43-9fe969476162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295268, "uuid": "e860581c-a636-436c-9309-0a02c68dfa46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22422f23-ab8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676286676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286676, "uuid": "cf1d35dc-2613-4747-a44b-2bb46f41cea9", "comment": "Malware payload (Mirai)", "value": "0f470dceedf0d65a292209a78c49d957", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286676, "uuid": "f04b3473-3286-402c-8ebb-f1c877fb0bda", "comment": "Malware payload (Mirai)", "value": "2daf80551bb5332fda01481f73b098efbcf1273da9b2cea9e4aa612433b07b01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286676, "uuid": "208bd61b-c8db-4ed1-88b5-f29ed94b0eae", "comment": "Malware payload (Mirai)", "value": "3d44479de3dcee5f7620813ae3acc6de5c44c834", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286676, "uuid": "6cc45372-4f6c-4f98-9e34-c3dfd3dd6ae3", "comment": "Malware payload (Mirai)", "value": "071722e8f6894c35bd150a51589530cb0b36f64dc31b47fa2e2147566e8643b0d6f705ebb9803863b34480e947a61880", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286676, "uuid": "d498091f-3e0c-4f0a-aa8e-b36394d8b416", "value": "T1AA434A21AD792E17C0D8B87A11F74324B2F2674E25F8CA2E7C720E4EFF1565026536B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286676, "uuid": "7262b2a0-2166-4bbf-9adf-0e83256f640c", "value": "1536:p3rZSzeU/ma/gn4syUpJ1d2kaaqDCQbWV:pbglEaUpPdh4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676286676, "uuid": "fafb49c7-0e61-49e0-9d96-d2e3e9b928d9", "value": 60080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676286676, "uuid": "881a8fa6-49d1-40d8-a0bd-303a3035d214", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286676, "uuid": "ee4f0c45-fda7-48bc-a9bb-536737df9c75", "value": "0f470dceedf0d65a292209a78c49d957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776f49ef-ab9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676292832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292832, "uuid": "3ee8a55d-bc6d-40be-b395-4ed3ebcf7664", "comment": "Malware payload (Smoke Loader)", "value": "277bbdb38f90e36f7c9bfb38a5bce8f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292832, "uuid": "7bab297b-38ee-4e41-ae2b-29fa4b93c5c5", "comment": "Malware payload (Smoke Loader)", "value": "2e190ee883da7d4888e41aca2b082b4edc2aa3f35e5dca93cf0148d0253db380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292832, "uuid": "15347933-b5c0-40f6-a6a1-8b5e45bf6fb9", "comment": "Malware payload (Smoke Loader)", "value": "a840ac1f040e38dd871f5c6e89b8277887a0308b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292832, "uuid": "6ddd542b-3771-4767-93f4-a20ca8c349f6", "comment": "Malware payload (Smoke Loader)", "value": "77b5157511a9e42c4818ce6c23179da9cf96ec39a39ba3fab704d23db6a6796b2ae89f7a81dd21cd8c634c4c01181963", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292832, "uuid": "f9e04724-1e6c-45ef-b9ac-27c4dea493c5", "value": "T17314BF1373D0E872D47356309D79C2B56A2EF8B14E78659B37982B2F1EB03D09A36352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292832, "uuid": "01552071-cf65-4e83-92f6-2496ed1fb670", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292832, "uuid": "9ed99557-e687-4145-bef0-01c569337b34", "value": "3072:zpg3pwHKPeR50WIwB00HAPgcLEfH0/AxBuSXHU5i9vccbdJWQnvS3iNe:zpcmFpIY00HAPglfeqHUkvzXnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676292832, "uuid": "e217f885-afb7-462d-a225-bd7db017ecd4", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676292832, "uuid": "d9de8ad8-70c6-4d0a-b4fc-76da79b28377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292832, "uuid": "f81f2a18-5b86-457d-b6cd-6d9353fcb772", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fd8607-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676280567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280567, "uuid": "e7cb6ac3-4994-4e70-8beb-11a9b73c4ef8", "comment": "Malware payload (GuLoader)", "value": "619bc699aaea9129005e55bfb249ed62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280567, "uuid": "2dae2d43-021d-4f74-af5f-a5708a44eb74", "comment": "Malware payload (GuLoader)", "value": "2e28fe88785b4e200fa7a2ef73623e82377b6907dd24a17b1ed70ea4e8fb4ec6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280567, "uuid": "bd0a41a1-87e0-4a03-920f-634cd5483f74", "comment": "Malware payload (GuLoader)", "value": "1846dc68230a1121ffd671abdd114fe862d15c33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280567, "uuid": "6f42edba-8519-42a2-963a-806083887fe8", "comment": "Malware payload (GuLoader)", "value": "ef713ac561f54e41ee7bcfa21f6ee0e0133c59904b367cdb5904c914e921a7842d0c86e55383a36f9bd22eaf707673c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280567, "uuid": "48160dc6-13f3-4f8c-8fd6-e496821be992", "value": "T14084124A7FE4E467D0795E380CF2EB3652BB6E162C2953473BA17FAB3C352824C1514A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280567, "uuid": "aed3e5d9-86a0-4992-9af0-124a30c4850d", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280567, "uuid": "bdc5d6f0-795d-4755-8781-115c5e409162", "value": "6144:fC2+8+wtw0N8DRkZtQmPFe1WYB0nKEENcNxMMDy0Q4Y3ShiT:fwGggtQmPFqWYunYNMxMH0Q42p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280567, "uuid": "f9add0d9-77f1-4936-bf7b-1206aabe13d4", "value": 388832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280567, "uuid": "878ae11e-e490-4bd5-aa8b-74550ea81ae8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280567, "uuid": "323a95b2-17d5-4b27-b075-427f70ca5f03", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa24f659-ab9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676293346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293346, "uuid": "10fe9f92-1d0e-41c8-9ab1-389816bfd01f", "comment": "Malware payload (RedLineStealer)", "value": "1f3ddfada0515e0acb8efdf502c4ba29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293346, "uuid": "ad2f53c8-336f-426c-973b-9668d6b676a0", "comment": "Malware payload (RedLineStealer)", "value": "2e4d626ac05616a29f962f5e908b1a5e603f2d07d1f5ccbc83ac3425c7e9f4d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293346, "uuid": "2e544f68-3d3c-4871-b53c-c1947a70839a", "comment": "Malware payload (RedLineStealer)", "value": "3a21de02f00dcd3481f35940ea2c7850df7c0da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293346, "uuid": "26dc3a04-d5f8-4e18-8354-08364ba71186", "comment": "Malware payload (RedLineStealer)", "value": "9a7f5c8057f7dca8999e52e967c7654fceb76ab18c0104ddf18b2d3cc37cbc5573096aebc9ade22c09edd277101a216d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293346, "uuid": "83734f2b-342f-4f75-9da1-524d21227d72", "value": "T1CE64F19333D09472D47216319D29C5E12A7EB971DA39AAAB3778173E0FB02E1D636302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293346, "uuid": "11d1cd5d-bf9b-4248-babf-5b4edf190106", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293346, "uuid": "2665ccfe-e140-4bf1-a4e3-2c7a66b69a01", "value": "6144:SvTxG4HQI2jzWXsbaJxpjnUsNqqDLKfgC4qHECpBcV2MXzWNSMu7a/Gd:SvTVHzoWXsbSxpTUsUq3K4LqHjbMuE7D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676293346, "uuid": "7485819a-11eb-4219-839d-bad55d934d5f", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676293346, "uuid": "9fb4d3b4-eb96-49bc-8521-8181df888914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293346, "uuid": "a0cd1640-2f72-45e9-b7ad-f36172e1e70b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e0946d-ab70-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676273473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273473, "uuid": "57523728-65d7-4eb7-9bde-a7230ddf1079", "comment": "Malware payload", "value": "d42d34d87e404aa93862a40e997f8f6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273473, "uuid": "0e260677-0798-4c94-a9b9-a1339ac399b7", "comment": "Malware payload", "value": "2e96b55980a827011a7e0784ab95dcee53958a1bb19f5397080a434041bbeeea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273473, "uuid": "c6b1760b-feab-44c7-926d-d06d0760d104", "comment": "Malware payload", "value": "8ea71ea5177d46c9feea0e1cd19069a3441e1758", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273473, "uuid": "15127044-66ad-48b6-86f2-9c176cdf3c3a", "comment": "Malware payload", "value": "47360b933e7fde6196f2687ead5222e205ab1da2c9d5bb70862ea5d5fd0c1b433d1f6240537712c63ef3bb60c9c8c7d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273473, "uuid": "9bc08209-44ac-4c33-bf30-19ea2cf8fc47", "value": "T160A5D002FBC28272E593057891B6A73F893BBB209734C5D7C7D10D698D312D26A3B7A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273473, "uuid": "aa2777f4-804d-48c2-a6ac-cf89af44f1a5", "value": "ec5356d8e0f77a28432ffd3fb34115c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273473, "uuid": "fadb02ae-12fc-44c7-aa4c-163de57fd7a7", "value": "24576:w/iIzkQF+KpPnF1Fx+CszLyQ9lkxIQVki//47JhUhio7Z6OI93lGFtPtnNON+IjE:whBPrElwNkto7VINlGFtPtnwjjOaHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676273473, "uuid": "576b109e-3b42-40fb-8dbf-111dd2cab9dd", "value": 2095627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676273473, "uuid": "016bfc47-2e13-47f5-87b4-0af956b65035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273473, "uuid": "87c101d4-727c-4c60-b08e-0f711629343e", "value": "2e96b55980a827011a7e0784ab95dcee53958a1bb19f5397080a434041bbeeea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fad58811-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272007, "uuid": "ccc75879-72be-4896-bcff-81673b6f6c23", "comment": "Malware payload (Formbook)", "value": "f59366494a5482c4908d4d7758a8697a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272007, "uuid": "8d7c7bcd-02a3-40b3-84f1-0b0fb3bd93c4", "comment": "Malware payload (Formbook)", "value": "2eddf8366c0d6b856cf7b516463a976f64e0ae15037ace764b814698696825b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272007, "uuid": "8a8419c6-44f6-4c89-9a92-57ff97cebd89", "comment": "Malware payload (Formbook)", "value": "39cbdc1363badeb05e2a84ae6ca984a27e1f8dab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272007, "uuid": "ea18ed25-51c4-4c31-8bf2-3fdde824d1ee", "comment": "Malware payload (Formbook)", "value": "9c25f5ac65d2c1ed236034150663594b41df2be02ee3d48c782dfa02e1cea34aca08ba8a8aed152c33e4b4e41b6d7632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272007, "uuid": "4b8f243c-3952-4814-bfe5-8652e738f267", "value": "T11004AE32D642C031F2B212B5B6BD0B7B493E0E357295A5EAE3E116E16EB0495F13931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272007, "uuid": "e842ec11-db88-47ee-bd61-1bd6e0c20ddb", "value": "3072:WytHk412ERXjg305CEqYwamyFM3dAaaTqI4+EZkz+SFY+bcIPVL0:Nru0MEqnamyFM3dAacqIKLSFY+zVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272007, "uuid": "197f3293-ac5c-47b7-ab2d-1a9ccab80cb2", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272007, "uuid": "1df0b318-5579-4605-b482-3e5ef6338ffc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272007, "uuid": "53b0ff41-5014-42b3-933a-b3abf1c31ac6", "value": "2eddf8366c0d6b856cf7b516463a976f64e0ae15037ace764b814698696825b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46e80816-abf6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676330975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330975, "uuid": "147c0149-e95d-4f45-a755-d6490f9cd17a", "comment": "Malware payload", "value": "44e27b5d33ab38090f70fb036bd61175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330975, "uuid": "cebd9e9f-3b2e-42d8-8eb9-a58cc5eb0458", "comment": "Malware payload", "value": "2eddfdba90ce865b35f90b042f6a5a6de75a8f64b2aa251d3e3075660f1c9d97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330975, "uuid": "7b6a586c-c9cc-4c61-9e16-3e1970f11f42", "comment": "Malware payload", "value": "513e3ff9f0d7861bebe11718a4b7e6731e0f62fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330975, "uuid": "2706ffd1-5fe6-4d1c-a1fb-cd5de2b0ad49", "comment": "Malware payload", "value": "842215d6cda05902980701e7d22b4c9f6897bb5d9320908a36a15750e68eee88b6d2adc6eeb86816c2d52efb0511f3f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330975, "uuid": "1ad2687c-681c-4116-a842-72cfe18595a1", "value": "T104F4120BB6E89032E9B5577114F703E3293B7E615A34C3EB234F6D8A18666A07231777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330975, "uuid": "cdf38c55-f5b3-44b8-ab22-10e03928f2eb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330975, "uuid": "19959c42-bc81-49e4-9ca2-3b77a394bf6c", "value": "12288:mMr7y90GOs/MVlXVorjH3LHFss/eJh6hrbe3iXBRLzGjRcFESWQ7:Fyh70VlEXRehziKRcmq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676330975, "uuid": "a7bc39a2-5639-4a58-91f6-9dc2675ea60e", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676330975, "uuid": "de8fcf21-a33c-4659-9e1f-f31b0c180e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330975, "uuid": "38916adc-9f18-42bf-b7de-1b1ca46ed272", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a913f22d-ab42-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676253831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253831, "uuid": "c33e4874-7b76-4951-b417-7f86b56d120c", "comment": "Malware payload (RedLineStealer)", "value": "b5b730bf6d80b3a5f2072a0951d557a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253831, "uuid": "b2a8f21b-6962-4e30-b688-f4204111f6d7", "comment": "Malware payload (RedLineStealer)", "value": "2ee7480f8b60290e1f83f1161df0b626e1502ad1fc551661f9ac742627584392", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253831, "uuid": "aa04f08d-02e8-4043-bbd1-db0a17c1f674", "comment": "Malware payload (RedLineStealer)", "value": "da73543cfb814dd22d76f7fae594e294b66b0c72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253831, "uuid": "2beb2286-bd7e-4fab-9ad5-bc5544480b1f", "comment": "Malware payload (RedLineStealer)", "value": "c08dfbb1f37a70ece18eb1bf8713479e4e0148cd6f88ebbfb69eb66fd7da11d7174f21ef58b3385a7ec5d70e257b4ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253831, "uuid": "85eb8f65-a9c4-48a2-839a-e5f38313c215", "value": "T19654020179A2C2B3E1A785717A12D6B09A7FBC7593B4805B33140BAE1D332D39BB2747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253831, "uuid": "37b20f63-76bd-4b45-85b2-9b38f3bd1182", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253831, "uuid": "279a8c26-6ad1-40d7-8abd-8599b9dd17b4", "value": "3072:qBRMCVp35XkWotN/1+hoRZ6bU6rpZlmgc63ieWTLTYvfymZpQZ5Fz+xdp/LZaeOj:qppBTK9d+9DrWTL8vfnp0Hz+x5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676253831, "uuid": "cf8e0f75-181c-402e-b584-c92690a232d8", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676253831, "uuid": "9179c299-dfd5-498f-a27d-533ebfeea6a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253831, "uuid": "aaa43ffb-87c2-41f6-ba5a-b28ff47eb4cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36029680-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676280696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280696, "uuid": "59fa6df6-f919-4ddd-83bd-ee39cbf7e0ee", "comment": "Malware payload (RedLineStealer)", "value": "0f2d1e2aee44b262b2f19e07a20f3f87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280696, "uuid": "34ab0e75-eea7-460c-99d8-18965ce66e85", "comment": "Malware payload (RedLineStealer)", "value": "2f98b200bfc8d4e5f137f4da8470c6f4ea826cf2135d84e79ffa756edb6b915a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280696, "uuid": "98edfef7-a6ba-471c-a318-b1335791e7b1", "comment": "Malware payload (RedLineStealer)", "value": "01017723ff2be61d82f497b55e04f2413ca519a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280696, "uuid": "94bbca82-a59d-4cf8-a4c7-e91bc0779cc9", "comment": "Malware payload (RedLineStealer)", "value": "d91dd09cf41c8e54e56f188d39bedd581f153ffe6b4d98176ca371853a22c586a5eec542ff04f2a21ae32fc05d85c63b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280696, "uuid": "d9551b44-37c2-4ba8-a0a8-bfaaf14a5cbe", "value": "T12564E02273D0E471D06255318D29C6B06B6EB570BE78EE6B37981B2E5EB02E19733353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280696, "uuid": "b0e7b1c7-8751-4213-800d-43fd37ea53f1", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280696, "uuid": "6c2c3b8a-2f8b-4b74-a83a-1fd10613d33e", "value": "6144:mzfw7wKSWOL7Szj+b5suzyAbC74QPjb8TugttNkW7j:ofwd8/Szj+LzlQPjbOXbWW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280696, "uuid": "71cafb3b-4591-4cd5-9cc9-2be388bcce84", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280696, "uuid": "bf210f2b-3322-4c63-8d27-eab7de22271a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280696, "uuid": "dd7a3aef-2fb2-4a60-b64b-8b284fb26521", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d80c62-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676300671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300671, "uuid": "2c0a33aa-1fe2-469b-aed2-5af220ea6f62", "comment": "Malware payload (AgentTesla)", "value": "362a5bdaa7bbbb85964e02974af6f0a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300671, "uuid": "c5552ec6-0fe3-448a-9fb0-69aebbb4bc70", "comment": "Malware payload (AgentTesla)", "value": "300cca95ad6a5bad5d65a1670defdda3f08f7b64cef5689a093f4dd4910a69ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300671, "uuid": "3c09a82e-9ead-4ccf-bc88-fa0bfbaba823", "comment": "Malware payload (AgentTesla)", "value": "007a78ab144d359941caf3bcbebeeafa9b200ff1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300671, "uuid": "95aaa2eb-836d-4eb0-a51b-cc836984a405", "comment": "Malware payload (AgentTesla)", "value": "b97cd84a83f009f065aeb7bb7220fd20ca87c7f0b50739f605f7e2674675eefa5321e2315adf0337efc2e79857efd7e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300671, "uuid": "dd0a4a33-b7f0-40dd-862d-93a0801879fc", "value": "T1E8F401A03AAD5F18D57E0BF82475B09093767E5A2966E71C3DCA31CD0A32B568316F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300671, "uuid": "129e54b2-50c2-483f-87f2-3d9fae77881d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300671, "uuid": "d0b9b907-4e8b-48a1-8182-462f4d68350a", "value": "12288:yFZGUAZh6q6/TKPzG7iS2ot36ZXUYfrCOmePIoKt9kDeKXHbiwGzZJ5tei+fqsT:yFEbY/TKPzG7d2okZXrVIrkqsFutei+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300671, "uuid": "2307c7d7-2298-4d6f-a596-b5adf70d7a7f", "value": 760832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300671, "uuid": "5157d3c8-9858-470b-b8f3-617ec08e33e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300671, "uuid": "ad9507f7-198f-4dce-bc30-4d7fcdb8713c", "value": "HESAP DETAYLARI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4124e3-abea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676325802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676325802, "uuid": "13806cb6-39da-40fa-a5ef-0ca00b2e4ee3", "comment": "Malware payload", "value": "f9c62edcddfdf0f34a4f3bf3cb8d8401", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676325802, "uuid": "6cfe164f-d19c-4aa0-830a-d6e59c372fca", "comment": "Malware payload", "value": "30a641e50f57f72a60f1a453b8d63dfd28ed0261800cf4275428d66bb0945d06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676325802, "uuid": "a00ae3d0-9050-499e-8eba-4cb8042fa77c", "comment": "Malware payload", "value": "e802ebc97a6ecbabb809492300d0b7f4549ea6a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676325802, "uuid": "1c2dd751-e979-4111-91c4-2a0b3716cb89", "comment": "Malware payload", "value": "7c8733daf1133d8d0e7b68702e3eb241693f24064affd77d7a7815956722e1ac25da8967c96f90ce14b7da7514d9934a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676325802, "uuid": "f2728773-a028-4749-9540-b931aa3221a5", "value": "T108F4122BEBF88022EDF067702CF606D316357E616B79825B274F9D2918725F0697036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676325802, "uuid": "21f58e1e-4c3b-423b-90f2-24b433d642b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676325802, "uuid": "011c27dc-c36a-4454-af89-e790c17b9939", "value": "12288:+Mrwy90DJ1VpizwM9I6aCLh71YpeJUo+fN4Udxu3G+58ch67SiNiRm8Yc:uyg1Vj6Hd7jUoy4Ur8H58ciSvRmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676325802, "uuid": "54f0a0ff-0080-4f75-bdfa-0f3762bccc06", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676325802, "uuid": "48b05811-8875-4062-89a6-e2252a2a4fe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676325802, "uuid": "27372798-da9e-4079-a9da-074c346b42f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcfe392-abf7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676331393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331393, "uuid": "c1fec9db-eeb5-42fa-b0fe-c6ca0c9f84ca", "comment": "Malware payload", "value": "b28ad4dcaf012c10fc7025418addf986", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331393, "uuid": "94f9f7ea-fca7-435c-80b4-21b01bfa3461", "comment": "Malware payload", "value": "3114fe8233f4fe9943761a1d9ac8e24fc20db151511be057c5c22a7a888fcd76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331393, "uuid": "7f96a669-ace9-4847-be97-94b26214f7b2", "comment": "Malware payload", "value": "880901fdc7b4d7ab64eddcffd8ba2ef5327f278d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331393, "uuid": "cde0ef51-52e6-415f-a368-2f57f6903a69", "comment": "Malware payload", "value": "6cd6a25470688c1f8f52604c4911e1d412b5952a822fee6ab026375f809e3f404cc7b5a8013dbc72d86c4953cda712e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331393, "uuid": "d6e6fbc1-28ef-43f3-9c7d-c530b647aab5", "value": "T1E9F41207F6E89836E8F4577014F903D31736BDA48B7842AA634EAC5A1C736F06236767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331393, "uuid": "bf2968d0-c771-4ae8-88ab-948afba8b8de", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331393, "uuid": "18c3488f-3e6d-4bcc-b845-f14414d43540", "value": "12288:pMrxy90SmljrvdjAcsg44T5c1JFj0RteJwEZthVVnG4ecFB7kCvg8O:oyIr1E3p6cnFQI9dTtec/QCvHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676331393, "uuid": "6a56c00d-21f5-4626-85fb-14560be114db", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676331393, "uuid": "4974b31c-78d5-4d4c-9843-81b33da0041f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331393, "uuid": "c1a6e287-f986-4858-bd0f-9f9e9cd70063", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5d7e57-aba7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676296970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296970, "uuid": "e2966fc0-336a-4e1e-b791-9ec61039de72", "comment": "Malware payload (RedLineStealer)", "value": "063e7b94ccc2f1d0a54111d2e73e2c3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296970, "uuid": "8b9fb7c6-c31d-4b36-8789-58f781f5eb23", "comment": "Malware payload (RedLineStealer)", "value": "31457a1530dba380f518443e23f59ed07971dc3830f73c5da0d7d35296b9eb00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296970, "uuid": "7634cdff-1e7c-4793-bc5f-b5ce5af24944", "comment": "Malware payload (RedLineStealer)", "value": "f4a8258dc40ba454de37594ff8854e51d6709674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296970, "uuid": "30e35866-75b7-4e42-945b-a60f0b0d2b3b", "comment": "Malware payload (RedLineStealer)", "value": "fff73def6a8ced4a43d545dd99dc74646e7df9ac4cc76bf97b0e5b49f50571cb09515234d43210c359a57013d28e8594", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296970, "uuid": "aa1848e5-7c97-460e-a21b-32bcd5a03421", "value": "T17B54F11333A09471D5632A305D24C2B46A6FF8717A78A67B335A2B3FCE713E19636361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296970, "uuid": "e91ff281-7634-42ff-be0b-d7160b203706", "value": "a915562f5b4dfee9fa3c29b2972ad3d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296970, "uuid": "93a54ff2-0f05-485a-a13d-642613aefeb5", "value": "6144:0Ty1MktKBCYARrUUFUt3A7drAfMmGlWhRd+JYABdNTJLdCVvcbX+:MyICY+jFC36hehRYJHB/TJZ6vca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676296970, "uuid": "da5427da-418f-4d6c-9035-e8df1a8e0272", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676296970, "uuid": "0c95d3cf-cfe6-40c6-bcd2-e2b1d2b58b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296970, "uuid": "22cd793e-2e03-447e-97d5-8c87315249f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc6385f-ab45-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676254857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254857, "uuid": "618135b6-aa41-41a0-9e23-96dbc5cf9a96", "comment": "Malware payload (RedLineStealer)", "value": "e2eeba0299ee7aa8e78673964fdad841", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254857, "uuid": "c4ede71f-1bd2-49ff-92f1-6876189afb2f", "comment": "Malware payload (RedLineStealer)", "value": "3162953e78209f45bb04135367f1b2a2f5bf20fa7db341568644499fd11c64a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254857, "uuid": "ddb6fd1f-41a4-4976-a3b0-d564165b41ce", "comment": "Malware payload (RedLineStealer)", "value": "550a4a06169c511c90489dc10f446aecbf70b937", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254857, "uuid": "ae1a75e6-d921-4c7f-9661-fad417999923", "comment": "Malware payload (RedLineStealer)", "value": "bb7ed6b63661d29cdae8bc495c9f3dca06e0036f88ec11531ec831ca13f93102f3ee973d681578a3f518e21303e67e52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254857, "uuid": "2fd20c8e-e9a2-4cf6-ab22-c1b994cdbe38", "value": "T1D5F412076BED5122F87567704CF503C31B367DA01B38929B628EAD6D4C32AB879743A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254857, "uuid": "f376e2e5-6685-4995-8487-802e594cdc42", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254857, "uuid": "db5da8ae-cbf4-42a9-a978-eb4a3111e622", "value": "12288:6Mrwy90Qcf5HZ5NjB3Uk9mUr+Hxa7LgeJDf3jp2CiPaeM1ObocqE:6yDcf557Fnr+HGb3jAC8an1uN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676254857, "uuid": "941992c4-00bf-4172-a099-02ec2a0cecb4", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676254857, "uuid": "246dd93b-c382-4578-92e1-e5f2b9015246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254857, "uuid": "24a8b129-24c9-4bf7-80d5-75e1a515ec66", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbc083b-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1676299523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299523, "uuid": "1ffadd7b-981e-4a8c-8dde-c569f20831eb", "comment": "Malware payload (ModiLoader)", "value": "77321c3b7913f9ea3d70c8901e6e7acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299523, "uuid": "0edbbdfe-23a4-4d3a-a6cb-e28de27dce20", "comment": "Malware payload (ModiLoader)", "value": "31a20253af2b351eac7922198159d9b73a032649e942da764bc6811e7b95ab34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299523, "uuid": "a31b40f4-68f0-4a04-a905-f4da56b5c50d", "comment": "Malware payload (ModiLoader)", "value": "3d360ee32dc1ec1d9f050aa6dcc7722c837f7e94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299523, "uuid": "53e80397-893e-4fbe-b818-77d4962c2966", "comment": "Malware payload (ModiLoader)", "value": "cb9671be2a05da36c3826a9dc15dd538c97a9bd3fe3b0317870c2a0379337f11a76cb092f521f8636ef3f16d09087223", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299523, "uuid": "1482da4f-d1ba-43fa-9f0e-548297051995", "value": "T17415F41DBEDC043BD37309748A4A4E689415A9F2ED14F8F73D9CC848DBE21B2A436E56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299523, "uuid": "b8a27297-d55e-49fb-b23e-5cdfdc8892d6", "value": "1662538b13f763bef491d93c57c319e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299523, "uuid": "c9ef2fc0-baad-4346-94f8-93a66f7afe43", "value": "12288:fb8A+lyMML0gN55kXFyqf0bGBvGoE05qhAf1nAhglR:f4ZzML0gN5WXFaK9GoEUf1nAhglR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299523, "uuid": "b921e588-55e9-42be-94f5-dbe208254600", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299523, "uuid": "caddca76-8f2f-4269-9756-cb6716453578", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299523, "uuid": "9bba3f0c-ee53-4444-8d46-8b8bf3dec48d", "value": "TKM Teknolojik Request order Document Specs 94859675.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef5e02f-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676251478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251478, "uuid": "6628f132-61b1-42cc-817f-9c3fbddb23be", "comment": "Malware payload (Mirai)", "value": "fa6bd9366ef372275b62758ab87bd91e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251478, "uuid": "d1cd86a1-8123-4505-b8db-ad6583b0f711", "comment": "Malware payload (Mirai)", "value": "323bf3a45ba455f95c752b69dad1f3e04fee6b2867709f603c2948ab3eb86b25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251478, "uuid": "b6c0596a-643c-4283-9d6f-bb3de30dc60e", "comment": "Malware payload (Mirai)", "value": "35c2d1a78456d800626267c6e5404fc69e29a19d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251478, "uuid": "a399db67-5d65-4382-a078-1d23c0d7198a", "comment": "Malware payload (Mirai)", "value": "4b91b4f7df8e5af9533338dc27a4846122f418351a0fa7267337db55d672ceb6d37f88b34a3c27f5405c6949da6faf08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251478, "uuid": "4ed3561d-0847-4435-8ca8-6f1229950f2e", "value": "T1C0B3B02341A4ADE1C0558B3075F6593D0772F88C755B1CB2BF81C5AA408BEACB69A3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251478, "uuid": "c706c32e-5e4b-4469-95a9-cdcad8bb0d0f", "value": "1536:1T/adiXck7bIZwty453gQLL2kt7WfVMRZyY3AYm1mALQ+GSUCEbm/Yunrl:1/CiXck7bki3gQLL2ktAMSQOLQ+GSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251478, "uuid": "898214e7-9fb7-49a1-9c32-06caf155f058", "value": 107628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251478, "uuid": "09fd6b4b-ea46-4178-9341-23fa072c6d8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251478, "uuid": "07e6c8ef-d1b3-4b90-b038-9aa1b6b05205", "value": "fa6bd9366ef372275b62758ab87bd91e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dbdfa88-abbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676305593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305593, "uuid": "41357e6d-ec94-4c69-95fd-ef10f8b3434d", "comment": "Malware payload (GuLoader)", "value": "6d5c55d79f56dc3e6df2f14d27171f40", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305593, "uuid": "ef9ad871-33fa-4db5-a6be-9702a9746302", "comment": "Malware payload (GuLoader)", "value": "326abb5f5a4c4f52eb50f6e6a4107da70992906da9d0f0e46243d87570dff09c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305593, "uuid": "36dea442-f1de-40b4-b9ea-305b2d8a2698", "comment": "Malware payload (GuLoader)", "value": "31c1c561004ee67c7919257c813a0c05a155f7c7", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305593, "uuid": "e34f7386-ced4-491f-acd3-52bb1fc19f47", "comment": "Malware payload (GuLoader)", "value": "2be2a44f10830ce27f276dfdf3c088cd9d55d4151c40802e4df71348ffbdf2bbf2e44d41a063d9ac608b7cee1c7131d6", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305593, "uuid": "fd593af5-f3d8-49cc-8713-134e5551e27a", "value": "T1C76423248293DB234DC61CF585621D4E4F04D9EBAAB5F4621C7C3E301BAB8E855E7E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305593, "uuid": "e4883071-df53-4349-a0e8-0c8c6468d9a8", "value": "6144:Sd+waHL4fxum24iUZUMUtHWCJ3LCkwMGQt9Ap9YdFZC8uxM1KnH:Sd/MZ4VZlUEC1LbGQwPYdFZtuxM1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305593, "uuid": "99468b8d-9020-48ed-81ee-597fb1492f75", "value": 326627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305593, "uuid": "4decff34-e4cf-4d77-9fca-ffa15ee4fb7f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305593, "uuid": "b7199b5f-d291-41cd-bf2d-f95455ca5701", "value": "Purchase Order Form.r19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cb7cef-ab51-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676260160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260160, "uuid": "fed2046d-ae56-49e3-9ebb-866798e0ef67", "comment": "Malware payload (Amadey)", "value": "96c1dade597cc024ccaa725c0b87bd7e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260160, "uuid": "ff77d60a-eeae-4bdb-bbea-8680ecc1306c", "comment": "Malware payload (Amadey)", "value": "32c12bee4f12ef843dd78d5b76425b327e4690c6b1b41a8f38c8a62fc2d4a14d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260160, "uuid": "693236b4-c54a-4de2-affd-5549c5d92a5c", "comment": "Malware payload (Amadey)", "value": "9918e17dbf06844b5ead7ee2446e1af2dd3b27c7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260160, "uuid": "c8d7f0cd-d86c-43cd-84a9-3146a46ef833", "comment": "Malware payload (Amadey)", "value": "68567f9f93cea9bd12ca68e964644ac16a52cbc6338bfbf07ce7f997319d550b8ca315b7078cc1e67ead3a4f82e1ada7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260160, "uuid": "c2254b26-29c2-4b34-b75a-430ed5d531ae", "value": "T1A4F4120BB6ECC022E9B55B7018F703E31939BE255E3853AB234FAC594C729B5613176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260160, "uuid": "9c577353-bc5f-49b5-b078-1d7db7b006ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260160, "uuid": "b5445ebf-df99-42b5-bd98-38529e15096b", "value": "12288:qMrsy905SVeg+7aEVI6fWENtQFBrEBcVq1eJNHXWRH3SMgx3KT0MF7/iT3m:WygSVYDVI0NtQICVxhmRHTgcTVqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676260160, "uuid": "467e1005-bd65-4a74-869d-f2fbc1adae15", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676260160, "uuid": "7f29a111-74b2-4671-b387-81d5d5ebf9f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260160, "uuid": "f1455b0a-0c2c-4e11-9d6d-a28551de93f1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ad56de-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676272057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272057, "uuid": "41575d00-742b-4389-b968-a4919cdcb61a", "comment": "Malware payload (GuLoader)", "value": "ee5b5e12b39f2449a53bf8f7785a918c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272057, "uuid": "5314e639-e845-42ec-b031-06cdd64b4c04", "comment": "Malware payload (GuLoader)", "value": "334911b248ad837e24303037e3733e61b119998dc1e1ce8bf7a444754a4cda01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272057, "uuid": "4347614c-54c7-4803-83a5-a10ee7a3d988", "comment": "Malware payload (GuLoader)", "value": "953af7f4010f2165a28762d04e91efc9862ffdc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272057, "uuid": "69c20ed4-5ce0-4347-91a4-386768969710", "comment": "Malware payload (GuLoader)", "value": "f4a8e8ad51b8793b11abac615a763889128436e4bd6891006d4bf667cb80ccebc7d1b52a95b352779a0a36ce3287cb81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272057, "uuid": "d8d2cd40-3d7a-4bdd-9cd5-f94d59b9b40e", "value": "T164F4CF427230878BC11353B44D23E77985152EECADA1C39A71B67E2FB8B2A534E176DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272057, "uuid": "28fd87c5-8009-45cd-a88e-c9cf45beb5da", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272057, "uuid": "e28adfba-ed7c-41f1-9931-95057e9e097b", "value": "12288:92cL2HkGchuWXqm7icDQRKVDobPOsC0z2hs8wtwC7IE1id:9ncckWX77wFbRC0as8WhIyid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272057, "uuid": "4caecf48-6da8-4a71-b0d3-8e0acc75a38d", "value": 785680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272057, "uuid": "c97ec602-f2b9-4077-bbec-94d30140cf0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272057, "uuid": "88b7a042-85f8-4c29-bf60-eac0292a5b0b", "value": "PO-398334100264361.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aa1057a-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676301051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301051, "uuid": "51230020-7628-4983-856d-a9b261c9e549", "comment": "Malware payload (RedLineStealer)", "value": "9f8eaa0918452d6e6c97d10d12e9b027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301051, "uuid": "c4598429-7d7f-4f54-b5b6-086a502de9ed", "comment": "Malware payload (RedLineStealer)", "value": "33fe26cb7a9c571714042dbf7db131dafadd972267c3f681432e4296c12b1146", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301051, "uuid": "6d940df8-7c8c-43bf-9236-4fb4fe0d417e", "comment": "Malware payload (RedLineStealer)", "value": "d98fc3bd29a362b6dbaa2974fc1c13892cc7f00f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301051, "uuid": "8e2daa77-0752-4168-ace4-87d1bcb8b5b7", "comment": "Malware payload (RedLineStealer)", "value": "2f2cc7f512979ecf3f2dc759c92ac169973e7248f094c46492f2af61b1ca1285d314d427f8f1239e746389d48e31c616", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301051, "uuid": "24ca32aa-88b9-471e-93bb-60087911e149", "value": "T10BF4124BA7E84536E5B047700AF603C31A36BDB65A34539B138F6C590D73AB1A63633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301051, "uuid": "65883d6c-75a5-470b-8cdf-a9e927477faf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301051, "uuid": "fe675094-09ef-42ab-80c2-71ad5307ad78", "value": "12288:EMrDy90RERsV46YKJxcxzwvX288X8GIPpBQdY1C7VcVX8LCaenz1Kpb:fyyERsV4OK/88X8GIBfDVX8LFYz1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301051, "uuid": "dc8b0d97-d7e7-460a-bb66-213e4f8bd930", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301051, "uuid": "8640709d-6322-443d-89ae-e07325fb1d96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301051, "uuid": "6791bc62-f186-4c62-b748-db4b619b5edd", "value": "9f8eaa0918452d6e6c97d10d12e9b027.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d127db9c-abdb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676319611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319611, "uuid": "2c3047ce-e0d5-4b3d-a046-77e7ea993e7c", "comment": "Malware payload", "value": "a51b7a19120cbc019247cc179cc64631", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319611, "uuid": "e0e2fe30-79ba-4385-88bc-14f9a2d4e623", "comment": "Malware payload", "value": "354beb2bd4a13c9cec724d63421ee7b7abe1f4bc2078b64dbf88eaeb7611f4be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319611, "uuid": "ddaa072c-e7b3-459b-9375-a89309036d5c", "comment": "Malware payload", "value": "2becf322015edf912c2a4b8e03200dd8a9c1cddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319611, "uuid": "0616886a-3d9b-4bcc-b382-e3e584c8e68d", "comment": "Malware payload", "value": "8af4c9e0b1abbde9191b65b1b09b8e0b71754991cadd257ebac04d89ea82fc8c365f34b15158e0f89a4f21e4efca3e7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319611, "uuid": "2160a9fc-ac4c-4ad8-933c-a78d43db2ce2", "value": "T175F4120BA7D88422FA7057702DF602D31A367C504B34479F63CE6D1A1D72A74B635BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319611, "uuid": "2fd33dbe-610f-4884-bed4-01e3a21aa344", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319611, "uuid": "e883cecf-09d1-4c88-800b-0b76a49dd709", "value": "12288:SMr4y90jFvX6cx3/1JJnJVr5pt7CisCeJEraJ5VZ5owc4RuAndaLBdh:KyQXb3/nrVrB7Cfya75oBsDdAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676319611, "uuid": "afe2db5d-0d32-46f9-b302-3a39295fd7bb", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676319611, "uuid": "20b4725b-1204-4e5b-8912-ed726fdc8d4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319611, "uuid": "941a9e50-f938-4235-b11c-018130c82c99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d060c820-abe5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676323905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323905, "uuid": "298093c6-335e-4674-ad13-bf573d01593e", "comment": "Malware payload", "value": "aa8b1da38ac9aec11a101b0dddc6ae35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323905, "uuid": "6187e157-fd7e-487c-91fd-445193e29ad2", "comment": "Malware payload", "value": "3651fc35c8b9c58df6b477a88c448144da46ea4753a56a4fcd1a695c3c0e054c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323905, "uuid": "6be7659f-c7dc-4703-b9b7-c49b7d3f2e10", "comment": "Malware payload", "value": "33358cc77afc25b9c06f755ec5d3cda3f548f868", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323905, "uuid": "3d403585-1ba6-4e46-8b1f-f596434f5a66", "comment": "Malware payload", "value": "dcbecf59575256538f522d219d51e4e97ac136daecaf52fc95bb0b92f31964857e24341e9b94fcb7aeaddec9d6985145", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323905, "uuid": "a97f30de-9535-45ac-8b62-b3d597ea869a", "value": "T1E8F4120BA6F48032F9B5277069F603D329367E60A934C39E674F6D5D1932EA4A231377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323905, "uuid": "48906276-4a6f-435a-82a0-390aa23955c2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323905, "uuid": "c7595c27-8f20-4b74-9ddd-a71fd1ab3b16", "value": "12288:QMrUy90w0kq1tGgpPULMWIsQxVw3dxhhleJlLxE/z6V75fwcfdPn1aNBGOeM:Uy70hxULBXh3dwc/E5fBFf18BeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676323905, "uuid": "9eaad2f3-378e-46b3-ba4c-a6ec0505a5d0", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676323905, "uuid": "ecfa5961-f62c-4c0a-a4a9-295b854d2cde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323905, "uuid": "14ab4bd6-e141-4a07-a421-a3f5bbc56a0a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9198e29e-ab87-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676283427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283427, "uuid": "556134e9-710d-4ba4-9f10-3eb3a94738ba", "comment": "Malware payload (Amadey)", "value": "5979598216dc8556877a9f26b06c2ca9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283427, "uuid": "12373f14-88c9-48aa-8209-effc7d175ed5", "comment": "Malware payload (Amadey)", "value": "36e81f6e41665a9dde966490e14c27438255f598162859240c9a0eae16e4116c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283427, "uuid": "b64b2637-b04c-4be7-9c01-670812a05a78", "comment": "Malware payload (Amadey)", "value": "d772f438f3de73c5c01e1b86360ee23e8894e67f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283427, "uuid": "b49b3403-6923-4dac-8148-5df3ed515f35", "comment": "Malware payload (Amadey)", "value": "e1d64b0acbfc4e752e6b1a86e216a607e0cacb5a8ee42ec6890e59017ba5fea51ab7b4ffcacecf69ba4ebad6b435ad20", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283427, "uuid": "cbdb8579-98ab-4289-95c6-9dfda2027605", "value": "T199F4120BEBEC4522EDF1A7B05DF603C31535BD929A38828F274E5D5849716B1A23473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283427, "uuid": "fb5c9134-de89-405f-9cb6-23876e614f19", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283427, "uuid": "ea4dcb3e-6388-463d-aea2-dbd8e1a85862", "value": "12288:wMrjy90y0BqdtRcGyW5DJ58mIKX1DlcUgeF/XkoeJsIRhrqZO3i8vCaTI4uDI:DyuBMRclA6jKX1DlcuF/XwsIRxqU3i8f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676283427, "uuid": "e718bb30-2c3a-4235-8e2a-6457d2d6da4f", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676283427, "uuid": "2afd0370-1d92-48fc-9057-dbadf52064d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283427, "uuid": "fa00aa2f-d8b7-4f6d-b61d-a6ed1694d974", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d6918c-ab3b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676250555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250555, "uuid": "6bcf6654-4a8d-4532-a56f-0a6e3dac1412", "comment": "Malware payload", "value": "450cebe5aaf584a02f8537a9bf9c03f5", "object_relation": "md5", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250555, "uuid": "976a797b-d579-4922-988a-a1d02870f9b3", "comment": "Malware payload", "value": "371ef938312d86da00c1c4a66a05e7f06b35f5a055096e9888428807cc16674e", "object_relation": "sha256", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250555, "uuid": "3db5e1af-3e3c-4c7a-82ef-5d93d1b3afeb", "comment": "Malware payload", "value": "511daec7fe68267be47b9bf30e5a0e85dc7b7605", "object_relation": "sha1", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250555, "uuid": "9a75bb5c-efdb-481d-b3b4-6b74cfe23c13", "comment": "Malware payload", "value": "6ce23ae1a48423f23f25f4d3da3605ff6ea82f64b88ac00d95fcf760567d0d9fb472f7ff9f78bf3841e8b2d39ac1505e", "object_relation": "sha3-384", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250555, "uuid": "e2cd18f5-563d-4de0-b369-48a8ef1e5931", "value": "T10B37335E46A8589BF5DAF13B0C1FC06CA596EE054368D18F039C975A4CABBD02D3BF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250555, "uuid": "7b629910-cb89-476c-80a4-075abb073a8b", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250555, "uuid": "0a78ec83-9e59-423c-828b-0fba5dae5db9", "value": "393216:5u7L/OtASFuznSyY+k4tO2dQuslN/m3pDl9AJ4ZoWOv+9fPV4aqCtLhSV4FY9iyi:5CLuFOY4tndQu4KRS4ZorvS3XdhpeMyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676250555, "uuid": "225c8c47-5a95-4994-843a-a8ca8413d402", "value": 22400317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676250555, "uuid": "45ecf2f0-b109-40ff-a9ec-25a1da336c5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250555, "uuid": "69fa9e2d-5eb2-4f1e-89d4-d9df8d7d3183", "value": "reaper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcc18345-abc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676311416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311416, "uuid": "cce70427-4266-4c2b-b427-0f4b2b87f72e", "comment": "Malware payload (RedLineStealer)", "value": "050ffc8c29aab97fb9e696c94251c7aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311416, "uuid": "192bd2ae-1322-4db7-bd92-da329884a448", "comment": "Malware payload (RedLineStealer)", "value": "373fe70b99b69e97e6cadaf68cec4341d2278ba7d53c1398213ad5fcbc848575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311416, "uuid": "a4c44ed1-6a48-4983-b996-a4742fb59699", "comment": "Malware payload (RedLineStealer)", "value": "aec09227907dcb89e83e9eaf36c68fc96a7476a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311416, "uuid": "94f8affe-99dc-43ab-93e8-5283bd3206b8", "comment": "Malware payload (RedLineStealer)", "value": "311d6f1a3074c4a45b990b2c63321e1a67f03f924643ab64e3fc761d2721ef34ad62275136cd680234d50633e32cb67b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311416, "uuid": "12e7c875-a848-4480-b6f6-1ae540009d52", "value": "T18054E02332F08871D56205369D75C6E06ABFF4217A789A8B67D45B3F0EB0FD18A72352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311416, "uuid": "fe47ea5e-c44d-446c-97bb-473375dfbb45", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311416, "uuid": "6598352d-622c-4447-9287-55da8ce27988", "value": "6144:ZJYY+GjgToY0ku5VKXi77msJXC8TqY7UiuF4Kp:ZJhgToYlWUiPmOCzY9uF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676311416, "uuid": "6dfca678-b301-4fb6-adf0-cbd281a3a304", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676311416, "uuid": "52525e9e-9b41-49af-973e-5536a7cf1050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311416, "uuid": "3d2a529a-3cc2-4d59-86e0-259a9d77f5f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d460de-abc7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676310900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310900, "uuid": "354afb3c-2de9-4c5f-83ce-32e4e05291a5", "comment": "Malware payload", "value": "21ba9027a42adcda9c8094f2e57c87b7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310900, "uuid": "8dcf2a63-a5c6-400e-901f-44ceef6f5be5", "comment": "Malware payload", "value": "378f209030f8bf87e51c7d83f0d6cfe40647f4ff16f372b08a7ae64daa676b29", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310900, "uuid": "219605f0-47d6-45ea-892f-4b758d25fe03", "comment": "Malware payload", "value": "c1288e67640f9cc15550aaa1c0f9f091b7718faa", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310900, "uuid": "dd2a658d-62ed-4c30-b2dd-98b6ef18334f", "comment": "Malware payload", "value": "379f7d0f60e7a0dad389db22e070fc9c3690c77f25f6fbc1dbd34ff7aba70cc5c50aa68ff544de40179a05d80f5dc4ef", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676310900, "uuid": "6f22108f-1c97-40cf-a7d5-348ad133d875", "value": "T12D8103132253F36E02C317A772CB16B5448AB90BD15ED418F1AE8FDD92EC8EB311D595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676310900, "uuid": "658d6aba-375a-422b-9098-954e5cae45d7", "value": "96:Q3M0Cfq4UPB+tNxx2ryZMTHHqudnDt+R3Mo0UXELJNTJnoOkW:Qc0CfqfP0NxxWyjU+GLUXELJhJn2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676310900, "uuid": "ed0ab1d3-3ea6-45bd-9271-d6daf40e8b2f", "value": 3878, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676310900, "uuid": "8399e5ad-e43f-4b7c-a804-0842e167c39f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676310900, "uuid": "3509f1bd-bdb8-421b-b2ff-387f0d19d572", "value": "docusign_dropped.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7342885b-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676284664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284664, "uuid": "451a6939-7773-4715-9e56-0e7bd060cc0f", "comment": "Malware payload (SnakeKeylogger)", "value": "4f24c3202f4792d2bb19424203662969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284664, "uuid": "b8c7457d-58d5-42a5-825d-16f37daf6248", "comment": "Malware payload (SnakeKeylogger)", "value": "3857fcbee4a5113f3be6d087d6c01d1b78383e1b5930b0549ec8bf78a8bb1fdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284664, "uuid": "8dfad5fe-6478-457f-9714-9b5768ee6569", "comment": "Malware payload (SnakeKeylogger)", "value": "0ae681f2fb114033d863f12c70da24ed19a8ad3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284664, "uuid": "6f6becab-b7e5-49a9-b867-cfd0d52f1683", "comment": "Malware payload (SnakeKeylogger)", "value": "1507f70060c243ba5b116a2a55662fac355be6d5150569912d3562ee06ac288b176280cf33c22056330f2cfa0d7b2737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284664, "uuid": "e6a51d30-c1d6-4b3b-81c3-cf610c5e69da", "value": "T1E53523592E19633BCA3EC7F85D0A80B8E371AD383471E3A76EC336DB14753A64851A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284664, "uuid": "ae5f8fa1-66d4-4e88-a4bc-3aee36fc5769", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284664, "uuid": "e927ca11-b730-41fe-9dc6-10abe2f203dd", "value": "24576:kYXqQ57jwc0mNdYjjDdIIkoR4zzQEdjAxYyk29IqBG:F155RQXdIIkoSzdjA+72+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284664, "uuid": "855d696e-fc3c-4488-97b3-0e4706e4a5d3", "value": 1105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284664, "uuid": "95c93947-d1e2-4a43-b3da-78b8b941b6ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284664, "uuid": "5f984083-414b-48f7-8df9-e3dabf14211c", "value": "ORDER ENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db5308b-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676271689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271689, "uuid": "3b720e5f-f6f1-4978-8c99-7c6b3ed9cd08", "comment": "Malware payload (RedLineStealer)", "value": "74dd208eb53f1c614b1b12b9fa7022a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271689, "uuid": "e654eb3d-e935-4e76-8f70-282ee17f409e", "comment": "Malware payload (RedLineStealer)", "value": "38c274ae221c837a69b2c64f247d8a4841d20283e04e3a87081effe49f5d666c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271689, "uuid": "5f6b83c0-9fd7-494c-8b46-5ff892cf4d6b", "comment": "Malware payload (RedLineStealer)", "value": "b23a5ab6746f52ddd16920c026c5d5cf10906bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271689, "uuid": "967223c7-19da-46ef-aaff-5fbb300b84cf", "comment": "Malware payload (RedLineStealer)", "value": "c686a5de75fa51b6eb6dc59f83bf4a8f3ed56ccfe295f88d631523ecd7b64e181123fdeecbae061f8c8f34eb26242b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271689, "uuid": "7c22b168-99b6-439b-8046-9809463946d4", "value": "T1EAF4120BFBF89172E9B453B049F202C319393D119634439B77CFAC5A1872661923AB7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271689, "uuid": "8a69bdaf-1d86-4246-b8e6-a5d304f36160", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271689, "uuid": "f21d03ee-bd6c-40db-81bc-18659e74aeed", "value": "12288:tMrfy90dKBGjdx47IOhwXm8GJ6FmXKBLMiTBGiee9/eJ6ujMwSpjrnF5qe8Vfpfv:uyBBGjdx418o6FmHiTBMeqMnpj7FYTVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676271689, "uuid": "315b1a8b-c56f-447c-b57d-a1430807efa4", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676271689, "uuid": "509154eb-548e-4abd-94cd-057f9a99a9c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271689, "uuid": "95a86dad-e25a-4308-9ca8-fcf1cfa3e901", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184887b5-ab3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676250152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250152, "uuid": "205376d2-5adf-4eb1-8cc1-880cd1fd19c3", "comment": "Malware payload (Amadey)", "value": "337db07a7ea8ab660e978f57b03f6b03", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250152, "uuid": "43938b9c-5adf-4eb8-9c16-891939f944fd", "comment": "Malware payload (Amadey)", "value": "38eb18afc6ea0dfb8580231a5c4851106e781e843bfe4fecc811c8249655e033", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250152, "uuid": "caa1dfb8-90a2-42c9-bc6b-b87ebbd08299", "comment": "Malware payload (Amadey)", "value": "efe71cf08c8593c2c302c54c0feac86e5fae498f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250152, "uuid": "ea67f0dc-9aba-4a5f-a7bc-9fb22593da3b", "comment": "Malware payload (Amadey)", "value": "c76e293b778e6a852e3bbac24f2cc42adae605bb3deccbb28b614682219f80f1df8995e201bd7773d9b7267a5f18bed1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250152, "uuid": "0430067b-5a4f-40d3-ae3d-47e902e7ffa0", "value": "T134F4128BF6E89023F8B523705CF647C31A357EA15A7482AF138F6C1919736B1A13572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250152, "uuid": "5d5aeb6c-2971-42ca-b9db-c07c92da62a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250152, "uuid": "3be945bd-8925-49f9-b163-87bcd90aeaef", "value": "12288:FMrFy90ssO/EkB6a7aRmY1D/iW6eJvNX1CIU3lKOhUe/ODl:MyxswEkAa7acY1DKwTXUBUemB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676250152, "uuid": "47119b74-fcef-48db-8528-49803d5bea10", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676250152, "uuid": "46f159dd-2af0-4779-858b-09e12943cb70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250152, "uuid": "b1b6b554-685d-470b-b499-55e857cc6899", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56e85ebf-ab68-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676270014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270014, "uuid": "2078016f-0ed8-4702-86bb-4ae9d828c4ee", "comment": "Malware payload (Amadey)", "value": "90b3285ff03bc0b3a0cb6fa8dd20095e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270014, "uuid": "bd607412-8266-410e-8d97-5ca09d48ed80", "comment": "Malware payload (Amadey)", "value": "38ef49f2eae23ace24086f69dbaf43942c56e11e37cf60301b432f22a30dc33b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270014, "uuid": "6d6ef5f1-8a7a-42f4-8d38-706e54b008ba", "comment": "Malware payload (Amadey)", "value": "967792a97a7fbfdafc4f40e0b0bd89666d53613c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270014, "uuid": "9c5f188b-e0fd-4000-bab8-0353eae2dd4a", "comment": "Malware payload (Amadey)", "value": "be454ea7228cecc13ef506bfb0e3d6095699a02a5abe038acb726c97c6788f0d5eaf79d9d3086a6f69d2b8616e700655", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270014, "uuid": "c7f54d9c-b47d-4009-976a-505939ae0fd5", "value": "T16AF41207FBD95122DAF9677059F303C3163A7D2096384297278FAC290D32AB0E57676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270014, "uuid": "50f0df99-f192-4c7e-9a27-8167afd97af5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270014, "uuid": "60d76bab-3937-4ade-a0ba-59f86b8d78ad", "value": "12288:YMrVy90jRGtwEe7lqUvqI6MeZiv7W5HeJDR05K9A+K5qetIxiUt/1X:dymI2EeRTvt6xZiTWOt05IA+KY6ITNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676270014, "uuid": "8eb904e4-fb43-4057-a063-fe60c08e13d7", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676270014, "uuid": "0ededafe-b46d-4256-8160-3cae984c5337", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270014, "uuid": "6ca3edcd-1dc8-4e31-83d4-43cea16a60e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4cbc5a-ab7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676278072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278072, "uuid": "731c3bac-60d6-4e12-8e4c-2377341cd7f2", "comment": "Malware payload (GCleaner)", "value": "0f329eba0aa76656df5e9e009e910793", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278072, "uuid": "6219b986-4378-4dc3-8cf9-a949ad0d593c", "comment": "Malware payload (GCleaner)", "value": "390796c68e1d2dbb00457aeb397bdf7cd06051e806fe69041d9ba69f76a0984a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278072, "uuid": "e13f415f-63ea-4ef6-998f-5c2c65647e57", "comment": "Malware payload (GCleaner)", "value": "3f6164a4d0fc364dbe53393c64c53edec6e15f04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278072, "uuid": "9629cdb7-a5a2-4456-a35d-47d2b202bbda", "comment": "Malware payload (GCleaner)", "value": "442315683f805ecc17d045d56dae3660d06532ba8c8c5f4515cf01e43fdb6f19015ab65938e9cc41d1e4caccee938c49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278072, "uuid": "77bb7e00-ae31-4b59-8522-ac7f7705967d", "value": "T1FCE5123C7145C8ADD280BEB48C3A99E75CD66DE3E8E4A462B0DD7F3F51782984B0A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278072, "uuid": "307c4d6d-41e1-4f9a-a825-ace38594c7c1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278072, "uuid": "27d32373-f7ee-4b9c-8928-7daf017d9899", "value": "98304:JHE7UGMvDaMjbl8g0Cn0aNNljKuXis3B/v2MR:dPtvD9jn0gXZ/vjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676278072, "uuid": "f93dd9d8-0f36-4ce2-8516-ff707829d882", "value": 3308861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676278072, "uuid": "8ffd9d80-1023-489c-ae8c-d213b7329bf7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278072, "uuid": "05d0e183-2317-4a25-a7a1-e19efe71a7f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f18852-ab61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676267143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267143, "uuid": "669e48f0-2470-43f4-bca8-80162ff8a0d4", "comment": "Malware payload (Smoke Loader)", "value": "f2b513354985dcc6c865179192b8d71f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267143, "uuid": "b11d785b-41ae-4262-9365-8e1eb7cf3258", "comment": "Malware payload (Smoke Loader)", "value": "3946eba316d97091d39adabfcd310d015b49a694fdc5ec6360d8e3a2bf4f7add", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267143, "uuid": "4a91c8c3-d660-4297-9c73-cb8fa1e1089e", "comment": "Malware payload (Smoke Loader)", "value": "3b9c1b9ae3d14bf18a7a2cecca674da7293352f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267143, "uuid": "84c7c2a6-dea4-4a4e-8cf5-3496866a2a76", "comment": "Malware payload (Smoke Loader)", "value": "2748b331ef80b87125ddafd1a9a304dff27ee31d48c8deb2cdfb9e5b5e7894f3726683bea3f24cac7cc842bd20ebe6d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267143, "uuid": "8a6ec1e8-05fc-48c6-8a7f-84eacd8a8d45", "value": "T1C504D0D2B6E08073E56345743531E6B06A2F7C72A761C09B73649AAF2E303D1CA79367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267143, "uuid": "afb53bbc-3f22-4445-b86e-09d3e490c633", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267143, "uuid": "a905dff1-df7f-4cc6-a55c-3eecd34f9225", "value": "3072:2azL2anEx35XMTXkAcYYBokCjziuaxk+3cqg0F:2qniBMLkA1YBruQk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676267143, "uuid": "9db56b49-1d02-4bce-8950-db0862846c7b", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676267143, "uuid": "483c9e57-c377-4b34-880b-11c2fc870d0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267143, "uuid": "2e6589c5-a524-43c7-b99d-93a9f6d1f8a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baeabbb4-abba-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676305400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305400, "uuid": "549df086-2f15-4de5-b590-3a1a69fc6bd8", "comment": "Malware payload (GuLoader)", "value": "c058bd8df91f8d54d5f6c81c913bac2b", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305400, "uuid": "dfc70d1a-2189-47cd-9b98-cf8d1ab35de1", "comment": "Malware payload (GuLoader)", "value": "397a1d48cb742ca6062ec51d128d56466cb0837b42acb4e709d725d5e9506f6e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305400, "uuid": "14f4bcf7-caf2-46d3-a865-1d402f98e45e", "comment": "Malware payload (GuLoader)", "value": "6643206051807e2b02870a1b80538a9d98bfc967", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305400, "uuid": "5516c803-4317-434d-b794-adddbc54bde6", "comment": "Malware payload (GuLoader)", "value": "bf5540e61e43b4163225e104e81cc78d728c12cff0a572d6f98371c14ef0cbdb1b739e06a2e6092ca850bd0430d66019", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305400, "uuid": "a0293fde-a869-4939-b267-fd7c3e9e6216", "value": "T15B6423284293DB234DD61CF185621D4E4F04D9EBAAA5F4621C7C3E301BAB8F855E7E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305400, "uuid": "2000a85c-3107-45c0-b912-b064f94a14ec", "value": "6144:md+waHL4fxum24iUZUMUtHWCJ3LCkwMGQt9Ap9YdFZC8uxM1Kn8:md/MZ4VZlUEC1LbGQwPYdFZtuxM1K8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305400, "uuid": "8dd657d6-d63c-4357-89c2-86d6736a517d", "value": 326605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305400, "uuid": "144db402-9c4a-4661-aa89-fae00442e4f7", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305400, "uuid": "4363be10-3187-4206-b8ac-3a28a89d7d72", "value": "E-Dekont.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ba7d46-ab73-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676274812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274812, "uuid": "8b72c9a4-69e1-41ee-90da-c14dfd462093", "comment": "Malware payload (AgentTesla)", "value": "2a2911f43963ca8d7f0f2c95cd84d042", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274812, "uuid": "f8175c95-76ef-4b1c-88e9-199d42e77595", "comment": "Malware payload (AgentTesla)", "value": "3a4b557b3dc52bc71b6b209feb4c5a5cea1b5872ba975863602507b45e1bccd8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274812, "uuid": "1f9d113f-cd0b-442f-aaa7-03f0a9741ff4", "comment": "Malware payload (AgentTesla)", "value": "ec7f82f082180441c9bd04646eba05dccb340d43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274812, "uuid": "323c8e37-51ba-47d9-adf8-70d11a086884", "comment": "Malware payload (AgentTesla)", "value": "b9d9459f810056825df8a0966805d3803d190606fa71a8d0621b8824503737b582ee353ef5c77d300957c5056693110b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274812, "uuid": "11514f4a-d98f-4a13-8234-e406a052f34f", "value": "T19AE4F1503AAE5F28D56E57F41471E080A3767E0B2A76D32D7DC970DE0E32B468319B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274812, "uuid": "27f972b7-6364-441c-9b42-452f143a0fad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274812, "uuid": "f54beb80-7dcb-44b7-b3e1-bde6298513fa", "value": "12288:ix9TlZh6q6/TKPzG7ITAvvopc0ZazT+nce32CSjO16T0/iyUXoffXZcofNW:ix9jY/TKPzG7aqvo+KcI2CSK16TmffJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676274812, "uuid": "01ac3a1a-02a9-48b2-b0e5-1a8a8457ad2a", "value": 712192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676274812, "uuid": "39a3833e-1bcc-4bcf-bea8-e6ccef4c10ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274812, "uuid": "aaf01662-fc49-42f5-8d9c-736137fcc9f2", "value": "FedEx Receipt_AWB# 1022355160763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43319266-abdd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676320232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320232, "uuid": "372d7bc8-4f10-4c1d-81bc-9532a27d5404", "comment": "Malware payload", "value": "4f748595a500366636a1cc81c47b0e5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320232, "uuid": "5490fbf9-945a-42fd-8d6d-dd208af538db", "comment": "Malware payload", "value": "3a8c142ebc1069a8b4be15f7f112f768fac56cb6eea2147fe7bc9b3ca96e975a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320232, "uuid": "359f5a78-70a5-4887-ba74-259acb2cbf63", "comment": "Malware payload", "value": "dc026784feefaf6f8bea4dce001c25eb6732f4c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320232, "uuid": "edc4ab4e-2a25-4527-8a9c-28fe643f161b", "comment": "Malware payload", "value": "384688fa3f2d0593337593ebe0f1fcc4e9d94f504efc548b4913603be832e48085ef3c8362b035b39469ab7c0d7fe9be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320232, "uuid": "97b921a7-a644-46c3-94c1-2ca629ac7e26", "value": "T19B54F1233290E872D9621631CDAAC6B2777EB5110EB5574B37A8AA3F0F313D1DA32355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320232, "uuid": "1a106175-efcd-4dab-84c3-f871bcff1dbd", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320232, "uuid": "ad8e9fc9-9b50-4ff3-85ee-0f849cfc1000", "value": "6144:HCZX5UdgEyy37dGFhLNGFEeCPftk5bhH0HpIrU7vl:HC1EgET701AFmC5dUHWQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676320232, "uuid": "5c067527-0788-4dfe-ba0c-8ca2e3d01bb8", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676320232, "uuid": "c6d0f297-f8a3-4c26-bc4e-5a964e857663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320232, "uuid": "2cd0c0e8-7dfc-440b-8c88-1f4bee162b18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c68341d-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676251501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251501, "uuid": "f56fdd81-738c-4d62-98c3-010d1b22c533", "comment": "Malware payload (Mirai)", "value": "986518816011cb102472c36b50744ab0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251501, "uuid": "4731aa1b-3180-418d-a210-1171a1aa6ef3", "comment": "Malware payload (Mirai)", "value": "3b4a981d04d4f2252db276a62a0c4520b11dc6e4f432922d30a30069b51b37be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251501, "uuid": "c431f171-3e92-457a-adb6-abcb13405e2a", "comment": "Malware payload (Mirai)", "value": "12ee2e379480c9b1f69b94bff19e8c3825eefc93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251501, "uuid": "66104e32-536e-4c92-95b5-ed51b249f2ed", "comment": "Malware payload (Mirai)", "value": "f390de6436482dcdca62817796b5437c78069c57aa06a9ae898fefdc85a2f7cc519a9229a9ca351ae31cb5983d0feef8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251501, "uuid": "a40608a8-1c35-4267-a1ad-b9ca69b0b278", "value": "T123E2F244C0C94831D0331D36EDEF0AAC56DA39ACDD21B2325FA14626BE8937357FCA58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251501, "uuid": "bcb96a9d-5d05-47a1-93ee-e3512a9b4f5d", "value": "768:4/2Miwn2JztEm+5My3TglOvP14Is5+2EYol3Ui:vMP8Em+bgAP14f+Y4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251501, "uuid": "ad363fce-633a-45f7-92ee-133254468374", "value": 33644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251501, "uuid": "a7fac56e-27e7-4319-b4ad-e288499fff2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251501, "uuid": "7de43fdb-e733-432d-9dcd-3d0ca968ad8c", "value": "986518816011cb102472c36b50744ab0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eae9c602-abdc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676320084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320084, "uuid": "f0dcdc2b-33dc-4fe9-a04f-2074538da246", "comment": "Malware payload", "value": "9f7b82845a0b981bcb036ed23758b695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320084, "uuid": "2733f3ca-5670-416e-96ec-9b21ca1453b7", "comment": "Malware payload", "value": "3b8d068bf359ab97ca3468dc784377d766e5adea18b7c3d88d8ccf91d6f56308", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320084, "uuid": "db158bd0-cb67-4c26-a44b-92c20f1b7aea", "comment": "Malware payload", "value": "2ea0b2b8af0a3b6ea8a40fcb10714ae1245125b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320084, "uuid": "c230e96b-e139-4368-9132-a5e9374cad12", "comment": "Malware payload", "value": "56c5ecf3f88509b9f6a57248c3736ad580ab980919c55cec30b64a9b6e621b5d1a9a9102309c0d7bd0750daafc1792f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320084, "uuid": "c7aefb11-8099-41d2-8ab4-b2b79c052a8f", "value": "T18126CFE11F83D578E3C7CFF1B35492DA4E95AE610AA0B65F1D41AD1B0E4AF52C0B3A09", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320084, "uuid": "6fc90956-a641-4389-a453-8155c7cb335a", "value": "19f63d24f8949fc723d269de46ddfe98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320084, "uuid": "686c0c53-af16-41b0-b6b2-493fc1065ca5", "value": "49152:6Ud6aaFAWFXRwj7bKTCRJnrEQfPtlWatoIavHSIROfyFRCrBtkDfrgWfFWvJqX+A:6UAAWM0CPnx7+yfm8ttkT8OiJq+xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676320084, "uuid": "3162df6f-a8cf-49c8-b9d2-e54cacb773c8", "value": 4775424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676320084, "uuid": "60a63649-3834-4a22-8ff2-8d45919ba952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320084, "uuid": "5e34a817-a604-41d4-8ea9-196b93e2268a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb9b74b-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676299900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299900, "uuid": "3cfdc5ad-501b-4759-bffb-d4fca8508cbd", "comment": "Malware payload (Formbook)", "value": "e69d8210280dc0eb9e0a22ebe5a6c76a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299900, "uuid": "7d312c4f-6ab6-4f1a-b818-08f2d52855c0", "comment": "Malware payload (Formbook)", "value": "3c081233757b9e6b0c3b74db106fb9778b2bcef8a708fc642f3e2c4e6eb74410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299900, "uuid": "a2b02a67-f94a-4d9f-a027-a68515ecb72c", "comment": "Malware payload (Formbook)", "value": "9e62f6a60c597ae0ee96caebad44e8936a8d4009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299900, "uuid": "aeb92592-38b8-41d7-a5a5-737c41a7a5c1", "comment": "Malware payload (Formbook)", "value": "fd0e15c7ea40c180455ca101fc64fef94f92aa75e1d64967a0c05148d5e8996c21b5c2f76b8cad94c8b5b22e38ff1b42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299900, "uuid": "55bfcce5-508f-4e24-b469-825c2062b6e1", "value": "T1F6541200F7B4C027E6F146710F3F9B5A59B89B26957C420B2770668DF5336A3EA0A727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299900, "uuid": "38029406-ac3b-411b-a44a-264739c5d4c6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299900, "uuid": "87bcb69e-eb96-4dbf-84ca-e15e43a11df0", "value": "6144:BYa6sjxMVY8Coew0YJkWP/2kwKpW9SWhHfPFuhaVUaBdILUF:BY6jz8Cop0YawwKYAWh/PFFVUaBdIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299900, "uuid": "da58079b-27d7-496b-8ebf-855cb1a687fb", "value": 279021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299900, "uuid": "28f8c6b1-d2b3-4921-9173-1584b086f9b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299900, "uuid": "ced66eef-b1e4-4484-a05d-edc2e1b96bc5", "value": "bobash2.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e9639d-ab85-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676282444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282444, "uuid": "2ddd3c49-1c8e-402a-a7be-94bc9a088d9e", "comment": "Malware payload (RedLineStealer)", "value": "b20fd43b3f96842f0548e53a16613ee2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282444, "uuid": "c7ee585f-dd90-41b1-a700-e00ef748928b", "comment": "Malware payload (RedLineStealer)", "value": "3c3b546283c1705bf2f5611c2a773f374d2a90fde664e6223742fa567e49f7ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282444, "uuid": "e5b5737f-f305-49af-8381-6931af178596", "comment": "Malware payload (RedLineStealer)", "value": "ecbde5a6ff9bf7f77957914240281f4043e7e916", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282444, "uuid": "57eaea4e-a966-483d-8e19-1eca16dbc247", "comment": "Malware payload (RedLineStealer)", "value": "9541e65d3687f32be2b4583f107c9aa36c976c837738b6e0ed12edf9b11ee505c0b9f545517c060db2fcdad4459907cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282444, "uuid": "488c8833-904a-491f-8da7-6bcd27e76ec8", "value": "T15564F01373D0E4B2C5236A316D38C6E26B7EB8B25A39755B37481B2F1EB12D19672342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282444, "uuid": "f3b1d8b4-eca8-4518-b4b2-169663417278", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282444, "uuid": "2cd39438-c90e-4c04-b1c3-f858d6185692", "value": "6144:lrissK5vRl4zu5Hoj9bXH7Hf2UW7OwuLOhxNzLqZ:lriWnl4zG8d3bfuuqXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282444, "uuid": "0f9c48d3-df3c-4974-832f-245370bcf8a1", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282444, "uuid": "df0e6556-2ab4-4c7b-ad94-95b254b6fe5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282444, "uuid": "f07bf634-ec5d-42e9-a841-dde2231b8da5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc189919-abab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676298987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298987, "uuid": "2c24f9b5-18d9-4ac5-a09f-885c83a78264", "comment": "Malware payload (RedLineStealer)", "value": "ded440ce863f663e5cd1b889429b2032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298987, "uuid": "01a788b6-7bd9-4a51-931c-078ac608b9cb", "comment": "Malware payload (RedLineStealer)", "value": "3cfaab47409ed203cf2892354340bedc5348ce77d0ae750ec0376a3790957bf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298987, "uuid": "4f614db3-f110-4ee6-bd4f-2b969163b7b6", "comment": "Malware payload (RedLineStealer)", "value": "35b29d35f426f3c705488f02b90a28778cd5df28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298987, "uuid": "a43a958c-818c-43fd-a595-015b5db81f41", "comment": "Malware payload (RedLineStealer)", "value": "5734a42c8e17df53a0d3725cf708f365462869edd6adc970cefda3c4b7dba41dcb6a465ee0514ee983ed34e167e83d9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298987, "uuid": "06835f12-6acc-4b94-968e-c7941d199491", "value": "T17CF4120BB7EC8073E8B8177168F603D71A357E611A3842ABA34E5D5908721B1B7367B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298987, "uuid": "97435fa1-12a5-4272-bfa9-5c3e0ee9d8e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298987, "uuid": "1b5ca9f9-10ed-4936-b602-571d00fa8762", "value": "12288:5Mr/y908QKoIw+05KlTi0AfXrvworeJ5aqNDb1A/j8Ugt+BLFzY7o:uyfo40UTuzYh5aqF1Uob+B1Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298987, "uuid": "80981398-5021-4888-866c-5fffb34b59e7", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298987, "uuid": "065b3d76-c323-4bd7-8711-d9904bf576e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298987, "uuid": "c7daffb0-aace-4c91-a74a-f3060afb7448", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "363fed90-ab3a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676250202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250202, "uuid": "f75b7c64-a31d-4d09-a45b-37f402618fcd", "comment": "Malware payload", "value": "e66e96db8080b8042ad5691805ca79ac", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250202, "uuid": "15bcbee5-d83d-4ecb-9ce5-e7ae35cebde7", "comment": "Malware payload", "value": "3d76f59c4dceb13546eb9c72a7c0f03fd335093583d326de9a314f3dbd5a77cc", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250202, "uuid": "9a2063c6-d996-442c-93de-5b3213ff28b2", "comment": "Malware payload", "value": "22bd61247ada53f582c8897fbef5bb0ddb57cce4", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250202, "uuid": "6e527f17-8776-43fb-a6cd-d23c769d4550", "comment": "Malware payload", "value": "dfc68f2eb98dd6f5346dd890a069eebc14ff564f849c8c93d2bf5c68b6401f4eb5497bbb56bd722da37145c6ac5be2b2", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250202, "uuid": "3f0e217d-14fb-4d81-94fd-71eae760617f", "value": "T1A1234B12B2A6DE13F19666715DEBC2DA7238BD1D8E46820F33407F1FBC356B48A01B95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250202, "uuid": "5d59ba2f-79e9-44f3-8cf3-1aec2734fe7c", "value": "768:9rzihs1c4IoFqTblvB9Dmrir8PQk2Cj+Pc:c/oF4BXmriuf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676250202, "uuid": "f03da3d3-bc86-4a32-9a84-a9d706fb90ed", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676250202, "uuid": "e9de12e0-c05d-4c88-9da3-f118186d5be2", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250202, "uuid": "31103c4d-dbcf-4376-8ae2-a6f7ca0d6654", "value": "3d76f59c4dceb13546eb9c72a7c0f03fd335093583d326de9a314f3dbd5a77cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07576fd6-ab8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676286631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286631, "uuid": "5dce13ef-0ca3-4398-899e-90d7bff2f321", "comment": "Malware payload (RedLineStealer)", "value": "918fee161ff85beba22b171f1e401cce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286631, "uuid": "917c6b00-34c9-4732-9314-d81933e41a85", "comment": "Malware payload (RedLineStealer)", "value": "3dbb485f94bffbb6e070780451ccda0c651520b651ae9f2f763a8ff9fa70060e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286631, "uuid": "4d68e68f-6a39-4603-88ee-85f857ac2bc9", "comment": "Malware payload (RedLineStealer)", "value": "fabbf5ef93c4323827ba0252d2dd57bdc3a84078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286631, "uuid": "04c9f556-25d6-475c-af64-ce86fad74bf2", "comment": "Malware payload (RedLineStealer)", "value": "3a7a906f25cc88b9ba869054fafb5e76b2aeb2528a426557384ecced54014629a62ea007d4b85a44287a1c3e85822d85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286631, "uuid": "6fa8e14f-2424-49e3-bc8a-3de9432a4868", "value": "T11B07C04090B17015F7DAB2BBEF7B6186F43C96246BE874D75EBE924C86E35E8C4B0901", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286631, "uuid": "b765a1f7-7842-4589-8045-a84f4c4589fc", "value": "b2ab5d36f7dd4a87126c1487665c85da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286631, "uuid": "cfcb00c8-0ee0-4a50-954f-7c246f1cf433", "value": "49152:goMArUG9GOWMfTppUyr42O+EVkPVKMTyEgSW:GAvGOWMVl4TVe0MTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676286631, "uuid": "718a251b-4fc3-4ccb-ae4c-524c5fb90365", "value": 16931020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676286631, "uuid": "347c6af7-1d63-4600-b63c-c487bd8a3c2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286631, "uuid": "cb7f4f0a-ef1d-420a-b200-a44343476ccf", "value": "918fee161ff85beba22b171f1e401cce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c460f782-ab7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676277928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277928, "uuid": "71523c73-0f56-4cd8-a9bf-2e665d57651d", "comment": "Malware payload (Formbook)", "value": "75561baafb11a48c47fd8585f99a5745", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277928, "uuid": "a5f0eb8c-ef6d-423d-9ae9-10b4792fd8d1", "comment": "Malware payload (Formbook)", "value": "3dcc54fb60bb9878edf5497951f2b86516acbb5bc364f33283afcc894d6e4178", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277928, "uuid": "43f5568e-bec5-4b5a-baaf-7d75d5e5a32e", "comment": "Malware payload (Formbook)", "value": "2465e0ab3570fc05c7fb8131a0d9fa3639e3b3c6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277928, "uuid": "626c378c-c5dd-4aa4-8ed4-1564d1c16af9", "comment": "Malware payload (Formbook)", "value": "961a4e054540859b93720fe3dd796b25c494a69c2ed28dfcb7870842487ca07fe7b43a721e9d55a186808af4d2bc177c", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277928, "uuid": "523f3dda-81b1-4912-80c8-d188f005ade1", "value": "T19F0533D8FCD74E1D3A2008C2AE693758479CC5DF76E564ABA0B34224FEA85451BB784C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277928, "uuid": "d01c1f4d-72fc-4102-aa76-eff8315325e6", "value": "12288:z7d3UAB6mfWgcMNDDF0WLkVz44tn/inlLoJe7gSrEAGrV4I4+4x7d6ht/B6jnovx:Hd3UTfYnW/inlLn8kqVM+ThNBdvNDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277928, "uuid": "0b516e44-ae0a-461b-959c-04f4b2818921", "value": 837049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277928, "uuid": "7361f26a-f34b-46fb-9dde-4f87ae8b4555", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277928, "uuid": "4368c054-6674-4469-8158-f58082f1dd29", "value": "RECHNUNG0028377387.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b403f49-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Fabookie)", "timestamp": 1676301240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301240, "uuid": "1bf8b165-5e8e-47d7-a458-868aa2675d6d", "comment": "Malware payload (Fabookie)", "value": "710475fad4072f93192db19f14847c42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301240, "uuid": "639bedc9-4189-4ece-93eb-cd35c60df83e", "comment": "Malware payload (Fabookie)", "value": "3e1e58c974bd5981f45438a2fb6f9ea909e2a578f4d39bf55b5a251d6bfe5006", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301240, "uuid": "30e0cd9b-ecc4-4405-ad3d-e7a24886feb7", "comment": "Malware payload (Fabookie)", "value": "9bf391f8472480390fd31cec52203762533bdbf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301240, "uuid": "d087989d-7aab-41ed-9189-ccc1cda5af83", "comment": "Malware payload (Fabookie)", "value": "bcf202f2a2895d0056557068aeaa2bd35a02ee3eaeff0dee4967073c684f83083762422df6ecf9f4cab624417c242fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fabookie", "colour": "#289638", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301240, "uuid": "43d8bc7c-d4c9-4816-94d8-11c0012f52b6", "value": "T1DF0612DEB31C15A6CE98FD375631F2F9F58A43277B03261C90946289356A2707C9B3E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301240, "uuid": "67aa5e59-ead9-4c33-ad81-fc9d6666d22e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301240, "uuid": "4a131b1f-12b6-47cb-bae4-18b8cb8a035c", "value": "49152:iSgkERHLY2fSGfrhN2Gt8ZTgo+QCDJR7xTC2GQGJYlgQJaHVL9D7a+FMbj7Z/tT:6xRHL6G3e0cWTC2IiRE9va9bj7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301240, "uuid": "fc1fe0f5-9480-480d-a6d8-d5f129f237a7", "value": 3826176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301240, "uuid": "a5f9cc1e-3e9c-49e3-97f4-fc2606982721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301240, "uuid": "bcfe5b18-64b1-4bfe-ac26-5923a254a65f", "value": "710475fad4072f93192db19f14847c42.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c17f9e86-abdd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676320444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320444, "uuid": "71eaaa61-5749-41ae-b467-ee39d164efbc", "comment": "Malware payload", "value": "b5be2d54bb608e614e700296859bb6b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320444, "uuid": "de77a9c8-8aaa-45d3-a7e7-d97711a757e3", "comment": "Malware payload", "value": "3e54368940df4bfd27a81fe0c4b1d923c344719bc4627428e6abf50b4d87b8be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320444, "uuid": "e09bab5c-cb63-4ee4-8342-1097648d6851", "comment": "Malware payload", "value": "0130222f2a44767de359b6d80e69bbeb6a3143fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320444, "uuid": "b57e2330-04c1-473e-ab4f-ee8fabb4d3ef", "comment": "Malware payload", "value": "7b20f4eaa77a99c1c4c18238bdeaea743b915446636f389a2315246aab4c849016f8a9c3851257d2382f1bd4e63f6e5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320444, "uuid": "aba59635-2a2c-4d88-bcde-fa0a8d3f2340", "value": "T1D7F4120BE7E85422E9F96B7029F203D71A367E505B35C3AB238F6D0918726A0753572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320444, "uuid": "10cd1149-fd01-45cf-a553-2947f8bc0774", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320444, "uuid": "b0c24261-224c-414c-a2c5-86d0739e6aa0", "value": "12288:zMr3y90QEN+WUVg2UuDogWl+3qUmTmeJu46k59iVa5PwcAwkqO95he0:gyvEN+7VdUuDo5+33ejHd5PBGbJe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676320444, "uuid": "3a26398d-d138-47db-a41f-db5812ca816e", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676320444, "uuid": "12899b48-4afa-46d8-9d78-8a33a4570f0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320444, "uuid": "dca2b6c4-477c-4272-a78b-e4a4b309941f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc932129-ab6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272761, "uuid": "1355f87c-2a22-4ecb-8d55-ac35daeb6c19", "comment": "Malware payload (Formbook)", "value": "545ed41d88ab62019cb80b2f971481dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272761, "uuid": "9aab6310-51a2-43a6-8442-1ea0b18fd4a0", "comment": "Malware payload (Formbook)", "value": "3e924b372c019c41e9995a276ce5c1b1487d14ceb9fbc8d606a09a83df5989b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272761, "uuid": "f5ad9915-7052-4110-be1f-f0fc9e02683c", "comment": "Malware payload (Formbook)", "value": "4205dcbe9720c4ec9549bf107e87c8385088c136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272761, "uuid": "5f2a5257-eb41-4dc0-9ef1-4f58a4d2429f", "comment": "Malware payload (Formbook)", "value": "b2dd19220ac845b96add8d8abb1cb026a16d34019bfd290d5956faceccf54ec35210a4a23fe6a724f674e33bebe3bd4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272761, "uuid": "a1e82747-9424-4609-bc43-1e450b926664", "value": "T1B60523563C58C773C62D83F8092A8874A7B1BC6825B3D39B1DC33ADB35717A24986787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272761, "uuid": "af3e22e4-3e21-486e-81bd-bcaea2fdaf76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272761, "uuid": "98240d93-3e4d-40ee-8bd8-69a5eef4a038", "value": "12288:98tfh6q6EM1YC0ND571Vd8ox9nnano3iokTNIBx/Q8Xy0MwTPJiHB:aYXbQ57jz9nnQoyfcZTEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272761, "uuid": "8adbcdc7-fa45-48cf-9aa6-d70671861f46", "value": 801792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272761, "uuid": "148a8ab1-c1ab-4701-ad6f-04a9c2468f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272761, "uuid": "b6bc22f0-eaca-4f32-b0b2-6925c809c661", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3681d69e-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299595, "uuid": "d141e8d0-921f-4f46-891d-1c61fc151ff6", "comment": "Malware payload (SnakeKeylogger)", "value": "a4507e7dc150f20e19d3b3e2882d6f5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299595, "uuid": "dc5dc3e3-0098-4959-9b41-af06a394b256", "comment": "Malware payload (SnakeKeylogger)", "value": "3ea05ca04e253720730dc4cc9e99e42beaf056643f2150f4dce2fc0e7825217a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299595, "uuid": "0d846912-3b14-44f8-a3b3-1e13b6fefd01", "comment": "Malware payload (SnakeKeylogger)", "value": "6b6158a2d66fc92bc58143108eb7ed0974f93df2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299595, "uuid": "10f1350e-9d23-4116-ba55-8e599e5d4ab8", "comment": "Malware payload (SnakeKeylogger)", "value": "4d7af6cfd00c477f1eeb51e8ecb39200903949706ac101abf6c9533dc650301f632af5f7d8c30bce1b029bc3033d51f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299595, "uuid": "1964fd1d-8577-4c7c-9817-06e8c04bf201", "value": "T1B2641226A1B4C063E6B252724C374D2F6BA3ED172AF1195A03610FEDBA736C4D41E7B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299595, "uuid": "76b7dbd3-bbb9-4006-9b21-8d527d002a91", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299595, "uuid": "35a22893-e140-4cd3-9813-23cce1e1021d", "value": "6144:1Ya6OoZUyEOZLa8NB8ZZ1s6VL9i9B9k2EsnRIFSO5uNzy:1YsoZf9Z+WB83/05EERIMzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299595, "uuid": "7737fd6a-23d2-4e02-ad1d-66ce6e060f3e", "value": 306747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299595, "uuid": "485cc69e-338a-4cca-91e7-0579cfcf0cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299595, "uuid": "2b6939e6-ccb0-4107-8c50-9b06f05befac", "value": "Doc35624727213022023.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac249db-ab9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676291522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291522, "uuid": "8846ade4-ef3b-499b-84da-75eab98c9245", "comment": "Malware payload (GCleaner)", "value": "70cdabe50d91e8dfe8c42346f059dd00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291522, "uuid": "79af6971-7c1b-4f40-8e83-50863657d246", "comment": "Malware payload (GCleaner)", "value": "3f53067e6148baef9067cb7a301e15731bad017afef8281d5618b87454fcb4ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291522, "uuid": "866e5191-7ec4-43c7-9c9f-75edc038b5b0", "comment": "Malware payload (GCleaner)", "value": "8c28ef3f58bcc6051723208e576e307fbe52f420", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291522, "uuid": "c8ab5105-d466-4389-82bb-9206efcce98a", "comment": "Malware payload (GCleaner)", "value": "5c12129f104065d7770140b6765e172784c13f6bc943fb03806db73bc790b7089effa75471777949dfa727513b6c5304", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291522, "uuid": "0f1c574f-3747-432d-9767-d6e07c175e05", "value": "T163F5127C7145C56DD2C0FEB48C3A98E75CD32EE3E9A8A46230D97F3F517A6889A09107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291522, "uuid": "01d6acba-f237-44bf-9ac5-451defdab5dc", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291522, "uuid": "9889c0f2-f2d1-4d55-b912-8e5d1afe4183", "value": "49152:rdHDqvq2a6WGWmC+EH4VnQruJ8nQkz0A6NuNBDd8xUvdDFq17OfIjLCgv2MR:JHcq2zCknQKJ8QkzauNZhuuInv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676291522, "uuid": "3420036a-8e67-43ae-860c-aec79d0766b1", "value": 3332661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676291522, "uuid": "6e34b4c8-df14-4c88-a497-3cc8a0f2589f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291522, "uuid": "30ce349f-50c7-47f1-bdd1-171233a84b5b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d35533-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676280320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280320, "uuid": "0d068736-6871-4273-b470-6637481a145a", "comment": "Malware payload (Loki)", "value": "e21bbc04816043b4db416c74cfb3eec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280320, "uuid": "b6ed2986-6ed6-4032-85dd-188f49124cf2", "comment": "Malware payload (Loki)", "value": "3fb83350f2970de34e20da59966fa86d238292be9f1e07754070a90ca57f5ef1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280320, "uuid": "3d7eecad-fcc0-44e4-b6c6-03bcf5c10360", "comment": "Malware payload (Loki)", "value": "fe99b9be857d9c8fd8ca3d6e0715ebc24251ad64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280320, "uuid": "fb887d20-3f25-4c8d-ad64-420d80f6e3c3", "comment": "Malware payload (Loki)", "value": "66c31b08a5bdb7e5db6cd460fb8ea062b2907c7290c359e2450c917be2df59c4120a7befc39692507046f4a4e8bac902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280320, "uuid": "e1fd7d7b-9296-4182-9c05-0c8f1f8f5c17", "value": "T1A7D4F0103ADD6B18D53E57F41465A080633A7E4A2976D32D3DC671CE2E32B878326B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280320, "uuid": "38d01d2d-8365-460b-888f-2ae00bc7bf8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280320, "uuid": "a1246bae-81b4-4ff0-8968-d65db4ebf8b9", "value": "12288:alnHnZh6q6/TKPzG7fS8KEMgTdN7zvh3BzpjNX8yppyJuXTLux:aln5Y/TKPzG7fCEMgTz/hxzbXp7bDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280320, "uuid": "4765ddd7-5226-4ca4-820a-05de8f562d59", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280320, "uuid": "c3076c5c-f5e5-4dc4-8993-fc67e21175f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280320, "uuid": "78c858e6-7134-411d-8e54-affb54fb3557", "value": "SOA JAN 2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53fdbc78-ab5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676265714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265714, "uuid": "0a846d09-b7db-4446-8555-350336a947e8", "comment": "Malware payload (Amadey)", "value": "aa28a5e8f7fa854f5f5561aa823ee162", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265714, "uuid": "d6188277-0901-465c-a474-2f924a1a8c4f", "comment": "Malware payload (Amadey)", "value": "400a1e472ffa49f009c71b36321c5f6721b6504a49fb832f95cfeb4e0e639299", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265714, "uuid": "d012a926-783c-4f53-9124-7580a4cc3465", "comment": "Malware payload (Amadey)", "value": "5009400da6cc90d28e27594e6fd601df6f9f1562", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265714, "uuid": "bf16045c-45ba-42fc-81b9-6cffcf42acc0", "comment": "Malware payload (Amadey)", "value": "758e0a2e34caa06d9da3714e3529e7627d9c39d89f7ef98b062c8226404eaf33fde3745a20b84c3e12a4be46359f8fb1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265714, "uuid": "b60a7380-7cad-4ae1-8e33-eb2e7201b280", "value": "T188F41207E6FC5132F4F163B054F603C71A3A7E915639839B234EAC5D1872AE1A239B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265714, "uuid": "8a7a3df9-0661-4a10-b6d4-733e169275f2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265714, "uuid": "84fe5c6a-a549-4494-bc5e-f75ef1cbcd0b", "value": "12288:jMroy90dFNFRefj+gxzVzlm0YF+DRHeJE8SQ0e3/qAd3B3kd6BV:PyyfRg6gxzp3efWhe3/zpi6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676265714, "uuid": "ef1f0806-129c-4e9f-9f3e-2547d743eac6", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676265714, "uuid": "820a50e2-4d4e-4cfa-8cc0-9020e7158099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265714, "uuid": "8760d9f3-a534-4a0f-a45a-eb003c368872", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ebfc8f-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676276829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276829, "uuid": "d9c20aee-aba6-4560-aa70-34055c5e0b33", "comment": "Malware payload (SnakeKeylogger)", "value": "ce038e9d0a12de1b62825aca7128b8b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276829, "uuid": "31532c2b-84b6-44a7-9f41-7b2a9fcd8041", "comment": "Malware payload (SnakeKeylogger)", "value": "40249d5ce7cc3f51a130f15132d7b877cc9a34ccf7c7c194daab58c7ba605144", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276829, "uuid": "c852078d-4f3c-42d6-8741-ac4e44234709", "comment": "Malware payload (SnakeKeylogger)", "value": "abb117799fa11c0ca948c5ed3c54806f80cd31b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276829, "uuid": "21b37065-b2e2-4a01-b10d-3281bb22a605", "comment": "Malware payload (SnakeKeylogger)", "value": "70c2728ccd3e208a1c3e5fc433f6828521995c79bf7c0104b08b9b4e85e63c1af329d71f04a0ee2fcc9097c60d3213fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276829, "uuid": "6155c9da-599d-4860-80ae-b05a1dc620d8", "value": "T1505412153B88C02BC8130B715D7E47BE6F7695A920E4A357A330A7ED3A137898D2D353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276829, "uuid": "3363c340-d554-4516-994b-9cfc0e46da99", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276829, "uuid": "21af3e19-e843-4143-b655-15bb4c8926d4", "value": "6144:/Ya6hgV6dIWlWCsOBgWQ+deC/sty0CKti8BJAvSFj9rWP+ZH3U03F/amPs4Iakm:/YbgV6dIKPsEQ+kDCKti8BJ0yJk+R3U+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276829, "uuid": "3b9d0c4f-b32d-4e74-8872-048789cedfb7", "value": 303312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276829, "uuid": "97f58a11-919f-42fe-a5f7-6db4356cefa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276829, "uuid": "5921da4f-abcf-44c5-8761-2c00d733573d", "value": "Payment Advice.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f952813b-abbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676307652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307652, "uuid": "dd2562ca-0d93-40c7-87bf-5b66dbaffbac", "comment": "Malware payload (RedLineStealer)", "value": "7bccaa283f304061054be621bdde0212", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307652, "uuid": "0250a014-cc24-425c-a61e-5940afdb234d", "comment": "Malware payload (RedLineStealer)", "value": "405a2325559cc3052af68e23a40e297f6ac3a51daad014ffe2c281d1b53bf178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307652, "uuid": "8fd809c5-265f-4d4f-b751-a051eaf9490b", "comment": "Malware payload (RedLineStealer)", "value": "1ac977d7e99c9344106c90ff61683b16afc0fdbf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307652, "uuid": "25dfcc4a-bf5c-4352-b457-eb35fece22a3", "comment": "Malware payload (RedLineStealer)", "value": "cbf5f5ad4530c0bb59eeec1fd5d987fdaf2e8bf03f50c8e3aa4bdde4649205188e6eeca7528bb92a861060d288ab63a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307652, "uuid": "7c379b44-19c0-4bf4-ba42-6a4dc3f644f5", "value": "T163F4120BA6E9C027E5B4537058F202C30D3A7DA1573953DB275E6D5A1C726B0BA323BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307652, "uuid": "55d44bbf-423a-4474-809e-e2803c5f4128", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307652, "uuid": "106ec9a9-99a0-4161-853c-1bdc6b165e41", "value": "12288:zMrqy90wpCY12bjDpMz1udFYXZ8ByMTUAbASx0883OkIPn0HTkq/07w0qGB5XchG:hy9L12bjGZ+YXZ8BPTvbAI0883OkI/Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676307652, "uuid": "83e1bd9e-def6-4f0c-8ad5-201de265671f", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676307652, "uuid": "8b7070e7-eca2-49f4-8902-8113d400049d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307652, "uuid": "dc0370f8-1e49-42d3-89a0-3cc77c97bd70", "value": "7bccaa283f304061054be621bdde0212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ef5d34-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272052, "uuid": "9e9e5b2c-8e57-4604-9ca3-1e28c2d73a97", "comment": "Malware payload (AgentTesla)", "value": "3843771ae9cb5965ed85aa2ccfd4cfcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272052, "uuid": "abd29adc-2c27-4324-b686-0e8918d27db9", "comment": "Malware payload (AgentTesla)", "value": "4060d1c2c34a61e0d88fb5e154baadb5958d9f9ddfd03de92759af025b347ebd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272052, "uuid": "28147754-c987-4096-a295-972671ea8ef2", "comment": "Malware payload (AgentTesla)", "value": "3dddf86d835046449546ccdcbd086c4252a048b3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272052, "uuid": "afb5a549-473d-4e8f-82e7-00d03dce85ac", "comment": "Malware payload (AgentTesla)", "value": "842a6f2c076f1fcaa103264811574e0a97abc9ccb3d3ae5f1518ddbf66a63f18cf5c1ffd4d2925e6d92d95d3d97e47ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272052, "uuid": "1509b00c-f215-4bf8-b4b3-87057c1a97d5", "value": "T1DBF26D1536AC2733E97B17F484EA64260BF1B5965501EA971CCAA0CF4EE3B500751ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272052, "uuid": "1c9774d2-a18e-4543-96d2-1ec9a79dc8c0", "value": "768:JfCUhXwRCYh+x89rVSYeJzkECC7WY3CyiRWLpx:N5XI+xwVeIC753CyiILL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272052, "uuid": "b17fe7e8-7d4b-4060-bc21-e888a8cc2076", "value": 36256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272052, "uuid": "4f1ab1a4-6020-4427-a418-1cb0c0d305f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272052, "uuid": "c4420cfe-a290-406b-ad48-924803d8bcf6", "value": "Order 45655454__GZip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e23f16-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676301471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301471, "uuid": "85078b40-987d-46b7-810c-a78aebe3dfbf", "comment": "Malware payload (AgentTesla)", "value": "1dd62ed5322019db26ca5673f316ea37", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301471, "uuid": "4c08ad1b-e061-40b0-97fe-af0c9d781f78", "comment": "Malware payload (AgentTesla)", "value": "4184d11c404536e306fcaca8867fc33b749c607abc12ed94878d81b51027bf1b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301471, "uuid": "da95bdb4-814f-4ce6-abba-8e23e55e2926", "comment": "Malware payload (AgentTesla)", "value": "be3d085c35ac3773043b33dc23ab99e0119542bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301471, "uuid": "ac12523b-5a94-48d9-be43-57b1f3df0d90", "comment": "Malware payload (AgentTesla)", "value": "c7e52ed07cbeb094c2c9258c7188c74962357fb5e1e48782408dfd15f569596f16182ab93bd99c0ba0782b5c45e7ad4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301471, "uuid": "7edb40ca-319e-422f-a459-aaa97981a18f", "value": "T18AF4F53D297617E6C338F93186D18420B6EEA1923703E969EDE61BD14F026C27DCE61D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301471, "uuid": "5b8e2fcf-0568-43f9-8f9c-0b999bf72a5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301471, "uuid": "46356605-35c2-4c07-b7e4-790922f42f1f", "value": "12288:lHEzIlVB+C+2SlLVseHKNTn7tunA+/kSZ5ljwXcd7wJErzqIAd7BwUQ6U07ZiUJ1:VQjseHKNTn7tunA+/kSZ/KIiWOIiS6rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301471, "uuid": "a08977db-39bd-432c-8d86-3d415fc719a3", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301471, "uuid": "0e3e9ca9-617b-46ed-aeb1-aa7430f41a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301471, "uuid": "8f03a5fc-4db1-4267-8019-47ea844dca93", "value": "SOA DEC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8cee09-ab79-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676277539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277539, "uuid": "b42a2f49-7395-4a8d-bd7e-c2e703560e8e", "comment": "Malware payload (RedLineStealer)", "value": "b16e861515d552c3bbd87747ec7f7dea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277539, "uuid": "4a5cb5cc-3bc4-4452-a89a-2727e783f86c", "comment": "Malware payload (RedLineStealer)", "value": "41b041f5debefbf11f7ed4f1daadd9375eee5fcc3392cecbf8ea1360fa910b60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277539, "uuid": "b75046cc-c8f4-4b13-9715-78a32fca965e", "comment": "Malware payload (RedLineStealer)", "value": "2ab3d9d02ede2c550380387320e2ee6ad1dc6f98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277539, "uuid": "5bfac09f-01c1-482e-b726-e1c6dfaf9575", "comment": "Malware payload (RedLineStealer)", "value": "9a6d45010588e4b40ea741cdd861079dedeb500afa350e8dd4f0906097df7e127a99d228c233a9dc1cd192f7b591e766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277539, "uuid": "fddf7093-38b9-4034-ab84-390ea0f4eff1", "value": "T13AF4120BA7FC9032E5B5637019B613C316357E00BA78C39B66CD6E481C726E4B675B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277539, "uuid": "2b924044-a762-4367-9f76-445e2236617d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277539, "uuid": "fb40eaff-70c2-417c-8ce4-f6ff35fcbb64", "value": "12288:aMr3y90VP0xRkgSD6xF918zWx+u9tLQdH2vxw5DaHeJGKpdxcuWB7eTHXwcGTeG0:tyk+hxn1wfwb21GdZBijKeGSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277539, "uuid": "92430960-68fc-4ec9-a6b0-1f77629fe2c1", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277539, "uuid": "5eaa5099-3bb4-4bc1-8807-7bd092bc619b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277539, "uuid": "004e2b22-9ae2-42f5-b367-b732c81eeb47", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3a59d4-ab6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676272623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272623, "uuid": "aa46386a-6bb3-4b98-b9e1-1039a81c9d50", "comment": "Malware payload (Amadey)", "value": "055589edb1a56768052c5554d1097360", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272623, "uuid": "3db017e6-c2ea-4bb2-867a-41a1f9871264", "comment": "Malware payload (Amadey)", "value": "41bb2409c5a7bddbaf2066e868bae82b55e2fb4bfead1f0917d3322d999d1907", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272623, "uuid": "5afcdefb-bfb9-40fc-9086-2de8f3d03332", "comment": "Malware payload (Amadey)", "value": "100882e73a0324acf8ea0802ca6b196abbb3221d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272623, "uuid": "e46250eb-cd18-48a2-928f-535f1c0763f2", "comment": "Malware payload (Amadey)", "value": "da3a9c0b247c83c41fd396a526661ad70dd8e956759d4d21d23b5808a21c27b88145f885a20865c2f1a30f7892fc4830", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272623, "uuid": "eca9b7fc-2b24-4660-8c40-17ba62979c73", "value": "T111F41307FBE89032E5B0A7B00EF703D719357C605F3882662B8E5C5A1977571A63A36B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272623, "uuid": "d68d58f3-09c6-4562-9e42-4ae848daf640", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272623, "uuid": "b9338b68-b630-46ec-8e53-cf6e9949df95", "value": "12288:YMrry907MsLht/nijV3NApfLEJh9dPHjjeJy8+XPT8TTl5qe2a6PmUOe:zyKMsP/nIV36a4XwkZYRa67Oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272623, "uuid": "f0144437-e6d8-420a-a7cf-304b04d90058", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272623, "uuid": "8feac88a-47fa-40e4-9350-bbdeb37bbd61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272623, "uuid": "2fb5bf29-29c9-4328-8268-15c11bf3c049", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fa81ee2-abe1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676321890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321890, "uuid": "b04bd93f-09ec-4330-bf40-e7fe7e512193", "comment": "Malware payload", "value": "c5093fb4b393608fa4236ec9d5a4129c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321890, "uuid": "53f83067-5dfa-447a-8d17-a6ed97ea765f", "comment": "Malware payload", "value": "42a99c9bb27df1469e67a4d2e6871d23dc85058798227c876d8a6c81abafe04a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321890, "uuid": "b093a5d8-e57f-4b35-ba7e-802672f11c81", "comment": "Malware payload", "value": "e874b1f34689d5c9a291abc11cfc02601d4b1a37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321890, "uuid": "8a0dea98-1d93-43b9-a2e3-ff9ef03ca0a1", "comment": "Malware payload", "value": "1237c375e7b223606faf4456c4af3393cb66b9d66483ef54054a3e2126926ab97454b7690ec0243e8665f467960a6b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321890, "uuid": "88cf651b-6ec1-4299-8782-c4c581ff3831", "value": "T195F41217EFE8C077D9B117B019FB13D32536BE60163483AB23CE6C191972AA0913679B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321890, "uuid": "304db328-1eb3-4b11-9e54-6ba88ab615a3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321890, "uuid": "39049533-12e5-4298-9bf4-587b749e62d4", "value": "12288:fMrFy90mYFbjVC+YPNx0XJUEBjhv3KXnweJ8XlzN8oGnNI+Vk5owcxd39n:OyGV2XAX0hQyLK/5oBH39n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676321890, "uuid": "daade1b2-21b7-41b1-8f38-5c97b1f211a8", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676321890, "uuid": "6fac1709-2f9a-4446-a0ed-466df77ae75a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321890, "uuid": "da2e5a0c-1ea1-4177-b264-998f4401730c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7ecffe-aba3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676295422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295422, "uuid": "f5b47dc1-0656-42c2-8c3f-a15ecfbd14d5", "comment": "Malware payload (Smoke Loader)", "value": "89f2dae893595ed9bdb0fac74e8ee4f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295422, "uuid": "d713b09a-4659-440d-be07-6cc1630be9da", "comment": "Malware payload (Smoke Loader)", "value": "43886c06b5cb90a79919994b9304522c3c75b18b75d3aba5d8feddc2511b5b2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295422, "uuid": "1186d9f5-4141-498b-9803-e902eba2336e", "comment": "Malware payload (Smoke Loader)", "value": "42618e472a26416cf436cbcdbe07a2cb89882323", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295422, "uuid": "1d6a17fb-0839-49e6-b3a1-02f09d83a385", "comment": "Malware payload (Smoke Loader)", "value": "1416efb131b637f760066d1b21911ee3b0cd07eaeb0458afc390ffdb051b7f27775f75adbf0e594ec3c9bfa6d58a1069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295422, "uuid": "3b0cac53-9730-4466-ab4e-b27f81a2f7dc", "value": "T11514BF1332F0E471C1331A319C65C6B96A2EF8717A79AA9F37981B2F1E70ED09932355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295422, "uuid": "d756dee5-f767-4b60-8dee-8cffb43c6d3e", "value": "b5b37a1e2171531433caad206e98583c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295422, "uuid": "4aa78fe9-54e9-4f80-ae4f-83536662c3ba", "value": "3072:Qn91yWDkugXKHGEePyd3s1rsevx1Jzsgi7mJLfEVm8Rguw38RJOH7K+wE3+1s9:QnXyWgvaHGEead3wsKxfzfiAkRj27k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676295422, "uuid": "17f9dd83-135f-466b-ad9e-8f598fced344", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676295422, "uuid": "1053d549-d9f7-4f9f-83b0-950ffcda476c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295422, "uuid": "490998d8-d88b-41c1-8e31-32741ada9d3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b399a0-ab96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676289658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289658, "uuid": "f9aded30-a82d-4508-a3d5-1d1c362422b4", "comment": "Malware payload (Smoke Loader)", "value": "860e3a147a3e8bd78e8ab0d4a6d2ded0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289658, "uuid": "844349be-c148-4b9f-b46e-82bfb8964626", "comment": "Malware payload (Smoke Loader)", "value": "44335fc73724f3ee18c8d5f8d659e4356414fda58dea3ec7367a42b6a69a2d42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289658, "uuid": "254914df-1482-4df9-967c-8f0b4612844e", "comment": "Malware payload (Smoke Loader)", "value": "6850597cb1dc83282546a7776dfd69b9ed3f9b28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289658, "uuid": "4a2b942e-a16c-44ac-b5d0-6f4ee9052c1a", "comment": "Malware payload (Smoke Loader)", "value": "dcd4c9758dca3ee67c77496fc75b23a0516e288d282f687f703d7db1119c13a7c8bf211df30137b48f8f9725ca69599a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289658, "uuid": "55fc8182-ca74-4180-9bbb-7e018b8f1602", "value": "T16114CE2373E0E472C57216305929C6F46A7EF9B14E38A5A737481B3FDEB02D19632396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289658, "uuid": "4e709018-5a70-453c-b882-b5f186b5b783", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289658, "uuid": "8931c6b2-3678-4522-ada7-4cb162111171", "value": "3072:+pgelDNY5XwzR31YI+YK1nkorxGsOE3hHG39N+itAJKGPLasCArFA3MdZ:+pdl5KmyIzK1nkmxGO3hHG39PGDaEFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676289658, "uuid": "03f277aa-efe8-41a4-8457-e75cff67d951", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676289658, "uuid": "50cc9d1e-82c0-426d-9d75-00542905dfe3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289658, "uuid": "1afd5fea-78db-4cbd-8aca-6b0eb0c52997", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7210837a-ab73-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676274784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274784, "uuid": "ab907e93-6df6-4962-9fcc-d6dc7efe542a", "comment": "Malware payload (SnakeKeylogger)", "value": "a814a172ff0d97c6e502b58d3d275c4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274784, "uuid": "53a121a9-1a2d-4737-a757-af55bbd589a0", "comment": "Malware payload (SnakeKeylogger)", "value": "447870a4ca679539cc6a2a062969c4db84d3c0f77228d3822dc8d90b54583c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274784, "uuid": "7b69dc00-88d7-412c-ab7c-aa74779cd653", "comment": "Malware payload (SnakeKeylogger)", "value": "a51658f905c74661f556a2de91866ec7d2266e22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274784, "uuid": "a23db7d5-802b-4a63-8126-591573796629", "comment": "Malware payload (SnakeKeylogger)", "value": "b2ca40e0b8d84b76f0d2430d5ded2010d6ded8401298685890e93bbaff6c4154ccf49c20fd30793457acaf0cba477baf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274784, "uuid": "6d83c5a4-ca1b-449e-8218-5cf1a93b66e7", "value": "T1595412467B40C0B7D9729B706D7A9B6E0BF6B02625510B0F2B10761CB6332D5FA6E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274784, "uuid": "0863f682-8b98-4f4f-9b2c-eee14407e1ba", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274784, "uuid": "67c7243d-62a5-4eb9-9529-51bb9e40ed93", "value": "6144:vYa6SksNY2nQdKhGNGydmVmgn+H9qdp8MJamYP7mK6ovYzAeP:vYsCKYUmgn+dipemYDHDvYzfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676274784, "uuid": "4254b4e3-c7cd-4678-a5f6-0bca6c499f17", "value": 302927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676274784, "uuid": "17f98ee7-f0c4-4390-ae40-88bf07cd54ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274784, "uuid": "b68604d6-0105-46a3-9a21-4cf222aa8bec", "value": "payment remitted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64547aa0-ab6a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676270895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270895, "uuid": "0b2a8d65-1421-4de3-b640-9e287b3189ea", "comment": "Malware payload (Smoke Loader)", "value": "e139d930a560cb9d5d6570ee631ac149", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270895, "uuid": "e8fc704a-9879-4fa9-84c5-ac0449ab7175", "comment": "Malware payload (Smoke Loader)", "value": "449d1b94b6a0159c1ef021dc36c7d282a6c8ccf41502df50be5c2299557af078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270895, "uuid": "3d582de3-f6a0-49b4-8586-b2b9d575b390", "comment": "Malware payload (Smoke Loader)", "value": "c550632e838d8050aca5d3af5044b50314cb2c46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270895, "uuid": "9b86c864-8b61-43ba-95bc-c56e37bff279", "comment": "Malware payload (Smoke Loader)", "value": "78906fc924de26cf311fb9fe7eb5515cb160ecebc3f12726edf82191cfb30cba169082b0744a82a426f68a7ce4965154", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270895, "uuid": "6ec17ab3-30ee-477d-81ff-880a21d14401", "value": "T1E714BF2373E0D472D42256309E79C1B06B2EB9B16E78656B37483B3F1FB06E19676342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270895, "uuid": "e5e31ac7-0140-4514-9b1c-fcabbd3d83dd", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270895, "uuid": "5ffa6a50-6a12-4707-932e-43f214377939", "value": "3072:jrkwWOLtpwWKzJuxWxvUSf17gmOyDQTnwl3/ssBExZxA5A33qZ:jrPNpKtuxWxvUG7V/lNEROX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676270895, "uuid": "a5ea78f0-6f87-425b-a40c-d8eefdf4978d", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676270895, "uuid": "fc14bb49-4e9d-49f7-8006-3ec1faa19a98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270895, "uuid": "d624faea-b6f5-4371-98a3-870e06ffb24a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c726c5b4-ab8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676285234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285234, "uuid": "0f4b13b7-830b-490a-8e88-2eea6baf4de8", "comment": "Malware payload (RedLineStealer)", "value": "8cc0a90c20fcb556442575f5b0c126bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285234, "uuid": "c7bf87e5-2dba-487a-b185-13d004a2cbd3", "comment": "Malware payload (RedLineStealer)", "value": "44c7f5012d00dde4471760b15cea070cdc97bcb17395b181bd915c06e5f6a16b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285234, "uuid": "284e7496-72da-4dca-9871-6a5e1086577e", "comment": "Malware payload (RedLineStealer)", "value": "32516d1c965020def2a25b4dacba1ad77a4766ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285234, "uuid": "a56562db-30df-4434-8953-67f658aa583f", "comment": "Malware payload (RedLineStealer)", "value": "aa5212b8e460b5062ba2acb5f7c5cae997381bef183da1158b002f3a25353e020e704261c3f6d0ef90f439cf54639125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285234, "uuid": "f3983fd5-159e-406f-a39c-3b55b88664f8", "value": "T17FF41207A6E98032E9F5577048F203C31A3A7E615B3443DB678E5CAF5C727A0623676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285234, "uuid": "157a4811-9775-4bcc-be4d-a78b01bc00b4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285234, "uuid": "e4e9bae1-fc01-4482-9143-97e4cd5c3996", "value": "12288:VMrfy900vhs/dOpEZzofxVfb/UQnh5s4S0sPeJqnph7+u38gCac6V+YBuCv:ay3JsVOpycfPB5S0Tqnz7+Y8gFNV+YBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285234, "uuid": "fee60a85-45aa-4d08-83f9-34b56659ff61", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285234, "uuid": "7c942ef1-1d32-4fe7-a5bc-b8f684400e88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285234, "uuid": "258bee12-8bc7-41ce-8378-bac444d8197f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f86ec95-ab7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676280014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280014, "uuid": "70519f05-c1b4-4fb3-9c13-d7b87d9849b3", "comment": "Malware payload (DCRat)", "value": "876c853d1f8f4dcefb8c7acbc5b02100", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280014, "uuid": "b80f8407-5e67-4923-a3b5-23510ec2843d", "comment": "Malware payload (DCRat)", "value": "44c9a4a9ee95355817cb806bb72bf18e2007b036b81d2e3dcfbb4986f05aefd6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280014, "uuid": "af6810a6-3f5c-42fc-b7b9-92f618d4d0cd", "comment": "Malware payload (DCRat)", "value": "281f3fbc8fedbdc242135ec249dade25f18aa732", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280014, "uuid": "609a7e5f-5bc4-46e3-b9c8-8806ba78cfb7", "comment": "Malware payload (DCRat)", "value": "b4167f05e959cf904c5a4f6b8e11562eb89d8b6b0bc9eb20b11c23f5b20919c1b6566ca5573089cd1b2c6dc2cb070827", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280014, "uuid": "b9fc69bf-06d1-4225-a818-446fe2a48580", "value": "T142657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280014, "uuid": "08f5dbb3-229a-48fd-926f-d75efdc66ce4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280014, "uuid": "fd010e93-3807-4921-b69d-9f684c57d004", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280014, "uuid": "96b9705c-c46b-4357-a111-42ecd4d2069c", "value": 1410060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280014, "uuid": "3b0e30b8-f201-42a0-8b44-c3f10f20b53e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280014, "uuid": "ed5ef162-16a4-4f1a-a559-e68802064ca1", "value": "876c853d1f8f4dcefb8c7acbc5b02100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a26786a-aba5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676296084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296084, "uuid": "671d297b-215b-4d6a-8179-849af4e1d46d", "comment": "Malware payload (GCleaner)", "value": "f3e5e32ca8764324e5efe379bdf0d005", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296084, "uuid": "0bcf9989-94d1-488a-8f9d-86213a251e10", "comment": "Malware payload (GCleaner)", "value": "44e0a705d4c84265783d35ccf267935f3be0a8aeee83681da4562bdaeba9a1a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296084, "uuid": "8fdab4b3-800b-4857-8089-9524cbb01a2a", "comment": "Malware payload (GCleaner)", "value": "f2edd3802ccdc06c812077a020ef844f2dcf7933", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296084, "uuid": "ccdf5f89-1c5e-43f1-abf8-4fdcb4b2a22f", "comment": "Malware payload (GCleaner)", "value": "7ce275387dbc7e6d94e409d4dd3f1ce34e8e1034aa7c0ce235e48dc8acfa8fdcad69c40f55d83dc44c7c70f9e65755a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296084, "uuid": "dbebd347-d827-444d-b90d-58a1be7af424", "value": "T1CFE5123D7156C97DD2C0FDB08D2A94E71CDAADE3E8A8A062B0DCBF3F51791859609207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296084, "uuid": "7226e126-1d20-478f-a43f-7329698440e8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296084, "uuid": "a85352eb-3da4-41cb-94f0-86be2e83b462", "value": "49152:rdHmxbW2KZcwsoA5KJJvbIyIB1AIYXAP27NFhkWMSUloDzVMP2+99btNuLFjzLCU:JHmtiHA5XN7lYX3NAWe0VMuMiJDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676296084, "uuid": "9b5d8497-4064-43ea-8081-4eecc8a9b8d8", "value": 3157129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676296084, "uuid": "8556ac35-81fb-4e9c-be47-8bc8e42821a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296084, "uuid": "808d2b10-8630-4ab7-842f-cdaec637dec8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821ec32d-ab89-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676284260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284260, "uuid": "c625b51d-2245-4d99-b328-de0cdf5a5e23", "comment": "Malware payload (RedLineStealer)", "value": "ae8204ab3d08fc19de3687057a680b70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284260, "uuid": "5185e249-277b-4e4c-8d14-89d187acf2b4", "comment": "Malware payload (RedLineStealer)", "value": "45e774302f6eabe32be7d36341c984e64cca1b65244e9252510f041c9e114a73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284260, "uuid": "c5cffcb7-5e71-412d-9ff2-888f4987aad0", "comment": "Malware payload (RedLineStealer)", "value": "04abd541b43377559fa62b007981831441366d62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284260, "uuid": "edf75025-2d03-4fe9-95c6-40f50f447623", "comment": "Malware payload (RedLineStealer)", "value": "cf9990333e28f50e11adf157b3526419f138f5f9169adeca4c92268545b48baa7d077e5f8ae0fd0b28f656dae8ff77bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284260, "uuid": "63061148-dd27-48b3-9c86-18fef4a3f488", "value": "T146F4125B9BDC8132D9F167B059F203D32A36BEA29E34975B538F6D181C716B0223472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284260, "uuid": "c419da40-5634-4b38-baaf-650c05d86b24", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284260, "uuid": "6bfed70a-f7e2-490d-a545-53c1d9eff159", "value": "12288:UMrNy90YverTXjfaA5GE//Xnvvvb5kEeJjqnQPD08gCa32tcsNaMWeO:xy+TX79/vra+nm08gFmesNEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284260, "uuid": "c5e87741-9689-41d7-a211-6d6488dcad3e", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284260, "uuid": "a9d127ed-ba5b-43c8-bc68-33d20cb4ad83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284260, "uuid": "c1258355-9ab6-4526-baa2-e0120fcc2e94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3980559-ab90-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676287403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287403, "uuid": "035a9a05-478f-49f8-a790-54fd1da49b4a", "comment": "Malware payload (Formbook)", "value": "f9cc978ce8c76e048b126f95f9457135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287403, "uuid": "ccd8e1b6-07f3-4576-917d-50a82ff1c26a", "comment": "Malware payload (Formbook)", "value": "462db09c34a119d6b77c4cfa73e381329d336aa687796ba8c723057b5daebd4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287403, "uuid": "00545c6e-0f5c-4cd1-8c67-084a02f504ec", "comment": "Malware payload (Formbook)", "value": "a7bdbda14e584922802c7e13d4db4aaf10b72fff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287403, "uuid": "98a61819-9794-44d5-b0bb-c6ffcca5dc60", "comment": "Malware payload (Formbook)", "value": "43d7d1b30f72167170d191b7465e12be1b190226e465f1d1a722109864be7c22e4cc7da8a73943483dd9cfe9734049ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287403, "uuid": "baf1b1f4-c6a2-46ba-b8d4-8dba1cf26b44", "value": "T1F4C4234564C5C2A3EDAA47F11DB12327C9EAF6039E94432B13240E1D78B6510EFAF39E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287403, "uuid": "8810175b-9d8e-4c3a-b580-7c8c7bd23410", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287403, "uuid": "4845f6d6-46b2-435e-a6be-52e49bb42f16", "value": "12288:/Y0h77gpTHfPXG7MQtyp0tRly8umN5tgE31sEb3nYuk6XkIi06ztvOw9nPToS7iK:/Y0lg5HHWHC0L3Zjf31d260Ii06kw9nH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287403, "uuid": "fc8595d4-d383-464d-8d7c-033681e1495e", "value": 547982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287403, "uuid": "e6b68f53-9cc8-4cab-ac0a-e2d4daf253a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287403, "uuid": "cebab3d5-5204-4536-b8f6-79898cf674ea", "value": "Photo_00430jpg Photo_00430jpg Photo_00430jpg Photo_00430jpg Photo_00430jpg Photo_00430jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fbc7cd-ab84-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetSupport)", "timestamp": 1676282122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282122, "uuid": "d3e7457b-e253-487e-811d-6706d3cea50d", "comment": "Malware payload (NetSupport)", "value": "92d8cace3f5be94d54700290a22b01ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282122, "uuid": "c5e0c183-ecf5-4ba0-9193-b0a1995b44d8", "comment": "Malware payload (NetSupport)", "value": "4689feea371ab0b27c3b7760ad99d3d587e770b36403fcaf795e4a5c17bef173", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282122, "uuid": "109b9534-b589-480f-a49b-467cfc12a828", "comment": "Malware payload (NetSupport)", "value": "08feb65fdcd6a8284297461c1afced9f769134c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282122, "uuid": "5389d1d5-f74f-47c1-ac3f-5ad108dc9cd4", "comment": "Malware payload (NetSupport)", "value": "dfedf26216470005e4ceb5a78be7620971dd08c4a46d66eb63155cbf4226c4b8cd8abb9083a6d54ccd96c04f93ab2767", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282122, "uuid": "5768ab03-7ee1-4000-9c2b-79f370c4df88", "value": "T17BC579432874C111C322BDF5F6E286F49CA96E26DA6DC20BA7C8FCA537FBD504129653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282122, "uuid": "6686ffa0-bab8-400c-81b5-b287d030dc1b", "value": "f3173778f088ce2b56b8257bfe393419", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282122, "uuid": "4912df88-6b1d-4fc6-bf26-6723cf3f0ebf", "value": "49152:RJso4ozTdxkp92TMp2OX5yadksH1dSXnnGz2pU8E8SDJI4x:Reo5d6Ugp2IyadJH1dSXnGz2pU8Aaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282122, "uuid": "904c09f8-11cc-48fb-8aed-a296939cd164", "value": 2693236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282122, "uuid": "3ea2dbcf-23a2-4483-b864-d7f10811bf20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282122, "uuid": "a71b062c-696d-44fe-8cab-e7d4e411b878", "value": "92d8cace3f5be94d54700290a22b01ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173900f5-abec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676326600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326600, "uuid": "f8ee48cc-4cff-43de-8b02-d656c4ae6092", "comment": "Malware payload", "value": "78558d63344aec587e5233d5aac9f5e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326600, "uuid": "9e858ff4-5dad-49eb-b8d3-bbf0a18107bf", "comment": "Malware payload", "value": "46b9f1ea823e50b6e6f734b5ac6a2f80d0b4d946364ab6a0b49ca91622480e03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326600, "uuid": "be7b4aa4-55da-4f64-a368-c103e2f4f688", "comment": "Malware payload", "value": "5be233e0420f21b7c35afdb5d7f2970d35a22b0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326600, "uuid": "2456999a-cb89-4081-954a-59d4051f0666", "comment": "Malware payload", "value": "5603efb544a1dc087e78347ef137c47e6fe2e0216b7f2b900988a4abf380fe9d9be59777411c74a909ba313ebc4a1c7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326600, "uuid": "cbb79b23-7ef0-4f87-a661-38693a3a8f17", "value": "T15004CF2332D0A871D56216305C69E2F13A7EB8115B74EA8BB7D45B3F0E702D19A723E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326600, "uuid": "e4ebd724-b8d5-4259-afa2-db15866473c3", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326600, "uuid": "cb34613a-8429-4049-b2f7-928964c91f54", "value": "3072:lKSBMvAUZzKIXiGbXR0DMWm2zvWnHSAEBNQf5xL31C/EiH1a5GnGhND:lPB4p9KIXKMWm2zeHiGxBC/LH1aok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676326600, "uuid": "33ec0c1a-d168-448d-85a6-482de14e18c9", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676326600, "uuid": "4ee6a2e7-cdba-4d13-b83b-6a0ab13012cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326600, "uuid": "007bc831-d17d-4260-8d11-05f67a8f571f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d26d722-abeb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676326181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326181, "uuid": "69052abe-a45e-471f-b779-d886ddf8382c", "comment": "Malware payload", "value": "7db5ac87bbfa0a1fb3f1cbc1394302ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326181, "uuid": "9659b727-5797-4fef-a200-ca94aa54d6a6", "comment": "Malware payload", "value": "474c28e6a1558db7a10caf18d35acb0f646a943374c84c90a8dc04b8f71b4931", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326181, "uuid": "07bafae2-7cb1-4387-a0a3-2a32070475a9", "comment": "Malware payload", "value": "ac88c761b4255e8c357c8b063783d94ce1318690", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326181, "uuid": "ce2c823e-450d-4a23-b011-3b58f0e619a6", "comment": "Malware payload", "value": "42d777c103ea707b80db5515ee70e741ff47c57b09bea8ab8da6759446a653d414963f2750c36378189e572ae6e4f13b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326181, "uuid": "90d7f2e5-0bd2-4996-85f5-df4615ef073c", "value": "T125F41207E6E8C432D5F56BB02AF703D31A357EA116384257279E7CA909725B0B23876B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326181, "uuid": "0a211a6f-e29f-462f-bbd9-37565307ee50", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326181, "uuid": "f63e4d14-f709-460b-aa30-82f239a1de88", "value": "12288:/Mroy90imSc5EzfkfvPbhPIBLaefU65CVn/R0f9eJs7ZlPhMhd/lnmYgBB:ny5mSeSMfvjhMumIVn/RLsFhmZnmtz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676326181, "uuid": "3aae0597-66ea-47a7-bb09-dd009dc2a840", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676326181, "uuid": "fccee458-df3a-402d-9260-d471f0b99f5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326181, "uuid": "a09ae653-28e2-47b0-8d2f-1253e4e35656", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "594ba67a-ab94-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676288915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288915, "uuid": "b67a93f7-2864-4ffe-a8c8-638c16ed1ceb", "comment": "Malware payload (Amadey)", "value": "0638794ead78405687008aa3ac657b91", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288915, "uuid": "79c3678f-4928-4692-a8bd-d748ae129cee", "comment": "Malware payload (Amadey)", "value": "47c94dbcf17a8cf1338b40c92f3dfc903b941f53082f44136985321b6f20fa0e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288915, "uuid": "3f324518-fee5-4161-987d-72b5cd10ff3a", "comment": "Malware payload (Amadey)", "value": "ea10a5b260ffe0b54c16611ab83e26e8085da190", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288915, "uuid": "5ac16b5f-9f9b-4f71-8a3e-4f9a2aaa1834", "comment": "Malware payload (Amadey)", "value": "6a4203afbfc167f0db82b5e05300cc8d6a29a16231157a2a8b50d065411d8e9148c86d9be170eeb4888ba39117071a21", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288915, "uuid": "9de00de1-ba48-4ec1-b1cc-7d1df1b3588b", "value": "T1F9F4120BEBE85062E5F167700DF206D319767D619B3942CB638FAC190832BB4E63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288915, "uuid": "afcc0f25-db2b-4fd1-af83-d308ea928afc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288915, "uuid": "655b3aea-a67c-446a-b649-cc5b8bed3062", "value": "12288:sMrmy90/vij06OrpdD9eCV8QES2OQzBeJacjuvPpP5oILk8P5WJpBuj:SyivU060TBTV8QElcDjuvPfI8BWJp4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676288915, "uuid": "8685040e-00cb-4f02-926b-521dcd368852", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676288915, "uuid": "18917487-ca71-47a1-bf14-15436790fd7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288915, "uuid": "1cebbd39-5b61-4266-9fac-53f4ef5d17b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8cd3a9-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272008, "uuid": "adf5b779-68c9-41f4-bcd4-0e02750424a7", "comment": "Malware payload (Formbook)", "value": "3cdda6c19e438133a87894f233d2f3e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272008, "uuid": "e045a37d-e1a3-45ea-971c-f63c425fb3bd", "comment": "Malware payload (Formbook)", "value": "48dcf0afe635fd456a6914465d2b79e61ddbd57d304203eeeb14cafbf5dd1e81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272008, "uuid": "78abc010-534f-460b-897f-fc171fa143b2", "comment": "Malware payload (Formbook)", "value": "80c4d2be7f3fcb10058bfa5b790b2224998a1884", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272008, "uuid": "5e5eeeab-a63c-4162-8ae5-4535debea07e", "comment": "Malware payload (Formbook)", "value": "dfa1bbeed9b3cc24b88236a9e4a736d6e577a14177d4e9e8a489cbd538caac25c0fe1f278bf7484a400182e57de628ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272008, "uuid": "da10b410-9d07-4054-968d-5d04055abfab", "value": "T1E004AE32D641C031E2B251B5F6BD1B7B883E0A353255A1E6E3E216E16EB49A5F03D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272008, "uuid": "9dfe2a46-35cf-47d1-bfa4-371007ad1e7a", "value": "3072:A81ZkcOYX2iR3h7+gMJOTKjgtCZoEilKag3Tx+Cf9:fRNhig1TKjgtCaPST4CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272008, "uuid": "c43016c9-1f34-4f2e-a0f0-833ebc209ea2", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272008, "uuid": "3f104e0d-e182-4241-ab38-afec87a1d85b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272008, "uuid": "f39f36ec-8852-4ded-b0bd-38169967ee4a", "value": "48dcf0afe635fd456a6914465d2b79e61ddbd57d304203eeeb14cafbf5dd1e81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9211d6-abd5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676316788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316788, "uuid": "603bebf4-f863-44de-a882-e853e3eb2f5b", "comment": "Malware payload", "value": "469addeec35376610112e02e800e4b28", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316788, "uuid": "0d863d93-a34e-4c85-a226-fba9169ab1ab", "comment": "Malware payload", "value": "49215ba3fb3e632847843780a063d93942d3282d7cbbb99d72abd0b3993d429b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316788, "uuid": "33ca379a-bc32-42dd-951a-7b0057bdd69f", "comment": "Malware payload", "value": "e29dfd6c6249a33454f2aad87f7605f57e1d0d03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316788, "uuid": "0287e603-bc5d-4b2f-817e-56ca17e28be6", "comment": "Malware payload", "value": "c27a904600b804a5df6089b0725599f4f2f5d1c0d37c5f490a0f53bb7e6aeefb22671e03e64a11f9f67cc01854c3bc27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316788, "uuid": "c569cd60-d22c-4952-9849-dd74f533cc4e", "value": "T12CA64B83F85151E4C0AED2F48A6E9262BA703889473433D72B50E7B56B72BF45FB6350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316788, "uuid": "638d3547-1993-43c4-bc8d-fc990604a530", "value": "49152:yTNYKdudsJ5dOErb/T0vO90dL3BmAFd4A64nsfJm1a3kqHh2EL4Xp7CrC1LQQFbC:0NsNkUAM5UCxc5THnNvWza/NAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316788, "uuid": "ec042d42-c942-4f42-9dc6-c31cf5a6fc43", "value": 10088448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316788, "uuid": "b395cfeb-8dfd-4434-8c8a-295e028dfdd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316788, "uuid": "b32f4648-ccdd-485a-ae79-63788c3f7792", "value": "elf_49215ba3fb3e632847843780a063d93942d3282d7cbbb99d72abd0b3993d429b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab83dbfa-abab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676298932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298932, "uuid": "35cbadda-f8b7-4456-bcd3-a835045d5eb3", "comment": "Malware payload (Loki)", "value": "1fd64c68d09df6674fdc82a5b419bd6b", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298932, "uuid": "c0599a83-4df2-4581-b99d-b3d0b81b7719", "comment": "Malware payload (Loki)", "value": "49238631256f8043c3c488947c7ab25c442940ed02b36228d97e19ea1cba5076", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298932, "uuid": "caf2955c-016e-45f0-b6e0-d4a7b178cf7d", "comment": "Malware payload (Loki)", "value": "0d709490b3c2df86d88d2f94ffc83b1bc364dca9", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298932, "uuid": "2a988585-0463-42e8-9926-6fb695ae8e20", "comment": "Malware payload (Loki)", "value": "fe85652e23887f4e93f2889eb830f0e141455f3997bba0e88ab029c0fa05ba205580e81738aff4eb3e32d67c7857c0eb", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298932, "uuid": "06b96e7a-f9c3-4c11-8a21-416d161da267", "value": "T196E4DF07F276AC2BEE16C63CE81E145281539D3E9955CA1D21C3B72F8A32BB45C3EE54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298932, "uuid": "1012f73a-4d27-47f3-b12d-bda498fcbec4", "value": "12288:q6ZXFeKw8TKjij4a3DjZcjzr+PADnmO4+EeN/gugm:q6FFex8TEezjq3r+oyOCWEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298932, "uuid": "8963170d-2fa8-4474-84a4-fa0910e43239", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298932, "uuid": "56289746-638f-4626-acb1-d1790da71deb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298932, "uuid": "d80a4385-f839-49b0-ab97-9968d0e0526b", "value": "SHIPPING INFO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a575a72e-ab9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676293768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293768, "uuid": "797be3db-c04b-4940-8d04-66bbedaf54f6", "comment": "Malware payload (RedLineStealer)", "value": "440d80177fde6f98a55bf5f7e0bae9fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293768, "uuid": "f984604b-77c1-4e79-b6f1-ef4773873f21", "comment": "Malware payload (RedLineStealer)", "value": "49684dec204eb2dbc2279a2acb9cd3bc5aca5d101d004549584b6fd8ca59a770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293768, "uuid": "b17c9d58-07aa-4f08-a381-45ebe81eda4c", "comment": "Malware payload (RedLineStealer)", "value": "ce0fb0341893d810d1e91cab5d2867794df8edb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293768, "uuid": "3af623e4-bfb1-4bfa-8ac4-9d2a1285c817", "comment": "Malware payload (RedLineStealer)", "value": "e2722a2b584081b39d19455ee96113d7c5b5cb166f18793165ea82e1345d8f982d15accdaa9f4b222eb8716941fc6253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293768, "uuid": "8bfebbf7-71dc-43b6-a457-da39c4b69972", "value": "T1B6F41207AEF99416C8B463701CF203C30A377E919A7483AB678EAC691D717B86179737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293768, "uuid": "03355ac3-b8e1-4bbb-ba81-85689bd9d63d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293768, "uuid": "84f77934-3ce8-4217-93a7-e74d380bea1a", "value": "12288:8Mrxy90Od69E0D8icBvrToDMM8/rzsHStueJU641diMOKrVrrogURsU0LddG:dyBd69EaQbdrzsy1U6sdiMOQ5Ugwj6dG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676293768, "uuid": "f8b7208d-f435-4406-8329-dde2cdcda99c", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676293768, "uuid": "c2482235-cac2-4b10-a10e-ab8f2c1ba093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293768, "uuid": "95104854-5855-441a-baaa-2d7907dc7b86", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4678c147-abbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676306064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306064, "uuid": "9dcdb344-dcd7-47eb-84fb-052906160e47", "comment": "Malware payload (Smoke Loader)", "value": "8405d9ffb506e59c875d8539f5d17242", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306064, "uuid": "4dec8646-2785-4dbb-ae89-6b4d34326bb0", "comment": "Malware payload (Smoke Loader)", "value": "49752b4bcd7267f99ddaf7d990a102d8f43478c7c73cc3444e7df94d5c7350cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306064, "uuid": "1ecd9b74-8f96-49dc-b111-7564fcd6a36c", "comment": "Malware payload (Smoke Loader)", "value": "a27c29410f8791cf72010c157bc5c5747f30669f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306064, "uuid": "8769a21b-e471-4d07-b2f4-9119094d8edc", "comment": "Malware payload (Smoke Loader)", "value": "7e1482d06e51175a6d1df794030974e265ece6dae605629e7b29fefba6a7bad58d6a2cd9890c8ae86fb7bafd153e7195", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306064, "uuid": "87f79b4c-fc89-4a87-9ace-fc18eb9a2f7a", "value": "T13814C01332E0D472D17617319C24C6F46A7EF8214A79AA9F37E86B3F1EB02D18A72751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306064, "uuid": "20e82e35-4d16-4cdb-a5b4-9e42ddf36038", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306064, "uuid": "53981e7c-eccf-47a4-a4c9-5a85f3760244", "value": "3072:6OyygBe3HU7pG7fT6YCCiz1gOnGLzrosjf0bmynoacy7QRpdE:6OLgMupG7r6YCDRfGHHIrvc2QRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676306064, "uuid": "a0deb4f6-62ce-4a0b-a5bc-8b2bdb318bd7", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676306064, "uuid": "cb7ca2ef-2a4f-4c86-99d5-0d49dc079d2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306064, "uuid": "55e4f879-d649-461b-a73e-4e6028cbc4f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc62a72-ab9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676293356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293356, "uuid": "c548fc46-4f0d-485e-bccd-4b93980efc50", "comment": "Malware payload (RedLineStealer)", "value": "c36d684df9f9a0251c2a8a9cad380910", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293356, "uuid": "d17bdf20-292c-42ea-9218-299bb20c6a56", "comment": "Malware payload (RedLineStealer)", "value": "49f6ad931801dc0cfa78c854d6be47b0e8006d4b24e9ac31bec03baf742b0806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293356, "uuid": "77c56213-bdf2-4701-a73e-bc0db359bd04", "comment": "Malware payload (RedLineStealer)", "value": "af5bcf4d96f50bbf006fa04b7dee85541683b8b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293356, "uuid": "00f481bb-fbfa-4635-8e12-fefa49a66023", "comment": "Malware payload (RedLineStealer)", "value": "55396bd3ec343c89830624297b0165ce429a4fe2d8f45de1f206e63b1781f08859ba1196a25c82e3d5afbf53baec050e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293356, "uuid": "a310412a-ded2-4042-ae7b-d07445371a9f", "value": "T16DF4124BE7E88032E8F5A37059F606D71E3A3E624936935F638FAC250D325B5A031767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293356, "uuid": "cd0ea13e-44d4-450b-8173-3bc0d030202b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293356, "uuid": "6c262950-56f2-44cd-8f42-05b93fcc1967", "value": "12288:5Mrzy9016z5Od6W2bgwBR+HoE8eJdVS5WyhP2rro33RLhFtwI8+j:iyPY6WCgw/MoOQiU3hdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676293356, "uuid": "96423694-7e38-431a-99a5-3dd481ae68d7", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676293356, "uuid": "0f2df7be-94c9-4b77-8b33-ebd2a4f1ef5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293356, "uuid": "7e648b4f-96ee-40c9-806b-75939cda9c09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5166249-ab75-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676275862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275862, "uuid": "a3b4b06a-ee87-4e3d-8b4f-4cccfa1ee11f", "comment": "Malware payload", "value": "d3f0ee0b1cf3c0a1abb95eb19acc92fe", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275862, "uuid": "084c641f-35b0-4840-8fd0-f524669c7a67", "comment": "Malware payload", "value": "4ab10d52e602bf25abe1f7907182dda6df5f75aa06f7745caa70728134882907", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275862, "uuid": "9f401442-0929-4833-801b-7eed9fcae155", "comment": "Malware payload", "value": "ab2d4cab545f99ddc61568a288a4a6958bdc3d4c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275862, "uuid": "f7c955ca-f930-4b65-92d9-8184ff66816a", "comment": "Malware payload", "value": "0b633bff3d9fcdaaabed08960c7ac9133c54be28ef5012a61a98a9c333da6dea406cbc9481641db4508f3a9619eae9c1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275862, "uuid": "d8e61748-a140-4b17-abcb-b0342331ddec", "value": "T1D0C62325A287C922D52D017BE4A8EF4E4134BEB3533455F7B7F93E5A48F0CC162B9A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275862, "uuid": "7cd399cf-e0a1-4ef8-be6e-d76925f7568b", "value": "196608:ya9lzsHBrkuBGwjjlD2nKy3f5rK8bIPfdR5JQGYmGYbA3wuwas7xpSg0OR:dshLBTnl6nz3fI8bIPfpPlbUw41OR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275862, "uuid": "e2e8e2a5-a6b7-48e6-ac36-9c2e17a3e132", "value": 11949568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275862, "uuid": "7bf7b273-286b-4309-b7ed-6deadefd65d2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275862, "uuid": "4ae49f1a-6169-4491-b14f-d436e5005ced", "value": "Rec1b0_fev_0223.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67bbc6a1-abaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676298389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298389, "uuid": "a8364d3a-c26b-4394-af47-39a20c5fec0e", "comment": "Malware payload (RemcosRAT)", "value": "35e9911b4f9ec8be1b083b76d6b377e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298389, "uuid": "c87ba0bc-e9cf-4954-8b8f-446692c613d0", "comment": "Malware payload (RemcosRAT)", "value": "4ae79ceea285cbb607eddf58f18707d2920f77fc8cac6e92f26013be0f70a5f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298389, "uuid": "84cd6cc5-b521-4973-9bfb-8f7d29c4bbdb", "comment": "Malware payload (RemcosRAT)", "value": "9471a4481d1e4f8d14101d8d58fab2c0b22ecf85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298389, "uuid": "75944f94-f0f1-4be6-a30a-63722b53243f", "comment": "Malware payload (RemcosRAT)", "value": "2c72454c1a49cbcf8e0db85ffdebf403639294a8c30048068f13c8ac9084d14f1882d0651903f3b48ed60ca5f13fb2d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298389, "uuid": "3c4ecc0f-ab62-44e6-827b-b695c247b3c5", "value": "T17FF4015067B58A51EC704BBD17F935E132F4FC2D289FAEAA899C3CC04C96B590476B32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298389, "uuid": "bb21d728-6371-4ccc-b106-4cebe7d9e493", "value": "12288:qVntokr0ZwcjjJHWE9OJ3LJzmyd4y5hn0S+nigEOV4sUpZTJdM7FGifRFK4:+qjuwC53Tk91xCdM7Frv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298389, "uuid": "eca797f4-f26e-4965-9d72-cd160d1ce198", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298389, "uuid": "f0983f32-a85d-4227-8cb4-c3fdc1dda8be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298389, "uuid": "00ec09dd-45d6-4c1a-9644-0028c4567427", "value": "SOA#202302.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e29ffb8d-ab67-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676269819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269819, "uuid": "ea6ed643-98ff-4068-842b-d6cd2232810c", "comment": "Malware payload (TeamBot)", "value": "a1d512eef56d8cdd3b2e934c60de4790", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269819, "uuid": "e4f893de-d56e-475d-a1cf-24f8ceae0f6e", "comment": "Malware payload (TeamBot)", "value": "4b78af0579a1b35584060c64c5a5315b0dea66b9f4af862966661b9adff12989", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269819, "uuid": "bf000eab-71ca-47e9-811d-fd58fc64cecd", "comment": "Malware payload (TeamBot)", "value": "acf76185bff7d8043e0fff2bbf65ada68f9bcf49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269819, "uuid": "6ff84216-84da-494f-9c70-b7299b626898", "comment": "Malware payload (TeamBot)", "value": "089145ed72e695ae916a8f041173e6589ec767ce1e333bfa5fc733c62e57518ad606f90ce4d8fbb7bc25d0fc11cdd106", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269819, "uuid": "3485a4c5-3f32-4744-ab75-7c27a5541cec", "value": "T1A414CF1373D0E6F2C4731230BD29C2A56B3EB8B50EB965A737481A2E1FB82D19672355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269819, "uuid": "006c121d-e7e7-4cec-8e73-726e3f18a671", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269819, "uuid": "a317ced3-ba7e-4565-90ef-127ced3265bb", "value": "3072:dzfQVzZRSbTK48S3vbpA8C4Rhmf8VEGBWw3+HdBSMmUNt/YCyjCt0U3:dzfmzmKXS3vbpA8hRhmwEvVBmUj/SA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676269819, "uuid": "920d8281-c5fe-4f8a-8a82-bfd427994ef5", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676269819, "uuid": "4e804fb1-9e3e-479c-b459-883519afa459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269819, "uuid": "4b2de95c-65d8-4521-bde3-1164a8216778", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e520b611-abd9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676318785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318785, "uuid": "7dfbb910-32d0-4e2b-a397-233869004bed", "comment": "Malware payload", "value": "ec648956161ceb8a85ecf5ac5b162498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318785, "uuid": "3d94ce9c-92ca-4dd0-ab83-ca97c76e5dd1", "comment": "Malware payload", "value": "4c03ac553db883fef57aa73e5833c3a66115f2ae66133aa0eb20c8d67831affc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318785, "uuid": "404eb8ce-2727-4d22-8f43-eb87e47b2ec7", "comment": "Malware payload", "value": "3ce029923e6161438dedaf02d5a082122b3c2572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318785, "uuid": "1a510bc9-f6e8-455b-b5c4-eb8496a54464", "comment": "Malware payload", "value": "5144eb841120448880d17668d6c52fdad64794aa4bdc6b63fca6adef86dc85342a624ece0d6863acd65971fc9867e395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318785, "uuid": "41bb35a4-ac14-4f0e-a78c-67f30d03415b", "value": "T140F4130BF7ED8431D4B5237128F607C30E36BE614B74966B268E6C295C726A0B335767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318785, "uuid": "02015f01-de91-40d3-bb39-695840981a72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318785, "uuid": "a53c566e-51ca-4db2-b6ff-14887f89914d", "value": "12288:TMr4y90C09/TWQYvwH6uvlInv6zQHgDOeJ9e4tMLpYxWRhE1Nfol:Xy0HovGWq9eSEdu1Cl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676318785, "uuid": "d0b40f8c-97eb-49be-9456-9bc6f3ef7586", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676318785, "uuid": "ebdc711a-1e8f-4363-ab11-6e3013acff56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318785, "uuid": "5b7d3b51-68c4-444d-816f-223ca0c12ea0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b71c1d9-ab70-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676273511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273511, "uuid": "1fcca247-9d84-4bc9-a233-b0cc3030dc5b", "comment": "Malware payload (RedLineStealer)", "value": "408dab826b14c46fde92c763424ab399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273511, "uuid": "95b24eb0-7f47-40e9-995b-e83ddd82b10d", "comment": "Malware payload (RedLineStealer)", "value": "4c0b819519ceaa090e8b27269649c45c4f7a3aad3fb3151e1b419853759b7b2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273511, "uuid": "4c6ef348-0e14-4376-a64d-564792a74d52", "comment": "Malware payload (RedLineStealer)", "value": "9661fd8e494e9cdaf326bf97148242842f4808f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273511, "uuid": "a759c98e-0dfc-4758-9dc5-153ff1e57010", "comment": "Malware payload (RedLineStealer)", "value": "5064d6082cb79b71ab08533da17fc600153d59830c5ce8cc5bbade5b9eaf3a9cfd8110022aaab7b493c619df590ba8cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273511, "uuid": "f1aea9d5-e3e5-4e65-8437-74f317f9874d", "value": "T18964F11233D0A4B2D8735630BA3CC6B0AA7EB8B11B79659B3758273F5E702D1A673345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273511, "uuid": "cec77c58-5f9b-4c2e-98d3-75ce8ffa1237", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273511, "uuid": "711ad1c1-284c-4667-af90-2251c728fae6", "value": "6144:o3zqLEKJcKIFES7obWRMan15pQYKw+J0JF9G/LuAosI:mzq5LIFE1qRMM1r5Kwsa9G/Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676273511, "uuid": "ce4857a0-98db-4996-b3cb-5d91fddb6264", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676273511, "uuid": "0fb97b61-d3f3-4a77-ac94-14360caa2b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273511, "uuid": "b06b9217-9a4a-4129-8e1d-1852b7821648", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e329e3-abb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676303612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303612, "uuid": "267081ae-a062-4db3-9b7a-77f8f5a417b8", "comment": "Malware payload (RedLineStealer)", "value": "dddb1e93b42b83ba55d1c808cfbc2f38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303612, "uuid": "8ad68e3a-2546-40f3-80bf-157af5f47a99", "comment": "Malware payload (RedLineStealer)", "value": "4c60eee40ec3b35e3d1dda8d73d74a86a424a46d75050b98360a16c2ce0394f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303612, "uuid": "4db22c3f-fa14-4171-b0c9-32ae5e719611", "comment": "Malware payload (RedLineStealer)", "value": "8a1ff468b6d64243db157272c4bdf1d78a34d8dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303612, "uuid": "52613bce-04f8-4361-85de-74bdb5306f4b", "comment": "Malware payload (RedLineStealer)", "value": "92482c3adc4f6e3b8da82fc2d1ff5c8d51bbfa3d4547ccefd1418183573422e068c50a5551cd1cd71e1e0baa3b0d01eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303612, "uuid": "8cfc5525-b742-46b3-b699-2cee9d71d29a", "value": "T11CF41207A3D84132E9B127B01CFB03D31679BDA4573883DB578E6D6A0C329B4A635B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303612, "uuid": "94485139-0c73-4357-a232-3e8b5ebd583d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303612, "uuid": "ae538dab-ca3f-4ef0-aa4f-866c3920127a", "value": "12288:DMr/y90u/tCr2ezS7WMBDLn/GUXZnEVfQ/TeJy4vwzQNGS80l1NWhn5fDDMtahyz:cyN/t7ez9MBDqaJWQ8yevl1UfDDHRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676303612, "uuid": "c052ce3c-90eb-4b15-9a7d-eda8fb0b1746", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676303612, "uuid": "c9acd4cd-696d-4b83-a1c9-744da37a112f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303612, "uuid": "23cfecce-4671-4e1b-af0e-0134d1b3974c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ecb2cb-abcf-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676314136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314136, "uuid": "d1d2a954-49a2-42bc-a94a-a294894fcca6", "comment": "Malware payload (RedLineStealer)", "value": "b55f833695a84e4ecc751e5660e27e03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314136, "uuid": "91c2bde8-3ce1-4c4f-a452-bfd1f4011b97", "comment": "Malware payload (RedLineStealer)", "value": "4ca1792f41d0193aa50df1422fdc4d70b4f0113b351246c2d7fd0231a70d57fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314136, "uuid": "8f8e16c6-7e42-4523-9374-ed128526832c", "comment": "Malware payload (RedLineStealer)", "value": "a60a6e355159b055b5ce0720c08658cd54de75ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314136, "uuid": "1fb9dfc6-facd-40bc-995d-5f17144c1f5d", "comment": "Malware payload (RedLineStealer)", "value": "a05fe6b85bd860b49ec52f5ddfdda96d5707d1fe2cf680b95352c54735d8ea23274bf2d70323d48762e23f56ef828f43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314136, "uuid": "1aa67711-e290-4a5a-85ed-9a029301f0a9", "value": "T1A204BF133290D472D46256319F69C6F52ABEF5214A38A74F77942B3F0F702D1BA36362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314136, "uuid": "6a156372-efcc-4053-81bf-eb12bee3f4a9", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314136, "uuid": "062bf968-cbcb-417f-a5a4-1e3ac3a1d085", "value": "3072:XoJAg/1n9QDOqTxsxyFV/J3QJFVoyzY0Dk1DsC8GgjhW:XKAo9QDORxKV/jCnDhH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676314136, "uuid": "4d84af09-127f-4cc6-b0cb-6688b6eaae0d", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676314136, "uuid": "f64d924e-7d83-41bd-bdb2-9e45f62cde37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314136, "uuid": "6278c01f-3632-48c2-96ab-c3b3db3763ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda3c5f3-aba2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676295177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295177, "uuid": "8a1a79e4-ec65-4a76-8ea0-7b5e400e0677", "comment": "Malware payload (AgentTesla)", "value": "04cd8990a80cfdd8c38de77cd47bcb4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295177, "uuid": "242faca9-16bd-4e31-ac6e-0a8cf8568807", "comment": "Malware payload (AgentTesla)", "value": "4cfe6ac8a8099f7549f14d3b8ea42af6f35807b5031843b589d24e94db8f0a4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295177, "uuid": "ba56012d-9bcb-4219-992a-1f0d977a7e5d", "comment": "Malware payload (AgentTesla)", "value": "ffb1dc41c05039d102582eec6145024573ed8bb5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295177, "uuid": "e78dbfe1-8233-43ed-aa23-35e0645479a3", "comment": "Malware payload (AgentTesla)", "value": "fb7b0cba57cef729559df5720e2e549f41de3e094e598b7195a465f4723f023072a117224a2da797c3a7c2747c411560", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295177, "uuid": "dd0f69fa-3236-4f6a-b1de-7bd3d752bf89", "value": "T1EED4237112B6EEF002BE4357B7CCA2124DE858E099B9EBE130B91B855D0C27F7B24D56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295177, "uuid": "373f6e7e-94ba-49c3-82ad-d0be389f488b", "value": "12288:t/7wZ0EhhFbKERPO893RxuItaiDiYJ8UggCFYAV2nIIIL03bdcI5da18:tMZ067mMOeXuItaiGK8UgSArwcea18", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676295177, "uuid": "7219c892-b8e1-4819-8b0c-65e59920fd1d", "value": 627605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676295177, "uuid": "d350eb0b-037d-461f-b98b-f1e1807e5e97", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295177, "uuid": "4e1c7b48-9c27-40c7-a20a-e7481eff8efb", "value": "BL_CL-2838374_3494432_Docx.XZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b49fcc-ab41-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676253499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253499, "uuid": "5911ab13-6936-4eb3-b62d-15a879c5e7d7", "comment": "Malware payload", "value": "35c6370224c3911f07d4d52a638ceb2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253499, "uuid": "5b6ea6c3-c2cf-4c98-8501-0b6c122d19da", "comment": "Malware payload", "value": "4d9d50679a7ace443910c7bc9ea39f09ff522d2452b3046bde5cc3c66a30c088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253499, "uuid": "ceff5962-e9c2-4141-9c3e-92de5d551fdc", "comment": "Malware payload", "value": "c0d86efc7a16459d88000db6273832c2bda75fdf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253499, "uuid": "84852880-9c1e-4f5c-83f0-33eeaa512551", "comment": "Malware payload", "value": "f020599c472e7f75e8812da71c98051a49e8c92854f33192d99626958c090a9940c261841e283fd1392a3d5af8a384a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stager", "colour": "#684D81", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253499, "uuid": "bd89fa85-71d9-428c-bfd8-640502391430", "value": "T1B3734A13B5D1C472E4771E360870DBA09E2EF9211E21DEAB2758036E4F741D2AE35E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253499, "uuid": "a3108a58-5b2b-496f-bda4-70ccab904148", "value": "2fdf7309d20cd84f94628380f62d28f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253499, "uuid": "1c33ce48-fc41-4d84-b821-6b40fe5a15a0", "value": "1536:AtxBR0RizqjseUx3cCAwPZCCc29W3uU3/euRHYJpAsWlkFcd61xklA:mzosessOZHr9G9/PoUD61xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676253499, "uuid": "137b130c-c86b-4074-9b46-02fc77ec49c9", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676253499, "uuid": "e776fce8-010d-472a-95a1-a2d9d2f11512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253499, "uuid": "53f4beb4-5c1e-4708-a84c-54540a70a4b1", "value": "win7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273ef303-abb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676303434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303434, "uuid": "7fdd06a9-a0e5-427f-871e-1f1be0ad8ddb", "comment": "Malware payload (RedLineStealer)", "value": "abce7bb76cd0b298f352761c961c8727", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303434, "uuid": "289f6793-5f99-404e-96aa-aa9918052f1e", "comment": "Malware payload (RedLineStealer)", "value": "4dbf6414e86f128d65b575fe220d5346a258c2b9c188c886a93bb9293291fceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303434, "uuid": "5219b396-a077-4e58-bd4e-532b1d7d33b0", "comment": "Malware payload (RedLineStealer)", "value": "d42bcda79ec435b3e62dfcf5ba4e574fb1b6d5b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303434, "uuid": "fff2a248-c649-4e3c-85df-89d0e26aba2a", "comment": "Malware payload (RedLineStealer)", "value": "8159f03fe5189fefff25b6d69d368a5952f1d72bb0da17a4c2c94e706b214677cf7d4f4767e38001463ad66c5097d110", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303434, "uuid": "a8c4343e-d5a3-4c7c-b06c-bb57f4474e05", "value": "T1FCD39F20B7EC8F35D5BD1B74B872011043F1F446A491FB5B8EC158AA5EA77C2690AEF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303434, "uuid": "2a984c02-03fc-4ab1-83bc-fec824c0411f", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303434, "uuid": "200faae6-4bb6-4132-a065-e2764cfaa314", "value": "1536:JxqjQ+P04wsmJCmzi0Zb78ivombfexv0ujXyyed2dtmulgS6pgY1qqskfq+Tmlb4:sr85Cmzi0ZbYe1g0ujyzdVgOY6taY/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676303434, "uuid": "681487b3-9549-4fbf-81bc-a7c9e57f22dc", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676303434, "uuid": "f8fbda1b-7fc5-4af6-a09c-e8c9e8b6831e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303434, "uuid": "447c9ee4-59dc-4cce-9413-d9d89c81d037", "value": "abce7bb76cd0b298f352761c961c8727.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930b017e-abb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676304045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304045, "uuid": "9aaacd5b-b52d-49cd-88bf-418714af5611", "comment": "Malware payload (njrat)", "value": "ad3cde8cc64201729f2cc55587f47846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304045, "uuid": "4eaf3b82-77d9-40ae-9738-c3b3d5588241", "comment": "Malware payload (njrat)", "value": "4f0d14299493cd79d1dad861c5994235d8d73383ce55e77609bcd4c555f199e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304045, "uuid": "622d99a6-f1d0-49b8-9d83-1f3035b0985c", "comment": "Malware payload (njrat)", "value": "de343dc6737bbeed86f36ba8a90661fe0d4191b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304045, "uuid": "3bdfb735-de4a-4ded-afe5-eb6900be47a2", "comment": "Malware payload (njrat)", "value": "2335dd75fc6c05ec6406ec54dcc448edb5f0b96bedcf68aade809fb9dec0204dfa388b1afa7a9153c202a08293e1be86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304045, "uuid": "2807d456-24e3-4f1c-baf0-00de5d84813b", "value": "T19174C002BAC184B2D5B319361A396B21AA7DB9201FB5CEDFB3C0496DDD725C0D7317A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304045, "uuid": "e7ce575d-5ada-492c-993b-2ad9b4cc3d3e", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304045, "uuid": "e7d020f3-5d0e-4977-bdc1-779124e70195", "value": "6144:yTouKrWBEu3/Z2lpGDHU3ykJ3JIdJ/ADrspV2DHh:yToPWBv/cpGrU3yi2xADr6V8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676304045, "uuid": "87d84fba-7c5e-49be-8dd4-dc4a694a5e64", "value": 367391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676304045, "uuid": "006f334f-0cc0-4d23-96da-d53d5a34b2ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304045, "uuid": "214ec74b-f023-4660-8dfc-aec8ee2e1dc0", "value": "ad3cde8cc64201729f2cc55587f47846.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda9138f-ab6f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676273300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273300, "uuid": "bee38cfd-615b-4404-a9d8-b2ee654e9a86", "comment": "Malware payload (RedLineStealer)", "value": "34669094cdc1f936da808b2fdef58775", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273300, "uuid": "a6bb6a9f-efc8-45b7-a3c4-385829632d0e", "comment": "Malware payload (RedLineStealer)", "value": "4f4a3e01c3719659bdd821f730705087fd2eb520a10ed8116d39189e10ebbf1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273300, "uuid": "f4076096-e1de-4768-80a7-391efd6d2449", "comment": "Malware payload (RedLineStealer)", "value": "58603cb0943c419bd94dadb32e26f610c542d8dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273300, "uuid": "147ab65d-94b4-4071-8e86-ac5201c15e66", "comment": "Malware payload (RedLineStealer)", "value": "3c7c3ce632a26c50f34d9f590d49e338a08b34438ee8d669225664b29de2fce066e710f70e96680e8c309c5fe66f1019", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273300, "uuid": "9b93fa40-ef7e-417d-9f95-0b41f5178598", "value": "T161F4124BF6E8D032D9F5ABB048F202D316397E915634839B734BAC5A09334B1A63675F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273300, "uuid": "8f93bfd6-8ea7-4e15-a45d-78a697f1819f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273300, "uuid": "667bc1b8-7564-4a75-a6a6-bfade2c62640", "value": "12288:sMrWy90pNVKcvtf25YkyjUNoj4V7SvXRho3eJAPqi5u1VXA5qe8b8KE3cDCW:ayCVKcJvkygOvBhjGqi5u1VXAYTb0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676273300, "uuid": "23da1540-d794-42e5-bfa2-c86f612dca1b", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676273300, "uuid": "a08c0db2-2c31-4c97-a367-a90cff967eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273300, "uuid": "779b1a6a-40c5-4454-aa07-96e88f9e0a20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc50b169-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676280599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280599, "uuid": "e69be8cb-0eea-45fc-acff-e467e258382c", "comment": "Malware payload (AgentTesla)", "value": "024330591745d5bb0a22938d3351f246", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280599, "uuid": "1417539e-e975-4e14-a55b-75c166491c48", "comment": "Malware payload (AgentTesla)", "value": "4f8543c08f72d81ada87cafa2d8911300ce45a09be25e42e4c1bfd69952a8fce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280599, "uuid": "b3e4b87a-310d-477b-a889-36c15cda78a6", "comment": "Malware payload (AgentTesla)", "value": "c3b2eee0100fb4a4ace608fdb3e4a292eba8ffe9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280599, "uuid": "3fe79767-9353-455f-b3dd-1fb18a5add18", "comment": "Malware payload (AgentTesla)", "value": "e68c997d06ca6e291c4738037a82aec16f95c29a72173b5526d0482d8f746a6cb8ab5abde34d074ec2b270fdfdd90dbc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280599, "uuid": "76cff387-9900-4475-9ed0-6d803c4d0b90", "value": "T127E4F1403AAD5B24E56D5BF42471B080A3363F463A66D71D7DCA71CE0E72B868326B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280599, "uuid": "9095158c-27b9-4a5a-a334-4e847bccbdc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280599, "uuid": "47437bb6-3166-439f-a00f-909bffbac357", "value": "12288:vO8Z1pZh6q6/TKPzG7eTUeTOCfasWt8CU9m2Ob8+X4gVcJPou:vO8ZlY/TKPzG7cUeSe9Wt87/Ob8+IXd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280599, "uuid": "96fb8e34-b57d-4019-83ef-c3570381b075", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280599, "uuid": "e04f9717-5c13-47b5-90a2-288413f80f28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280599, "uuid": "3084512b-1b4c-4694-beb9-b8788c471dcb", "value": "FEDEX INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d573433-abeb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676326369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326369, "uuid": "40423378-a1a9-4b31-ad14-1aaa8d5f7366", "comment": "Malware payload", "value": "d915f2d5a7be6e3d019d1bfce1c48746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326369, "uuid": "17a82c19-a602-4d31-a56c-5a1e46363054", "comment": "Malware payload", "value": "4faf0273cc64ecd132581d6bd469dc494139c9f0dd548ca5b2b39b929ba017bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326369, "uuid": "a75492a6-f92f-4820-b54c-d30a0e99432f", "comment": "Malware payload", "value": "4aa89ef4b9f4831cac9b3aabf506daf7a0a869bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326369, "uuid": "31f1df11-41db-447f-92eb-ac45f0d0dce0", "comment": "Malware payload", "value": "06170709b7c8ff8be83a7daa1c64b4b3f8d383bf64a4c5a18cac531d73bd760033412556265fe322e8881004c08dcd53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326369, "uuid": "a46546c6-cb75-4096-bdab-c171e4464fbb", "value": "T15FF41257F6ECA032ECB52B715DF203C30A34BE615731925B26CE2D4A2C72AA1643576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326369, "uuid": "a3eeda94-de40-4e13-983b-c9dbcbac96cf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326369, "uuid": "abcaa216-62ec-4403-bdf6-ff7322ddb6de", "value": "12288:EMrby90DbOMniKWvjrM9zHklXjibeJ720bTNO4dxhqtnT3/STW07:nyUCMniRv8JklTHNNOYu3/Sy07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676326369, "uuid": "3fbfab4b-86b8-4b2e-96cd-5eb625a75888", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676326369, "uuid": "bd2fd532-c47c-4a78-9ec2-ea71f2cafb6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326369, "uuid": "46b49685-4bdd-466b-8923-1ce0349378af", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7881f8-ab91-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676287738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287738, "uuid": "de22d347-b88d-46d0-86a9-a8c1a88d410b", "comment": "Malware payload (RedLineStealer)", "value": "a39de983b04e0e346dc193e024872292", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287738, "uuid": "a23e7338-7a33-45d9-92cc-f977c546ed0c", "comment": "Malware payload (RedLineStealer)", "value": "4fed95c62ceca23e901a723160da20b8f7efc036dcfdc3641e667f273cc0d035", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287738, "uuid": "5b7c7925-4152-4aad-b6ae-24ba4501796b", "comment": "Malware payload (RedLineStealer)", "value": "68aae5aa3ac88863c6b3d1762702e84b9acb096e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287738, "uuid": "06f0366a-5071-41ad-8146-f7a38302d621", "comment": "Malware payload (RedLineStealer)", "value": "efb7f550f0b5b91aa5ddfeaa31affd264788b0dd5345c59202d77b15a85afe3f25254b99700b4c69591dd21b8478ec60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287738, "uuid": "b8108659-6059-4e5c-9764-e784a5633045", "value": "T1CEF4120BBBEC4423E9B4137058F206D31A367E616F34539B278E2D995872BB0B5713A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287738, "uuid": "aea4f617-9983-4e25-b551-7afe9af6cc9a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287738, "uuid": "536b79a2-cb6d-4664-b726-1defc5f3f89a", "value": "12288:tMrzy90ItwqHQgsqarxtn5Y+eJS0LFPlVrZrPBl5ooLkFzWHTFg:uyptwzDn52S0LFPnrZrPvIFzWHRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287738, "uuid": "31f9b45b-c3e9-426e-b4fa-93de5692fe70", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287738, "uuid": "6a4977b9-8bd8-41a9-95c1-ea3b03f90776", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287738, "uuid": "d08d9b0a-f20d-43c5-a095-2e4e2cb4fdaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b901b1c5-abcc-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676313128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313128, "uuid": "9ef5724e-4c95-4783-83f8-01b79e6a1d2a", "comment": "Malware payload (GCleaner)", "value": "205a48b41020c9d9c6c01503f7ba8acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313128, "uuid": "3b0b8cce-3197-4df0-8ebc-da69a03b7f09", "comment": "Malware payload (GCleaner)", "value": "50250dffa7becf4c5e3cb2071733df7cf283aab6fb61fc495c70a77e68ae1a3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313128, "uuid": "f00ec343-4ff8-4f82-98c5-adb62273928c", "comment": "Malware payload (GCleaner)", "value": "2c99e1deb6ff73c5784bb5103849815dd874d32c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313128, "uuid": "5496529b-748e-49ff-b43b-245dcfb1182c", "comment": "Malware payload (GCleaner)", "value": "ce16bc74c877d4ee923dd235f77c38e9247c0ac6bdf0a194d8ffb0617614eb2e34e3e69364c45765671aba8db640f82c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313128, "uuid": "a6589bfd-a1a9-4a15-9a07-c5147ee6e65a", "value": "T1F6F5227C7515D89DC280BEB48D2AD8E36CE76DD3E9D0A06270DCBF3F51B91899A0A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313128, "uuid": "ab3bf45b-00c7-4c48-9eb6-d1b2007d5e55", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313128, "uuid": "24a87675-f9ae-4581-9830-377133f37bff", "value": "98304:JHBW5YgHzdSezY7f4SsUsYzlXj8rbIycIviv2MR:dNgHz5zOux2lzAbIychvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676313128, "uuid": "9182dbff-1ae8-486b-9f8a-7d18f41c3d7e", "value": 3337197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676313128, "uuid": "f65a8c22-b3a8-410a-bf8c-2a42626fd96f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313128, "uuid": "1939553c-333a-4c12-af4b-d7bd731bfb34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d677a01-abab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676298908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298908, "uuid": "9703116b-763b-4193-a616-feecc2e044a0", "comment": "Malware payload (Loki)", "value": "100f26475d8a3a6a80fee99aa268d8f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298908, "uuid": "f21033c0-976c-430e-8fc3-2a707f9b90ad", "comment": "Malware payload (Loki)", "value": "50311d97abc9e1b82b52a4b0bbaddff680d11c69374c52f93bb6297e428d8a64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298908, "uuid": "42618774-6b99-47cc-83df-2bc7da6b73cd", "comment": "Malware payload (Loki)", "value": "d5ded16db456fafe05643f822212216e39ebcb6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298908, "uuid": "60171ff9-27db-4466-bfcc-c3c7e0a8d88f", "comment": "Malware payload (Loki)", "value": "f546202e541344eb8367958e6c5ef0cca962a29dd6f84c8158e46aa3a7c7f315c611702a8e18c0b10eedbc8d89ea59f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298908, "uuid": "bf3a092b-47a0-4c39-8707-be8d03a041c2", "value": "T1D504CE113AA0C077E59785311820F6B09A6FFC729BA7C49B73441BAF6E337D09A69317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298908, "uuid": "0514f4d1-ed65-4588-8ceb-3efc57881a2f", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298908, "uuid": "5fc3886f-b370-4289-9d03-b1329865e66c", "value": "3072:SbGrO3M35XuJyMBfBSvedC6YBWqABfQ2/s69LTFrjd:SN3MB6ZBKWzQ2/sMHF3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298908, "uuid": "a70ca145-42cb-4936-8ce1-8900af6be78b", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298908, "uuid": "7856b72d-f909-42b3-bade-28a9e447bf3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298908, "uuid": "6e5a39a1-b872-4649-8a8c-d9586d983fb7", "value": "50311d97abc9e1b82b52a4b0bbaddff680d11c69374c52f93bb6297e428d8a64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9bf68c0-abcb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676312726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312726, "uuid": "ba1208bd-259c-4657-a774-6b889c781e00", "comment": "Malware payload (Amadey)", "value": "4efafb6235ff2ecba3fd017fddcf0984", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312726, "uuid": "ebfa57cb-7b30-4ed3-84f9-c25e27265f94", "comment": "Malware payload (Amadey)", "value": "506bee1559bb5da7a9e3de2ac024f55fe5c694f33b00c886c05b9e2ae8c824f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312726, "uuid": "d74bf35f-d2f1-490e-82e2-f9c5305eaf0a", "comment": "Malware payload (Amadey)", "value": "186818a833c2096bc28f5ab3a797c81331c7accd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312726, "uuid": "588c515d-4b4e-4928-87fe-bbf7a4d80c99", "comment": "Malware payload (Amadey)", "value": "bddfb70396dd7b51261996a52010d5641cdfc52332470b4146f0102a54ec5f34f4fec9fc331a4b1242be19d2aca36003", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312726, "uuid": "6cdad9ab-6887-4be3-8c32-78339f6c26e5", "value": "T1D5F41207E2EC5471E8B967B048F603C31F797E71667843D7178EAC1A0A726B0A63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312726, "uuid": "591751c7-38d5-41e1-8b5d-6d975436197a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312726, "uuid": "7a170fd8-9712-47bc-8fb5-8300b99fd983", "value": "12288:6Mr5y90UzJf3I6pVqyo7V8GO88WnFIP5VjBxmpolTmlElMY9lqjP5:fyfJQ6pV9o6GO88WnFI3KqV94P5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676312726, "uuid": "74bd269b-db17-4a3c-81d4-bba3fa8b73c9", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676312726, "uuid": "3b84200f-9b1c-4577-8b8a-c5841bc665cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312726, "uuid": "b118617a-d7ea-41fe-8582-e1b0fddd62c5", "value": "4efafb6235ff2ecba3fd017fddcf0984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8897eb21-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676280405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280405, "uuid": "78ec86bb-4bd5-4d57-ac71-58e248c4f81c", "comment": "Malware payload (Loki)", "value": "bbae7b9de48914a4b46e97df15f21759", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280405, "uuid": "9fb6fb67-9c50-4964-b97d-abe22546670c", "comment": "Malware payload (Loki)", "value": "5104d53335e8e24add230c5940a6e3400bbaaca5fdaca129b9f94302581a8858", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280405, "uuid": "edfd1319-5740-496a-8020-0aaf9546b55b", "comment": "Malware payload (Loki)", "value": "fa0ec7de4e4123a35bbe37f2274693013d0ab82c", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280405, "uuid": "e6143ad7-992f-4550-849c-6543bb62f9b8", "comment": "Malware payload (Loki)", "value": "a3a217b26e3ac50ef122b68452dff5396ce1ae3cff758c386495cf993f0e58dae82a16c6945507d5c1bc1184d1db13a0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280405, "uuid": "fa00a590-514e-40d3-b423-7d1b8313f8c4", "value": "T12835D007E679993BEC22C53CE85F54828202AC3AB954CA4D21C37B1F9736BB55D3EE50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280405, "uuid": "78b2e186-e674-47b2-a456-451968355a0b", "value": "24576:JSZFeyWxKTFeM5LFRceYadbg+C9jAJTQlkR1d:Ur75RBRYR+CVKQlMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280405, "uuid": "b64803d1-8fa3-40e5-a6e2-4ecda8466ec3", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280405, "uuid": "1897739c-39cf-4109-a186-4948410317e9", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280405, "uuid": "450b4686-9bdc-4e2f-a53a-b8700ce780f4", "value": "Payment Advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4b4c1e-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272009, "uuid": "f75115b4-bff7-4419-b9d0-347971c3c761", "comment": "Malware payload (Formbook)", "value": "7d73c712c23895a7ae8c83c40c004b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272009, "uuid": "ba266b37-9edc-49fe-9101-ed629d7033a0", "comment": "Malware payload (Formbook)", "value": "51054c5181fc248a1642dc3a5cdb7f353aaf5d136aa20bdc59084970e74c5a8b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272009, "uuid": "50818d4c-7538-4db2-9719-c400e24e6aad", "comment": "Malware payload (Formbook)", "value": "3a92a36723b1d765368f29f3e448d256b31f50ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272009, "uuid": "a362c8ca-66f1-423e-bc89-2174dc950114", "comment": "Malware payload (Formbook)", "value": "0c4106e451746a10d53f0f0297679baa6ead85b2fc34bfbe8c05ba716dfdbd876bea9feab04362778e990baf18125f95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272009, "uuid": "490e998a-e360-41a1-9715-0af6f2cd7433", "value": "T10F04AE32D641C071F2B252B4F67D1BBB883E0E353295A4A9A3F116E06FA45A5F13931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272009, "uuid": "660b49dc-f12c-4c02-8afb-b174e2f7fcf8", "value": "3072:A0rOkQDI/W0mY3n07s1DUaYXk9BJb1UypLKZcNNJq0Lpq+KymRAykMdw8:yTWnu2UaYXknnTKeNj1LtKVUMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272009, "uuid": "c6fa16c5-6d88-490a-9058-84d617243746", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272009, "uuid": "29a142ba-efae-4ed9-a813-d1acff88ea78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272009, "uuid": "0f36ac70-97c7-44a5-b474-0866b8d0114e", "value": "51054c5181fc248a1642dc3a5cdb7f353aaf5d136aa20bdc59084970e74c5a8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee37eb8-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272040, "uuid": "008c2415-a62c-4166-b044-ebf4b78a2c87", "comment": "Malware payload (Formbook)", "value": "82353591ce0ead6d3dac381fb940fe18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272040, "uuid": "5b5dff91-0401-443f-9aba-20d563f4ed8a", "comment": "Malware payload (Formbook)", "value": "514522c0e2dd98ce2cc920c081d4a11f18a697917d26a82a3397fc69419a91c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272040, "uuid": "79fde97d-e6cc-4723-988c-fc339ad1962e", "comment": "Malware payload (Formbook)", "value": "604fa4a74aa98b2bef92b8eb47e4481276ded7db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272040, "uuid": "d8c0cda3-ba5a-4894-88d6-08ad56aac5a8", "comment": "Malware payload (Formbook)", "value": "07b2d5a5616e33f09819b2d9f31414923b57eadb7f1202adc20dfdfe895fda932e00544ae3f6b2b6ce7b1d195e8a32a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272040, "uuid": "bf8d74d7-9cc2-4f58-b946-f94433aa1b65", "value": "T177E4E09B5EFB6F6BC4240B30F4B525B433F09C3A2421D757AEE822F4EAA97051D32251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272040, "uuid": "eeac1553-e69e-4b8b-98d3-ac9f8940dd78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272040, "uuid": "26e9fa2e-d667-4004-a38e-59076d3e5bef", "value": "12288:VFbKFQmymXknLaxx0qUhwNQOubJ3XVkHvxJzRaf2L:VFbKbohyS05tL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272040, "uuid": "224a80c8-9c86-4335-aa1c-083110a522a7", "value": 694784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272040, "uuid": "8c404c3f-1914-4df9-b061-3e41ee268b66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272040, "uuid": "135e435a-c7a4-444b-8ffa-6a153c8b13b1", "value": "Email.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171b8ede-abbb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676305555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305555, "uuid": "30e378b0-a822-4549-a58c-ebfffe91ed63", "comment": "Malware payload", "value": "0f3c1fd5651852f1022df59ca251cad7", "object_relation": "md5", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305555, "uuid": "3256f248-3187-4ca4-9f50-1796cc644bad", "comment": "Malware payload", "value": "518518b0929911353cd7ab95d873e1fb290d8a494122cfb88e7f8bcf015576c8", "object_relation": "sha256", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305555, "uuid": "bc2f60aa-e6f1-4f0b-b9e6-84350f00dfea", "comment": "Malware payload", "value": "1d6a6ff06f5aaf10e73eb598b4a27129238e707f", "object_relation": "sha1", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305555, "uuid": "d532bdf0-3a4c-4153-ad29-03c0c284e215", "comment": "Malware payload", "value": "210f9d4b65f999b8fb0287e65ffd06ada34c57b6c3e9b0d338a7a5c1a2cb135cbeaf3c9c0e2e97fab186e5ca8e05293d", "object_relation": "sha3-384", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305555, "uuid": "4a096956-24fd-40bf-a343-c1717f186949", "value": "T10BF02BC2023C470CAA6279180A0A80847B702A333BCFA99133C3F2F2C0E10C260F23B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305555, "uuid": "7afbe640-9bd5-4f9e-8a64-a0597b6aa100", "value": "12:IGZK8ELfXNEHGMPzVEbp2pbAzLgyaI4HPKJ/23McP3:ZELfamOzKkRAzLCHPKJ23Me3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305555, "uuid": "90c1c762-d8af-4da7-b8ba-55890861efe3", "value": 447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305555, "uuid": "8791c5af-5bd7-40f4-b7e0-74f3bb56ffc2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305555, "uuid": "bd7e7012-bd53-4658-89bd-25cd84dd00a7", "value": "O p e n.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00f2c23-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676299852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299852, "uuid": "e3fa5a7d-8c8f-4526-a0f2-a1b7e1c5de1b", "comment": "Malware payload (AgentTesla)", "value": "497321c70f5797323950e1c06fba5efe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299852, "uuid": "4368358d-2372-4931-baca-f8967d2621a4", "comment": "Malware payload (AgentTesla)", "value": "51b54607413a36cd79a4fbf64125010db39a4efa5cb0b7a1674d7714e2270db1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299852, "uuid": "cdd38acd-8bd2-451e-9085-b78f8c392381", "comment": "Malware payload (AgentTesla)", "value": "43a4841d78027bfc71809e36d5553d51aece32c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299852, "uuid": "b3a9cd92-4ee4-4e35-aae4-48b7c8642c09", "comment": "Malware payload (AgentTesla)", "value": "7e150683f70c46d2eed8a43eafee9627d48f64ca22336d320b416e5de8a6e538326ab1ae248fe790b224ed6b8393f0ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299852, "uuid": "fa5013c2-0d1f-4a3e-b351-35914e95ed8a", "value": "T16DF412175E096A37C67C82FC6C176D5883B0ED396CB1E3EA2C47B4CF21A17A9441A7C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299852, "uuid": "d2e7dca2-100a-4fb6-a0bd-cff371e1f682", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299852, "uuid": "002a3c0b-d220-4186-b9cb-c31b7cacffc9", "value": "12288:6ih6q60MDYC0ND571Vd8FaVriWUlqOUDebwl25ld7F1bRmCnrCuorGY11aPLSbna:1YHhQ57jpUgmOYld7fbRmCnrborfWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299852, "uuid": "476cb1a0-6027-42f8-b8e6-7d9e90be3416", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299852, "uuid": "22057470-cce9-41a4-90d2-548c65828242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299852, "uuid": "6f9e076e-9a59-4208-af70-995eb02012c6", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48cdf7ba-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676272137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272137, "uuid": "5b168442-19ce-45fb-86eb-73dae7c996e6", "comment": "Malware payload (Smoke Loader)", "value": "7caec985ff34e74ded66927e0eacc24f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272137, "uuid": "e70418a7-1f6b-4d6b-b8a3-0f02de31e25f", "comment": "Malware payload (Smoke Loader)", "value": "51fa97123f6632d6e578469837e1ff64d9273a914676c0ed734e88b52c6b08c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272137, "uuid": "7d72592a-031c-4809-8370-8d3f0641f8fe", "comment": "Malware payload (Smoke Loader)", "value": "a2731e36d6dfcea93304759f469559699baeaae6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272137, "uuid": "31900b57-840b-40c7-84e3-6aaf62cb92ee", "comment": "Malware payload (Smoke Loader)", "value": "aaf2c02a88d0f79f0045123711fbbd80fd0cf951cb037e02ff64438e906cecb7925385e3a8330d14015b0ccf5a5e7919", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272137, "uuid": "a731d0e7-0ce6-4a7f-a8fe-a9c3bcabb6be", "value": "T1E914CF27F2E0E472C462163069F5C2F16B6DB8B10E7866AB77481B3E4EB02D1D63635D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272137, "uuid": "c54ec566-eb9e-4c1e-bcae-9d88526d0338", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272137, "uuid": "0f9dce86-7192-45f3-8ca4-6a99bb8bd3d6", "value": "6144:Ozfiuxb7Kdkructc2mThH7nREAYxJOCctt/:QfiuR+3ctc2ahbnREtxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272137, "uuid": "736ab84f-9981-4d57-9ce3-39ef777c3b79", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272137, "uuid": "f6c0b4ce-24ff-41d7-9e6e-332806cf5633", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272137, "uuid": "04aef771-883b-4573-b781-a361d48232ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3e7abf-abf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676329214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329214, "uuid": "bc942521-0c4f-4cc9-875a-b6172ee16407", "comment": "Malware payload", "value": "7143ef8e6f25a19691bd87a29462018f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329214, "uuid": "f1eefa8e-d77e-427e-b702-5064f9415cfc", "comment": "Malware payload", "value": "5238120b44b51fa780c8d232adbc214c17bc2c99dbc93eda101b10fb64939971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329214, "uuid": "10085893-606e-44ca-bd7c-3f79979451ef", "comment": "Malware payload", "value": "b2436b4e2fd3f40c38d4212947477a89fe634e3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329214, "uuid": "85ee21ce-3bbe-4c1b-a1af-ad7ee6bd78a2", "comment": "Malware payload", "value": "0c58633a7a110d181ced7cf3ceed331e61cfcc5186469d1d7790933d81f09e805fab4380c495406ece56383ffcd1a1cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329214, "uuid": "2d2ba387-149b-45bc-8128-0add45102f12", "value": "T13404BE2372D0DC71D46646319CA8C2B5EB6EF8614A78A68F37D43B3F0E706C19A75392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329214, "uuid": "2b8fd375-1ce4-4364-9096-4f39369bfe30", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329214, "uuid": "f1953af1-d29d-4484-97c5-0d410e194fb0", "value": "3072:+KiJtbWR0e+zVmRE2jiGprVpHsLvWrg2p9rkgtDwpcANCNPNqNm:+vJJiZ+zV4Pvr7HHs2rtUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676329214, "uuid": "3cee9861-167e-40d8-a09c-5301888a4adb", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676329214, "uuid": "d3bd6eb4-b955-4556-a064-14ae9eb4628a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329214, "uuid": "2958583c-3ac8-4c23-bfad-8ed785a7206d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a674ae-ab77-11ed-88f6-42010a9c006e", "comment": "Malware payload (ModiLoader)", "timestamp": 1676276726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276726, "uuid": "4df4974b-5ca3-4339-a19c-c608f6a1eef5", "comment": "Malware payload (ModiLoader)", "value": "84eec5f3300c6e064d3385ac1c737fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276726, "uuid": "134c42e8-2c7a-45f3-be69-e485c7738641", "comment": "Malware payload (ModiLoader)", "value": "525d58527438fd6f9e3e6a98e6fab50faeef68a92d067a2caa53cbb34b2100cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276726, "uuid": "63859a0a-e236-4eb2-8b4f-d44e46c59a34", "comment": "Malware payload (ModiLoader)", "value": "221983b838c25f529ad029a0a602f87b23e04fb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276726, "uuid": "038a9b46-0150-4104-8f04-198d84af7145", "comment": "Malware payload (ModiLoader)", "value": "af163a89c8f73770fdb27439196a8e05af7c49db5a41169792789310c0e487714d0b17a74cfd138134a9e78d2b51e371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276726, "uuid": "fab209d1-d360-4649-8176-fc7657070b76", "value": "T185E4AE31A2915936DD2E9FBC8D37EB94592E7D232E2864D7BEE91D1C4F382803435293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276726, "uuid": "7e6d9eb9-a549-4c06-96fd-a50d7eefdbed", "value": "c27a057e1266983bd5bb82ac08c499af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276726, "uuid": "2a43e633-f70d-45db-943d-e49596c45f92", "value": "12288:sL/ZNrRZBps9ttZ8DL2QXcGEMTD+aGgF9fPvfofHQsr0Sa:C3TBS9TZ8DLUVMGrG9fPvxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276726, "uuid": "c279467c-a40c-477f-8202-18360187687f", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276726, "uuid": "57a28cb5-8ac5-410b-9f7c-f64d3e0cbce7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276726, "uuid": "a267a4c9-f6ae-4b21-b9f5-841fc805e830", "value": "84eec5f3300c6e064d3385ac1c737fdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e944e40b-ab52-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676260810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260810, "uuid": "bfb6f616-de7f-4e62-b105-1b4cb4af94a5", "comment": "Malware payload (Smoke Loader)", "value": "ee12a9d02f45005bf7b170b7c830803d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260810, "uuid": "1f578546-64b9-4876-b067-f7f7167a35ef", "comment": "Malware payload (Smoke Loader)", "value": "52904f526ec9bbd0f2c6e90d442f6cc20a2fb1c3a374b37835736a3dca584530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260810, "uuid": "8cd2c778-37ba-4bde-9052-93809b94dd16", "comment": "Malware payload (Smoke Loader)", "value": "eaa4a9fae722bb2cc5ff42d10a5f5e2c30f57011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260810, "uuid": "893c6efd-1897-414c-9693-ff426c79fee6", "comment": "Malware payload (Smoke Loader)", "value": "4eea578ed4e65c394aa2a1dfe520d19801cebd1e60e64d9cc16a64266d1e50923a69e64caa7f477c88853f8899314371", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260810, "uuid": "3952e1c6-c53f-45a1-a3e5-490e6c092059", "value": "T1AB04DFD2B9D0C073E55789752921D694DA3FBCB1AAA1C18B33982F6F0D303D19E66317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260810, "uuid": "30d60a18-6231-4519-b94b-16239bd0b7d2", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260810, "uuid": "f11fcc76-1a8b-485a-908e-93b8971a33eb", "value": "3072:JQXYwg35XIGfduvI0tpY1Z9hzRwqoD4EbRPAf3a:J+gBTkpUX9nVEtofK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676260810, "uuid": "4b37ec15-1d6e-449e-bf66-870cf8751aad", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676260810, "uuid": "f49ebf93-7bef-406e-93fc-2961ddcd2040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260810, "uuid": "b16f1db1-3f85-4b4d-88c4-f51cc3368136", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce2a266-ab85-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676282452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282452, "uuid": "12e6de02-3f9f-4d2c-a59f-486570316c8c", "comment": "Malware payload (TeamBot)", "value": "9520c1288f8a4b39c0ed8c876c6ce342", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282452, "uuid": "9e8829c9-3bc5-4f04-b26e-c2da5248959e", "comment": "Malware payload (TeamBot)", "value": "52a38819ee5d352fe06f42db3944f004d73385b2ce37e301caa3ae6b577c1331", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282452, "uuid": "8e47c422-3e1c-469d-9593-cd7e08416a63", "comment": "Malware payload (TeamBot)", "value": "1baf26f1242e320dc93638a8968a29ffd6667b88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282452, "uuid": "577221f8-372e-47b2-beb6-725e75fb744f", "comment": "Malware payload (TeamBot)", "value": "4aefe8bb350bf61046b7657f355c6d6741e68cc20524dd85e17cb90435f109b6b661590d1fb66c9c52c0d6ba6a091276", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282452, "uuid": "b64b49af-5e00-4a2b-8f47-733e84304250", "value": "T10B14BE1372D0E472C5725A306D79C6E56B6EB8B17B78ED5B37481B2E0EB02D09A32353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282452, "uuid": "92ea4908-400b-471d-80ea-c260b82b817f", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282452, "uuid": "1d5bf47c-2f92-4697-8504-b936e11f7383", "value": "3072:drkbfUsQI9K5qkXyT13doZlGwHxju9TmdIOI838e:drUf/KEkXyT13GbBHxjgTmE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282452, "uuid": "448473a8-5e62-41c9-8afa-93be4f96b23c", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282452, "uuid": "f24ecfdd-f2f4-4437-bc16-54755acc78f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282452, "uuid": "dab2e29f-bea6-4754-9aac-0a21ccfdbd09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1eb7952-ab95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676289547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289547, "uuid": "b79392a3-200b-440c-b218-1ffdb02dd3a6", "comment": "Malware payload (RemcosRAT)", "value": "b0f70946dc03f74519457537d9bcf0ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289547, "uuid": "6723734c-7e34-4325-bc1a-dcf78a9efb24", "comment": "Malware payload (RemcosRAT)", "value": "52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289547, "uuid": "038ac5cd-cbac-4df4-8c57-1ea15acf2802", "comment": "Malware payload (RemcosRAT)", "value": "373c6256339023c584db4f13bc3f856a30c3cabe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289547, "uuid": "5bbfd89b-8ce7-4be4-87f9-b5d6247caaad", "comment": "Malware payload (RemcosRAT)", "value": "c66320c469f622d6c6587c96da30952f95094dbee0a0f3a90c167b8d96607add8b419c97add7f7672358c67aecbe04c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289547, "uuid": "9b90b812-f5f2-4f40-9e28-d32d6db3769c", "value": "T16AB42318A2F4C497FCC369763FBBC82E0FF5B44368149A0B37658558BC725D281A6F91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289547, "uuid": "7fc9f259-eac1-4544-9385-38484da63968", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289547, "uuid": "bddad0a7-6414-4d94-b7c6-435e3d7a9f3f", "value": "12288:FYIVcKxsozwYGYAq3nArsgYUY72y+PrXH6Yi:FY2t2gwYbvwXYUI2fHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676289547, "uuid": "9003c88f-5c80-4a8b-b732-107a218004ab", "value": 510400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676289547, "uuid": "030b7c48-4fa3-4b1e-8b01-6af5dd8f1975", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289547, "uuid": "19919574-59c3-43fe-9d70-3a4f77822fde", "value": "OVERDUE PAYMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c954235-abe0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676321455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321455, "uuid": "b904698f-8a57-44bf-9db4-de69e3b495d1", "comment": "Malware payload", "value": "23c44a221be89ae12709c12cd5faaf4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321455, "uuid": "2de7290b-2233-4ec9-929a-6298d7b3f73d", "comment": "Malware payload", "value": "52e61dfd09d4889cd275afffb823e0ab0123b3b6db831f2e8acaa482c029d142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321455, "uuid": "f5c888af-172d-4f32-a7b2-64ea1f1967af", "comment": "Malware payload", "value": "393744974ae5fbadbb9c6bb35f99352a34549db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321455, "uuid": "d8a7f4b5-10b0-4b9c-8205-ebf604df8eb9", "comment": "Malware payload", "value": "ff91cfec0441edf244559110457504e2768fc568cddd97feea095a755f61455eb2213ba995384014d527db5ddaaee12e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321455, "uuid": "35fa2dcb-4dd1-45de-bb77-2f1908c07c5f", "value": "T102F4124767E44032F96467B019F703D31A35BDA16A7893DA238F2D1A18B36B0B636737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321455, "uuid": "e8f1525e-ea2f-4573-abc4-e388a8b2bb71", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321455, "uuid": "84e905c5-59dd-4df4-bb37-e297507b3d96", "value": "12288:wMroy90qqaBGpbA3yFblLd/Q88+tCIPLA6yfflx0fV75gwc1DDOe:IyNqaBGplFbtpQ88+tCIDA6yfflxe5gX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676321455, "uuid": "23c3b4cc-8239-4068-a407-d017fb3edfad", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676321455, "uuid": "550ab110-6c43-4f5b-a677-fe4012045da4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321455, "uuid": "589a76dc-0e4d-4f34-86b3-bf604527c00e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0697d11-abf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676329408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329408, "uuid": "eedc4fa4-0251-4a74-a49e-d21ea9eaa2d8", "comment": "Malware payload", "value": "06dcbe350ce76e9d90666bd36818ef95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329408, "uuid": "557fb241-4f60-4c0e-96a0-1910db9969e2", "comment": "Malware payload", "value": "530db0f6fbac39d172d962f60a216d7ef3fa0d3b59952c799b84ee5be67e4291", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329408, "uuid": "4ca8b81e-6bb5-46a7-9def-65c4987a9ce9", "comment": "Malware payload", "value": "b897f1b2ae6533feeefded6e359cd03b011ab377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329408, "uuid": "bc7399a4-2be8-4a85-8653-5982bb358c4b", "comment": "Malware payload", "value": "97efa8ae789ecc15f2a8c02ae3969faa6ae0aa3de83911f6f48ad2c8f131faada0f541f324d652956cd1bc231b97cebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329408, "uuid": "230c499e-1ac0-4af1-b72d-df3ec0d3c00a", "value": "T15654F11373E0E872C9621A319C65C5B1366EF5124A3D969B3BD8EB3F0E702E1DA31359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329408, "uuid": "8af81623-b13b-451f-97e5-29eefb4a6741", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329408, "uuid": "91c8c5df-80de-4a4e-b55d-ae4e9b7979b0", "value": "6144:g1l8N/vta+55IzJRybYlxvHq2DMGg5D7yltQk:g1gA+55I1RybY3fIGED7yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676329408, "uuid": "3e913b8a-dab3-4dfc-85d8-323195c74eb7", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676329408, "uuid": "d5b2f917-6fa9-453f-a80f-a7d899ade582", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329408, "uuid": "4f3d9fb6-f042-4ddf-9b44-1963be4225ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16998955-ab96-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676289663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289663, "uuid": "976f00da-fdaf-4ad4-8c0c-68ccaedb80fe", "comment": "Malware payload (RedLineStealer)", "value": "dd68ef10ba2394bb5ece0ae1c18b2936", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289663, "uuid": "e1186dfe-9b15-449c-928b-4df48575ea9e", "comment": "Malware payload (RedLineStealer)", "value": "534b1b0aac62686c6eae074a4fb4f917d7e92ed59ed2a4dd8cde3eb9457d5140", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289663, "uuid": "3fb86e1a-1c3f-4d95-a094-cb3295a5c310", "comment": "Malware payload (RedLineStealer)", "value": "5d43c57471768117b18b1bacf67f5d4706d23ba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289663, "uuid": "a3376156-6df3-44f6-b770-b98e434b7dbe", "comment": "Malware payload (RedLineStealer)", "value": "20503aa2b36acd59531519eae7b131fbc5ccefdc24a8977ad3f36ac53aa439d4f7ea654b0305dc5a763921407a33b58b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289663, "uuid": "85164da2-1029-4e98-972e-fa94100c48a7", "value": "T1B2F41217ABE89062DCF4537019F603C72A7A7D629F38C24737CEA9081D726E5A43572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289663, "uuid": "f1d2b8cd-63ad-455b-97f2-e8b9d503c50f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289663, "uuid": "d65818f3-cb82-46f0-aade-876920d88b59", "value": "12288:fMrEy90D0PO/XS+OGRNNa2AH+0plFeJLz3cdG0rroT4Rm//+q:PyZO/XS+PRNNale02Lz3WUTkAmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676289663, "uuid": "7915ad8b-8ba0-4979-b4c7-31af3e4603e7", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676289663, "uuid": "139979e6-b169-4bd0-b6e6-5c9ee3ec54f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289663, "uuid": "676b44da-4bb9-401d-a3bb-a944bb6ca16f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b7a1a4d-ab5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676264438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264438, "uuid": "43aa9b89-eb49-426c-82a4-a5c06889b78b", "comment": "Malware payload (Amadey)", "value": "3e36cb2f97fbe73d36ec678867601431", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264438, "uuid": "a2c793cf-3fec-4228-bd01-0dcf1e6229a6", "comment": "Malware payload (Amadey)", "value": "536d0ce34984d2f3cf9c5d6440e154ef25624523d7cceba769e9c27348f25f4a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264438, "uuid": "6eeceacd-56c0-42f0-abed-93724b72e9dd", "comment": "Malware payload (Amadey)", "value": "667305559e972f3b60d369f8d07e86ad188440db", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264438, "uuid": "40052ddf-ff57-4ccc-aa1f-6b67e66496f4", "comment": "Malware payload (Amadey)", "value": "1f45c98eac1cf703f840ff4d83250171627d5ae766e512a4886942203f5270f3b9ee36a194cc8104525d40efb49124ca", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264438, "uuid": "fc613112-8b7c-4c71-9dd7-d5f509ab07d3", "value": "T150F4120BBAD8D131E9A5277029F303C316367DB45B3893AA27CF6D5908725E1A23536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264438, "uuid": "2141050b-f70c-4fd5-8a05-c2118dfec1a4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264438, "uuid": "0436ea2e-618c-498e-9e96-13860621fdd0", "value": "12288:3Mr+y90zlxmHBYaSeQTznAyeJoNhmDhNq+fIMg8m9TobIQQE:9yQ3mxQTznmo7UNqwlgXTiIQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676264438, "uuid": "f5c5b995-8f60-4564-91b5-8bec03c35639", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676264438, "uuid": "6ca7580a-d435-4bf3-a3b8-3a1a6d0aed78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264438, "uuid": "b0af9bf2-f0a5-49a7-a25b-32a67958e394", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe95626b-abda-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676319258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319258, "uuid": "8c976a1e-ffc6-402f-a645-68d0e5eff89b", "comment": "Malware payload", "value": "2afe2ca6322c8151aa480d4d04b4b019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319258, "uuid": "54cdc9c7-c44b-4772-ab38-d1fa526cf15f", "comment": "Malware payload", "value": "5385335eceeafefc930163c92c8c7479c0ef07bdea8479cb02966e5e944d1399", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319258, "uuid": "762cdc7c-6675-4efb-94e3-84a95a38621f", "comment": "Malware payload", "value": "562c25e3f9c359393515e0779901162e1b659347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319258, "uuid": "559fdbd0-45aa-4f06-9a80-3c25bc871bad", "comment": "Malware payload", "value": "9307b5f458bebffc64bddd3eb4c8cee41ba3dbbb22e3fd11d577267125731230e5f355cb55e1c6e395435b776428f8ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319258, "uuid": "d3ef43df-7241-4448-87db-52e5670d8553", "value": "T16C657C4533F84B59F1BF67B9E83015109BF6F857AAA6DB9F8640D8A82C63750CE00367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319258, "uuid": "45aafb36-0890-4818-a89b-db568d426059", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319258, "uuid": "f25fda23-1ba6-4348-af5c-7ec8935b447c", "value": "24576:WxE4SBnU5+K8m657w6ZBLmkitKqBCjC0PDgM5A4woGf9:N4XJVV1BCjBkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676319258, "uuid": "66b3a4f2-5bea-4791-990f-d52011b2846e", "value": 1451568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676319258, "uuid": "efd0fa95-59dd-4e01-b7e0-2e5c3525b0b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319258, "uuid": "71866ace-cc74-496e-8d02-a73fcdf5e4be", "value": "listrar-Hola-Browser-Setup-Inst-Agreed-C-Mmdb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806554e4-ab92-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676288122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288122, "uuid": "d221dfbf-5d88-4a9d-ad4b-83e462afb45c", "comment": "Malware payload (Amadey)", "value": "6c7e8ec5118903fed29ead85df67c6e9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288122, "uuid": "c18c319d-2ad8-4e6d-957c-bbfe4ff4b059", "comment": "Malware payload (Amadey)", "value": "53e574cb8208f9394b7e1f7ff24bfc66e438ffaade744a9ee1c4e5b71a8462ff", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288122, "uuid": "0d9705cc-c761-4a9f-86df-bc3cac6a333f", "comment": "Malware payload (Amadey)", "value": "98975848fdbbadf18e9fa8438663265251507d11", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288122, "uuid": "e97fd679-84b7-48bd-b14e-b772adfcb130", "comment": "Malware payload (Amadey)", "value": "cc6ebdb1e5914d0bf28d3f0cb3f7a578b0a9a24761902a006972f27c1b9598954dbb08ecbe0e46cddcc29e3bf5198dd3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288122, "uuid": "36efc36e-bde6-4d65-9e05-174abe8ca3a6", "value": "T161F41247B7EC5122E8B5577119FA03D30A36BD608B34838B238FAD5A0D726A0B675737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288122, "uuid": "be10f05f-0dbb-4268-801a-8c359e00518c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288122, "uuid": "12ad8dea-7400-43d2-80f6-13a738d8dc84", "value": "12288:6Mrcy908LB0+U9SELduyK1Gvlz4GteJE0f1zB27bxHr5okLkvnaQYkdxFQoP:+yvU9UQvp4lEfhjIvnZDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676288122, "uuid": "654bc29f-db5b-4a69-9617-d7f3ef70a51b", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676288122, "uuid": "330a3811-3553-4f64-847f-9794d1b4fb4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288122, "uuid": "42d99f6c-a016-45fe-89f1-8de60a5c1c05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3203c145-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676276824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276824, "uuid": "0378f2cd-54d0-4f8f-bd80-7680343825f8", "comment": "Malware payload (SnakeKeylogger)", "value": "6651820f8d2c357326cd6221014214ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276824, "uuid": "5a4aee9f-fcfc-47e3-acfb-21443ba636fe", "comment": "Malware payload (SnakeKeylogger)", "value": "53f9dacf7ccbe8af215f3cb912f7c2abb468505d5c1430137c82c4b60997c424", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276824, "uuid": "2b0aa120-86a1-406d-a828-0f068c8c964e", "comment": "Malware payload (SnakeKeylogger)", "value": "b9ddfce64ef990935593d22cd3c931ea73dec827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276824, "uuid": "3497be05-e812-400c-817e-fbfc8f1e371d", "comment": "Malware payload (SnakeKeylogger)", "value": "3d9ae2c6c194eac75028c376de1dc62fd87c04a6f5a7f6d691dee38a8215dc9431c85cf93fbc283ab51e8097d87d8315", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276824, "uuid": "9355b05b-949a-429f-a628-b71984bdb5df", "value": "T1231512617614DAA0D4284BBDCCB29AF05375BEB9E860EED72DC27DCE3AB179111406C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276824, "uuid": "1a14438e-39db-4918-8fa3-90633dfcdf8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276824, "uuid": "fad24ca0-cc9a-4a65-bf86-6c210e6163cc", "value": "24576:B1bgzPGhgzfYLwMYe2+e3cfEVvSGBqbvSqArw:BZyPyywLwMYep0gGXqJAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276824, "uuid": "7db2201a-0f1b-4851-a610-9f8a19de5ade", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276824, "uuid": "891d98db-93f3-4b99-8f03-c59b5e0a72cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276824, "uuid": "c9253fea-27c7-48a3-9f3d-95e70cd74299", "value": "6651820f8d2c357326cd6221014214ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b527f829-abf5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676330731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330731, "uuid": "bf8ff1c5-26f6-4f9d-b5ad-113d02135828", "comment": "Malware payload", "value": "36efaf12d3dc4fb35b0b827e37c15b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330731, "uuid": "c9b48e9a-5130-49c7-a8a5-b3eda968b014", "comment": "Malware payload", "value": "54f9d8b8655a1cd436af4048ef17088b3aa1cd64ff77475a03e92f139deb16f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330731, "uuid": "62e74cad-62a2-43a4-b40c-2abe7a564dc5", "comment": "Malware payload", "value": "fcec0cf0f7cf66c491f52c8cf36051be17874b49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330731, "uuid": "83be0b08-512a-4a6e-bc2e-9fa5139eb059", "comment": "Malware payload", "value": "7b5c50ecc486d69320695597161c36be6f10250bd3b9baa0abf723f8c2e3255493f85e5eb65495b065582284de0dcc92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330731, "uuid": "31ddab42-c524-48db-9c94-7d77133f1884", "value": "T174F41207A6EC9022D8B5777029F603D30735BC614635C25B278EADA91C72AF4B23577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330731, "uuid": "f6974763-3850-44dc-99cf-2377839dc13a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330731, "uuid": "fba81dd5-1180-4410-a9de-86ce05af1607", "value": "12288:PMrXy90IauA7aBehf/J64/hvSG/+QHZ5heJ1Dd2GczGhzFFZjhq1N:oyFav7+ehnJ/5aG/H5IZAZIzFfjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676330731, "uuid": "7e82dcd7-a2f5-4970-bdac-ba27c90c8853", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676330731, "uuid": "b66c7423-228c-449f-94de-1b4aa1ed7b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330731, "uuid": "6934ec02-9260-4eda-9634-e6c4e623efc5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256ceb89-ab83-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676281527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281527, "uuid": "bd150400-696f-48b5-bac3-30b83fd97259", "comment": "Malware payload (Loki)", "value": "54108bee673e86375a7b9823977c2443", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281527, "uuid": "ce6eda94-7f3d-495e-85ba-91b6a059c9c3", "comment": "Malware payload (Loki)", "value": "551ea82313ce0400560a5aaa288b8ad8c80e6e1ff329b6574ebefd24463b2c14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281527, "uuid": "9aec5322-d4d0-46c7-93d5-60f4f00689b3", "comment": "Malware payload (Loki)", "value": "77f12e6b204acf1fd484dba732bc31239551299b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281527, "uuid": "ab2e0441-4f42-4255-89ea-4846658fa534", "comment": "Malware payload (Loki)", "value": "f72234206527677746130252840d2b23270392e795f00bf5412c7e6acf4ca199b5b8db8e9b9eaeeeaaca32686bcd1eb7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281527, "uuid": "8f6252a3-b0ad-470e-8526-28ed4558de76", "value": "T113D4F1403BAD9B14E46E57F82435A090637A7E5A3A66D21C3DC631DE1E32B578322F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281527, "uuid": "48a4fb11-f4d6-4c97-bf7b-409550099440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281527, "uuid": "9aed1b7c-0612-45ab-97d4-c5605243b8f5", "value": "12288:OddPgZh6q6/TKPzG7YTc3JHrcJHReAVZWu6u/sxtV3x8LeVK/C:OddsY/TKPzG7qc3JHKHg7LhOdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281527, "uuid": "8b6b15c3-9af2-4a41-a96e-7a5f3d02c367", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281527, "uuid": "e163bcd8-e69c-4d28-8e78-7311b78c1530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281527, "uuid": "0ed41f87-f403-4c94-9dc3-a60b64ed5135", "value": "54108bee673e86375a7b9823977c2443.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b505220-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676300462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300462, "uuid": "075a7e99-f6f3-42b8-a15a-0e00030d9845", "comment": "Malware payload (Formbook)", "value": "47d4d1036aa1bd03159f548c5f82b8de", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300462, "uuid": "2b4cd276-aaa6-4c31-9987-4d19c0b3efe2", "comment": "Malware payload (Formbook)", "value": "55be2ab6bcd32fe49927c60d0b463572ffd0eabd6f55a28354df2924be9ea7d2", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300462, "uuid": "ea634124-ca2f-4cbd-b0e1-585c0b506d0e", "comment": "Malware payload (Formbook)", "value": "39867331fd7959d8f04bdcfdc57fd5764abe59b0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300462, "uuid": "3d3f8752-55f3-4fd5-a7a9-caf4bca3a599", "comment": "Malware payload (Formbook)", "value": "768bde71751d4dfc54b7473b5cb2cdb7beb4d4f2b1563d7c28f7771b07b4198345e33a643ded24047f7a9f47e46e2b99", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300462, "uuid": "5e48df48-2aec-4a28-9bbc-9a6c85df313f", "value": "T1C895AFBC76047DE6266F576BDA96ACDC13B61B239ACBA4CC806477C305A3375FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300462, "uuid": "e8009261-20ce-4b94-9228-c4c9d5be5ba2", "value": "24576:3Ou2nv2JyS6pSpVz0//Asx5zAZqhZwnu9TOdhDmZaY965fhY8VXpE8udBTfbDvU1:B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300462, "uuid": "c010f5be-86f0-4b4f-b70b-c106c9aeff55", "value": 1935959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300462, "uuid": "41a4eb0c-55bd-435a-ae07-a2aa6d1af5ab", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300462, "uuid": "3d27a2e8-3861-42e1-9884-ae723193b453", "value": "\u00f6deme makbuzu 1202203.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff52667-aba8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676297758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297758, "uuid": "f1bbcfa0-3d2f-44f3-978c-3518c7bfe296", "comment": "Malware payload (AgentTesla)", "value": "c49840031b2feedc67e64e4472d851fc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297758, "uuid": "57ad628b-4576-4e35-9d74-603e8762282e", "comment": "Malware payload (AgentTesla)", "value": "55feee9337b7e9c4a83a4d45257ffed5c7afd479a0144dc47444bd05f71e9803", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297758, "uuid": "8729c3d0-a7a8-4c74-8524-0b15a31c4b9d", "comment": "Malware payload (AgentTesla)", "value": "8afc913418607659183b720ee522b37125b6ac9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297758, "uuid": "ac057ad0-4838-4ed8-b35d-4ff0a6cd7d3e", "comment": "Malware payload (AgentTesla)", "value": "45bb85323230f66a220af0a88f06453169ac671474f7972ab9736a204f2954392db72d92dd0a16498067bd67b653f605", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297758, "uuid": "d02a42ed-f1f2-48c3-9f60-6c4c0303c29a", "value": "T167F4120B3D189667CA3C82F80E779570D3A1BD24B8B2E3BA1CC6B9DB2275750411675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297758, "uuid": "8de91060-b14e-40f5-bec2-38a23bdb5fdf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297758, "uuid": "06bed968-f584-4350-9ba4-127942092199", "value": "12288:Dh6q6EMdYC0ND571Vd86WhN3C5iTbQjn5PHIj24uXvLxKXjt1RgHPNvwvC3OUceG:DYXzQ57jZY0i/QjGbufLxKTt1KHPNvh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676297758, "uuid": "71506972-7793-4f9c-8611-f30d54295993", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676297758, "uuid": "ac282282-9e44-4319-9800-ad2ef6cb06d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297758, "uuid": "e01149c8-5104-47e2-ba0f-a75f3791638b", "value": "Curriculum Vitae CV Lic H&S Olivetti Renzo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b30ee0b-ab9b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676291818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291818, "uuid": "6eb97dd0-a6f7-4fe7-af6b-9a48453e81b9", "comment": "Malware payload (RedLineStealer)", "value": "f9e6a914aa1c77db240a8d862a685b19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291818, "uuid": "f10aeef9-b183-4873-a607-26be28128384", "comment": "Malware payload (RedLineStealer)", "value": "565533162924f687f1377fe6a28eca17f94c03e40ea1a00b7f3d758538761e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291818, "uuid": "0b84457b-bbe3-4639-a80b-5d35e4505e53", "comment": "Malware payload (RedLineStealer)", "value": "69739135bc9eed02e45c9189b87b6aa0a851a261", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291818, "uuid": "76f89c70-45fe-4acf-a06c-ca205fc26e1d", "comment": "Malware payload (RedLineStealer)", "value": "af5bbafced696acacb749fe3a46034996030e515d0ce3108656b6035372d09fa1944f30cec81c15959aff93ca261fe45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291818, "uuid": "def8ce2a-4397-4c2b-99ac-d2009da14fc8", "value": "T1D0F41207F7E88021D87127B10CF313D71A3ABE516B38826B728F6D692CB27A06575767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291818, "uuid": "41117d5f-bafc-4798-97f7-971237a5d9a9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291818, "uuid": "d6f8dd3f-35db-4779-98e1-d2874ece6172", "value": "12288:/MrLy90ZOlgXhIJzC/zVPSnYsU7KaqVUHeJjd8DrE+rro/KRDH4BzyDg:oyMyJzOVIHUmnBorECU/yusg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676291818, "uuid": "7b62611c-d8e1-41ac-a479-6ec2e6e20e34", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676291818, "uuid": "e3b0b271-2f92-40b0-a541-2de464de7495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291818, "uuid": "3e3f458d-a890-4c95-9e13-527b89a3e92e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840d5a9b-abc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676308315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308315, "uuid": "d3382458-ded0-4701-a6c3-29cbcaed3714", "comment": "Malware payload (Amadey)", "value": "0e2f9e0b1a402f040411147084e11911", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308315, "uuid": "53cc4a07-b770-4427-b6b6-f22d501a58b7", "comment": "Malware payload (Amadey)", "value": "5667b6aa454dab57006a26c1c9b245841fa3b364a5e734925cefe8a872098b8d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308315, "uuid": "a1467816-edf3-421a-a9f4-d7005d07d94a", "comment": "Malware payload (Amadey)", "value": "a7acad3d8a1e7c3f831d475409f09574407f0d15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308315, "uuid": "c15b5ee1-744e-459a-b293-f99eaa540f22", "comment": "Malware payload (Amadey)", "value": "afe792ae7bd2eaae0cf9e05ae8c23297ab7bcff9529da3f8d18a1c87f5819539a7793c0da94f9981e12a5606125e4503", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308315, "uuid": "4ba42fdb-3241-4f2f-b1c7-eabe825e2319", "value": "T107F4120BAAEC5163D8B0637048F303C317367D519A38826B278FBD6A1C726B1E675767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308315, "uuid": "de732759-f26e-4f82-996d-d30bf41f7838", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308315, "uuid": "7225aaa4-c754-479e-8529-53a87226e840", "value": "12288:uMrgy901icp0wUCB8TNH+EMXvdulw2eJCiTferx34lsl3MrodWEv:myup0QYenmuq3orodX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676308315, "uuid": "6e1ba8e6-bb03-4d1f-b889-6e8372763d01", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676308315, "uuid": "98de1455-8640-472a-a208-93314df03203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308315, "uuid": "b364a8e4-561d-4cdc-8d71-ae5ba25ad8c8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc2e781-abae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676300222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300222, "uuid": "cc97aa46-dc49-4013-9328-d11a21e974d3", "comment": "Malware payload", "value": "f36aae38211154a45f16acced7cc0088", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300222, "uuid": "5dd55c3a-ef1d-47b0-916b-0ad9510779de", "comment": "Malware payload", "value": "573f05f4ee439843b61ac337d803bc1842ff1d3bdb41aede40f203388fab406d", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300222, "uuid": "970b44f9-a7cf-4a2b-bb90-7417ebd05b73", "comment": "Malware payload", "value": "e4ce654f22448580a63e17862bb19f4375fd91a0", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300222, "uuid": "7bae133a-7403-48f7-8490-3369bdd17ddb", "comment": "Malware payload", "value": "1d66f5838bcc665d7ab258860e17569dd0339411a1c288bb7aeb13273459d8b884f0493af04685e0a857233feaad6309", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300222, "uuid": "c3934807-5fdf-4695-ab73-438fa1850f5d", "value": "T12F714497EBB0E4BBF91E023F4867CC852BBC7231529327094B74955EA892E103C45F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300222, "uuid": "314ff76c-488b-4380-85ca-6feb42c26f7b", "value": "808b7829622780b812b9cf702c1b652e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300222, "uuid": "6674e32a-c61e-4a99-96a4-718421fec2e0", "value": "24:e1GSSubCW+hlgdFZu92Arbzhnk3JhihnSnyWgcxjXjeydiPnRuV:SSubr+/K8fb1k3JhihnSnZDjMRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300222, "uuid": "8cf68de8-f767-409a-a259-47c11ab8f697", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300222, "uuid": "ba733789-db47-4457-94cd-2e880baea9d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300222, "uuid": "8f7fdcb2-15a0-471b-9243-763b353b3a1b", "value": "No-92005.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f25050-abd9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676318726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318726, "uuid": "289fb601-0a04-417e-9a40-6a0835e503a2", "comment": "Malware payload", "value": "e5516483111786f534cb82777d534a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318726, "uuid": "484f0fdb-3dee-4ab3-ada3-25a7abf05637", "comment": "Malware payload", "value": "57650b5e0766eeeef908ed679d567d75777a5b1ca0dd7a3a6d86ce0f4527ae1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318726, "uuid": "8e694561-24b7-469e-a20d-2db5f74d764a", "comment": "Malware payload", "value": "2df0ea78a4395f1af80eb8580904f0875b499bd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318726, "uuid": "9a24e4d7-594f-49ca-9373-0d00562ad9b1", "comment": "Malware payload", "value": "2bccd58349a9c2fff58edf8ec890bbdfb8ebd25609ad864b206675e13fe65fcc67a8513b45cf42c82d4ed4e4d436f0bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318726, "uuid": "ec37a4e6-9fd0-4fa1-aaeb-0611305eb0da", "value": "T1EAE5127CB146D46DC2C0FEB4883A98F72CD66DE3D9A4A06270C9BF3F52791894A1D607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318726, "uuid": "d20d973b-83ec-4111-948b-42e5e31b0e9d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318726, "uuid": "957631ab-5b43-4185-b84a-e6c425a4d2e4", "value": "98304:JHWkYbxZxF1o4uqGgAMR6y8K4EGerDSbLDVsv2MR:dWkmBF1pvGgQ0ObLuvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676318726, "uuid": "61e86c9d-99c8-4d9b-9870-7cbfa5089b85", "value": 3154517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676318726, "uuid": "90e3e2c2-f7ef-47b0-af08-40860eec699f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318726, "uuid": "515e7a2d-6e08-40f6-9902-d7ed5e7d5f63", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0dcec4-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272061, "uuid": "93d2fce8-c378-440b-b589-7a589741384b", "comment": "Malware payload (AgentTesla)", "value": "d1fb1bd908b3b882b47d78fe17b02236", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272061, "uuid": "80fa1ee1-c15b-4786-af2e-b43c1c3ff95b", "comment": "Malware payload (AgentTesla)", "value": "578aa55f121e6661b383b90b3a8569b10d3578b8d09a0a29b029bd40f034a441", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272061, "uuid": "fc3d346a-4658-4993-bd95-30031b6aea95", "comment": "Malware payload (AgentTesla)", "value": "81085e18c696929d70ebc689e39428790296c37f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272061, "uuid": "420bd361-2fd6-4a46-848a-e1fd3e247ab2", "comment": "Malware payload (AgentTesla)", "value": "451cce2aa75b7df656179f4701ee2606aaf019259c479ca6f22d979ae4d7043917a2aafc015b8658d55342d1da2d0e5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272061, "uuid": "c4b11b0c-1cb8-4ff7-a3d6-f48399658ea9", "value": "T1791523818E6A93F5CC4A1EBAC0F15C79F371AEA240C2D34D9CC1757658B7320B64D9B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272061, "uuid": "b783d6b1-b2d6-4e20-8569-6badf0a42ec1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272061, "uuid": "08024ebb-0259-4766-8c1e-e96ec5534200", "value": "24576:dMRYTynuUNAuQxJ23mavbLYM/ZY6klfIjNWYCRyvBGueD:4m2bUMolfIjCRyAue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272061, "uuid": "6dd8de06-78d8-4c0e-88f2-95c5da766356", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272061, "uuid": "21536e50-91da-4bf9-8cae-74a37e82fba0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272061, "uuid": "68b1c206-b7b3-4b7f-beb9-cc802b7b0634", "value": "Quotation Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7876d96-ab82-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676281423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281423, "uuid": "ec7fb148-b7aa-4466-a3e0-a702745023c4", "comment": "Malware payload", "value": "35b08d29ec098f92aaeffc171eaeabfd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281423, "uuid": "acd15861-4767-4070-a0df-154d4afd1f45", "comment": "Malware payload", "value": "579e50e534a8cb2fb8906071af52f819d54d7ea11df4dbcce5306958357cbb71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281423, "uuid": "2fad447c-9e47-4002-8b48-24e5a6d0157f", "comment": "Malware payload", "value": "321db0a75b35f347c16212b19de6c653a13a412d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281423, "uuid": "987c060f-b948-4a73-b02a-7126881e583b", "comment": "Malware payload", "value": "48deeaa031e0e98c0b3ab72d6fa623a134f451d95067816f55d7d088dcecb669c11f2a3b24a2a3f11c11aebfde683678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281423, "uuid": "8b4984c5-a5c1-45b3-ab45-93360ce3f928", "value": "T1F2652212B9C480B2D5721D392EF68B34653DBC2027B5DEEB53843A2E6E305D09637B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281423, "uuid": "69904fe1-d889-4b99-a5b4-12bbad309b00", "value": "e92b2275a730f59940462780c383a1b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281423, "uuid": "c7ffe72b-e8ad-4cd2-9910-f53f9c769cf1", "value": "24576:YLeTtjJFtHrKx+CMT70M7uMR35N0KP3nrcEZjdk0fW8I8N7an/EUQuvoWV6TrrEq:YLYkxu86/V3nrN/eKpSE+wW8TryzU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281423, "uuid": "a9e114d8-0130-49ba-8635-85673600dc61", "value": 1487209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281423, "uuid": "0391b304-d81c-44b1-bfbe-a3cecdb1d79a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281423, "uuid": "cbd2c470-4113-4072-9acf-2c8f0b04fbbb", "value": "35b08d29ec098f92aaeffc171eaeabfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb4bc54-abdf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676321160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321160, "uuid": "7a63a506-3639-403a-be27-cedd5c602fe3", "comment": "Malware payload", "value": "71de13b2b627f12dedcdb1024840a069", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321160, "uuid": "389e85af-dcfd-4af9-9fef-1071262b7ac1", "comment": "Malware payload", "value": "57d8a473c29df1db0747cf710dbec288a9b0b9d6db7373e74c13ad7a69726b2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321160, "uuid": "685f2a4f-1384-42bd-8bbc-df9a32585492", "comment": "Malware payload", "value": "f6664727fa84515aecd42f58034bf429874e0a76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321160, "uuid": "6a63b188-d77d-461f-8dcb-a523eefa1705", "comment": "Malware payload", "value": "53e47a348112c9eec616faa009f37ee76f64d4abc174ceb6cae6a20d4326c76155b77cdc49cd9e5814d1ecb45f0bb6c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321160, "uuid": "7f9ee075-d119-48c7-b21b-b2f0d4980866", "value": "T10AE5127C7605C46DC2C4BEB5883AE4E71CDA6DE3E9E0A162B0DD7F3F81792849A19107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321160, "uuid": "6c8302bf-941b-40c1-812b-1e1995c96a45", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321160, "uuid": "60923f25-a4a9-4bc1-a084-f5ee2943eb09", "value": "49152:rdHTiUwfVwmLsSAac+rc+DKymbdxSx+2/GoZ00M2Ja8LCgv2MR:JHmUwumgQ7DKymbjh0Muv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676321160, "uuid": "b17480a6-c052-4d6e-bb60-ae59d05dc8d3", "value": 3156932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676321160, "uuid": "6fd93b5b-cbc4-4d07-9254-ab4b656da3f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321160, "uuid": "aa778c2a-01e5-4297-b90d-3100124c6eca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105f0339-ab46-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676255292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255292, "uuid": "51e882f9-2d34-43d2-b056-63d37c1d2eb8", "comment": "Malware payload (Amadey)", "value": "18d91f5db572c9e8233b56ea0ce50da4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255292, "uuid": "53c4ff51-067d-4670-9de6-b5304c4092e2", "comment": "Malware payload (Amadey)", "value": "58611aba1df1f3880192dd30b5258d56530c49ef6a531f6929883b83ed369e82", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255292, "uuid": "d020d9d9-adbc-4b63-9210-85e24979d181", "comment": "Malware payload (Amadey)", "value": "22b1f70f148fbdf1db224713a5e0e5450a4dc128", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255292, "uuid": "660d1b4f-3027-4c5d-8e1a-676c3fcda4f5", "comment": "Malware payload (Amadey)", "value": "464c4c921b6cd86a3975a95eb91b6b346abd7be212c065572c162c80b144acfd571ca8b54dba83f5d43eb14294bb5cc7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255292, "uuid": "ab5208c9-dccd-4518-a015-778b6d956343", "value": "T192F41217B6DC9122E475273048F603D32A72FD61977882AE638F5D1D2C326B4A67077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255292, "uuid": "a4070d00-2fae-4b09-ad05-2e52cad89682", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255292, "uuid": "f25cd57c-96d9-4ae4-8974-00744bcec4e2", "value": "12288:lMrUy90hJ8bERtQ0NL7riV1kx6pAjpeJ88lUn/hjdyaeHaOboXQJ+:hywLQyHiUxYhQ/hjdyaEaNQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676255292, "uuid": "e0759cd4-524a-4ef6-b75d-062ac1fe8c2e", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676255292, "uuid": "35441905-df77-419b-a942-03ac77e2e662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255292, "uuid": "9c357cbe-b8ff-420c-a646-b82e7d9a7552", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63610325-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676280342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280342, "uuid": "5ba77824-8451-4486-b38e-8bad55608f90", "comment": "Malware payload (SnakeKeylogger)", "value": "5734c1eedd84d117c3b93225ff3b80f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280342, "uuid": "b302d875-135d-450f-8387-d8ada88f829a", "comment": "Malware payload (SnakeKeylogger)", "value": "587d7f111c3de0f35aee401c6b61f69103114dc9d65e4c5be1b9ce85f5ebf716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280342, "uuid": "b87918d1-d7d8-4690-83ee-739e59ca22c4", "comment": "Malware payload (SnakeKeylogger)", "value": "5d169c2182c6860745dc99028a1a85c6c8b4d3c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280342, "uuid": "7c718969-4663-4dca-9ed9-77ad220da743", "comment": "Malware payload (SnakeKeylogger)", "value": "4165be26ba974043d531290b595411b3cfb889c144a87dca54fc4bc23d0c24b6e9156bd2e82b1bcb2445e8879e0fb0a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280342, "uuid": "0d43d5e2-3834-437b-b34b-160d4db173e7", "value": "T162E4F0503AAD5B28E57E17F42475B180A3797E4A2A71D31C3DCA71CE0E72B968312B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280342, "uuid": "7905422e-df7f-4116-89b5-8f6f89ec3e9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280342, "uuid": "3b4bd31e-ff0f-4cf3-a5d4-09999fc5a06c", "value": "12288:AzRaCZh6q6/TKPzG7rTOtqWnJ7T+7jzwk1vAuWOzkhjoroBTIQw31:AzRLY/TKPzG73wZqjF6kjITil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280342, "uuid": "eefd9904-2c8b-4147-85e3-e7dbcbad8c95", "value": 663552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280342, "uuid": "0edfdcb6-237d-467c-87d7-54fdd57684ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280342, "uuid": "fb245411-fcf8-4fbc-9ae2-6462fc0da4b3", "value": "2Qr2W1dJY6KubS0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4950afaf-abe4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676323248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323248, "uuid": "1fe94910-5654-49d6-8a64-78d7166f73ba", "comment": "Malware payload", "value": "8f5773b003b13002d089855ff06b7a4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323248, "uuid": "9eb376b3-9595-439a-a482-1a6b5a694936", "comment": "Malware payload", "value": "588a81a924c8b3ccaed316b82323156af4b7766104d9ce2c2a8d2d606bf5b48b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323248, "uuid": "e8d082fb-3439-459d-a293-3a47e9121e85", "comment": "Malware payload", "value": "ffc102fbefa24cd57c75d2870ae8ebc8dbd3a86f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323248, "uuid": "0c10a518-ce5b-4098-8d5d-ad6e797ec55f", "comment": "Malware payload", "value": "7e97a2d965254485dd94827d6d27c0baae39d21c5aa576e17c5fbc3a8e5562f532d5f5c9b99e5bd123c73b05c5ac0e09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323248, "uuid": "551e15cf-88ef-4fed-b8a6-095b9bc23de4", "value": "T106F4121BA7FD8062E9F5537028F502C30A367E515B3482AF27CE5C1D58B1BB4A235B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323248, "uuid": "f122397b-15ab-43e5-9591-d0befa4819f6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323248, "uuid": "02e96598-3997-4e1e-aaec-6b3cd5424221", "value": "12288:EMr0y90XvAO+lVZ9Fd/tVa6yP0P0ZtQeJpG/RCG9ONzVL5twcbBGKnOg:YysvAO+xd/tVhyc8npwDUNZ5tBdZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676323248, "uuid": "3a3ebbd2-7376-467d-98ce-0f2789bae8e2", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676323248, "uuid": "e7e96598-2f46-411a-86ea-6853d54d0054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323248, "uuid": "406319fd-c224-4233-a7d3-efecf7247073", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba3c3577-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676280918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280918, "uuid": "aad7391c-e41e-4f86-bb2a-e169930f5056", "comment": "Malware payload (Formbook)", "value": "054d3ce0c0c82f28547112a82f8ea692", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280918, "uuid": "d6493603-8f83-45df-b49c-da64da66aec4", "comment": "Malware payload (Formbook)", "value": "591ea8c06daef587f239bbaa3d29cb46ccba25ccba58c324441efbaf4c5eb5d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280918, "uuid": "fd356718-7b23-485b-9935-6365fa6cbbba", "comment": "Malware payload (Formbook)", "value": "8c088a60d8f7e66261cca8d4ccb384ea1d9ad2c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280918, "uuid": "3d123923-7f32-43f1-bdac-fe562ce41468", "comment": "Malware payload (Formbook)", "value": "6f0f954fe0b36e1342f181e367271f678b789aa0b3e06ec3c7323c3ab4d3f29243bb296da34842cd6fb63d3ac6a5f17b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280918, "uuid": "bb4a1b56-1451-4edb-a599-94c803f8f7be", "value": "T13E159D1C7EEC0037C33359344A5A4EA854156AF2EE14F8F73D9CD848DBE22B2A47AD56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280918, "uuid": "d820db08-5694-4996-9021-e6b1360b76e3", "value": "1662538b13f763bef491d93c57c319e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280918, "uuid": "4c459a1d-921a-491b-b458-932abb3c7365", "value": "12288:Cb8A+lyMML0gN55kXFyqf0bGBvGoE3IhAf1nAhglR:C4ZzML0gN5WXFaK9GoEHf1nAhglR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280918, "uuid": "a65957ff-ef4e-4cdf-b1a1-77e87c2d2506", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280918, "uuid": "c29a9079-16f9-4480-9022-12e005da634b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280918, "uuid": "f65a6207-5938-4792-8bb4-70517e05fcdb", "value": "SecuriteInfo.com.Win32.PWSX-gen.9780.18189", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f42ccc-ab4d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676258518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676258518, "uuid": "7d5630e4-14dd-45b7-bc6b-2d708b79b9a0", "comment": "Malware payload (RedLineStealer)", "value": "c90a801629f743b1c227dceae96a77c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676258518, "uuid": "04743a13-5b50-4709-a192-af1e219a4952", "comment": "Malware payload (RedLineStealer)", "value": "5926f961ea17cb3eb23beba14dfea26581185ccf5950c4f067335463da397fa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676258518, "uuid": "8c227ac7-11ac-4953-87de-e471c6f810af", "comment": "Malware payload (RedLineStealer)", "value": "e3cb4a61823ec100a08433957b6593be7ef83be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676258518, "uuid": "2799dd23-29cb-48ca-8a3a-164572e89ce2", "comment": "Malware payload (RedLineStealer)", "value": "d974d528e68f704f8e46ce59c96f86120010b46f3508d2015b947e5ed8885ff2494d76eb34991f7763e5821b593058f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676258518, "uuid": "4a46e1a5-8a38-4663-8387-4fa4974aa50a", "value": "T1ABF4121BEAEE4122F9B227301DF203D31A397D515678436B338E2C6C1972771A5B53AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676258518, "uuid": "5f2b76ec-faf4-426c-a322-8a2f0ad73d94", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676258518, "uuid": "c86fec81-c7e1-4dda-8f54-486dd04709e8", "value": "12288:yMrHy903NICqy9jQ7IgbuI9wV1zBRr2yeJ2GvTjGxvSYAsCJaei1ObocL1wNr:dyONIw8fbPwH1Rrc2GHGNlArJaR1lr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676258518, "uuid": "6b9dbbf0-a089-4c1d-85cb-9aa48dfae2b6", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676258518, "uuid": "095e43b7-cb01-4ee6-9e78-8bd9365ec7d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676258518, "uuid": "d2ad5e43-fc87-453b-9259-b24b9c159fa1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39a8420-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676280584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280584, "uuid": "9d75549f-8c5e-4923-868e-3b889bdb0ea5", "comment": "Malware payload (AgentTesla)", "value": "177f599f2d90e9938e85eb59502e7a1f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280584, "uuid": "37693aba-3086-4883-b594-94dd3958f110", "comment": "Malware payload (AgentTesla)", "value": "597e3670e4305971ce03454059d7c49ea1bb9a13425b04c403576cc0d3ffec48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280584, "uuid": "1621b12f-2ec1-40ca-9d6a-cecc287f076e", "comment": "Malware payload (AgentTesla)", "value": "c95f078a9b7a08631b4f28475005fa9351aa8607", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280584, "uuid": "d1d93078-83c2-4435-aeef-591da701bd20", "comment": "Malware payload (AgentTesla)", "value": "cb1b10ee7cf30d4eafe2a0ed6e2d56bd42eafc8250bedac17bb873ef01eba1b1f8db79c7af5f358d63c5f735c1771931", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280584, "uuid": "9f305b55-a04b-4cf3-b159-869c0764a2ec", "value": "T11F151217378D4765EAF11ABAC2FB493907F1BFD69973C242BF083A46460626BDEC2501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280584, "uuid": "e41f8c01-22dd-450b-acf2-7787e86111e1", "value": "12288:K6Y7c4Wp0n2RaEBx2A9wIgEv5Ip1hCCN2+aQT41DBJXFMsC2Ah6z8qhNcri2MyI:6BEF9LHuCS2+hsy5FhAuFMV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280584, "uuid": "7df18231-6ae0-433c-a347-a115dc66b864", "value": 927304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280584, "uuid": "0569408e-e57f-4f32-bebc-1ae272909c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280584, "uuid": "c7d2116c-6d3f-4154-992a-34c1652a59ef", "value": "fedex shipping doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb4f1d9-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676276947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276947, "uuid": "5a4f0052-302d-4966-93c4-8712640c2366", "comment": "Malware payload (RedLineStealer)", "value": "098d646cdfdcc4b6d05fb6802e31d868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276947, "uuid": "0951da25-8a4a-464e-8ed5-377de24e5c08", "comment": "Malware payload (RedLineStealer)", "value": "5a32fda75ce79b29aa79db7446e48f92532e949dd0e4d75de711b53292391481", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276947, "uuid": "6205c1f6-3b6e-4e67-8417-f6b544d7e01e", "comment": "Malware payload (RedLineStealer)", "value": "593c6c5484dae87f97b261174e8aa8a62e276008", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276947, "uuid": "d813e0ac-c25a-44fb-8bdd-43a130538a4a", "comment": "Malware payload (RedLineStealer)", "value": "551263ee1b833feaba7279dccd05b568e25045ba9d7190d870d924c3d8b837bbcf625a1857df455dfb5b7954f8323318", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276947, "uuid": "567e71d9-4b40-49d9-a7b0-ee0ef47bb32a", "value": "T1C5F41247E3F84422E8F5577059F743D31E3A7D629B7442AB364EAC291872270BA343A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276947, "uuid": "428a6ee7-60a7-4aaa-9735-b1115da11567", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276947, "uuid": "5b5b7e6c-e27d-4091-8d31-8d2859434319", "value": "12288:zMrVy903ABVLfSfien6sNjSeok388bIZIPt9ygere3eyBrR3:6y1VJenJ5oe88bIZIBeabrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276947, "uuid": "8acd6c51-162f-4507-8b61-5dbd16e5d2b1", "value": 737280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276947, "uuid": "40d0f33d-b1dc-4500-a41c-d2bc37a04e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276947, "uuid": "7659c5fc-7167-4c44-af50-f764b7465c8c", "value": "098d646cdfdcc4b6d05fb6802e31d868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "467520f6-abdd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676320237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320237, "uuid": "a719ba40-41e2-4c81-9f0c-2550d7a01439", "comment": "Malware payload", "value": "0ee2990a10ecaad58f764029a4d2f531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320237, "uuid": "9d6835b1-a075-409b-931f-b39c53a34ca3", "comment": "Malware payload", "value": "5a3939b015f210933a85716d810399ce3ab24d39f1de09edd358a0418343498c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320237, "uuid": "ffd2cae9-6c48-40f6-b35e-2dfd07694a99", "comment": "Malware payload", "value": "9ff1dcc93e137ab3568494735ea3493401c581a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676320237, "uuid": "083a89ad-95d3-4d05-9749-3e600ba7211d", "comment": "Malware payload", "value": "bac646764377dfb86885159d8a2e0854ef97f1d1ed98c7224690170884aad31f1d1a64100faa888555055a708d62e111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320237, "uuid": "2c8752ed-8b95-473b-bcf7-b378e9588047", "value": "T1CB04CF1333E0D431C56216319D69E2B53A7EF8225AF8AA8B37D81B3F0E703D19A36355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320237, "uuid": "bbaa1917-6c8c-456e-884d-57b3febc1476", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320237, "uuid": "52ee818e-741c-494d-ad63-094841d9ffb9", "value": "3072:ZKqPtTtEO7eTVfds4c+CFtsRs9wIOprzaTk5pXSRo2dpq/Ow:ZfP5S6eTVfG4mCs9apSTk5pi22z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676320237, "uuid": "d6f4be54-b681-4103-bcc1-c21bab292875", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676320237, "uuid": "4cd86dfe-eaf0-43d0-9587-8c493a83de0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676320237, "uuid": "1ce6b5d4-c029-4b07-8b80-cfe2483d7c23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d8d325-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676280701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280701, "uuid": "fdc88039-bbcb-4935-a14d-f700e04861af", "comment": "Malware payload (Smoke Loader)", "value": "b209283b35ce5990f08a55c45a6c9c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280701, "uuid": "f6c9fddc-c4d0-4d54-b583-2cc7eac96f8b", "comment": "Malware payload (Smoke Loader)", "value": "5a69e476d7419a489ff51b3655cdde91cbe0fbc47c1e1e3cfae08ed184d73776", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280701, "uuid": "142ed481-d3c2-4c2e-abda-82fff1920122", "comment": "Malware payload (Smoke Loader)", "value": "8fe7e7443d78afd1dafbbb12eb6c870927404cec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280701, "uuid": "497c0d14-74e9-4bc5-ba51-f01a2b6d3035", "comment": "Malware payload (Smoke Loader)", "value": "e2714d532d5e89f3bc1fab16d2900ef3934d2716698da07f4e0a2f84f619a2db70b4c903bbefde99d01684381c0d1e0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280701, "uuid": "12dba7a7-c4a0-4a80-800b-cdc4af252c20", "value": "T18614CF2372D0FC72C47256305D39C6F12A7EB8B10D79A9AB3758262E5FB02D1B676342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280701, "uuid": "2820ed93-3e26-4092-a7ad-8a21dc380f43", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280701, "uuid": "8265784d-92c9-405f-b44e-ad6a932b7f8e", "value": "3072:kzfQlve++3JN/K9nlTC3WrDj3vqhk9s17Qo0c+eigY4MU3M:kzf2vkJlKVlTC3W/bihk9shQY+ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280701, "uuid": "bb28e32a-883a-4989-8429-dcedcda1563f", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280701, "uuid": "5b64f0e7-0430-47d8-b83f-4c205fa6ead2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280701, "uuid": "972e62b7-fbd8-449c-a47a-b46f500583f3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fe74de-ab41-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676253523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253523, "uuid": "1411b2bf-82d0-411b-a76e-689c1c6f6bf3", "comment": "Malware payload", "value": "3dfd3c72b912a9be3d64fc23c1e3de88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253523, "uuid": "eeecb303-1a22-49ec-a6fa-097181fef730", "comment": "Malware payload", "value": "5abefe3745602bcfa13738f1cc2996abec9cb380cb3643e8f647711a9c0f4f25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253523, "uuid": "089e33d3-74ee-44b8-ac20-5ddb36e0725f", "comment": "Malware payload", "value": "3252bb0e12e467beb500949bdb8d49d62145e603", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253523, "uuid": "4e199f84-2edf-43f8-ba9c-c5236255baa2", "comment": "Malware payload", "value": "01d2e2eda3bd38353698cb356a65e98c11ed4bc4d2f74e92244e47acfda5adad92a34a39ba5206e498a6b6e394e9ab84", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253523, "uuid": "15ac39cd-708e-4756-a8e4-d57c16102e91", "value": "T114449D2B3787CA8FC2027A3C55B9DB39B0ED8D883D9BCB81EB717955A335E541843291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253523, "uuid": "b2331208-5eee-4aaa-b28d-1ba49722848d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253523, "uuid": "ace655aa-6c6c-4e4b-9948-375bd56e80a9", "value": "3072:Tyieq0EpONHalFd8zE+jq08zRsONc7+yfbS2VG0qHkoBTqfsQSA1l64GEx7ft:2pnEkNmn8zEHcff+0UUtB7GExb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676253523, "uuid": "88bcf6a6-f0cf-4987-9bad-1baaac4d3fdd", "value": 264192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676253523, "uuid": "6a60d648-a1be-41e4-9afb-6f89125c4b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253523, "uuid": "93663d59-48b3-497a-bd9f-ee119f690c6c", "value": "WPSupdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee8396f-abfa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676332734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332734, "uuid": "f90a4d1e-842b-4139-93d6-9bd9cf24147d", "comment": "Malware payload", "value": "4ee75ac3e96665481b677e96ad4fc6cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332734, "uuid": "44571c34-3397-4824-ad0a-f82e57fa2f78", "comment": "Malware payload", "value": "5b2fdeed792a48f934ec70eef7746ff8b476b52c11f5638c2462081fda979e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332734, "uuid": "97df0822-7d03-4f1c-adf6-b4630c53b2b0", "comment": "Malware payload", "value": "5e811c1aa930bd5433275b5749e44f0e3f496fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332734, "uuid": "d6717c94-16e8-4bba-aad5-8058a07d8d8e", "comment": "Malware payload", "value": "e342439465cf12d3bb5050e667cdad151b8f9fdbf296f3c5d5424b2e218370673f6b45f7d017bc76a427f483165a151f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332734, "uuid": "3a7e730b-fca1-42be-91ea-9a4af313bb7d", "value": "T1E7F4120BF6D8D423D8B457B058FA07D72A39BEA00675865B138EBC564C327B4673872B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332734, "uuid": "050197fd-2be3-4d19-a530-0228707f6642", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332734, "uuid": "cf24b4fd-befa-4459-ad7d-3a441a45f5f8", "value": "12288:VMr9y90kC+jNF2FdBzjhFs44QEOZQeJeLT9VXK3KRRe3tPD6Qu21GlKd9:0ygiIbjhFz4QEaXRP+QuK+69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676332734, "uuid": "f2e327b9-0fb9-45db-b414-e6b0d29d6e97", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676332734, "uuid": "1c8796e5-c56f-41eb-b811-166fb78fa19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332734, "uuid": "d9cd1bcd-a47f-4d03-988b-2f2ee007a96b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066cb74d-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676284481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284481, "uuid": "62b12bc4-aadd-496b-a29c-06d52390d806", "comment": "Malware payload (Smoke Loader)", "value": "2b77da2883f79c255f9f29cb40873e19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284481, "uuid": "27a863f1-7313-4d08-85df-8df3b12a7f6d", "comment": "Malware payload (Smoke Loader)", "value": "5b3b2cf72c20b3af56ba40aa517ab25b3e12a0770888b11564ad0a6a22272d25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284481, "uuid": "323c848e-75db-4645-a882-3562b09b8277", "comment": "Malware payload (Smoke Loader)", "value": "c3f4a9bce6de8adde56b3477ef0109bcae34fcf5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284481, "uuid": "f1ece064-38d4-4d00-a55f-a6d763746013", "comment": "Malware payload (Smoke Loader)", "value": "3bc27a35e88b8a040ec71213ccff084795f80e706da501a50bce99431f50b34db8def44266fdd3d31bcb39a8e93514a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284481, "uuid": "13d754c5-a309-4f35-a3eb-300190a5218c", "value": "T12014CF1332D0E472C5721630AD78C1F57B7EBCB14E75AA9B37581B2E1EB02E29632356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284481, "uuid": "dc1e2736-191d-4be1-afc8-9190b46eee47", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284481, "uuid": "5391c1bd-be2d-4459-b625-ba0fefc1bef7", "value": "3072:Xrkb60+nPUKi5SgnGHi4sKM/lgrp3EU8nFTUzM1bxOr183:Xrk6UKGSgnGHiKN0U8nZaMm1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284481, "uuid": "85b52e72-0eed-4b66-bf91-d4c98d521ab5", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284481, "uuid": "3fa88d52-f595-4b8b-a7ab-e389bbed9774", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284481, "uuid": "ed6fdbe6-5928-4b3b-9956-fc21332cbe85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c13ae5-ab64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676268185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268185, "uuid": "66c6ca63-f0c7-4848-b1b2-729f0fb3aa9f", "comment": "Malware payload (Amadey)", "value": "f523c9695d8fb79d588ff67eb4dd6d5a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268185, "uuid": "3e9b4042-a959-4ce8-b3ba-c7fa5d01d211", "comment": "Malware payload (Amadey)", "value": "5b71b18cd140c2046ebcf0cc61535db7320d0b1e5cfc2fa7f354fbb518554b6f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268185, "uuid": "e80b9abf-1d2a-40e4-8cb0-b7ceb8b50811", "comment": "Malware payload (Amadey)", "value": "e2a12dc9d49378b06ddee895f18384fae02de6ff", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268185, "uuid": "255dbc3d-72be-4608-b27e-6624b6e3e230", "comment": "Malware payload (Amadey)", "value": "2ac9dfdf48ba4b236af7c6cfff34f33cba156bd5a64f1f73e520140c8dfca1a9753b4baf2c9ad333ac53829effdfcdd9", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268185, "uuid": "107ac15f-573e-4f24-ab6e-8f6f9bca8e89", "value": "T1A6F41247E6FC9272E9B06B7059F607E32A757E625734839F278FAD191831570A23032B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268185, "uuid": "e20bfe0f-3c51-46be-9558-d95e9cf57488", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268185, "uuid": "db3af5a3-fc36-49d7-b3cf-aa87e5a8410c", "value": "12288:YMr7y90xw97eFoqd8z7LHhTceQ5BkeJ3mXI+QPBI3pYZp/r+MFa1JN:zyuAcoqSLNg5zW4+QPBI3p7/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676268185, "uuid": "0045bc19-eb9a-4fa2-9096-e0e8863fb3aa", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676268185, "uuid": "7c8de75a-3db4-46d3-a43d-597877522f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268185, "uuid": "d570b5bb-9ca3-4ebf-a45a-e408bc2f5c4d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2ea01a-ab9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676292626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292626, "uuid": "72a7a2a4-8668-4ddc-8bbb-82f524699746", "comment": "Malware payload (RedLineStealer)", "value": "7d122a65e3415cdbe6de5c679aefb4f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292626, "uuid": "2e36f546-ad91-4a70-ac7c-249bba5bc2d3", "comment": "Malware payload (RedLineStealer)", "value": "5b7382e4b6cd77bcedc1289ce1950b9b4e8ebf515b2019c9aaeaeb23f5bbd06a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292626, "uuid": "b665c4aa-6103-4a93-a8d4-5c29d6cbd559", "comment": "Malware payload (RedLineStealer)", "value": "b5134873c2813dd47a6f74ce8d65275057d2e8f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292626, "uuid": "596d5482-f23b-438c-b95b-bbdb40d00c3c", "comment": "Malware payload (RedLineStealer)", "value": "186052fcd1012bca8df922a996eaf1ec0d6b94b9c6402dfbe1bac1c52d40afb975c72528d7910e0ef6aa5375266d6237", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292626, "uuid": "15a1d610-2eec-4510-a1d0-54cc8910c676", "value": "T122F41207ABEC4071E87063B108F203D71A76BE509734835B27CEBD5A28727A4E57976B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292626, "uuid": "5dcfaa36-8586-403d-9143-487a2d3553a4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292626, "uuid": "1359afd3-484b-452c-85d3-643d2b72ca3a", "value": "12288:BMrEy90VheS4lQm3wU4bR/BtaIQYtkaVeJPSz4IiurppAbrroQSRb22CFIo7Q:5y6kS4zwJ1ZtdkVPSzDiurpGUQaS2ho8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676292626, "uuid": "3daf826f-a6aa-49d9-a1c5-839f5b2135b0", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676292626, "uuid": "765ad0ba-05ac-4f10-b64c-84d9d59a5f6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292626, "uuid": "243be3e5-a074-4daa-8195-bd45df29cc36", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6ff224-ab60-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676266671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266671, "uuid": "d5d85701-d1a5-44b4-8876-ec33fdac2d37", "comment": "Malware payload (RedLineStealer)", "value": "ffb972be3680d20ead316b4baccff9c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266671, "uuid": "af973695-35e0-492a-b547-89b2f40d027f", "comment": "Malware payload (RedLineStealer)", "value": "5b8aab7616dae7258b0917abeea65b3f3d5bfe38f30a8796a3a040f7601537be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266671, "uuid": "caa6abb4-3f08-489e-ba9d-17dc68e21bf4", "comment": "Malware payload (RedLineStealer)", "value": "085a4ac0080d65b8b90240fc773b61e83ba0d766", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266671, "uuid": "cb25c3ae-db31-43c6-be14-37c7f8b02534", "comment": "Malware payload (RedLineStealer)", "value": "1713a016ea8dfb4ed7282a53ff244de9ad98013c6edbd807ce4882b7326e7b716e129cd7ec0c018811968df1d5efb710", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266671, "uuid": "c1f84a1a-e6d7-43bf-aefb-517db90a7659", "value": "T198F4130BEBF89433D5B1277059F603D30B367DA14A78835B638F6D9A08726A0B53671B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266671, "uuid": "bfc5ce1f-4891-447a-b9a5-017eddd7db9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266671, "uuid": "68afa328-e60e-4fd4-8589-584b59c33a8b", "value": "12288:cMr6y90HpkxJCKBpwkOMURwn57DVeJFqQxREtPUH3uaakPNHe:WySoBqH6nBCFqJtsH3u9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676266671, "uuid": "ba8a521d-e3fc-4329-b2b2-2bb9472f80c5", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676266671, "uuid": "78ac1900-8a4a-4bf6-b2b6-3e608a50aeac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266671, "uuid": "eaa9cb8f-bf49-4aaa-b875-810bbf7bf263", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d9b84b-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676299756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299756, "uuid": "260570a7-54fb-4470-b397-2291ce5878c4", "comment": "Malware payload (GCleaner)", "value": "353b10864f15f898b3cd5f10954de428", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299756, "uuid": "63992806-26b5-496f-8ada-ec9de8fbf1da", "comment": "Malware payload (GCleaner)", "value": "5c0b0fcd7687469fdc31911816751aecb6706ab06216757543393ddfc4d65134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299756, "uuid": "b5963b5a-7d41-4acb-a872-4c08e737580f", "comment": "Malware payload (GCleaner)", "value": "7299c372175022fd23998de8cedb2296fe66d7d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299756, "uuid": "e0629a93-a123-4c2b-937d-635f0473f281", "comment": "Malware payload (GCleaner)", "value": "7f0199e16ccd3bce194336ec3da9a5a537bc492bb5a25c4f62373c38f2c0b1270320f931de5b308695dbfd94282356eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299756, "uuid": "330b4f33-1421-49c0-8c3c-7f6fb10905eb", "value": "T1C8E5123C7145C4AED280BEB58C2AD8F71CD66DE3E9E0A52270DC7F3F92795885A1A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299756, "uuid": "60928c54-ec11-43c6-af39-3ec7580b5066", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299756, "uuid": "1b119165-d2a3-4e7f-8d29-0d589fb99a12", "value": "49152:rdHtA4twlIVNhpqVINz+Kd6mvgFPjcBjbdozmRHokfi0EbA2hraroj7t9k2QfS0u:JHm4mkNvqVIZ+Kd6m42bdoLkfKbA2Ar6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299756, "uuid": "429b0df8-52d0-4f23-97d0-2325cd59dd20", "value": 3130712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299756, "uuid": "7a314518-7c7a-49ba-bcc1-34fdc60ade5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299756, "uuid": "7d198df5-1bf9-419c-b979-3fd7d3687ee8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fae1763-ab8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676286403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286403, "uuid": "f0baf5e7-4a74-410c-b2c0-24abd9739ad9", "comment": "Malware payload (RedLineStealer)", "value": "de4cf8467397769c3bf0b2f1856771ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286403, "uuid": "d4b306e3-412e-41bd-ab36-00af0d7e88c0", "comment": "Malware payload (RedLineStealer)", "value": "5c96e02d91be3c02bcecf2be1d55cdc11aec2e5a5933224d2808f28476ed0c72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286403, "uuid": "dbe1225d-5023-4154-90e8-f736eeda891d", "comment": "Malware payload (RedLineStealer)", "value": "3e7cfeb4cdd99748c92c151e4211399844dda948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286403, "uuid": "2c543853-8276-4711-b46e-49916d917b9f", "comment": "Malware payload (RedLineStealer)", "value": "43bc3895cd3c2d5a7f7c69c00a71479c02837dbf7ef71d521aacfead4baa2943a90722da47813380e4be0325bf396fb5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286403, "uuid": "49f0cb34-b4d8-4d0f-b14c-4cdb7f3e3be2", "value": "T1D764E01333E0E832C43606315E39C5F0AA7EB8715E7465AB77981A2F5EB02D29A77346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286403, "uuid": "cdd96127-8aeb-4cff-807e-227b17f20f28", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286403, "uuid": "38e0ecb1-48a2-4748-a025-a5aefe6865cb", "value": "6144:LvPcTwIqmwBnQGfTeZpbFKRD0VYZefkHkZOY9VDrPdo6duN7HNrlJ7:LvPUTYBnQGfCZHmN8rxq6du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676286403, "uuid": "4bd7ddcc-7614-411b-87ec-daffaf3cb961", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676286403, "uuid": "34553038-44be-44b6-a01e-68b8763b5352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286403, "uuid": "88b63bbe-747e-4bf7-8f7d-cf7d5ce802f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea6a47e-ab82-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676281328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281328, "uuid": "7d2552db-6832-41ca-8f95-12a0a4be9b19", "comment": "Malware payload", "value": "a004decccb1b30f4f20e02ed63e5f9bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281328, "uuid": "4c5b3aa3-7025-46f3-a1df-ee812ffbe7da", "comment": "Malware payload", "value": "5cac65d30a2180221aa4b248ff2515c66cd9309f8cec6ef0ddce1e87757a2fbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281328, "uuid": "2bc82fef-7368-4ece-985b-f15c8dec1e5f", "comment": "Malware payload", "value": "596597bce16f3742a3a6fe8276dd8b546465c96e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281328, "uuid": "864dadf7-c98d-4744-9c60-1ac925b1caef", "comment": "Malware payload", "value": "a8db4dea736ee473d1353309bb7c323280029de2059f0b787896a8dd4264bd3ac7f21235fc2a2352d192861907415404", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281328, "uuid": "61f29f52-651a-41c9-bcfb-d57a45e6d6ae", "value": "T180563382B140C8E1F86F8239C49209F9D7617C26C366E60B16E4BE673E772E15D37B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281328, "uuid": "ddb4d3f2-9dd0-444c-a4b5-d7e9cf9b879b", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281328, "uuid": "c440639b-5d30-4b16-ae1f-306bedbc3e51", "value": "98304:8OIjD1azb71QGQCPDbZfzuOqV6lORkBMjq86uUTWthnddv7k5DIig:8Oa6dQmRrdA6lakaqdVTmR7DyDI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281328, "uuid": "0894802e-7637-4fb9-a346-435550c8d8c7", "value": 6124149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281328, "uuid": "7d3ebd71-238e-4149-a4b1-b02ae792f28a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281328, "uuid": "ee6cf6c0-e7c4-4207-ab48-7312ce76a305", "value": "a004decccb1b30f4f20e02ed63e5f9bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ab3748-aba8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676297759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297759, "uuid": "41650c89-fbc4-498f-bc57-0b7973c6af57", "comment": "Malware payload (GuLoader)", "value": "8566f250323d019e194a8d06e8145eb3", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297759, "uuid": "2b5530a8-c763-43c6-8fef-7ea544a02dd5", "comment": "Malware payload (GuLoader)", "value": "5e04ea315ad3b90a431ee7b51dc7d06128f0868518cfcfc5e4f6ed8cb4902982", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297759, "uuid": "ecc19caf-2c29-4a1a-98cb-98aafc4540c4", "comment": "Malware payload (GuLoader)", "value": "8532f545933a23ccad71e6ac6953b605df609a7e", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297759, "uuid": "db463ead-432a-4aa0-8eef-fa06358d6953", "comment": "Malware payload (GuLoader)", "value": "4cecb319c6df9d8c62b681e9e34ededca84aad86ad8dca227e47946039e241974d9cc087ab4d632fcac8107578d6be7e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297759, "uuid": "dbb2ad28-c496-468f-9b12-6ec0ebe26e30", "value": "T1CD336A508F460A44DF0A1FDAABC268B7D7274D312426873A3CE75FBC52E664C927B706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297759, "uuid": "f02e98f1-4ed6-4176-896b-2b2eabb8a1a4", "value": "1536:KHA3YSlpGtiIwN0eC6b5pivZkFwjYkRakQSAHkxhAToN:KHA3YSlUtyeeCm5cvZkajJUkaeLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676297759, "uuid": "5ea9a736-5146-4b18-9d59-5bc9c303e9d7", "value": 52858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676297759, "uuid": "0fbfb266-f672-4fbf-b6ac-dc2e4f58a26a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297759, "uuid": "21a8d119-4b88-43d3-9cb4-cc6c59b2ce4c", "value": "Produkt nove\u0301 objedna\u0301vky.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a02dacbf-ab31-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676246514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246514, "uuid": "3c5dd542-4391-4652-bab8-cbb9a05124d8", "comment": "Malware payload (RedLineStealer)", "value": "1871c14dc052525b8e35bfde1403b275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246514, "uuid": "1d9254e4-78f0-4717-b692-4ec2235c968d", "comment": "Malware payload (RedLineStealer)", "value": "5e631043ee4cf9fd2bb14482a02a18c27418a175a56c1f0602b5a04ffab9f5db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246514, "uuid": "14d6f774-e28f-4bc7-a483-27fe9cf98d77", "comment": "Malware payload (RedLineStealer)", "value": "cef5fc3c8b6deff7b38a755f26fff7c95131d01d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246514, "uuid": "c981b57e-0670-43fe-969b-f033df732496", "comment": "Malware payload (RedLineStealer)", "value": "cd0efc1da653ac52759c4e8e50d00950fcfd7ebd1fe774fb045530997f1ba0213b4cbe8174976b5198f306cab2d2576f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246514, "uuid": "adfc916a-19aa-429a-9577-6441c988b3c9", "value": "T16F54F1147AA080B7E6A38638693DDAD07ABB7D316BF5CDCB32141B5F1A305D18A3D316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246514, "uuid": "21ef2f23-1ced-45c1-9b2a-7d21f3276886", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246514, "uuid": "eb521f0a-dddb-4d67-b595-4538facb0613", "value": "3072:T7cZCiL5H3UxyXs2tHWT3YWMgsfGLJk25NlnvyxDgPPUaFu+nUsJpdGVIwyZjjus:sHV3UgXRNKJOen6W0zWN7d+UWCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676246514, "uuid": "b97beec9-0bda-41a5-a5cf-10f4f9109023", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676246514, "uuid": "936befe0-3591-4734-b0a5-62d0c679ca97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246514, "uuid": "a131db1c-23f0-4569-8693-43bbf9bebba1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed78cfdd-ab8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676285728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285728, "uuid": "62d9b719-459e-4931-9980-c9cd1eccea1d", "comment": "Malware payload (AveMariaRAT)", "value": "3d1e8f56e5e88d555c6290118fb998c4", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285728, "uuid": "6828432c-4953-4213-addf-f4c1e7861edc", "comment": "Malware payload (AveMariaRAT)", "value": "5e777ea6208a9e3819ce079fca5d8ad1d8f818b20de8cda1f6c2fa867e17aac9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285728, "uuid": "9d465546-0ab5-460f-a0ce-dff3dd1fff22", "comment": "Malware payload (AveMariaRAT)", "value": "c7024ea5d5169c859e88bc6d3670b2cee1b1c7bd", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285728, "uuid": "1e1327a3-f305-476f-b0a0-ddfcb6a15dc4", "comment": "Malware payload (AveMariaRAT)", "value": "16a3ccd28c7c4204d876021eff0e6c13867559e891f723291fcee3b493172a7a4d525571c89da59cd2d513cc9b0ba1d5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285728, "uuid": "0f4b64c7-c443-4a41-8f81-0ec78a27747d", "value": "T1AD3412A677D0C857D8A14B322F7E160A5B9FD61488F89B1B2B805F8CB936441DF2D317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285728, "uuid": "24a26df7-0234-4b59-ab5b-f03b50fb5cdf", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285728, "uuid": "2c0d9975-8ae1-4cda-baa8-8d822c721903", "value": "6144:4Ya6KDmzCR3DYpxOziUEZ31FI3FHP6SIZS59NoYRj:4YMWC9DWO+UE11i3F5159N1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285728, "uuid": "b11552a9-d2d2-4a99-900e-382ee067a83f", "value": 245098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285728, "uuid": "963a0c56-13a5-4a8a-b1a4-5d1ffe84a253", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285728, "uuid": "729de3e2-02a9-4a10-917d-98b1d82fafbf", "value": "productinquire.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ccc8df-ab3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676250785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250785, "uuid": "b8df09e2-9a93-4b92-9222-fd85bca94fea", "comment": "Malware payload (Mirai)", "value": "d3d32fdba688da347f0ba95456bb48e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250785, "uuid": "7844aa15-061c-496d-931e-58c77fd91776", "comment": "Malware payload (Mirai)", "value": "5e77bd6df03e8a49773bb2463fba07c0086780bdb281df2a0550763a7e130627", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250785, "uuid": "fc53bcd5-5218-4759-b58a-a4f3d182d2a3", "comment": "Malware payload (Mirai)", "value": "ec802f8254f4b1ffd6e2245e3f2347e1b362ab47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250785, "uuid": "b995f7dd-62b6-4700-8696-62bb6000a07c", "comment": "Malware payload (Mirai)", "value": "77c72ff71f49c6ad818353a020057c0a434f4a53bc512e629b1f279edd5492b35a9d24581a50e7da05147d7b404a8f4e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250785, "uuid": "720aba13-30c9-4c44-af5f-4f8c0c51af64", "value": "T181F2F12280D1B891C0EE647BBC6F7E6E09A4361FC56411F5CF826235BEB1F9585DC2A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250785, "uuid": "a1ebf150-eca8-4b29-8b7c-15775ee0a6a0", "value": "768:F9wZNEwkqftLfKDJ5+e7Ibr/hjRU/3SuAIWnaMFiwmhvCgnbcuyD7UVyqa:FarZZ1W6eINd6WnxAw1gnouy8sqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676250785, "uuid": "06d2e1ef-fb14-45bf-b0fe-596b0ab17cf6", "value": 34500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676250785, "uuid": "61c3ba34-3d1e-43aa-ac29-db84e154decd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250785, "uuid": "0d13509b-2c5e-4251-9c46-3b9e790640ab", "value": "d3d32fdba688da347f0ba95456bb48e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdbc4f88-abe7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676324759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324759, "uuid": "27d64e6c-d48d-4197-933b-02347ab64808", "comment": "Malware payload", "value": "b981f199391d880b758f287e3bf8ff62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324759, "uuid": "7de536db-fdc2-4727-ad33-50958c31c35f", "comment": "Malware payload", "value": "5ea63b30fc55d4aa746d392b2cb73f4a6cccd6776c11e5f7db8c5c00f79c73f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324759, "uuid": "367430a9-c957-4fec-8a3d-45e27a116182", "comment": "Malware payload", "value": "24410e5fce52847419df4b3511621a97f23fecf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324759, "uuid": "f4f80250-81b0-4d75-be5d-8c5ba5474636", "comment": "Malware payload", "value": "3fcca2decf9f7e900f78ce72233ace746c1d4def4f678b557f3f3e4713137919ee3518355e46b4e4d1c2c0d67fe8a411", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324759, "uuid": "dc34e40d-9da3-41a9-9bd7-68f44ee82887", "value": "T125E5123D7515C5ADD584BE74883AC8EB2CDA6EE3E9A4A52270DC7F3F217D249830A113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324759, "uuid": "a70a4768-b02b-4904-a73e-130726c286c2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324759, "uuid": "8c55a51e-0c6f-4d3f-a567-660406941968", "value": "49152:rdHhEYT/DKc3uNBSocaM959aBf4EuGXJ3AxCqPPjrQ0LUiKcfikEF5opGFdDDLCU:JH2YT/mYaiswJ2wQQQ0LUjkeocHv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676324759, "uuid": "fc8d5a14-2d4b-4b7b-a7de-8ea6cbeaf4bb", "value": 3314011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676324759, "uuid": "3d165341-2925-41f2-a505-de87ebdbdcd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324759, "uuid": "a03c2dde-af9a-4420-a051-1444c55b97c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "846dd2f4-ab56-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676262359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676262359, "uuid": "56363109-046e-48b7-9bea-c10d9a793964", "comment": "Malware payload (RedLineStealer)", "value": "c30f3c77e1f6856ce033f844a8683ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676262359, "uuid": "8ac06059-a280-4fc1-adfb-024d7bdb0733", "comment": "Malware payload (RedLineStealer)", "value": "5eb5dd599026a1cfc270901e804464e0be7a5e59a5d75a365434631760a952af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676262359, "uuid": "f39e03b7-6d90-43e4-ae5d-a06e251af738", "comment": "Malware payload (RedLineStealer)", "value": "8465171cf07a0d14cf6c1dcb619943b1820fbf12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676262359, "uuid": "f44a7dc0-c6ba-49f1-bace-ca5e4851912f", "comment": "Malware payload (RedLineStealer)", "value": "025f2a13d2c5ca0de6945ea7196d071c6404e96499a009b4755289f369d035253813d2eb8b28819e6f340e92f84ed69b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676262359, "uuid": "938e5514-6c98-41d5-a84a-8048a11b498b", "value": "T1F7F41207F7DC9022E9B5577058F603E316357D725F7082AB238FAC991C726A066347AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676262359, "uuid": "b53582ee-13b8-419e-a5f8-b0b97d471ef7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676262359, "uuid": "a4db739b-93c4-48de-a171-42116c074062", "value": "12288:GMrNy903WwMVqKKFs2xqIeUW4aeJg+faHRYMgSFeTyNarAv:rydRVqyBNUWugxHPgVTyNa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676262359, "uuid": "1591fd05-8718-40bb-a5b3-e0e5e43005b2", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676262359, "uuid": "3e6c2268-7d5f-4ff0-ae04-b1df584bb027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676262359, "uuid": "ee7e5463-fd63-4b30-969a-5f65af234f0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ea3cf2-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676251493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251493, "uuid": "8fedc16a-6ae8-4d91-b0fd-82824e54eb5f", "comment": "Malware payload (Mirai)", "value": "63ccdbdbe414795f99908a7bb7b9f8e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251493, "uuid": "fb91cfd4-42e5-4adb-9425-a5d1585b637d", "comment": "Malware payload (Mirai)", "value": "5ebd307e86d4b81f0f20ab7e4ea084ceddb84e940c3b6360ae09cdaec796fb78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251493, "uuid": "6b16593e-77b7-44b9-ac66-55ce2f656986", "comment": "Malware payload (Mirai)", "value": "d6d8cd2bf322aafddb1702c480fd0d9859724fe8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251493, "uuid": "38a96913-5bff-4368-aaba-a02c302cdfae", "comment": "Malware payload (Mirai)", "value": "b3eb7c6b3e9d3f96713b7e477f9299b7620cdbfcfaa43d97ce05fe9e193c2c3b0aa96699a529e30f1ab339cc514d76b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251493, "uuid": "02746b3d-1da4-4612-b530-705c2f1f8498", "value": "T17C03F12030902563E5FC6EB4F55210076A5E1BBAD1B73119D51D89E0FBE711BBAFC742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251493, "uuid": "19a97322-763a-47e1-85d2-d5c56f388d33", "value": "768:vZ5lD40jauSiVpwto1hGcEHL+2OjwSR/Nwqz+C32mhMoaqRq3UI03:xHTauZVpw4GcEr+2OsSZK5s2qMdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251493, "uuid": "adbeb6ed-af04-44ec-be1a-3187d825dc59", "value": 38568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251493, "uuid": "a23fd7ca-cc82-4b13-896d-7dff4ba80320", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251493, "uuid": "4e27f2b2-8c9c-42ed-8c65-f355b20bcead", "value": "63ccdbdbe414795f99908a7bb7b9f8e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "186c4b80-ab83-11ed-88f6-42010a9c006e", "comment": "Malware payload (Nitol)", "timestamp": 1676281505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281505, "uuid": "342ce867-47a5-4bdc-805f-1c8ca2700402", "comment": "Malware payload (Nitol)", "value": "94a47b128536d0104ca69e11e170e960", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281505, "uuid": "086132f8-03ca-402f-89ce-b87059eb0767", "comment": "Malware payload (Nitol)", "value": "5ef75cab5654d09db58080a7b4e566057f23601b509e8dff460fbbd511307655", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281505, "uuid": "454188cb-5307-43a1-9e51-e5eab06ea293", "comment": "Malware payload (Nitol)", "value": "7e5ae8b66cc43820a3f78e848af6a959fa62bf97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281505, "uuid": "cd982111-e1aa-437c-bf46-cc14778702ee", "comment": "Malware payload (Nitol)", "value": "2ef85a6d4eb043a565b956482a89355192fc20f0e437a6feac04b96bdd7603a9c2ea15c4449448df8e6c66bea87a9020", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281505, "uuid": "4ea167f8-eb83-4544-b8ad-ae16a160edf3", "value": "T14DF433442F5C24F1D3DA65B644BB8D3D73B94CC1C4829E93EF04BB49B9D3261A48E2AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281505, "uuid": "a75969b8-c3cd-4eae-9205-69834eb33294", "value": "74bc29c35fa0e780d3a2904733045efa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281505, "uuid": "aab7b799-694d-491e-9f1a-c41d71c53622", "value": "24576:gX+WZe/Si3X5+dZpZdQz2QHmEKcafcSyJBmev:TWZe/rX5+dNa2QFgcS6Bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281505, "uuid": "53dfceea-53fc-4a72-ace0-2fc6def23f05", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281505, "uuid": "d20215c6-15f9-4d95-8459-3e85da6c9b14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281505, "uuid": "237dcf7b-670b-4b6e-bd89-ce5c9e7f4854", "value": "94a47b128536d0104ca69e11e170e960.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22ed829-abbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676305842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305842, "uuid": "346be0fe-4714-4b03-930e-dad666ae8ca9", "comment": "Malware payload (RedLineStealer)", "value": "6662132e46fd847ddd5d66df5ff5fedd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305842, "uuid": "880b47ed-e0d9-46f1-8a5c-70ed1d1a9958", "comment": "Malware payload (RedLineStealer)", "value": "5f2f3521b88c23d64b537a403e27e84e1258ef7a8797b0133e8470251a8ce5af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305842, "uuid": "f0bf8351-d146-4f6e-87de-0c7075cebb16", "comment": "Malware payload (RedLineStealer)", "value": "31c8136c29b33c2fe18b5912e28e9782dad4bce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305842, "uuid": "05ffb1ca-68fd-4c1c-a878-fec625e2cefc", "comment": "Malware payload (RedLineStealer)", "value": "d7c1d34b3aa67641592d9eb0d35d33b149bb4d369d43bf3822eaaef6c000905206a861c481093f88b12a2c2a8cd03815", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305842, "uuid": "9433d19b-9d56-43f4-9da0-e43728ecb309", "value": "T12FF41207BBED9022E970A3705DF607D31A35BC709B38839A678A6D5D0C735E0623676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305842, "uuid": "5482112c-c2ed-4718-9dc3-adb875f67dd8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305842, "uuid": "ab4299ae-bd0b-4b05-b722-74de3ded4371", "value": "12288:GMr7y903lOBOGTO/ncRprCUoYlhjlyC/eJzgem/m422xZb58/aL7Kuzt4VF:hymlyOGTORUr8lz/qQ2qCHKKt43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305842, "uuid": "7b918191-ac29-4e64-adc2-825b3d2791cd", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305842, "uuid": "568831f5-5010-46ce-ba3f-9d13d042327d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305842, "uuid": "26219d4d-8f60-40d3-8603-50f9112f286e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110047a9-ab39-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676249710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249710, "uuid": "0a0039ed-e2ce-4cef-be6f-ab481faead87", "comment": "Malware payload (RedLineStealer)", "value": "a3e77ce3874c9f66311ea6e25a09e57a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249710, "uuid": "83b8ddb6-2853-4cbc-bf17-5e2c6b1b9b60", "comment": "Malware payload (RedLineStealer)", "value": "5f7502e0ceace6941eae6ff992bbfd482900252575758b0586527a8d026ba66e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249710, "uuid": "c0c41cab-1259-4424-bef3-2957dd6f72a4", "comment": "Malware payload (RedLineStealer)", "value": "4e1ba1dd7b5ad2649760c573a3d4d119a4718895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249710, "uuid": "4b2826b8-7dfd-4627-a2d4-75be1f205aa0", "comment": "Malware payload (RedLineStealer)", "value": "0e3fc287ea418cbeb2304b939e5f93282863ad253d4b8deb6e121c56f522261ed60bec32e8b54b3a944c5c5870fa18f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249710, "uuid": "84437110-2477-4bf7-83c0-fdcf9e8030f0", "value": "T18BF4124BB6FDE032D97953B058F703D31E36BD505A78832B128F9D8908326E565363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249710, "uuid": "1d6b65b0-2df9-4a05-a472-772a72d9eb12", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249710, "uuid": "8b936362-bf2d-4ba7-b2cf-eea7097d7a42", "value": "12288:EMrjy909vxr2k/iefukkgJfnQnSQeJ/9O09TXO/F8PZKD:/ySL//zkgJfnQnc/J9TKUZKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676249710, "uuid": "47a2dfc3-c05e-44b2-a12e-e47f25e8f8ee", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676249710, "uuid": "d667ff2b-8f5c-40e8-b9aa-2234dc07518c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249710, "uuid": "8140d22d-acb9-4034-a859-fd0016a9e20f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523f98d7-ab8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1676285468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285468, "uuid": "1db9e7c7-865f-41e3-8f2f-5fb97146a092", "comment": "Malware payload (zgRAT)", "value": "e41613899b8e5f8f71adec1477946048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285468, "uuid": "11f9c50a-96ec-4ac2-a84d-822cf763972f", "comment": "Malware payload (zgRAT)", "value": "5feb04eca06aa9aee04353852118e5fa4d0480a3fd496aa88e093a0161d170d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285468, "uuid": "e21f8485-d062-42bd-8a8f-5bc61d8f942f", "comment": "Malware payload (zgRAT)", "value": "d639c9267cdf4103cfdc166e86b69ce4124907e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285468, "uuid": "376a3ef0-9d71-47a1-90aa-5a7625e29525", "comment": "Malware payload (zgRAT)", "value": "88ebc62f87bae48c55c8071d6f9c707141996cf370b3748fc10d37599f54629b71b93d29ad65da65f62d4a952ba985ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285468, "uuid": "f3150190-78f9-4249-bd30-24f808b3a504", "value": "T11745EA392CBE123B51A4D6EACFC58827F444E1B731226D3698D397998747E8329C317E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285468, "uuid": "efd44200-657b-4e09-b87e-33840e39c90a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285468, "uuid": "0aaacc68-5f41-447e-a450-4c967e64b595", "value": "3072:qJAzBu3L+uK/txkobCyiEWDZ8INMmVz0zpm0UtSr/5Dsg0f8D5bTgxH+b9J+UEaN:qazBqL+uK/tx0yiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285468, "uuid": "36ebffd5-36bf-46fc-bcac-eb48a19fe997", "value": 1188256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285468, "uuid": "530b65c5-b820-413f-a252-97ac5c862f72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285468, "uuid": "25d5e31c-f231-48bc-92b5-706eb849f751", "value": "Paralysis Cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5537afcd-abd0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676314678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314678, "uuid": "7e3ce5d1-3b68-45d0-a789-12e5d713b772", "comment": "Malware payload (Amadey)", "value": "525b8105e72285b2bff9f0d02f33e0fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314678, "uuid": "53e5bc58-5a48-493f-97e6-cf6e23c7780c", "comment": "Malware payload (Amadey)", "value": "604099e26c7fc4450a94368250c898b49c136cc1e0023e2d5c5e849176066ede", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314678, "uuid": "e825c00f-e339-483d-8cf9-1c9a59933798", "comment": "Malware payload (Amadey)", "value": "29927a77786cf15f5e85eecdc89b6b08574e06f9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314678, "uuid": "24da053d-b20f-4a39-ab48-1ee3fd5a98b8", "comment": "Malware payload (Amadey)", "value": "3efe32c5798b5a839bd224b6b5613d75f04e3e26c149b9c39a40b7388fcba9d6b2b6485e5ffc96fe0be9bc17203f4e0c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314678, "uuid": "18e78aa1-426c-4d88-a41d-1c9745ebc742", "value": "T164F4124B96D84133E9F9677018BA43D31A31BD504B3883AB678F7C5E19726A0B17837B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314678, "uuid": "55b90621-1ff2-4401-9c6b-8801624c1ff8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314678, "uuid": "90a9ddae-b189-4552-b410-879cbc2757cf", "value": "12288:8MrWy90k4f271pPWe2IPRygZeJ7gs6BBh/3QK77Tmaj0:qytOA14IcZZ6BBh/DB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676314678, "uuid": "729ebbeb-5104-40fc-bfcb-f23812db3fb1", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676314678, "uuid": "a3190b8f-0d61-4f7a-a5f9-58273294d746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314678, "uuid": "c7114de9-b30e-45f9-a66a-e7ca1f9516e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa766c68-ab86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676283173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283173, "uuid": "a3f27bab-f86a-4a9c-9767-5e815ce6accc", "comment": "Malware payload (AgentTesla)", "value": "9b64719db5ce218dc50ee64953c6fc83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283173, "uuid": "31a7b5d7-e5b4-405c-a2d9-3d54a5911910", "comment": "Malware payload (AgentTesla)", "value": "6086f675e8ace6ef0bf835038573106d551519a540095e17ff4f07d0e22b3a60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283173, "uuid": "a9156e9f-e8d3-42f8-8c17-a4b19f927044", "comment": "Malware payload (AgentTesla)", "value": "78090e3f5c9d66c6fdae690b4ba4422cc7c2073c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283173, "uuid": "bea27199-4eea-4c9f-82d8-e5abea4683a6", "comment": "Malware payload (AgentTesla)", "value": "497513747ca604ca66f9ad2ffd65bfcf3e5d00dca1acbfd714e11bd32e3c5b6385b6377ac85d269dfa5d67955f250de2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283173, "uuid": "88dcb555-9a75-4ceb-b948-30fd57c5509a", "value": "T1EAF4F73E3D685AEBD439FD704EA8A020F6ED51F77B43495958CE22C88B7168178D632C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283173, "uuid": "bf832b98-1ca3-44dd-8418-a119ca90fdf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283173, "uuid": "5426ac5e-5acb-4806-8a1b-9632786dc1d0", "value": "12288:f1HO4S0v1MYHcFWbGBGlYK+XQXsj/GrT6Pp8MUqpW2MGtHJuHChZMRv+dtguGeM0:9O4S0v+YHOtLnTtSnm0DoM4VRBj4i+ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676283173, "uuid": "eb772d1b-75a2-4922-aabc-1ff8b9ca8345", "value": 760320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676283173, "uuid": "683406e4-f83b-4d39-904b-e3e25843fcf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283173, "uuid": "ab19fcc6-e1d2-4896-ab55-68d3b9249728", "value": "POLICY_MR23-0213-3.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0e165c-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272010, "uuid": "f32ccc61-81a0-4f4e-af89-85e126128f1f", "comment": "Malware payload (Formbook)", "value": "96721ec50570c0562cbc2b70406b9974", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272010, "uuid": "5b0b2658-4c5e-4ace-a39d-b3c6e933d50a", "comment": "Malware payload (Formbook)", "value": "60d9ae01ab2431eae179f492d60a1422b2b3bb41809d4d108e1c15309d96f682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272010, "uuid": "d408c61d-d761-43ee-92f7-3750dcd35c33", "comment": "Malware payload (Formbook)", "value": "11525b49e520a4a8885ba91e9cef5887ea393c9b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272010, "uuid": "ddc12071-a903-426c-b3a2-0b66b0be76dd", "comment": "Malware payload (Formbook)", "value": "a0914bdd245c6d8e2b5e29d18024209070583880cc6a96460fe085c9b24a132edeb72e3697ae88accf605d1b71faeee0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272010, "uuid": "fdb0c4d8-b77e-46a2-bc3e-5514db2e7a9e", "value": "T14204AE36E601C075E2B242F5B26C177B843D2D342394A0A6F7E21AE56EF05F6B46931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272010, "uuid": "9a90ea38-3565-44b3-b126-e1759c1d4eef", "value": "3072:D7oHnT5GM1Em/A06sWMvYWAf7g/Gg6yw40R9aGovpwhX06JJWW5Hh2qpsgAn9zfF:wHlT76iwzgOgp8R9aGovpwhX0AJD5HYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272010, "uuid": "3c48143c-7cf0-4424-b7f0-d5b7d88e8b88", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272010, "uuid": "09c11111-20b1-4037-a221-8fcce8aedde7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272010, "uuid": "f0157697-5702-4355-89c7-cb5098207e69", "value": "60d9ae01ab2431eae179f492d60a1422b2b3bb41809d4d108e1c15309d96f682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea331b2-ab95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676289569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289569, "uuid": "69a05115-b8b3-40e4-8da2-b9cee6a09294", "comment": "Malware payload (RemcosRAT)", "value": "1308064a3157ff309109c47b12268855", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289569, "uuid": "bbaa6128-b45c-4a07-b5b3-c64cfc29bca9", "comment": "Malware payload (RemcosRAT)", "value": "60ebf1b18422675b907c8f64e5b567d002326d2f011de975b037586fa93791cf", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289569, "uuid": "6fda2977-c12d-4bf5-b1c6-1a59f24879e2", "comment": "Malware payload (RemcosRAT)", "value": "1dc919aef81ba511d63583b5f31f738f0865baa6", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289569, "uuid": "97f81991-2167-455f-b695-13e25e8ba429", "comment": "Malware payload (RemcosRAT)", "value": "ca004aa54bbea2fa75bfd70ec3e45a1f59903cf3de3ab94b8f274f7893b2149adc5a42274715431d1883751532acb75f", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289569, "uuid": "d72d519b-1813-4ad3-90d1-acc251b86da9", "value": "T1162533F7F342A88E295D1FF05A65858BADB12364D06213FD4703BE24216137697AE7F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289569, "uuid": "fcd54cc4-00df-44f1-85c7-744ee6f0fc9b", "value": "24576:vb4JIdEyRlDd+NnyKKPdoBI97F4W0mP/SrgacoplHMc4FESNRUfJ8mVs:vcwEudSyKkoBIJKJbTEPUB8os", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676289569, "uuid": "c3382bad-aba6-4cb0-afaa-bd49b12126de", "value": 1005500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676289569, "uuid": "6b6bbad1-ec7d-4c55-b547-1a2f0f0bf4e8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289569, "uuid": "2826bfd0-3120-416b-b212-b97cf918bccd", "value": "TNT Original Invoice PDF.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcb680f-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272012, "uuid": "1b7b2348-2fa1-48f4-8695-6cb2c5d74420", "comment": "Malware payload (Formbook)", "value": "6d122632533c75973fd9619657adbe85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272012, "uuid": "4b68ca1a-8efa-43c0-973b-5aeb28c10138", "comment": "Malware payload (Formbook)", "value": "615349f7344705307b2316dee1177a887390195e85d692069fb2c74def5a4ece", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272012, "uuid": "9dddd6e4-5c88-4ee8-b7c1-a4be3e47fa21", "comment": "Malware payload (Formbook)", "value": "c5d30ede16160da229a9cfbdb0e7ae7c485ec23d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272012, "uuid": "5bd3aa82-5939-4e56-a500-c5ccb115780a", "comment": "Malware payload (Formbook)", "value": "1cb6245d187689e7e45ffd6f6edada2f7c8a823e6a2aa76592ada93c74131d8cd0d4870131910bfee65c39fa9cf270fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272012, "uuid": "77151a2d-e9d1-4aad-bf26-41c8aa4eb883", "value": "T16104AE32D641C031E2B251B5F6BD1B7B883E0A353255A1E6E3E216E16EB49A5F03D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272012, "uuid": "854bfae1-0f10-4dd3-91bd-784eb43c1123", "value": "3072:l81ZkcOYX2iR3h7+gMJOTKjgtCFoEilKag3Tx+Cf9:gRNhig1TKjgtCOPST4CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272012, "uuid": "61ec967f-8ad6-47e9-937b-43b6d5d6f22a", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272012, "uuid": "2980fedd-c115-4524-818c-fecb6a464c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272012, "uuid": "cf2f381b-cd36-4d2c-96cb-ca62fb7878ca", "value": "615349f7344705307b2316dee1177a887390195e85d692069fb2c74def5a4ece", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856d787c-abf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676330221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330221, "uuid": "c11eb8cc-765c-4987-b9a8-30f79aa53bd2", "comment": "Malware payload", "value": "632d9579b8f5c99d153f3862b24c39e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330221, "uuid": "2b54838e-1f75-4935-a9b6-5e4b97dee980", "comment": "Malware payload", "value": "6189b780f8c199a0157a6894351ce3009c43411fb8f5a205a83de24f3a23385a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330221, "uuid": "15c3037f-bfad-4e44-900f-187123abb54b", "comment": "Malware payload", "value": "4e1ed539d3bdb7c40ade60180abc908ae5ddebfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330221, "uuid": "62514331-8a82-4d17-a20d-44c2ce1a372c", "comment": "Malware payload", "value": "7ba30a65a2dc2c9ff7fad5b0b71e871e6fb758eab8c65094438047bbaf2f3f64eef29d3e32cf5be4d9371efd3ff2aae1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330221, "uuid": "281dc11e-545d-4801-bec5-ccffd71a299f", "value": "T1CDE5123D7144C5ADD290BEB48D3AD8F31CD66EE3E8A0A06670C97F3F61796845A1E10B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330221, "uuid": "824e08b1-a0e5-4d9b-be4d-ae30b6061fa7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330221, "uuid": "45de42d2-e313-41b7-9adf-f932da6706b6", "value": "49152:rdHpxAo4Zm0rZQIEcoCMy0m59Es6kdVT/r/gDdcGN0wJSFLSCSLCgv2MR:JHpxQHrZMiqYR6kT/icGNjJi2hv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676330221, "uuid": "ef99e1e5-3a93-4c22-ac28-04a9e07f3474", "value": 3304008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676330221, "uuid": "ebbdbb7e-b6fe-4942-9a9f-014c9713f348", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330221, "uuid": "834d9eed-c854-4944-85c0-0ab1dcde4128", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89280dab-ab8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676286848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286848, "uuid": "5c2136f0-9d61-45a2-83e0-239b156d6081", "comment": "Malware payload (RedLineStealer)", "value": "3b1b3885e6a0098150794e1329087b5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286848, "uuid": "61e6041a-73ab-41a3-93e2-7b82b1dae107", "comment": "Malware payload (RedLineStealer)", "value": "61b36e47eb8be70c15f69f38250e30b1e090e73f350c13104e0b0ed9846215b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286848, "uuid": "4d926ce0-a026-4797-a5e2-332ab03d6f9f", "comment": "Malware payload (RedLineStealer)", "value": "e426e4432f8ff994f645792f9389dba609b0ad50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286848, "uuid": "370e8f79-1a88-4a22-9fcb-0336909234c7", "comment": "Malware payload (RedLineStealer)", "value": "32989a9bdb9ac4fe24933def67f609560bd52b46dc7070d22ad0f196f8092c2c37ef1c6dd37ad4a4a706111793ee9460", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286848, "uuid": "59f4d770-fd67-4e44-a87f-6d11ccee7ef0", "value": "T1DEF41207B6ED9422E8B563711DF603C31932BE614638925BA68F5D4D1C72B70B2387B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286848, "uuid": "d289f74b-5f51-48c3-8187-48e8eb7a1360", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286848, "uuid": "2022a550-71b1-47cb-a33b-4c994287a626", "value": "12288:mMrOy90UdZC/v60tUXoLjaykw/SXw398keJRiwPbYSGW5rdNuU5olLkfr0KiJ15o:wy7Zo60t1vayFSXqC3P8W5jmIfrPiJ1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676286848, "uuid": "2d3ee641-601c-405e-9a7b-836cd8bd4ebc", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676286848, "uuid": "68c98c1d-21c3-4547-b9eb-f0c29fccd7bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286848, "uuid": "3c19c7dd-a91a-4d44-acdd-3f3f7b81a3d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98020d83-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676299758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299758, "uuid": "6d4f4cf7-adfb-41f1-8560-d833ff8cc38f", "comment": "Malware payload", "value": "0fb50fb4a5a92a63dafcc00cbc4e06ce", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299758, "uuid": "ac7dc308-2b77-4241-9095-50e024a52e3f", "comment": "Malware payload", "value": "626af71bc07d7aff8c644cdaca69be738076504d625e89862b847f9a14a8e044", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299758, "uuid": "6ca4170a-3fa0-4195-afd7-8a07d66472b5", "comment": "Malware payload", "value": "bf27893dcba132edc5bb25aac457b6eabe91b856", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299758, "uuid": "0cf4bfc4-031a-41e9-868d-62bf8ad73acf", "comment": "Malware payload", "value": "57f272cf6069eae90f4c5d13eaf2b2ebc4dd0c08850232e789bcd68d4ab4351b514421b91d9a03793c52126cb4f80ff3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299758, "uuid": "f6fb923c-20ea-4f22-bfcb-17ac718d73e2", "value": "T16AB39EF067946CD2E79F8BD7A1556E9C2726217BAECA24CC4005FBC92D673418E0DCC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299758, "uuid": "1576d368-0aad-4d04-8a35-7c31821f7dfa", "value": "1536:oJpHiIx7ypnuxXncm9jzi5t3czohdtHkZ98q8Yf5yCfhD+YcXM6sS7DF5X4cIca/:SpCIRzi8Mz8wrTX4cm/kDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299758, "uuid": "e854fb1f-32d4-4aa6-9a97-af4c4ce5be5c", "value": 114837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299758, "uuid": "cc242d22-b961-40a4-a7a4-736540ce96c9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299758, "uuid": "94426187-9e05-4ea6-bf24-3de4f5d7ce15", "value": "NOBEL-AL-SALES-QUOTE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5a22364-abb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676302063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302063, "uuid": "e325f8ef-6e9d-4926-bc17-c0b0a369ddcf", "comment": "Malware payload (GuLoader)", "value": "50451ff662100cffd50b4618c7be9bed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302063, "uuid": "deba74d3-9bda-4e05-ab5d-3cac8cffdf14", "comment": "Malware payload (GuLoader)", "value": "629156764548d3bdbc062de11f6ad819bb0d7d166aac339b04674861df522206", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302063, "uuid": "cfdebbc9-f2b8-4544-8e4c-73ab306e8244", "comment": "Malware payload (GuLoader)", "value": "96536fc2d6f16c232c909ebceff3a09e018a9ac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302063, "uuid": "145ab881-fe61-4776-a996-b69c13fa89ff", "comment": "Malware payload (GuLoader)", "value": "1f12787c4736885cc74f2dd1bcf565c2c8e89d66a35d2130848081b1ae05ec7b715c173b75d8af5b49eb46e9fd017be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302063, "uuid": "2cb3977f-66cd-4a03-b4f2-c0716dae9498", "value": "T1CCE4F040B6A1C9B7C916023388B6D7216774FD049A4E4F2B328DB71EAD7329F391B785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302063, "uuid": "a88c28e2-911c-4741-addd-f85f308cca54", "value": "57e98d9a5a72c8d7ad8fb7a6a58b3daf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302063, "uuid": "49ebc569-ebfd-4cb6-bd61-38348a47e1d7", "value": "6144:c5plzoM8/pUVYPcEHFGkyB+7iCPotKAlcmN4qo790lmluR8aJ869JWj9e0Vwj8vS:Zf1PcEH48iujqw0sVC869aeFar/BPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676302063, "uuid": "0db320ef-5f32-4d6e-b8f3-35c9cb46fbe6", "value": 662088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676302063, "uuid": "a4be3059-c6ed-464a-bf57-12609f130b4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302063, "uuid": "3e0941bc-6782-4a1a-a034-268e43a67da8", "value": "TNOR_CYCLE_C2_220006954787_32106010359796_E_BDA_0_E_20221211_112633\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f482c6f-ab98-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676290536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676290536, "uuid": "83ca9f43-88ef-4b7a-a4ed-894647a85f11", "comment": "Malware payload (njrat)", "value": "9f8b0e55996b0cef55fa43c561ef78f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676290536, "uuid": "63b01b35-d0cf-4cc4-a1a1-caf5dd572da1", "comment": "Malware payload (njrat)", "value": "6330bea13e1cb805bbc9f27d4ae8d776e2784cc9688ad549a3a561cd2996cf15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676290536, "uuid": "97612222-6df6-424f-9856-0e649cf17c88", "comment": "Malware payload (njrat)", "value": "c8eeca0b1164965465653e049d4ded5979fdf57e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676290536, "uuid": "6ff0644f-8ab5-4335-ab5b-75f9c95939f6", "comment": "Malware payload (njrat)", "value": "a634885ccd5b14d7ae1e15b29057aee804b8ff1dbc234b049e29164a84105cba73bed42a7869b8cef08f82ddf04e25da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676290536, "uuid": "ca087087-2283-4ab1-9a95-4573dd51b3ec", "value": "T14D033B4D7FE181A8C4FD057B05B2D41207BAE04B6E23D90E8EF564EA37636C58B54AF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676290536, "uuid": "be4891ae-3e99-4547-b478-3985c590a63f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676290536, "uuid": "7537a416-cb12-4fe6-b84e-a08c96ef6837", "value": "384:DK+6WIiejtCVLO309Qmykrt4QdqMjf+vWEWxrAF+rMRTyN/0L+EcoinblneHQM3W:lHdGdkrOGb+eE2rM+rMRa8Nucet", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676290536, "uuid": "c93c81cc-79b3-49d9-aa94-42a6766f661d", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676290536, "uuid": "23164e45-5f49-4983-93ab-ae91f4098889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676290536, "uuid": "1eb13ed7-4016-4627-a1ff-8a91ad838557", "value": "9f8b0e55996b0cef55fa43c561ef78f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe87d47f-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272013, "uuid": "26c18796-886d-4ed6-aa48-589c551b299e", "comment": "Malware payload (Formbook)", "value": "34b079f213dbd387f13cce2c610d3d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272013, "uuid": "e9393b69-ce05-486f-9870-89e7098e92a9", "comment": "Malware payload (Formbook)", "value": "63351d94c96745a2830b1a206583511c04d1f78cd631d2c51c08cfd391f4a211", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272013, "uuid": "300d8c41-b40c-4720-bfcf-a96ba7100b0f", "comment": "Malware payload (Formbook)", "value": "b6ac63a8b8878ac6d5e10487d32fbef9f4aed32f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272013, "uuid": "defcbf4b-648a-4b3e-92ab-2c9ce226bd0f", "comment": "Malware payload (Formbook)", "value": "d9ea949cc8c9e3d9d02b076213bd73333b7a5e3738190b734f6bc9fa977d7b732aea0773627f63f74e45586fa3abb55f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272013, "uuid": "77074a32-8e51-41e6-90ea-7eeed063eefa", "value": "T10C04AE32D641C071F2B252B4F67D1BBB883E0E353295A4A9A3F116E06FA45A5F13931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272013, "uuid": "5e84b7bb-2851-4854-842a-4ad9c4f3c963", "value": "3072:U0rOkQDI/W0mY3n07s1DUaYXk9BJb1Uy5LKZcNNJq0Lpq+KymRAykMdw8:OTWnu2UaYXknnjKeNj1LtKVUMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272013, "uuid": "bc2e44f1-ce73-4027-97c3-71e78e40ad28", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272013, "uuid": "d07aada9-792b-4682-b3f5-408a0308997f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272013, "uuid": "a8743031-2394-41cf-b699-edc24d06f47c", "value": "63351d94c96745a2830b1a206583511c04d1f78cd631d2c51c08cfd391f4a211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd886076-ab8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676285326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285326, "uuid": "32196a81-11d2-48d4-80ef-74c3b50581d0", "comment": "Malware payload (SnakeKeylogger)", "value": "39622459e8221636e1a45144c6f36561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285326, "uuid": "1a3001ff-2250-4946-b8c6-f104bc2aaffd", "comment": "Malware payload (SnakeKeylogger)", "value": "642de5360ff3669d769d18f1372853247895a6d4c0e72a9079869804ace6b15a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285326, "uuid": "d16025b7-4766-40d5-b6e5-253635a70dbf", "comment": "Malware payload (SnakeKeylogger)", "value": "d5e2bb46f472d5f9f8e1edfc33ddabe0babc8f4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285326, "uuid": "9ca789ef-4cf8-4cbf-9697-a1d183802e62", "comment": "Malware payload (SnakeKeylogger)", "value": "bf8aea1e60f483d2c466756b0f498a9de96b33e83f445f70266feaa55d73d3c46cc4147869d21e1082897e1467230fda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285326, "uuid": "fa1fd90d-5e66-44af-a957-5d4755ff5e8d", "value": "T13EA417C3F444348DF8DE823BB9DA8E26E1D51D5A1D43190192713F44BFEEA8297C4A6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285326, "uuid": "17266dfb-0c4f-4020-a023-a7e6685cfd33", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285326, "uuid": "9c19dc00-37d3-4382-b14b-29e433e16535", "value": "6144:lYa61Rc0kl+74MY7uRarPb8nQL3B4ELV2Wbw9PaRJFY/sTsqckbmRo:lYLC0koJ5RarQCB4MyP+XYkTsbkbm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285326, "uuid": "21ce0eea-8996-4fb9-a9ba-73bb85b610dc", "value": 469796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285326, "uuid": "f8cb483a-5242-4b59-928e-ff4dd9edddd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285326, "uuid": "b49987c9-403a-4805-b839-be362f05fca5", "value": "HAIAN RUBBER GROUP CO.,LTD QTTY (PO#7A68D22).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7d08a68-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676301556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301556, "uuid": "5d747ac7-ffe2-4fc6-9dc3-15190dca6a25", "comment": "Malware payload (SnakeKeylogger)", "value": "41c44f17ca8cd505c519c7e38b2397f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301556, "uuid": "0a130831-1988-4e9c-b3ac-a2da4bb2ca70", "comment": "Malware payload (SnakeKeylogger)", "value": "64432f4d06930d1f0233cd77e59e57bbbd878d2a71e4c5850ee2baa315e7bafb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301556, "uuid": "0489fd4c-edd4-4fa8-8de4-f17f7459df9b", "comment": "Malware payload (SnakeKeylogger)", "value": "106ff41515e8c2b11ce338b58377e329820c8bc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301556, "uuid": "d2d93b50-eb6f-4ec9-8b78-2e2d8bf484b2", "comment": "Malware payload (SnakeKeylogger)", "value": "0d6ffed05d90237b92e66155017d08983840b73f0d037be9261a541440f68ecda44111aeccde63e69c2c8878f3d064a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301556, "uuid": "35293adf-e172-4c86-b2a7-26c9eb8be2ac", "value": "T129E4F1503AAD5B18D56E67F41426A080A3797F463A72C72C3DCA71DE1E32B978312B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301556, "uuid": "886fa941-e9ca-4744-867c-7748f9ae261c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301556, "uuid": "0d0548e4-3ae2-41c7-8e68-ee17b6df7285", "value": "12288:DA6A1Zh6q6/TKPzG7jTtJsiRAmqeDsH98bDoMPgUZ/1DuoFXhKrx:DA6wY/TKPzG7PsyAm5sHCXpDRFXorx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301556, "uuid": "265c11ad-7cc9-4193-b6fd-be803b702b49", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301556, "uuid": "523e2a16-9562-4658-bf24-b063589d8a9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301556, "uuid": "6d5211dc-0259-45c4-8b5c-29ba979089b3", "value": "41c44f17ca8cd505c519c7e38b2397f4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490e4d37-ab95-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676289318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289318, "uuid": "f0d81c45-015d-4cdb-b353-7feb294c894f", "comment": "Malware payload (RedLineStealer)", "value": "648cea2078e83f90ae11817865da0729", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289318, "uuid": "1db97414-a541-4bf6-9be4-906d7c9af4a2", "comment": "Malware payload (RedLineStealer)", "value": "652507c2f28eb5305f7c5120af79ca4ee722f12a1a599573a129b164fc0ea842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289318, "uuid": "bf531726-014b-4644-b657-dd26a8cdf55c", "comment": "Malware payload (RedLineStealer)", "value": "dbcca11a02c1be9856da4fd5ed7fcccd4f99cb67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289318, "uuid": "ad8ba52f-e242-473e-b95d-d89d3baf40af", "comment": "Malware payload (RedLineStealer)", "value": "f9fd68cb2f6a25c14932b6a7db85e03dfa15d782f83b25c997b0402ab8da9728af9b7b1b876c178a537907d4d1e24e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289318, "uuid": "0b1d0867-e011-4a56-9ca5-83d48d37ee33", "value": "T17BF4124BA2E89462D8F563B06CF307C31E3A7E015B3583AE6B8EAD5D1C725B06131767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289318, "uuid": "204029b1-7037-440a-8024-05fc3810d129", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289318, "uuid": "a92d1506-eb0b-4ee5-b445-653aee79cd0b", "value": "12288:rMrZy90XqUa0THZMoImFTu4eJ20uZNqlG1rrorTRAcpYxvf4iMC:uyya0T5hFgBuKUUrNrLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676289318, "uuid": "9fdb6248-197d-432a-bdcb-ac0c5fb11114", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676289318, "uuid": "2cd27055-1112-4f16-ba9d-89e1bb4d2553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289318, "uuid": "1ff0f54e-0943-4f8a-9cbf-e38a3c92dbf1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a3be264-abc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1676308164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308164, "uuid": "b8295501-e116-4de5-b18c-a7e45ad52442", "comment": "Malware payload (IcedID)", "value": "3f33e43525441226209ef5bf9a5baa89", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-0213", "colour": "#A27126", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308164, "uuid": "abf1ccf7-f2be-4c3c-9b0b-335c292a4cbd", "comment": "Malware payload (IcedID)", "value": "6529e9f87b51be0230f9277505bc5b39bcd53938aa50a8585277b32256e4ee3c", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-0213", "colour": "#A27126", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308164, "uuid": "bb1dae16-a410-450d-830d-0b46fa81628f", "comment": "Malware payload (IcedID)", "value": "b7d7f27540378907b7a0b6d5c7e943c8f306a584", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-0213", "colour": "#A27126", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308164, "uuid": "bff0fef1-76d0-4011-ba23-7f73961384e5", "comment": "Malware payload (IcedID)", "value": "22d73d5a1572cb325bb39bc64f4dda7ef7159883a729a14288503f3f1af92a401564ba0b138cf87adcf324037e944163", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-0213", "colour": "#A27126", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308164, "uuid": "a1519cbf-e0b0-40b5-ae2c-90fa61b11c75", "value": "T12E1533CA4F7EF0CE6876E9A26D6D4797C2808D3419BCD8BCC25355B09B530B48C6E16E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308164, "uuid": "8a88aa5d-c57c-47a5-b747-8dcaa7d4fc37", "value": "24576:efLbd0NCshJFKN+D2iwtuvNxoXdT8pZ/dzLUXT:Ut9shJFKViwUqx8NHKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676308164, "uuid": "94e9f1f5-0c78-438b-affa-10c4b70411f2", "value": 923171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676308164, "uuid": "9c9f143a-bfb8-4400-bc33-f17d33bf240a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308164, "uuid": "b7f4d20d-aae5-47a4-91c5-48cb38f364cb", "value": "INV_Copy_02_13_#99.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8cf2f8-abc7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676310768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310768, "uuid": "82311dd1-2374-40f4-8bd1-b6f8c3f55ea6", "comment": "Malware payload (Amadey)", "value": "cf0e96bbd27fd542edec1ba5a90c4b7d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310768, "uuid": "3fc8398e-95ca-4092-b65d-30e3a02a9ca3", "comment": "Malware payload (Amadey)", "value": "655363cd3e7733f221e1d1b3bf4e20d076921ca630221b5a72a45390bffd6b92", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310768, "uuid": "6dc98c63-7ee7-4f61-b58b-2db13148d0c3", "comment": "Malware payload (Amadey)", "value": "daa6b6099f6434d2502162f4d1d2da40f72421e8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310768, "uuid": "182e7bdd-19d7-488b-8116-88e6012be93c", "comment": "Malware payload (Amadey)", "value": "1334db7150ea8577aeefa959e05bd8e572ebc9cf8753bf25cc1e5c9ba791631ec65ebd24fd39203aae3d8ab994ab62d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676310768, "uuid": "4bd91482-e9b3-41cc-b3ee-5ee7c99ceb8c", "value": "T1F2F41207F7DC8522E4F197704DF203C32A3BBDA05A78966B178E6C1718716A4A63176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676310768, "uuid": "775d0278-92e0-490f-8f05-44446b44b61d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676310768, "uuid": "f5d695e3-d3ef-4178-b8a0-751d585da4f8", "value": "12288:1Mr8y90BnRmemZ6t5b+i8XmEtUy9wzdPeJ/LDdwqJMlllnsTXPv7fOKI:FyneZt5b+i8jUKwzGTDdVXTPv7Wh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676310768, "uuid": "2fa48dfd-8002-44ab-af89-7349ae4252ad", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676310768, "uuid": "94ee6399-84d0-48a6-8942-7c1b3f4c6e75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676310768, "uuid": "8a0c906b-bf02-4760-b7d6-dea59b2242bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd597001-abea-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676326020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326020, "uuid": "b953645e-62aa-497e-81e6-862025088750", "comment": "Malware payload", "value": "af405a0636f72bd9ed60df5beda720d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326020, "uuid": "42134985-671a-4d9e-887d-00070099faa4", "comment": "Malware payload", "value": "65dcddc35af1ddf103e7bf1ddbb37b479c7debb1d49bda3cc258cf39dcaf0708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326020, "uuid": "2844a0e7-92b4-4aff-9b59-37090ab9aa26", "comment": "Malware payload", "value": "d43f60f8d5cb52c54413452fe18e555cad295c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326020, "uuid": "22ce3c83-9126-441e-a007-1ffce5aad1dd", "comment": "Malware payload", "value": "02475ac23ef74965129448c0a074fb2e75810f9e59f410ed1c0ef2b208b2a5b2912b064ad54cc61c128068a59ef53169", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326020, "uuid": "5802a7b9-75ba-44b5-88c4-5c27ad3dc656", "value": "T16FF4124BF3E88465E9B057715DF303D30B35BDA29A74938B268F6C0A1933760A63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326020, "uuid": "6d516972-cbb4-4e8f-9313-f880c0ca4247", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326020, "uuid": "470a7a55-84f0-456d-b988-6537410460e5", "value": "12288:nMrTy90zN+uXVjd8nk/sNC7z882DwIP3JWHEEhP0354p04i9/DK:gyu+YV6nk/sQ7z882DwIvEEEO354p0HK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676326020, "uuid": "79aa06e4-ac60-4b4b-a63a-9f09c49ad460", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676326020, "uuid": "bab21b97-28b0-49e6-8c46-6c36b18d75e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326020, "uuid": "be6129ab-7656-417a-bc08-52b5280e4b9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1533bc4b-ab96-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676289660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289660, "uuid": "095c85f9-9465-4f7a-9073-d33119aea6a8", "comment": "Malware payload (Smoke Loader)", "value": "9e351239a1757cbedccadd688645065b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289660, "uuid": "854eae99-719c-4f90-baea-267155aa965b", "comment": "Malware payload (Smoke Loader)", "value": "661311e040b8c7b47c81fd052c3a5f55d8822f9a92d8074fcc542966c8cebda7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289660, "uuid": "a753c6b9-cfc4-40e0-b76b-a03ba2eef872", "comment": "Malware payload (Smoke Loader)", "value": "d08e84bb26b34239a3db0ff2f48a02b73dee0f50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289660, "uuid": "ee40279c-91ed-4c66-89a4-a25d2a0082d0", "comment": "Malware payload (Smoke Loader)", "value": "2cbf948cc7b82f9b0fb3ea11641bdfc9ed785dfd3f60cd0cbe64cbd5ecb5e52dbd4272f767dbbe50e231edea0dfd34a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289660, "uuid": "4a4517c1-328b-46fa-bad6-af3a3feb7462", "value": "T1BB14CF13B2D0E4B2C46256309978C6B46F6EF8B15F78AA5B775C1B2F1EB03D08672352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289660, "uuid": "5f85acf6-13ac-44f1-9b1a-62f9275dc3e3", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289660, "uuid": "258db004-cf81-4b02-b57a-e4db22d0f810", "value": "3072:lpgNp256H7R7g3I3sNIR9r29LbiOrYkdj1y1XB2L7VK/+PPBZ83BX:lpmoIUI8NIR9r29Hz5J8XBqc/aZZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676289660, "uuid": "77a867da-b01a-43dd-84d3-9dc41579ba1a", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676289660, "uuid": "13be3170-5aa7-4104-9510-1c03709cedca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289660, "uuid": "04941898-5dea-486a-9430-83ede2ed9470", "value": "9e351239a1757cbedccadd688645065b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df24be2e-ab67-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676269813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269813, "uuid": "82bba27b-665e-4109-9447-bdb792ae5bbb", "comment": "Malware payload (RedLineStealer)", "value": "0cf8cb7f05bfd07fd5589c93cd428f1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269813, "uuid": "eba99266-30a2-41de-a5ed-a33ba6e0de70", "comment": "Malware payload (RedLineStealer)", "value": "6651fe1c46f84d2cdc87a89849dae9fcdb15eca12ca23d0797c29a1ae7f3ac94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269813, "uuid": "23bf5c2c-6fd8-490b-8964-783398ad5c66", "comment": "Malware payload (RedLineStealer)", "value": "3291533461ca4974aff89b3466df9c5626b7b95c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269813, "uuid": "9999fe17-f3ef-42d1-a2d2-f3e04575903c", "comment": "Malware payload (RedLineStealer)", "value": "00ffac358c6fb2d24f822b71eb931da95bba4eace976151ee53ba7938d5cce3fd1d497f4ab38fb6d7e09bb2a649a442b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269813, "uuid": "04578e82-32ba-49af-a540-d8a48e407714", "value": "T15A64F113B390E471C42246305DE8C6F56B7EB9B05D7862A37B482A3F1EB06E1DA7E351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269813, "uuid": "ebde4c75-a85a-4fab-8b7f-cb04e11b1833", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269813, "uuid": "c2ccdc54-dd92-48ed-896f-98ef89a275fb", "value": "6144:pzfIMWKT75NYEyG79Nh7TeDMMxtWL1da0519w4ZU:9fIEBNYEyQVoxtWLLai1K46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676269813, "uuid": "d94e1336-7ac9-4e08-8be4-c58f9d8cd6c4", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676269813, "uuid": "440359fd-4aad-447c-a888-575ea23ae286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269813, "uuid": "5245bb1b-0669-444b-bb21-8f263815f20a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c38b39-ab77-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676276533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276533, "uuid": "806b86fa-5096-4953-84b3-641f2b055b96", "comment": "Malware payload (AveMariaRAT)", "value": "d0e676a1e51ad5ab7c8ba431e704afbd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276533, "uuid": "fe7c7a21-0844-47ea-8410-f73d98df77d7", "comment": "Malware payload (AveMariaRAT)", "value": "66b9d54df08b9f4df7a87ce8946f3c775bb98a3504c3c2d6f81ca4a6e676e3bd", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276533, "uuid": "670c82cb-02b4-4cbb-bdf2-4087b3daafc3", "comment": "Malware payload (AveMariaRAT)", "value": "6b1b2d70779b83ee0ebe5988e79c093a536ec2a5", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276533, "uuid": "be8f5d1b-d5da-40d7-9629-600aacceed82", "comment": "Malware payload (AveMariaRAT)", "value": "7d590890ebaf583b1054291f78165a3623e03d0c239116623c2137b4fe1a47eb66805de861c588f78d4d8bc300cb01b9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276533, "uuid": "a79c45dc-7fc0-4b4e-bc31-c9a570580104", "value": "T19D5478D1E384D58ED41B02B7CC36D9716417AEAA8974861E242E3D2B76F7383206BD0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276533, "uuid": "6fe82cc0-dbc6-4b4c-ad77-1887876cecbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276533, "uuid": "c92be07a-42d5-4795-92bc-128ccc351bdb", "value": "6144:LmnoMGGGGGGGGGGbGGGGGGGGGG6GG/DGXxeXJE85PmWyVcjUkdHbIIA:4KHjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276533, "uuid": "ae351e55-becb-4e19-a608-e60713738f2d", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276533, "uuid": "251c0e48-7abc-4450-98cb-898d9b98b7b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276533, "uuid": "5bea05a5-49ab-4ede-8548-1387d06b7c82", "value": "PO - Drawings & Specifications Assortment^^^^^dwg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a0ef29-ab66-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676269099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269099, "uuid": "987d9099-fe9e-496d-8e82-b0ef7100e9e6", "comment": "Malware payload (GCleaner)", "value": "872f165deb59e09c1d0a848e57f5da11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269099, "uuid": "e83c3a29-3c93-4cab-a487-231789d97f49", "comment": "Malware payload (GCleaner)", "value": "66eba2aa43cf3d676f8b09cc7bc2aca4004a843fe68b917fc725793f92c19b18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269099, "uuid": "d69c37bd-48bf-412c-a347-183624e44ae7", "comment": "Malware payload (GCleaner)", "value": "e405a99ad99a3d0362042805da3be06e4951d133", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269099, "uuid": "1ea07109-3b9a-4ef8-b232-8563fd93edda", "comment": "Malware payload (GCleaner)", "value": "52d0bed576c8487981b3a646b4c9496b917df00b144bb4a42c8f7bd7cb8364d43b2dadd6bfde3f28f36f391d0453272c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269099, "uuid": "29a38f14-964d-4c02-b6e9-47d2c8349cd7", "value": "T1FBE5127C7505C4ADC294FEB4CC3AA4E35CD66DE3E9D4A56270C87F3F92792889A1A103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269099, "uuid": "815c358c-dd76-43e9-9c75-bca3cc0dd13f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269099, "uuid": "3d452100-0bfa-43b0-98ef-2c22c9ae437e", "value": "98304:JHq3hV9dmHsyZnt66tEW1n1NVHZVoMCQ1C6Siv2MR:d0V90BZn0UEWfNVH/DCqDrvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676269099, "uuid": "99a2a200-5c42-4b51-b85f-4aa4a92adf0e", "value": 3299826, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676269099, "uuid": "5a1075ad-3b18-43f0-b449-ee1c8aed65bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269099, "uuid": "668bb273-a213-4ae2-9f6f-96e3d14fc02a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4faaa1-ab5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676265268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265268, "uuid": "640a21d4-8a07-4085-8955-58cb4d5035bf", "comment": "Malware payload (RedLineStealer)", "value": "d6b7a14fcd3a585f562e35994bf7c42a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265268, "uuid": "8af2f52c-1667-4893-9ff4-4434962a2653", "comment": "Malware payload (RedLineStealer)", "value": "67122c0f490d228e18164d575a1a112c08020dd3c0b1e39be23260f00810cb47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265268, "uuid": "307c98d5-c917-463e-9c46-f6d667d899b4", "comment": "Malware payload (RedLineStealer)", "value": "24adf22103b1b3488e1e460d1cd377955045091f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265268, "uuid": "47cecef5-5d9a-4560-990b-8ea4437ae2d4", "comment": "Malware payload (RedLineStealer)", "value": "0cafc8dcf1e3f41fc608e6c9a1fb0aeb09587cbe9e15d4ba9d6a8935e2e86800eb03f9c3f6c7619f6d8454b20e575ff3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265268, "uuid": "11657325-27e8-4b41-9560-a6b03237e5d8", "value": "T112F41207EBF94132E87567B055F606D3063BBDB05F74825B278B6D4A0872AA0B33176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265268, "uuid": "65dff152-ab10-4538-bb45-4ad8cb5a97c0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265268, "uuid": "0de28401-286b-4366-8065-9241e9c401a9", "value": "12288:MMrky90K3BjYg4nyxuVDRJf4lxYaeJ4MsVZdNBZFv/3jUWxRq:AyVd5IVlJfH1sVlB7n3jTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676265268, "uuid": "10b1bbb5-6ecf-47bd-bf32-80a81c185bd5", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676265268, "uuid": "b3c4bc2f-7877-4992-88c2-ac122b586519", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265268, "uuid": "75dd64ed-be89-4a5c-917a-0a088703bbe7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6296d5fb-abc2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676308688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308688, "uuid": "b6a36964-8be9-4802-bc12-ff8ff969ed87", "comment": "Malware payload (Amadey)", "value": "03f9137dc472c671bd4c8168c605e918", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308688, "uuid": "6c4acdd1-3bef-486f-91bf-eb30977df080", "comment": "Malware payload (Amadey)", "value": "6755c0f801d8f8c61adbef984a76d24fdc7f78e680bb4857a32290a110af231d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308688, "uuid": "6bc34ed4-8771-4652-9308-50ddb70256d4", "comment": "Malware payload (Amadey)", "value": "3ada5f694109637f70faa84d61d0f5bad7dcb9e4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308688, "uuid": "3a084b52-ff3f-40e1-922e-0afad83504d9", "comment": "Malware payload (Amadey)", "value": "93d8aa0a3a38049153441477e1d18f82e958f98eee73ac76d9ee6d1931cd8551b6cbcc755090d35553fa428e28cfbd52", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308688, "uuid": "9aacc4b4-ae75-493c-9a26-dbf895d41c24", "value": "T17BF41207F6ECA032D9B5AF7029F203D31A377D606A34925712CF6D5B18726B0A27536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308688, "uuid": "6d12fc8f-1036-496d-910c-eebf039aadc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308688, "uuid": "eb380202-ebfb-45ae-bd61-02ad6ced95a1", "value": "12288:TMroy90p+LVDhK4VNfwj2Vcz4aBQeJPIj973jun6l1l5163PmL:vy40VFj+zJDPIjdj+c16+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676308688, "uuid": "40af6615-d974-49e7-a792-f234fce9ec0e", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676308688, "uuid": "fbb308e5-6cb3-4119-862d-2564211b0248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308688, "uuid": "c1031634-0777-4b18-946c-5e1068c52f6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d7f863-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676301181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301181, "uuid": "6b5f244e-b856-414f-baa9-ee485334b90c", "comment": "Malware payload (Smoke Loader)", "value": "acc8ca84e7673fb2d45396de3adc2034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301181, "uuid": "c0d84885-8316-4955-88d5-e8ee2faceb64", "comment": "Malware payload (Smoke Loader)", "value": "681c69efe56c9588dc36c2a5c30ff9e397f199c5062e19f61a160a0d9fa9351c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301181, "uuid": "abedf8df-2310-4f98-b8c4-b3eb11b3d322", "comment": "Malware payload (Smoke Loader)", "value": "a7a9c71fd48c9765ab4afdb09870baf7b28b172b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301181, "uuid": "3990e911-e077-4a21-8f20-fd1bec1a37b2", "comment": "Malware payload (Smoke Loader)", "value": "a433a10941df3cb906562586f20eb73cecba15d31a8327367b297f434fad35c01adb8a3e6efc0abc525bf566c78bce79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301181, "uuid": "492fc55f-1cf6-4a04-b0aa-3d57455c33cc", "value": "T1E504CFD17DA2C073E56781711A21DA906A7FBC72B7A4CD8B3210DAAF1E313D19B65323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301181, "uuid": "c9817510-39d4-4453-a618-c306448b7e42", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301181, "uuid": "9a376e4d-de99-4ed7-b7b6-388589c691fe", "value": "3072:Wuv5la35XKs4R1rYyVtAAX3OCFCOJQw/2QpOokonNTV:WaaBK3R1rx2LjwLpbko9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301181, "uuid": "c228c3f0-3d05-40dc-ae29-4f107fa86257", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301181, "uuid": "8be29aca-563a-4d1c-a704-0421fd020b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301181, "uuid": "e0f5d567-dafc-41f1-b655-759cb5c15779", "value": "acc8ca84e7673fb2d45396de3adc2034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f7f4c1-ab61-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676267116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267116, "uuid": "1ff7183a-6ac9-433d-93ee-d6fc410ea514", "comment": "Malware payload (Amadey)", "value": "21ed6f7a2bb883ac3f25af11da7e0cc1", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267116, "uuid": "cee75f24-60d3-4ec1-88a5-15e0cd3ec025", "comment": "Malware payload (Amadey)", "value": "68920b8d6e7c06d5ed6ebc63db5291511ba3269cbb21ef8369842255eb34455f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267116, "uuid": "4e204256-a399-4065-9a42-04376fd947db", "comment": "Malware payload (Amadey)", "value": "46880193abac8d00734a3cafc2481b034836645e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267116, "uuid": "ad1c35d3-2a0a-48ee-8b13-7e5a75cea414", "comment": "Malware payload (Amadey)", "value": "283d253cefab9d4689aadbc8275ab358db542cb3bfddc4cf2c00d61d6f981ec5ff48bbafbea9076ef0e8fc4f6d1b4d87", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267116, "uuid": "3833b9d5-c3af-4a75-81e9-fa34ae215183", "value": "T10AF41247EBE99622F4B457B055F603E3167B7EA11B39839B234E5C680C71AB0B23075B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267116, "uuid": "1a28c14b-737e-4097-b9c1-f34c58471e2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267116, "uuid": "7a22cc35-8f5a-4c0e-bc0d-49d75871bf2a", "value": "12288:sMr+y90kL1VzQOhRvBT+T6BMU2EAJXeJVM8VZd7kZmv83rixqP:qy7L1xzh5BTASAqq8VDksU3rP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676267116, "uuid": "8e273e05-1bdc-40c5-99af-6573c738afbf", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676267116, "uuid": "9f37f458-acf5-4b87-8ed0-199ab32ee7d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267116, "uuid": "c0b47c40-14e8-47a1-bc0c-fcc69a786078", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f2d236-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676272030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272030, "uuid": "f7791098-63e7-46c3-812d-ba25bc7ca2c5", "comment": "Malware payload", "value": "2f4f05bb09b396579225615ab4121256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272030, "uuid": "6d765ab5-dee9-4c81-994f-603f05f28a78", "comment": "Malware payload", "value": "68bbeee51b4808c6d6382d6b28344e5c3a66ab90ea6d013aa63ed836ce35c503", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272030, "uuid": "5bd997a5-7494-48d1-9d0c-1d0a510d03f9", "comment": "Malware payload", "value": "9bc7cc5f2030ae4d0a307f063b93f7caedacc2b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272030, "uuid": "47d03ff0-514a-4402-9f1a-09a05caa8091", "comment": "Malware payload", "value": "10843b04867fb7f9deb7b2fa760f293d0e032dd8b73af338bda44f8c6a1f82c416f4e66b03c885eb66cbcfe4e4111a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272030, "uuid": "fa5e8861-17f2-49b4-87f6-6f546852a21c", "value": "T1C3A2C0427717ECB2C2681A723683CBB841D26F9C1F50F15777AE7A1D39F961C3880649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272030, "uuid": "3b70e8bd-d93c-4b79-8521-217668e4a127", "value": "09d0478591d4f788cb3e5ea416c25237", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272030, "uuid": "21d51e83-a9af-4edb-a629-bc4b8ada2b33", "value": "384:F3jccc7UJPckKSB+Ir//avobyWblunkd1SHVbonWNDiRHfJb9J:9jZclSB+IDaoLluI1SHuWQfxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272030, "uuid": "ca4f1bc4-7593-4188-a277-c1ebad24854b", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272030, "uuid": "fae358ca-6e52-42a4-afdc-94e22eca9191", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272030, "uuid": "db5865d4-1d6a-4361-9ad6-d10a1383a082", "value": "Details.txt .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd47a692-ab76-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676276225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276225, "uuid": "f85575d8-888b-4cf2-a250-ac764b9ebe2d", "comment": "Malware payload (GCleaner)", "value": "557b91b2365a5f2e01a99a12dfa923be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276225, "uuid": "7ea476dd-44e6-4548-b753-10e9f8acd819", "comment": "Malware payload (GCleaner)", "value": "68c38795c2c6f1e70fe07b5ab8d4b53980c7253c809a35c092318aa880d01643", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276225, "uuid": "e6e5601a-7f60-4925-9fab-f37de7e01802", "comment": "Malware payload (GCleaner)", "value": "ee52b3d54058233f3946e86c09482e588e1bfe7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276225, "uuid": "f2d48de8-4e93-46c4-989e-7397e0cb602e", "comment": "Malware payload (GCleaner)", "value": "7ddbad5e8611090c5403b85cc949a2105e672bf3f89ecbbba89ca712ddb8b316a4ce5a94807e700e75445214423ad6a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276225, "uuid": "dfe035d2-f1bb-4d32-80af-d862b3a9f47e", "value": "T12FE5127C7145C9ADC290BEB48C3AD9E75CD72EE3E990A45270DD7F3F42782889A19243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276225, "uuid": "2e126234-d7c1-4377-a9dd-70268ad5c0b4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276225, "uuid": "8fe25136-8ed3-4b20-bc7f-09bd716bb5dd", "value": "49152:rdHjJGc6o1bliZVp6mIvvFZUgOmkWNgeSNbkAYM3qyAX00n6Q+kOn0ALCgv2MR:JH8q1bQsmIvvxOmkdeSFkTl0A6QMJv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276225, "uuid": "928e1c8e-29d3-40f4-9e5b-4ff1f397437a", "value": 3134847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276225, "uuid": "3649fbd1-a067-436d-ae45-240d4b62b993", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276225, "uuid": "ff18ec02-7b92-4b8b-9cad-3b1b5f99986e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c17397-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676280622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280622, "uuid": "02e60ac2-9daa-464d-9969-e0b1e308a410", "comment": "Malware payload (DCRat)", "value": "71cbb49bba29408c8132a2f6a626f278", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280622, "uuid": "a6e629f9-5e4c-4e4b-8e37-7ef3adc17b04", "comment": "Malware payload (DCRat)", "value": "6958b01e6aa8f0070a497e0d1f07cecb3aa169c96eeb898e653f9bcbcd99e93b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280622, "uuid": "600dfc82-e6b1-4848-b885-7aa915d854f7", "comment": "Malware payload (DCRat)", "value": "9cd78a098bf07e24c02e143758a0cb6e3054913b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280622, "uuid": "e9bd8052-b77e-4c9c-8b9f-9f477bc65aac", "comment": "Malware payload (DCRat)", "value": "00cf6a9a4b85d2d2dfe6aff49a29ce4e8749d854d11045243ee3e17c5f007bbbc903bd11bc1462e9a2efa4c5daf2b619", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280622, "uuid": "e2a4da14-15fe-48b0-8131-f1f1d9d6be7f", "value": "T11195AD027E44CA11F0182633C2EF465887B4AC542BA7E71B7EB9376E65163937D0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280622, "uuid": "fa4bf26d-dca7-4eb2-9060-cda8feb4e886", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280622, "uuid": "9a585b6c-f582-457f-a0cd-4a336fa31527", "value": "24576:U2G/nvxW3Ww0tfNvKlm4HE0aIegnMx1WvLF8/hdbhr/Np9t4Sy1rMBnjHhE07Qip:UbA30fNvcEsQe8/hdtG0jHhnRD/Tv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280622, "uuid": "23528743-7dd1-4a65-a774-c3467925bda0", "value": 1875556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280622, "uuid": "541178ef-1586-4c31-b181-eef5aae6363c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280622, "uuid": "85a3cca4-fb55-4519-96ad-97d826d9add4", "value": "71cbb49bba29408c8132a2f6a626f278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c29341e3-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676277066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277066, "uuid": "d3c46b3f-fc0c-4df0-a163-d95f3962a221", "comment": "Malware payload (Smoke Loader)", "value": "7e01b1a967fadd92b78a52411556c945", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277066, "uuid": "f73b54e0-eaee-4896-b07f-b707ee2acbfb", "comment": "Malware payload (Smoke Loader)", "value": "696682568c05c3ea48aba981d359133b72457417c8c10c27a80bdf83ccec7b61", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277066, "uuid": "a7b3ee90-ba5f-4ecd-9183-cd413328fa26", "comment": "Malware payload (Smoke Loader)", "value": "b8c9839599b8f721e05b68b2e9afe81fb8fc5225", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277066, "uuid": "086967a8-e018-4e51-abc7-1f7135a474ba", "comment": "Malware payload (Smoke Loader)", "value": "de1dd15c9f5550d9685513006b86a1047621a31f440df8a9e91ec23d4af84cc729ee65d08155edb111f0a6b72e5ef6f8", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277066, "uuid": "11e2ec98-1f02-4f61-b35f-531087d00443", "value": "T1500633527176E43BD46692B148086E33270BE2BA117BFC2B370885787D853D2B9BF1B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277066, "uuid": "16b9e4d5-8d16-45b0-ba1d-4afca264ed99", "value": "87e1f4e32d01d5a52e605f27fd138118", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277066, "uuid": "cb2edb1a-02e1-415b-b533-2e0c28a2f698", "value": "98304:MSQ3/Y0ws5Zw/QJCZObVeCuMFWxrMKUs+mNXc:MSQPY/s5stsPDIoKUs+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277066, "uuid": "1b0f7411-3f8b-4093-af19-97265cc86737", "value": 3847168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277066, "uuid": "3cd23cb9-e2bf-494d-9b30-c36953346f38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277066, "uuid": "98c516a3-2356-455f-b04d-9699eb2db3f7", "value": "7e01b1a967fadd92b78a52411556c945.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffb9871-ab72-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676274351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274351, "uuid": "45dab651-4822-4588-814c-813effa58c74", "comment": "Malware payload (GCleaner)", "value": "25749bf7523b6b1a24b10cb10be6be5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274351, "uuid": "5cf32a16-f503-4b40-b3b0-0619749f3077", "comment": "Malware payload (GCleaner)", "value": "699f44342466c7424f7942aa1f476b2565eb741b37f6c26ebb9b6c03cde91b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274351, "uuid": "b58a5501-672c-4665-ae9d-7618d024c1c6", "comment": "Malware payload (GCleaner)", "value": "c6595c33b79f78722b1db6b97fff8ea9aed914dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274351, "uuid": "d57ffdbe-0b6f-4d8b-8fb9-47368e5beb28", "comment": "Malware payload (GCleaner)", "value": "24964588ab147a7309aea4162c5ae5908bffe0041e117df867236d370518a15fe935ad2ee3f3e245a53e67bc34ac8009", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274351, "uuid": "895e69fe-ec34-4ed2-8960-0aa6769e8c1b", "value": "T140E512BC7501C45DD2C0BEB88D3AE4E71CD76DE3A9E4A42270D9BF3F52BA188560A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274351, "uuid": "0b71e4ba-78cc-45a8-87a2-e4adf15c70a3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274351, "uuid": "e3a2f620-51ed-4b8d-880a-b5f152893cb5", "value": "49152:rdHan0o1h33vMpZVunS9KNNZ0FL/czGkra0G9MrjK3Nzjk+5qraLCgv2MR:JHVo1hn4oNOpEz1zGawtXYmv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676274351, "uuid": "54c465c2-f0b6-49bd-aafc-c97e89ad26b8", "value": 3317727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676274351, "uuid": "03f682b2-35c6-4e58-be7e-61790bc4c66b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274351, "uuid": "9da8dd48-2666-42bf-acac-85dbe44918d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae8cb06-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676300890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300890, "uuid": "985bfda4-fa43-45ec-8677-8aa5bf3845be", "comment": "Malware payload (RedLineStealer)", "value": "128cee381323338543e831629ebc89c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300890, "uuid": "a9c5bda9-2954-49b5-a39d-a116d2edf620", "comment": "Malware payload (RedLineStealer)", "value": "69d10ce59d7555a18627f7e5ecb72ecec7f1480be3dd5ea4f85008a23e947258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300890, "uuid": "d36cbd10-f40c-4e12-94ae-dd9169130102", "comment": "Malware payload (RedLineStealer)", "value": "87b1626b745aded348c7efa69fdf252077d3c948", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300890, "uuid": "94535b9e-afed-41a6-a416-159233a878d6", "comment": "Malware payload (RedLineStealer)", "value": "8dc8258aae7941f220a261a84ce3ddf6906aba000fa9fbbf0baa92bf1d391b0d654ff863594ac076bb29ae7861213bfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300890, "uuid": "97a89385-4b52-4c2c-8ea5-27176097d8ce", "value": "T137A40247F7EC4161E8B54B7019F703D30A36BE910E38839B678BA9590CB35B4A63536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300890, "uuid": "8fe8387f-a503-4108-b93d-49f0bfeada63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300890, "uuid": "6fd7820f-0dd0-4c65-91f3-fd7601cdce44", "value": "12288:5MrVy90lotyVOqx5gvv/tLQfadBFQdaAjeV+kYc:QyvQVDivu+BydJjU+k1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300890, "uuid": "ec561a07-d245-4d26-94df-c7ea62c9866d", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300890, "uuid": "c47df077-1e07-4446-a758-e9fe7921fa04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300890, "uuid": "f694c7e8-f449-4fb8-91b4-03d6990a66b0", "value": "128cee381323338543e831629ebc89c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca620112-abbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676307144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307144, "uuid": "1693bdda-9be4-47f7-ac70-e020cab5f9cf", "comment": "Malware payload (Amadey)", "value": "45370c43556d354b5cc2b666f23792e7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307144, "uuid": "ba98137c-8dbc-4316-9c1c-5f11ae571c0b", "comment": "Malware payload (Amadey)", "value": "6a2e09bedfc453c86c65cfc64421c36de3ae12682f88be89eab0d3ce41272ba1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307144, "uuid": "afec25a8-8e35-4961-8fc5-7564772e92b1", "comment": "Malware payload (Amadey)", "value": "c356a4299785f449966549d00848105f1bfa1ebe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307144, "uuid": "474b42c9-3ac3-4e08-b81a-c34e175d0925", "comment": "Malware payload (Amadey)", "value": "346f571d59ee50d8d52b8bb04da383a868298a56c47de9564d7589265750217eb1e19c101bf10e6d5a77057c76b93fb0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307144, "uuid": "894cc20e-24fe-42c5-b29d-bfebf9c4632e", "value": "T1C4F41257F7E99077F8B457B018F303931A36BD614A308396278BAD092D706B0727AB67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307144, "uuid": "fcb35788-b2e0-4a2b-aa19-8e11fa26553e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307144, "uuid": "f5f31147-d5a5-4e09-afc3-c11b68e1b8d5", "value": "12288:qMr6y902HDJPc8uinwt7P7qbWIqGQHteJvP/wqOxWXwpnxql0aw0qbBEF/jDZsiA:wyjjhc7inwtfYfBQOvQqOxWXCxqiP5GU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676307144, "uuid": "69b964b7-741a-454e-9e90-f01b45e577f7", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676307144, "uuid": "00831986-716c-42dc-84dc-a76769361ac3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307144, "uuid": "9fe0dd49-48c6-4753-a44a-a592f4c73bcd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c975d66f-abe4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676323463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323463, "uuid": "2644a00c-d53c-4315-91d8-f216d3500c0c", "comment": "Malware payload", "value": "049972f927bb98e21039b7f67a71feb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323463, "uuid": "232308b1-c7c3-438f-a441-9583bca59ed0", "comment": "Malware payload", "value": "6a8cd1c401415686eae6abe903be7972739aef0a638908feaebfdb63c54087a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323463, "uuid": "79a87192-8fd0-4683-b09f-b65706b2de67", "comment": "Malware payload", "value": "f57ef779ab0e925943b520f660fb1edfd9e16d5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323463, "uuid": "6e47b5cc-fc2b-444c-b4f2-70ef3ad5456e", "comment": "Malware payload", "value": "3658b596eabd594c2ef89d0162fb3527a68a3085e24579ec7c9060cab0977d84e46f06c10377720a322fe54af0de0505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323463, "uuid": "c57845da-f443-45e1-a19c-7a0348460edf", "value": "T15FF4120BA6EC8032E9F517B019F703D31A327E605E35479A63CEAD195972BA0727076F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323463, "uuid": "d036fea3-092c-4655-8b3e-977c17503c31", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323463, "uuid": "1311d675-7c08-41c9-9949-18dde35ad703", "value": "12288:7Mr2y906/2IXVSNe7w8CA2KHNwZFeJSGMVf55wccxJYfB:RyR/lVgICA2KvSGa55Bzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676323463, "uuid": "648a5341-462b-4e39-b431-6a2f64014b96", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676323463, "uuid": "af5ba0d7-f50d-4208-a877-eafd4b8b3119", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323463, "uuid": "48ae4e86-2d2c-4510-ad90-2e91d71f1dcf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837a83b7-ab4c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676258063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676258063, "uuid": "55e09984-e592-48ca-9fa0-42969b729171", "comment": "Malware payload (RedLineStealer)", "value": "69a222aa82b09d654679d5404351b351", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676258063, "uuid": "743202e7-b610-46e1-9b0c-cc26b013a5e3", "comment": "Malware payload (RedLineStealer)", "value": "6acfb87b7bae0444e327aaaebda5273a6d094f217a6aa790deea6070e2e59938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676258063, "uuid": "fde7736c-5475-4d9d-8816-7c8191d179bd", "comment": "Malware payload (RedLineStealer)", "value": "f965746a5df85c533285ede19eeb5235ffa0e49d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676258063, "uuid": "a7498736-1717-4aca-b8d2-5d0079b7269b", "comment": "Malware payload (RedLineStealer)", "value": "bc43a32ad275aedbe31bfeb55c6d3daed111579fe6429a63e409d0fe33e8d4b0bf36667b61623da902185fdb9197b590", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676258063, "uuid": "4df89d2f-961d-460f-876d-86eceab882dc", "value": "T100F4120BBBEC8133E9B523705DF603D32A36BD91563C866B134E6D581C72270AA7176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676258063, "uuid": "45c0331a-73cc-448d-8f33-4775f2408921", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676258063, "uuid": "4412ee45-5110-4ee3-a88e-ca71914f8264", "value": "12288:OMriy90GW52BKdbYTsueJm3rlwyPd+Vevlae6DObodE:8ybk28e4mXvatDjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676258063, "uuid": "806fa73e-edc6-43f1-9f51-63cdf068a259", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676258063, "uuid": "8b15fc07-bd20-4019-8983-c5276ab9ceeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676258063, "uuid": "08ff032c-4196-47c7-b5bb-95f1bd14f6b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf62824-ab69-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676270425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270425, "uuid": "3cb8963d-fa47-4b12-9158-acda69728a96", "comment": "Malware payload (Amadey)", "value": "648c7c1113590813f4447f0b52336031", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270425, "uuid": "6f6c328d-1ab1-4745-ac73-68187a7122e5", "comment": "Malware payload (Amadey)", "value": "6ad23bf09653ae1ec2125deb6c0ca4b23d4295af5b6943a428711f5d3eda53df", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270425, "uuid": "e621c692-7297-4755-8371-9062bba222fa", "comment": "Malware payload (Amadey)", "value": "7674e073a187898225baab9576ddcd4e59d5344b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676270425, "uuid": "983210da-bd3e-4114-9be0-07668e439406", "comment": "Malware payload (Amadey)", "value": "b4218b2cd95074c3da913921a97d6878e469f0f65902316052f9c9d08f07438b1d22083e97222f0466fa5c2ca9b4a21a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270425, "uuid": "7d4b30e7-f11b-4875-8e85-8b3b7c2d09b7", "value": "T1C8F41217A7D99032F8F597B02CF603C32A387E614AB88257678F6D5E1C765A0A17133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270425, "uuid": "ba58c22d-aa7f-4daa-9fdd-e9c5215e75a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270425, "uuid": "31cb252e-a530-4021-beb0-735eea64577c", "value": "12288:sMrvy90GuDUuP6qXV2cHeJoV8J78g5qeQi0AQl:LyKNdUy8qgYLiyl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676270425, "uuid": "ba1e73d1-419a-4bbf-8bd8-6a796243af2a", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676270425, "uuid": "c74dcafc-95ce-4927-9384-49e49043edd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676270425, "uuid": "363de74b-897f-4725-aee2-e0c34d7e1d26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca702944-abb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676302420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302420, "uuid": "e13f35a4-a754-4f54-b569-ec1ca12404ec", "comment": "Malware payload (Smoke Loader)", "value": "0ba1fd41f1780286e14e31b14c2b0237", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302420, "uuid": "5fe92644-1d06-42dc-8987-f504e3f6cf66", "comment": "Malware payload (Smoke Loader)", "value": "6b2651e594ab26d0c36f485f16421b6ee53e836572ce58ef79470cf86f19abaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302420, "uuid": "1a515886-b5ef-4b0e-bc20-b9b7db16517c", "comment": "Malware payload (Smoke Loader)", "value": "69263c6f8d5e6add8a2974a38c65df1ecdf7f939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302420, "uuid": "659dd034-684a-495a-87c6-d858e4a70fd6", "comment": "Malware payload (Smoke Loader)", "value": "3e27cca829d4f517ea4e5cf495b9c6ea6aa0e8d8b6c1272cf38da23a55f9cde29685673c7134c6bbd14afa8d2088a6d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302420, "uuid": "a6141ad9-0fda-49e0-ad4b-ca8b9cace40a", "value": "T11714C02372D0D871D76616315C69C6F53AEEB8B24F389A8B37541B3E0EB02D19A73352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302420, "uuid": "4fc99a1b-0ba6-4aeb-993c-8de9d329b82a", "value": "096c57a489bc9be05d307c86ed0497dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302420, "uuid": "bdc68b4b-7314-4dd6-aea4-826f698e0fbe", "value": "3072:8uBNcwGLAWaVO/mu0T39m81FuD0pwlQX3AZv2Ex6xbW/y3T:8CVG6VWmu0T3UBYpwCXTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676302420, "uuid": "e07ee09a-1ba1-4dea-951e-9edd534c9c8c", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676302420, "uuid": "5050466b-6be2-495d-9278-af01da67deaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302420, "uuid": "55b58225-8b53-4d78-8ea1-4fbe851ecb61", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a426b5-ab43-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676254387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254387, "uuid": "1ecd9081-8d9a-434f-b2e3-165e8b1900e3", "comment": "Malware payload (Amadey)", "value": "9d4452ce8e7e02cf89531df9fce80a8c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254387, "uuid": "0c5160bf-949a-45a4-94bc-c00cee625ec9", "comment": "Malware payload (Amadey)", "value": "6b6f964a366b5197b8ee06555f97c35c64b7b8d91840ee9c7c682c7766be05c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254387, "uuid": "6a5993a3-e298-40a4-b56d-3f27caf04e40", "comment": "Malware payload (Amadey)", "value": "5e354d091a57fd01eb4918d2466986690f71b97c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254387, "uuid": "1193f31c-db49-4148-8497-9501b44cd0d5", "comment": "Malware payload (Amadey)", "value": "5419a44f3ede51a21da166ad864572c7c718cd080dfd66831217c920da5450b83b11263d058b4635b9579105b6b60233", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254387, "uuid": "12aa3e18-821b-49c6-bdb5-2b38839dff06", "value": "T1ABF4120BABEC8027E8F467700CF603D32A36BE615738839A674A5C9D09725F1B671767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254387, "uuid": "aa2362b0-ca61-4c22-9be3-a36f23d1e6ab", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254387, "uuid": "af65380d-c967-4fcc-90cc-1a6690eb4411", "value": "12288:dMrDy90DDb5x7hWcygkzQFT5ZK7vU0IeJwOdNBncEt+ae11OboMgWG:SyGDscRkzQlKgmwOdPnf+aa16U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676254387, "uuid": "e29ae1d6-84c3-46f0-9183-c647604134cc", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676254387, "uuid": "b3dad7ae-33cf-4adb-96c5-b2d646e97d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254387, "uuid": "91d57491-b196-4b7a-9107-8665672d90d5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1455ab11-ab3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676250145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250145, "uuid": "a7b2f0df-bffd-427b-9b57-f92f3b7eed1f", "comment": "Malware payload (Smoke Loader)", "value": "73cc5deaec07899ec3a3b3bab8444bf7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250145, "uuid": "085dc141-436e-40c2-948e-21494b0158d3", "comment": "Malware payload (Smoke Loader)", "value": "6b7e8aa70b9a9eb4025accfc23f6ad7aa70640297fdaca16470b4c5e236af62a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250145, "uuid": "cd2a5983-b17c-4df5-b455-d1876f34f828", "comment": "Malware payload (Smoke Loader)", "value": "ec8dcd2f87599bf324a600a0bed44fa3dc3f8282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250145, "uuid": "d7696e1c-7e7b-4ccc-93c3-9eec5f8f23d0", "comment": "Malware payload (Smoke Loader)", "value": "670921034533b96f4b9b994917a7ee79de08c359827932ec567a70fce06807b348eddc0f2253171abc714855f35b705e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250145, "uuid": "a3076463-6441-42ea-9a46-27f47403914c", "value": "T1CD04DFD17AA08072D1A78176792DE6D0762FBE3697B0C8CB33441BEF5E306D189B9316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250145, "uuid": "2c373328-0428-4855-a5fa-3d81cd53422f", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250145, "uuid": "4c79af1c-44e1-4686-b991-b9e29ccb08ba", "value": "3072:H18Zb+/5HZJ7g86QABcODJJdGBDiVgo+Cr5+Q1X7U:2YJz7dWCBiVgAr5u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676250145, "uuid": "bc1f1246-0a72-4978-ba5a-0ad545554665", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676250145, "uuid": "bb3d0488-073b-4653-8493-4ff4f3c61670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250145, "uuid": "802d07a6-daac-4685-9629-53f28458a4c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdb8d93-ab7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676280035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280035, "uuid": "dcc0b16b-f642-401b-b333-a4a0910f16f7", "comment": "Malware payload (Amadey)", "value": "59da797409305056d892ecf727795c7f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280035, "uuid": "6fcd03e2-c2a6-4944-9504-31214183af4f", "comment": "Malware payload (Amadey)", "value": "6be258a7a6b6d91c84590107bb55b48b3a4021aac71a6b6b9d093efbd5068826", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280035, "uuid": "a6388c15-0c96-42a5-abb1-ee8154c8742d", "comment": "Malware payload (Amadey)", "value": "7410d10163289428c1acff51bde951799ad56748", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280035, "uuid": "96b9e8b2-a7cd-47f4-a7a9-8c6437e24bc4", "comment": "Malware payload (Amadey)", "value": "aed243712dd43490336015f13a8bf4d02013866fe760d992c1341f828cba87cd52d5867a934ec68678277d5caf54e733", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280035, "uuid": "20187c89-6bf7-42eb-b084-d1e7cd8e7c44", "value": "T14FF4125BB6FC9531F8B59B705DF603D312397EA02A39939B524F69080C31AA1B23177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280035, "uuid": "3e5115b1-2e23-4532-8ce4-ed71ba2cc2d6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280035, "uuid": "34bd133b-a295-4e08-b1a1-40f8fd95101c", "value": "12288:JMrZy90f0PrvlOqRRk6rP2yZq+3H3npZ+eJKviA/MBT1X7cQ8lNs7U:gys0PrtOkRdqyZq+3HPKQRcWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280035, "uuid": "89c66862-d46e-4ff4-9a61-08fd6a21bd16", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280035, "uuid": "787d6153-735c-48dd-858b-969fbf31f4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280035, "uuid": "3a79f4b9-27e7-44e0-a41b-44b8505714d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dae386f-ab76-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676276118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276118, "uuid": "7491f280-668d-4f43-95c5-8d1ee4e3f5b5", "comment": "Malware payload (RedLineStealer)", "value": "657e36feb61d77e8d2d9da0833c9b8e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276118, "uuid": "00c7a6bc-3f3e-4f74-9f88-177f345429fa", "comment": "Malware payload (RedLineStealer)", "value": "6c1b0a6370877b232e230baa8703139865662584854a4f8306c387baa1185b50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276118, "uuid": "59e18c86-5fc4-4034-9d2e-47355debac36", "comment": "Malware payload (RedLineStealer)", "value": "ae4f4b2115a9fb55910060ad3b2e42e5fa97129b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276118, "uuid": "0b39df34-2c2f-4317-9c91-7446c1b8feee", "comment": "Malware payload (RedLineStealer)", "value": "2b42f4025ac39b045145f21eac8c4dd921ce4ab5bb1298861f52f989bc6789e86bdbe99201b85f2c820eaaedf624f1d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276118, "uuid": "1fc2bcc8-e96d-4b25-b63b-d3fba6dc2490", "value": "T1A26401323A90C072C4B684305C28DBA17FAFB53116B59A4777641BBE9F303E0A72675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276118, "uuid": "dd13706e-3906-4b8a-9604-2b09d77e474c", "value": "11deee92ae37204b8493d8d64f5f1f69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276118, "uuid": "45bfe180-be69-4764-96de-b10f4160fa35", "value": "6144:Eo+L5C9WpFX0FCYtEkHsWE7lL5svyb73KpRoouaVGev5:Eo+1pB0TRE7l9sa73KpZ93v5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276118, "uuid": "1a2d930f-993c-463e-a9af-3f4033e6e5a2", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276118, "uuid": "4f8fc8e8-727b-4dc0-9d0c-50db66f3e3fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276118, "uuid": "6c964cd8-0304-4fb2-b712-314041329417", "value": "657e36feb61d77e8d2d9da0833c9b8e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39b1c0f-ab86-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676283054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283054, "uuid": "ae44a9d4-8991-4367-91a8-b4ce6715dbaf", "comment": "Malware payload (Amadey)", "value": "91272a4e51c4c4702be85bdfc30f1a9b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283054, "uuid": "8953ca37-db68-4703-a96d-0fae59dafadb", "comment": "Malware payload (Amadey)", "value": "6c238443ee4ad5645f8d68dac43ced795520ead190422c39a85b89bb4a5a65a3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283054, "uuid": "3bd61d45-922c-4bd9-972c-c0995e5c01d2", "comment": "Malware payload (Amadey)", "value": "122d5e619d8c700f452a5d3a04c09ae3f535244a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283054, "uuid": "4d96744e-4305-4812-981f-52f204f69365", "comment": "Malware payload (Amadey)", "value": "73580a3b0a759950e38dbdbed7df416413fbb2fd0caeaf762abfb9c851cad7e58b4023de14810104db04ac0b9200868b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283054, "uuid": "1e60f1d3-1b24-43a0-9496-2a5f4490e78f", "value": "T149F4120BFAFD4422F6B5A3B064F203D3263A3E21DA78835B578E6C5908721B1B135767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283054, "uuid": "40667fe2-6417-43ca-887f-67b69b77d184", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283054, "uuid": "f81fe898-2801-43e4-98f1-d032b5506026", "value": "12288:vMrhy90PdlHCYUUk4bLLHhAWeJYG2/86CaOqeSKYxzb:iy4zHCTUZjoT2/86F1Bxzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676283054, "uuid": "2bde7484-e8fe-445a-b2a0-2d7c1aa0cc30", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676283054, "uuid": "65f28505-6dcb-4915-b196-7d7cb3f2c21c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283054, "uuid": "c75060db-0bea-4baf-9fdb-fe42442aff53", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fe5f95-abb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676304479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304479, "uuid": "a76fb900-dd82-4bce-b8bc-e1a7e58f6cb1", "comment": "Malware payload (Formbook)", "value": "aa05023887117e6f52dce6ae40dcab9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304479, "uuid": "a6763e9e-ded3-4ad3-96f8-b7c6bfa6e7ea", "comment": "Malware payload (Formbook)", "value": "6c3654d20a676bf9b7f77546e23bfb3a7d2d23f1d535d0feced966a22ece5d60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304479, "uuid": "00e6e9e1-d603-4183-8f53-2ee8a8889727", "comment": "Malware payload (Formbook)", "value": "3f6c3e8cc656a436be4ddbc248432e48dcd8aa0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304479, "uuid": "7043583d-1fa0-4822-b63f-be5268748ca7", "comment": "Malware payload (Formbook)", "value": "b8d2338ca65d90a13447acba3c017f2926e1945ab44a8469accb60b9b667b81042d9a07de0992d79397274e7dcfa5b04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304479, "uuid": "5f183fd2-628b-4900-981a-900b26471b7e", "value": "T19F541221EEB188DBC4B389B15D7A42A7B7ACF901E054B70B174829593F1BC92C32D757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304479, "uuid": "6ae1596a-835f-4873-9293-11ec39bf4f82", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304479, "uuid": "d3f1a436-a6c7-442a-aac2-81de92a9f1a8", "value": "6144:BYa6q6/iwjO/07RXNHT0uZ0w+5IoujNbjcgTAgqZ6VOmA+:BYcKji079BV0/IVNbQgMkw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676304479, "uuid": "d657b201-2ac2-47c5-9f17-a4ff367de635", "value": 279065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676304479, "uuid": "cf4587c2-00c1-4145-ae68-0b3537cf32a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304479, "uuid": "187072a8-7349-4d18-880e-9367d77e5606", "value": "aa05023887117e6f52dce6ae40dcab9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d430d3-ab70-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676273522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273522, "uuid": "c5d130ed-46aa-490f-807c-bc982517bb3a", "comment": "Malware payload (Smoke Loader)", "value": "724c39a3a8569a8d7d7bb02dea2373f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273522, "uuid": "594e06fe-fc19-4772-81f2-a2603891cfcc", "comment": "Malware payload (Smoke Loader)", "value": "6d1862de24ab8f51245e8f04f1b6530e1dad62b73bc34bd15fe25a335df6bb84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273522, "uuid": "eee09f0e-b769-4be8-843e-60da80609c38", "comment": "Malware payload (Smoke Loader)", "value": "b681bae9c7ce5cd4eee71971953c3db687578862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273522, "uuid": "186a3ff8-d3f6-48f4-8593-3474e0cf871f", "comment": "Malware payload (Smoke Loader)", "value": "1913fad72fa582b2bb59980d9d85b3ab1acd0efb807c202eab8e5e7c6c6c5d96618b14cf57064858053bdc4009c3ddf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273522, "uuid": "67160cf2-c279-48d4-b01f-7e10ed2718b2", "value": "T17114CEA333D0E473C56216305D79C6B16B3EB8B30E79656B37982A2F0EB02D19637352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273522, "uuid": "1fa19270-86d9-4bef-b15a-e4d3b15d77d3", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273522, "uuid": "dd3de9fc-2c49-4784-b593-0c07dc3bdb6c", "value": "3072:wzfQaDMJr2/LKvr/etU7p3n960ctuwdPueOCYy+ElZV2838:wzfPMsKDetU7p3nctvdW/nE0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676273522, "uuid": "0dc5b411-ec0e-4ace-abc0-bb8606d24a59", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676273522, "uuid": "7d277251-f24d-4f24-81c1-05933617ae69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273522, "uuid": "7f82c7cb-53c5-445a-a4df-0b6474aac15c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6790ec38-ab89-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676284215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284215, "uuid": "ba4dbf97-3cdb-44e6-89e6-09d2f0a72709", "comment": "Malware payload (DCRat)", "value": "905982c49891112cb3b7dd232cf94f5a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284215, "uuid": "248f3911-feca-42d2-b2f6-7abbe1c0d801", "comment": "Malware payload (DCRat)", "value": "6d46b5019e2ff15d922d83d923dc3d97490a7e4e6e14d263db67d8a72bf64849", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284215, "uuid": "42905880-de23-4143-9c53-4c5326217491", "comment": "Malware payload (DCRat)", "value": "c002947be363ddaf875037a8687cb2fcd9f35574", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284215, "uuid": "bf0bbffe-ff85-4b01-9089-39e76b73d862", "comment": "Malware payload (DCRat)", "value": "d578d6174aa93dc2b04aa208dd1c48ab31ed034e34dfb5725cc530c182db1273a7f53f3ac69828869c0701dea55aa4aa", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284215, "uuid": "524ab351-ce28-4867-ba7a-ab81cf86083b", "value": "T1D0657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284215, "uuid": "aba4c1d8-5b36-4312-94e3-4e68c971616b", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284215, "uuid": "b622b87f-2ca2-4712-9b07-180ea3299490", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284215, "uuid": "8f86c93b-e36d-496c-a46d-c0204f8fa4b2", "value": 1410539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284215, "uuid": "e4263e50-aac8-4cef-aaad-0e96b231347d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284215, "uuid": "04f57fe8-4ab0-4783-a40f-7325165dad24", "value": "905982c49891112cb3b7dd232cf94f5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a045e6f1-ab82-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676281304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281304, "uuid": "688a8f9f-745d-4207-8c4f-65a117dc901f", "comment": "Malware payload (RedLineStealer)", "value": "8858aea04a261ba68dda1a5e2c27922c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281304, "uuid": "4435838c-dcf9-4302-a601-b59d72816fa3", "comment": "Malware payload (RedLineStealer)", "value": "6d7e01b16538aaf819aed06167fda6423a19770cee4a88ed00408a75bbc579c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281304, "uuid": "4c9658de-8ad8-473f-af3b-db03034ced98", "comment": "Malware payload (RedLineStealer)", "value": "e34f4a168dcf70742c3a62e047e7b8b9285c53ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281304, "uuid": "088146f7-4ad9-4073-aab0-060e18797be6", "comment": "Malware payload (RedLineStealer)", "value": "bea11380feafe3fd86dde57f34962f5faff4a70dc1f4de92644b72acf63b04586215bc0cc59cdb4af98b268a73f089a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281304, "uuid": "689d4a14-8771-4e38-b5ac-cf80969a1b5e", "value": "T12CF41243BBE85232E9E5677008FB07D316757C609778C79B628F6C150D322A8B63636B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281304, "uuid": "ed8967ab-1d3e-413c-93c1-f65cb2bef6a5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281304, "uuid": "07f0f82c-f5f8-484b-ae1f-a49e736fd1ec", "value": "12288:6Mr6y909uGz2aML5byChKsUfV3NKuHvWeJ949v2vWm8THX0cPyGIpv+8b:Ay6527NbyCOlsuvOSWBjIlvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281304, "uuid": "ecbbe64c-6f2c-42cc-b3bd-3b2b48271fba", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281304, "uuid": "41b14556-27b2-41d0-8f7c-ecc1e656b484", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281304, "uuid": "8721452d-ddc6-4c76-9afd-7b06397166f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f569fb44-ab91-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676287889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287889, "uuid": "2ec0bafa-05ea-4c1e-bf90-7c625c44ba4e", "comment": "Malware payload (GuLoader)", "value": "9431d665d50848c73767bc1254d6dbc4", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287889, "uuid": "d372b3eb-c8f3-4973-b914-ab204a253243", "comment": "Malware payload (GuLoader)", "value": "6e6d5cacaea5bb7bd6eabd74a7a60fd6befe62ea0fd353079c6aff369662ac2d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287889, "uuid": "c42bf490-ed65-4e25-ba84-6c2463e05732", "comment": "Malware payload (GuLoader)", "value": "48b5b8c0930172dc46556df55ab72ae0e8c226ed", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287889, "uuid": "1cead379-c816-460f-ab50-fbfb6438d842", "comment": "Malware payload (GuLoader)", "value": "1cb0907f36a894be8eb8c3c4307ab2af963dfc4cb26955cb5966102b81b0d12baf24cc3ae1384c31fb148e6b873ed2aa", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287889, "uuid": "c71b0d5e-c88d-4289-8ef7-0a67c614cc2b", "value": "T100A40130DD571D349E3E065E8C565B448C698D5FEB122571BEE6B2BE218224CF3EF228", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287889, "uuid": "c25761c2-a8fe-4209-b9ba-0a43ac2f1283", "value": "12288:euXCHxS87hZ0nIkhxDV313l+W5EFV2h4nazmadXA:XIt7hg3hl73gsmt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287889, "uuid": "4001b2a1-5bb2-49b5-9b8f-fc7c1ee053d5", "value": 471054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287889, "uuid": "8ac4fdfb-37fa-476f-af00-bd84716e86df", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287889, "uuid": "c32f59b1-29c5-4ab8-be78-468cb8885af7", "value": "PO. No. DM223778 IMG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eda71ac-abae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676299958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299958, "uuid": "f880561c-96af-40b8-be42-4fa57a5d0e24", "comment": "Malware payload (Smoke Loader)", "value": "d5e234a8248c68ea536dd36de2cfb175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299958, "uuid": "d7b85af6-dc0b-4fd8-9344-55c0bf2590ed", "comment": "Malware payload (Smoke Loader)", "value": "6feb91b9bb98df912f9f63b2197d9998c3e89b86bc25f3f9b69f2b0271224eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299958, "uuid": "c47c7daf-671a-4495-829f-e4394ee76b8b", "comment": "Malware payload (Smoke Loader)", "value": "186be9525cd8a585b14fe5a0e2807536db4528c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299958, "uuid": "2264651e-b689-4984-8bba-b6e553941fe2", "comment": "Malware payload (Smoke Loader)", "value": "087d99d8843059aa987f0989a595a2194adbaadd72255a60ae7e14d57ada719efb9acdaaa9069582392490245f11d43c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299958, "uuid": "3aaee816-7184-4d31-8971-fd8e61ebd6cd", "value": "T12B14CF2333D3D472F1621A715C68C6F42A6EF9B24F78A68BF7641A2F0E702D18672355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299958, "uuid": "7dc88b0d-18bb-4540-bfdb-9310df0480b0", "value": "096c57a489bc9be05d307c86ed0497dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299958, "uuid": "0ed792cf-c617-48b7-825c-ab3b31aaf928", "value": "3072:06BNwKpO4hjsYevzSR8TgSZBhz1MyJagx1tldd6Uv9ny3:0OLpn5sVvzSRQwW1ttVv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299958, "uuid": "3054dc62-81dc-4252-8e82-50be4bcced6f", "value": 196608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299958, "uuid": "4b365834-88cf-4747-a8de-923d366a2ab6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299958, "uuid": "0255697b-41e2-4013-8112-4e8e65b50a24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56776b0d-abc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676309956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309956, "uuid": "2e47e7c8-f107-4229-be0d-be691716ed04", "comment": "Malware payload (RedLineStealer)", "value": "5473660ba05b324529dcfe35505c55c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309956, "uuid": "9ea8775c-138a-4612-b5ff-2b335844a18b", "comment": "Malware payload (RedLineStealer)", "value": "707f73bf49a9ff79ab213b73afbaf284a0611db42471e468a0d7abbc2d0893b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309956, "uuid": "2f1daa91-ba4d-4c70-8d5e-50b3b18a9257", "comment": "Malware payload (RedLineStealer)", "value": "acd5734dda1bc0a975e2e7638a53cb8e98f7ada2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309956, "uuid": "0eb6b0d0-a864-4aeb-8799-4ce18c0ad660", "comment": "Malware payload (RedLineStealer)", "value": "b6e4e8fff1693b8014cf6431a163c24ce223feb1c09c6009d48b444d65e94702ce6319dc49697d15aae32dfcb5a7e069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309956, "uuid": "9f4a065f-827f-47b3-9fa8-475dfa65bfd2", "value": "T1C8F4121767E88133E4A0573059F203D3273A3EA14E3487DB26DFAD1E19726B0A63576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309956, "uuid": "72fcc916-417b-44db-bce6-0083695fa201", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309956, "uuid": "73bd902f-8492-4a07-8f83-444616813986", "value": "12288:DMroy90FrgKFtWcfQ8+IlCb7wTjGxNeJ9qZUnFl7lkBxnxXE:bykgK3DflHTjGE9qZUnenXE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676309956, "uuid": "f66c43aa-f497-492c-b47d-d3ef4b946014", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676309956, "uuid": "b7b25d08-7ba3-418d-b518-1d99a48ddd30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309956, "uuid": "ff9018a9-e7cd-4b71-ada6-40b72f17d3f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9efdff8-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676277052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277052, "uuid": "970de285-80cf-4bd3-ba72-45c612a63e12", "comment": "Malware payload (Loki)", "value": "74da287a8274009e99ef115db7f61e96", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277052, "uuid": "e35f2dff-d25a-46fd-b6e1-7291572bc951", "comment": "Malware payload (Loki)", "value": "71d2581bac561e46a572888fca87df08794027c24c70e4b9a1bfae1e1a4d90f5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277052, "uuid": "bd9dc35a-e53f-43a6-aaa4-974036cf8894", "comment": "Malware payload (Loki)", "value": "49063b021f27d749b7a62443ead52e176662ced4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277052, "uuid": "468386c0-4358-47d4-9537-3bb8aee47985", "comment": "Malware payload (Loki)", "value": "974ba0d976ba309e1226e0a7bbe44a830280e9edb2cd6125e9d9a5058b6130d92741efcc4a465471ee2ab004a26ed428", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277052, "uuid": "f212d277-f9c5-41c2-b352-f9c029854fa6", "value": "T11075F107D675ED2BE967C53CE84F449281025C7AA855CA4E20C7772F9B32BB60E3EE50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277052, "uuid": "dab4be15-00c9-4288-b2b8-6ce1afa1f5be", "value": "24576:E+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXXXX9vFeTfF2s4FeSPHd3+6bvdXXXXXXT:h6yW7MbP46XEcYA6bS6GJ4s5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277052, "uuid": "f2fa82da-1914-4cb9-97fc-928431ee3c2d", "value": 1595904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277052, "uuid": "91769fec-3313-4f5b-8c2c-b2c0156c2d9a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277052, "uuid": "e97b1eb2-f42c-42bd-925d-71eb2c63525a", "value": "payment advice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07aeb3e-ab72-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676274539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274539, "uuid": "866c7c96-d7ee-4b0d-8a37-d08577612cc3", "comment": "Malware payload (Formbook)", "value": "39ef715c3cc013349c99bd5f36bf7202", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274539, "uuid": "83306913-edbc-4f8d-a5a3-9db6d7cd70c1", "comment": "Malware payload (Formbook)", "value": "720e92ff7311f11df9d0c37c4728748e82798ddb505422416c803e464743d8e5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274539, "uuid": "0cd3f00b-7953-440e-9db1-68f61b30d388", "comment": "Malware payload (Formbook)", "value": "c2b98c5fb330db02bfefbca504c611c6b83c6d14", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274539, "uuid": "1d3682ef-e8d3-446d-9113-da061795fd4d", "comment": "Malware payload (Formbook)", "value": "0d342016ecc945e79829e33505d486b9fccbe6b0afb3eafe6bdbe5fe2ad9688b880881192195f16ad0dbb09748c8328c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274539, "uuid": "d05e0bf0-483d-430f-9733-2fe696616843", "value": "T1D44423A0889F81F2A2868D257920AE5D805FB874357B776B44C211D286DF87CBD47CE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274539, "uuid": "09b2a412-66a8-4bf5-89f6-6290e881272f", "value": "6144:pStkjpAiAEJsiN2kzJswzHXhWY9Nv35jVKRRvs5G/UY:0tkjpAW31zJLsY35pK/05G/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676274539, "uuid": "d019a395-a385-4779-a3c1-a21d0b7336a6", "value": 270247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676274539, "uuid": "1abefd33-120e-4925-b731-db07e532f17b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274539, "uuid": "7104f6fe-d22e-4cf7-8a36-398d29bb1ff7", "value": "New Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "163f653e-abb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1676302976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302976, "uuid": "47b088a1-7daa-48e0-a12d-1c3a3f268291", "comment": "Malware payload (Quakbot)", "value": "5aeb6e164f5c212e21d629c0ea46f48f", "object_relation": "md5", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302976, "uuid": "e6fe9c7b-f99d-4972-97b6-0ed0d0f4945b", "comment": "Malware payload (Quakbot)", "value": "7272f3b71091a0188f10030287ca1e2b6689b6cfd7c91d400bd7d1a4d55213e5", "object_relation": "sha256", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302976, "uuid": "1d5163b6-14a2-4149-9d2d-350712ea4403", "comment": "Malware payload (Quakbot)", "value": "06a1743819db332d3c196a6960b90301c638171e", "object_relation": "sha1", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302976, "uuid": "4cd6397e-22e6-44bd-94c0-593e92529597", "comment": "Malware payload (Quakbot)", "value": "a914992602bee12465ae789609df494261a8d1148355a9091cf90c69013860a3c250168133380a1591aed082f6036a6c", "object_relation": "sha3-384", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302976, "uuid": "e267c40d-3a8d-437e-b306-742b5c84dc2c", "value": "T1B4B45C6FEE0240FAEE07A8FAC547F7EF4E6813328974DCF2C69D6D19B8842641219715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302976, "uuid": "37ae76bf-8d4c-460a-a599-04424e4f3243", "value": "5684749ec732d84594f077726c28f1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302976, "uuid": "1347f1cd-cf09-40c1-aa60-c858344e0cb6", "value": "12288:XPkOXczzPUMZClzjzbumfoEG1Tn2AK2Y0yC7+:XOnfClzjnum/G1TnVek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676302976, "uuid": "39bdfda4-6296-4f0a-847a-8fee12c992c2", "value": 537603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676302976, "uuid": "448180a0-d369-4a4f-9328-fb7306b7fb43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302976, "uuid": "7aa43e04-c53d-4684-8091-9dcf4e58c33d", "value": "09.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd784a5-abab-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676298778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298778, "uuid": "f2489ded-d408-45b4-a52c-95a03388329e", "comment": "Malware payload (Smoke Loader)", "value": "bc76a044ed5787cc5b63134da68baa21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298778, "uuid": "981e527b-8992-47c5-b6ab-49791d63c681", "comment": "Malware payload (Smoke Loader)", "value": "727e4fd6e443e9f3d20979842058744312d2407915d81bbb864a2f5b64c442a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298778, "uuid": "1cda2638-4b2b-4f56-86f9-b5042ee660a2", "comment": "Malware payload (Smoke Loader)", "value": "d2391bc87451a53d0f90e070b9fb22b82f01dff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298778, "uuid": "a6a3c105-f992-4165-8470-269a2491a486", "comment": "Malware payload (Smoke Loader)", "value": "36105c699e5553aca44db65ab6701bfd41aea73276e28e5c7b1872793798d339c0b009984f818c4f5cce4d1ff733f956", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298778, "uuid": "eb76a7e9-4f72-4dd1-a55d-4eda906783e8", "value": "T1C914BF2332A0E4F1D5A326315C68C6F42BEEB5B15F38A58B77581B2F0E702E19A7D351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298778, "uuid": "5d379f4b-b7f3-41dc-ae1b-c1ec4c31edae", "value": "096c57a489bc9be05d307c86ed0497dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298778, "uuid": "e9878567-a25e-478a-962f-f74f716f9576", "value": "3072:ouBNcpnDvjtC8uXaE8w588qTc69d4BjOolJe/DAstgbPz/y3:oCcn/tFuXaEh4K19mDAsSz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298778, "uuid": "3eaf8f8f-2be0-4bc9-a19b-c6549240a655", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298778, "uuid": "38f3c49f-06c8-4c04-a563-ab050dcb11eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298778, "uuid": "827b0c58-66e3-43fc-90f8-9a34e7edd37f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3902aac2-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299599, "uuid": "751aaa44-7a80-4e16-b63e-72f22e823dc5", "comment": "Malware payload (SnakeKeylogger)", "value": "8b4717e91a26d825f5b57fc9a13747d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299599, "uuid": "daa8998e-86ed-4d5a-873e-a9a27c3a2f33", "comment": "Malware payload (SnakeKeylogger)", "value": "739ded666c4e208978ef5fc2433a7f3da8c222f29279524d09c17c798aac6259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299599, "uuid": "3e68ce9c-9017-429c-829a-d7a36d0b2851", "comment": "Malware payload (SnakeKeylogger)", "value": "0129cc46460e4b67f44efd485e45a44aa967f115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299599, "uuid": "6c96c0bb-a09b-4fbb-9792-388f8e3e253e", "comment": "Malware payload (SnakeKeylogger)", "value": "57ac20e6896f220c209bca73f12ed113e192e7bc3df67538bd3bd4cda14ecac57c77e3622523f3faa2977276b1fd0900", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299599, "uuid": "b5c72d33-cd3d-4e27-b8c4-48a2acfb4f43", "value": "T1A1F422161C1C5BA3C93EC7F8583255A8C3F66D682972E6371CD778CF26743A5001ABAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299599, "uuid": "d01dd233-dc32-4d76-aefe-07706b2e105b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299599, "uuid": "2c641ec5-08b4-4418-94db-66eb78bc8d6b", "value": "12288:gc+h6q6EMTYC0ND571Vd8cv26fXo7J6yR4TCiD2t0benvPln99vLGHYEMK7T:OYXRQ57jKQ4X4TCiDPbevPl95LGH3pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299599, "uuid": "b18fa4eb-8bdf-4223-a099-f9c189637946", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299599, "uuid": "a5f8b6fa-05ac-465d-9e4b-1bc8ab42bade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299599, "uuid": "d78601f8-eed2-4200-ae29-60ca0f33afc0", "value": "8b4717e91a26d825f5b57fc9a13747d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d3114f-ab7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676278367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278367, "uuid": "71dd4201-5c9b-4ed4-b44e-041a6ca872a5", "comment": "Malware payload (RedLineStealer)", "value": "aae5047ea61f8c07dccfd96c74d14a3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278367, "uuid": "936eea2f-ff00-4def-97cb-91f221cb4135", "comment": "Malware payload (RedLineStealer)", "value": "73bf932735827db8d9f1a1d7ebd7cef4995036e7ea6b56273456163b905adcea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278367, "uuid": "86d694a8-1341-4112-a347-374ef382f239", "comment": "Malware payload (RedLineStealer)", "value": "557d3b15395e84cc12d4b43b905348446d5fc3fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278367, "uuid": "2c6359e3-126f-48c3-948f-8dfa47ba81f0", "comment": "Malware payload (RedLineStealer)", "value": "6b237ddbff817967b7860fad95a6b15d8cd3a0c0526e634375f65cd8c9024cf4a213c87e1e41b8f25087b743aaf98b4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278367, "uuid": "f49c2791-e1d1-4a2c-a99b-d886b4147f9e", "value": "T165F4120776EC9435D9B5637009F713D72A397DA05B38C3AE234EAC4C1C712A966327AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278367, "uuid": "e7521187-d2ac-4cff-8ea7-de43125b4a0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278367, "uuid": "a66b6217-272f-40f0-85b7-739fb7a4e63a", "value": "12288:vMr0y90dUaJ8UCFtCRcgjcaDE37wpeJCGCKqcZbTTDXjc3UJoR1uJ8C:zyQURTFgNxE37bCbR0nPRJoDuJ8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676278367, "uuid": "749d6147-8c0e-42a1-9baa-caba1a998924", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676278367, "uuid": "fed9ccf0-8d56-4dce-a6f2-f5fd49dfc05a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278367, "uuid": "d6ceadd4-1e8d-4fa6-84b0-c938d2358f2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c93fbc-abf0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676328579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328579, "uuid": "39d00870-8577-4bce-b3cd-5fcf99e25ef6", "comment": "Malware payload", "value": "1110bd14bf2401c4c96f142d0ed002cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328579, "uuid": "3f9d6171-45d7-4270-8f38-a2ddd669e2d7", "comment": "Malware payload", "value": "73c771a8a8fab929c1f1b58ad4d142546eaf3716f8e9085e671b14d4b6454172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328579, "uuid": "882973c5-b7fc-4cb8-83a5-1122a5d5d202", "comment": "Malware payload", "value": "0a13256f85b41bb98dd547094d80258162c674dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328579, "uuid": "091704d2-e1a3-447c-950a-cc77479f7ec7", "comment": "Malware payload", "value": "98d2e9548369c486467a8ef896becd37492b6826ffcc9332326043cd88976e438b54b963d6c3872718b594d2fdc2e6ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328579, "uuid": "09cfa37c-9635-4ffe-ae40-34f76378e54a", "value": "T128E5127C7145D4ADC280BEB98C3AD8F75CD65EE3E8D4A02274D87F3F52B9189960A213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328579, "uuid": "124cfe8c-705f-40ae-930f-5036c27d57ea", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328579, "uuid": "fd22560d-08f1-4699-96ad-5f669cd32ec6", "value": "98304:JH8OkigcWuVUFdkAaTirF84vVVYIhv03YERVYQpv2MR:dJJQ6cd5Sy9VYIhvgPvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676328579, "uuid": "121f88ab-ee68-45ec-94f7-51e9ee88b899", "value": 3309974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676328579, "uuid": "6827d526-6c34-4daa-b9a9-d242b3b4fcc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328579, "uuid": "8333bc7b-f074-446d-a3a5-ead5418b152e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd52ab2b-ab5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1676265568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265568, "uuid": "95a222f9-c1d3-4e6f-9b5a-7c1e93b62b3c", "comment": "Malware payload (LockBit)", "value": "e9cd8c321b68118611a0863b0b91b8f5", "object_relation": "md5", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265568, "uuid": "f7d535fb-9e45-4f19-9071-8223276febb5", "comment": "Malware payload (LockBit)", "value": "74437ac6c9f630c52c7e230d57d38c4cbc3affb3bec9215f090a0e3dca8e9d78", "object_relation": "sha256", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265568, "uuid": "36fb8850-7804-4e38-801d-1e9017063aaf", "comment": "Malware payload (LockBit)", "value": "dde3509b41639f4ae7383bcd7b1c17db88b667cf", "object_relation": "sha1", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265568, "uuid": "817f8bef-ea49-4335-9c04-b7fcc94a6517", "comment": "Malware payload (LockBit)", "value": "9c9c69273fe5dfeb7401902337d97bef007a4a8f7ad6d50aa0219faf4c03d473f5bf13a0fe9f396ed266509c2e47dffa", "object_relation": "sha3-384", "Tag": [ { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265568, "uuid": "ed65489c-894e-45c7-a87c-3a48551fcff2", "value": "T150253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265568, "uuid": "0010d372-5c21-4c0c-8592-a78d3c7dcf96", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265568, "uuid": "14ab0147-b15d-41da-8661-20a5e43d890d", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdAF:Ujrc2So1Ff+B3k796W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676265568, "uuid": "e47d0d62-1045-4601-98fc-7e4d2ad2e7be", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676265568, "uuid": "e9ef7e09-92ff-439e-a7f4-9793e0fe23ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265568, "uuid": "eed6bace-9a9c-4c67-b8e0-357bf92d2019", "value": "2023-02-12_e9cd8c321b68118611a0863b0b91b8f5_lockbit", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55fe34d0-ab66-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676269153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269153, "uuid": "37ca7c37-e20f-45c6-ae08-8b626b1ec987", "comment": "Malware payload (Amadey)", "value": "7c26bf60f9a168d9ae3eadabb67d5b87", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269153, "uuid": "507e99c1-f681-48ed-bbb1-364a00feca4f", "comment": "Malware payload (Amadey)", "value": "748e70274118773939c46dec2839028266fab4330219bdbc139b1ceca82d7a60", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269153, "uuid": "787a1b9a-2a8d-47da-93f2-697ed681fa13", "comment": "Malware payload (Amadey)", "value": "16ee41074bb51f35cf1dc842bd2f48c8af71d514", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269153, "uuid": "dd370542-895a-48f3-bfff-6f99b16e19d0", "comment": "Malware payload (Amadey)", "value": "16c8fbce3f1b123b99c05b3b413502c120488b27309e3c431f17f459b328e69d6920fdb5296aff3e8d191d22bd871fc3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269153, "uuid": "cc4e3975-d6c1-4323-a2b7-18d293c2ffb1", "value": "T179F4121BAAF8A172E9F063B05CF202C316357E606638935B378BBC590C335B1A579727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269153, "uuid": "e187e814-a0b6-4e0b-9c30-fc93a178d0fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269153, "uuid": "8410bba3-a761-450c-88b9-adb67cd6776f", "value": "12288:RMrCy90b7b74GPbspeG3VqZPF9IdeJRIy9i5u1Hri5qepo2KE3ZDCt:XyS7bDb8K9JR39i5u1HriY6oai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676269153, "uuid": "22566f82-085c-4b87-be10-1b87de98b971", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676269153, "uuid": "d76f6357-d73e-4484-b94f-b7cb251f2040", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269153, "uuid": "1577765a-68d6-4720-b989-cca15f5babef", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b3894c-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676280425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280425, "uuid": "196f64f5-d82c-41fa-a35d-19dc374c2caf", "comment": "Malware payload (AgentTesla)", "value": "f171857a9cc7939cc152f43316ee30d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280425, "uuid": "2e18953b-b6d5-4748-9d31-4e5cd3ca5410", "comment": "Malware payload (AgentTesla)", "value": "74a772134e325f53cb54809a228f2cf32763ecd6138d67160d9ab14f6e65ed4b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280425, "uuid": "028480d1-7678-45f9-b4e6-439829518ffd", "comment": "Malware payload (AgentTesla)", "value": "50a88884f5cae5469a6558e67fbf3bc12b473a5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280425, "uuid": "5a18a0fc-d0d0-4d4e-a744-7aa61cc1f4ca", "comment": "Malware payload (AgentTesla)", "value": "89db1431b7f1dcd3d37c20ccfe8ce6e5e75992959a882622f8515e14740444e9011874d4fc3dc48b46afe94ce7d4ebcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280425, "uuid": "848287c7-b1fa-4518-89ef-b940a564ef24", "value": "T1AEB1F9A5570C0983E1239276C959BCE346B7FB2FC6CB1B34636EF5F1092B1A67022780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280425, "uuid": "f789ebe0-8aa4-4af0-8d8f-3e12ff2fa4cf", "value": "96:AiAAwiD2riQQvYMM+nHkWQ8hS+FueiyMolGj1U:pAAwivQQv8W5S+Fue7MolGj1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280425, "uuid": "b59f6ee6-37b0-4669-b6ea-bfe866d3d10f", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280425, "uuid": "65e96fcc-023e-4f7f-a035-e67c62d69adb", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280425, "uuid": "20070627-4b69-4684-8537-662eff38cc6f", "value": "ORDER ENQUIRY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c12f56-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676301551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301551, "uuid": "4952e0e5-68f1-4608-965a-049688fb8f80", "comment": "Malware payload (RedLineStealer)", "value": "dd7b661cd19f683c1edfe6f04fac63bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301551, "uuid": "8f995d4b-8dbc-4d8f-9a02-807e27cc0f29", "comment": "Malware payload (RedLineStealer)", "value": "751ecfdc9e407c18104db883926c9336a798e48f582def9635952770b540f2dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301551, "uuid": "4fc73bea-afde-48f2-bd99-a08330ebba4e", "comment": "Malware payload (RedLineStealer)", "value": "2b8c220dab3830ade6bf9cdc12fecc0cdf0893ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301551, "uuid": "0b8f5e43-0d34-4209-acfc-087ed520e124", "comment": "Malware payload (RedLineStealer)", "value": "a9b09bb228b2793f5f97875463f2e56bb6e3d839ff80ad1b8a6ce2fc77d973c0866612b3c1c9bb48dbf00dd256eac001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301551, "uuid": "e4955042-ec1f-454a-af53-c5533fdd596e", "value": "T1DCF41247B7ECC422E9B6577018F603C319367E619A74839B274AAD2E1CB27B07532727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301551, "uuid": "d5668078-ed8a-4923-a6e7-a27ac3ec7daf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301551, "uuid": "d847d89d-f2a9-4b68-8c32-2066d312844a", "value": "12288:EMryy90z2yn5owjOjwr88EssIPXY/pmGZCDmBiipSBf+807:Wyxy5owfr88EssI/QVoCig59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301551, "uuid": "f4483174-3ec9-41a2-98ba-e9b4fec2d8b7", "value": 734720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301551, "uuid": "62aaff94-ca97-4a2a-bd67-f1035245f2f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301551, "uuid": "a8cdc4a9-fa1a-4b62-a15a-eaa32adbd564", "value": "dd7b661cd19f683c1edfe6f04fac63bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286bb62d-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676276808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276808, "uuid": "3f220406-8e33-4645-93a5-937fc119a76e", "comment": "Malware payload (SnakeKeylogger)", "value": "68fbd49ebb0d057b49851f4896773320", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276808, "uuid": "12d70175-0d5e-4b4b-a647-5fa1d66973ca", "comment": "Malware payload (SnakeKeylogger)", "value": "7612674925a45bd3432bd061d280a4be07d6c8a9b2b59387141f0655cd8714bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276808, "uuid": "2a6d6b16-e4be-47f4-a48e-9fd80b67588f", "comment": "Malware payload (SnakeKeylogger)", "value": "6e9b15718691e87f7eed3ca356488801fc7a0f95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276808, "uuid": "209cd3c1-705e-437b-8565-7a0d1b9b283a", "comment": "Malware payload (SnakeKeylogger)", "value": "ca0efde3b391ad0413bbe58589740ebf1d5ea2f1f13d64f1a6e157f96632fba91d10886565d9eb07f4777e62c629a35c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276808, "uuid": "dc40fb37-9664-4568-9eb6-c005f9d407a7", "value": "T117E33A1D2BF88800E5FF5A7305B15122C776B8021A2ACD1D56D2F9292A7E6D0CE1BFD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276808, "uuid": "c3a83b4c-b80b-44fe-bafc-11728cf87118", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276808, "uuid": "ec094b41-6b93-4d4b-91d8-69e4e893150d", "value": "3072:V8fZCYrYNJ3jpxlTvmESbDB2Wb8Ry3wBjOXFbYd:9YrY73jpfUMWbO3O1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276808, "uuid": "0333cdbc-d30f-4dfb-b28d-87721a89c8c9", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276808, "uuid": "989521c4-53b6-489a-8f61-358ac4d07763", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276808, "uuid": "58540e6c-5248-488e-ba3e-5963d058eb10", "value": "68fbd49ebb0d057b49851f4896773320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "563b5e1c-ab5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676264429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264429, "uuid": "c34e2ec5-a3e3-42e7-946d-d424d12d92f9", "comment": "Malware payload (RedLineStealer)", "value": "dc58ef765d8d64952f7b3b800bd52d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264429, "uuid": "e75dfc6c-736f-41bf-b6ed-0f3bf8173f08", "comment": "Malware payload (RedLineStealer)", "value": "7641baa4d5c0a4a55d9cd17301514b4b4c9657be5d1bdc026b5adc0d4bbfb29f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264429, "uuid": "222ec516-525b-4084-bbda-8fdde616fa52", "comment": "Malware payload (RedLineStealer)", "value": "6b5e666338df54210d690b11f4fdb381662d7201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264429, "uuid": "47a2b0bc-ce5f-41c2-a2f4-09a9b0fcf4d3", "comment": "Malware payload (RedLineStealer)", "value": "17fcbb7e4cdd1e83f7feed675bc201e4fac6c6bcf91ae80a904de08a7a4016c4f12ff616704733abf74b1c9087001664", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264429, "uuid": "82dd7165-685a-4275-9f52-9916fbffaa13", "value": "T1A754F11E78F29233D497C9312520D7A0BA3FFC72A7A0C44B33655A9E2E306D18A79757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264429, "uuid": "7e80a537-3396-4d98-93ff-90ef9383f9f5", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264429, "uuid": "2c44ed48-926a-48ff-80d0-4c64ee900eaa", "value": "6144:xUzB9NyCjX4WEIbVYGSB7RGOGCQUb7QwLQk5KqsdSkx:MN7LYGSRRGQ975Wd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676264429, "uuid": "48382d7d-daba-4b79-bcfe-4539d80291ff", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676264429, "uuid": "67aa14cc-865f-4989-9bf7-12f08c566687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264429, "uuid": "5d67e79b-725c-4bcd-90e0-15e78376b07c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef507dd-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676280577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280577, "uuid": "5ce34eae-d8f7-4c3f-aacc-c019e26f7225", "comment": "Malware payload (GuLoader)", "value": "b5c481207626216633fb86a433df5add", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280577, "uuid": "597ec5c5-e170-4433-b302-f790a28a9931", "comment": "Malware payload (GuLoader)", "value": "76578e322f2bc2a17088d6246a219f2a7600d459c40463c270d3bc7a8a6d1925", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280577, "uuid": "ca327366-e6ac-4642-aa09-8097e5a873d4", "comment": "Malware payload (GuLoader)", "value": "534fc0d1973a62a1f8d61e45d52accdb5bdf233f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280577, "uuid": "f1b6bda5-95c0-4d93-8046-419616ef7895", "comment": "Malware payload (GuLoader)", "value": "b92ea01598825a11394455d14cf63db88d619fe7f297d18e9a6b2f09124511e36179124fada6dc3cf9d0ea8517e4ef83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280577, "uuid": "ecda8ead-3e18-4f7d-858d-0d419891ee91", "value": "T1DA84125837F9E027E12B8E354CD1FB7643B6AE109C2696037BA27F6B34752C6D82405B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280577, "uuid": "23570d0f-0dfa-45d1-9bfa-15faac1bbafb", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280577, "uuid": "06d69109-15c3-4662-938a-98765b07f4ad", "value": "6144:fC2+8+wt+8ZiJy4a1hhKlw8P6YscxVfEENcNxMMDy0Q4Y3Shi8:f+4iy4arwtlxLNMxMH0Q42+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280577, "uuid": "7dfdd996-20f6-4e26-ad1e-22403a8d1718", "value": 390501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280577, "uuid": "50f804fc-2b43-40d1-a020-c94a33ae8723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280577, "uuid": "b42d35f3-36d7-4fdf-a331-4a75dd3cfe21", "value": "ZiraatEkstre_202301.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f599516f-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676271998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271998, "uuid": "24c95060-e14f-4565-b7fb-b3e436e65c4b", "comment": "Malware payload (Formbook)", "value": "3317e2f2044bbe23f5c8ccd2139ab59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271998, "uuid": "89e5b3e6-499d-4e1b-b411-8423f02d2ad5", "comment": "Malware payload (Formbook)", "value": "768e93dbe738905b75a89ba17edae3c981219e7f0261b19cdc61a055c0bb51a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271998, "uuid": "13b30b27-100b-4e64-af43-48869a0267fc", "comment": "Malware payload (Formbook)", "value": "0c639171fd3d837ca770b734fa5521c87409bd89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271998, "uuid": "029bda44-86f6-43d4-8526-476fb128ccf7", "comment": "Malware payload (Formbook)", "value": "ab426887e56e46c85a76d6abdcc125163f0d688a088b8781dfeed08827d0cb57928c7d22475338a375d058c54dc7fa26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271998, "uuid": "f7e30922-4fc3-495a-9e65-3fe644a8eeed", "value": "T17C6423D2369081A3D69206B25479613BBFFBED063619A3C72320376E7E76513DB1C322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271998, "uuid": "4693c71e-2f4f-4f90-a8b2-ff0a5156638a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271998, "uuid": "4d1cee56-98fd-4319-97cc-17af1979b29a", "value": "6144:OYa6xXhqi0rwGRhekazs/rL34dJBBYCxKElCdOyJTuXA9QbMPR++:OYDXhZ0tekAs/H4TfYCxKElCI3A9Qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676271998, "uuid": "84bfe56b-9691-4458-9486-67bc493f04c5", "value": 330158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676271998, "uuid": "a58f03f9-3e96-4584-a9df-68c8cbbfd57d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271998, "uuid": "e0ef6f81-dbb9-4508-a05f-77de98ebec4d", "value": "0272023.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff43673e-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272014, "uuid": "c3742cbb-eabd-45a8-9e68-54683a331f19", "comment": "Malware payload (Formbook)", "value": "cd16e966cc0e3f0f102d9c157dd82e4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272014, "uuid": "459adc85-43b6-4c74-ae59-22d7e78bba9b", "comment": "Malware payload (Formbook)", "value": "7724828eb796d8c3310c8af73e9c19ecf37ad1af5ebc0cbd35efc5d4b36f36d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272014, "uuid": "4d597888-2582-445a-99e8-d00bc1b20be4", "comment": "Malware payload (Formbook)", "value": "9368d50e547cbaa1fa184bd21bfb089ddecc7b72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272014, "uuid": "33bbeffc-d4b0-4e54-86f6-1de7f703f75d", "comment": "Malware payload (Formbook)", "value": "77e8927bcc1d36b93ce749704df90114bfefaa3e7d9c11235e1bb8f681ccfbfa62e6a76deabb8b6addb35d1b2c80eac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272014, "uuid": "f72f92c1-da6c-4ee9-99b9-1886bf4e7e76", "value": "T13704AE32D641C031E2B212B5F6BD0B7B883E0D347295A5BAA3A516E06FF49D5F16930F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272014, "uuid": "e317566b-90f3-44a9-b135-5f79e6992721", "value": "3072:iwJFEh7A2hy+b13/R6r6Kj9uWc7eKIdo0Z56zGDX+SGj2g9v:a7NZ/EeKj9uWbKId7nBX+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272014, "uuid": "04379203-884c-462a-8c14-d34ccc437f59", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272014, "uuid": "fd1dfbf2-c34a-4c97-86c9-6eb59db45f1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272014, "uuid": "f9837e4c-70a5-4ee5-963b-3c16e6b81958", "value": "7724828eb796d8c3310c8af73e9c19ecf37ad1af5ebc0cbd35efc5d4b36f36d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4a0229-abfa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676332758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332758, "uuid": "2a2536de-b6d4-4457-9b36-18b14f63b3f0", "comment": "Malware payload", "value": "fe877d42ca06b251d2abe6aa8ed5e3e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332758, "uuid": "d4c4c4e4-3778-482f-aac7-7cd94bb34693", "comment": "Malware payload", "value": "7724942bf64327118527a3f40be8c0c8066baebe261ac474ca916309c9d21800", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332758, "uuid": "aded0f24-2122-41af-8566-7c24d89e5c95", "comment": "Malware payload", "value": "b191dbb511fb009b0ec25388c1fa81d000b047db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332758, "uuid": "32c993a5-96c8-4f04-9042-348f4a546524", "comment": "Malware payload", "value": "660263032eb8e350879d093168ceb0bc8bb89d68b6a6538ee46fde3e5eaa27307980e614cf9e2735cca68d01b43c6651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332758, "uuid": "735b0afa-3bc3-4448-b3e1-178f3526cb9e", "value": "T19914CF11B390E471E46746315925C5F13BBEF821ABB9AADB63946B3F0D702D1CA37382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332758, "uuid": "e7a07ba3-1d06-4f6f-81e6-ca1c9fdb1aa1", "value": "dd0586f5c5e46eff877624b05b375878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332758, "uuid": "03621682-365f-44e2-912c-3cd22da92b30", "value": "3072:VpnkuRa5zbmyBHBPt7NkOX+Ac99ojO+1lWgeLCjhA8S:Vtcb5LV7Nke+599QLMNQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676332758, "uuid": "185f18b2-4990-47dd-96c8-30fbaaaafc58", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676332758, "uuid": "e45fde95-9872-48a3-8a77-69a17efe5c7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332758, "uuid": "4873dbb3-a5f7-41b6-a99a-071b32b87702", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23f8b2e-ab31-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676246518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246518, "uuid": "720bda49-1862-47da-98f8-d2e865b4c794", "comment": "Malware payload (Smoke Loader)", "value": "083b82eb68ccfe6f4a4f2e414e38b0c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246518, "uuid": "ddab95b1-8399-499e-af3e-a0b82f442975", "comment": "Malware payload (Smoke Loader)", "value": "7735ae96516897e1e8b5f3499f8c26cfa313abb56eab929ab7430910fc1ff08f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246518, "uuid": "864d8705-e26f-4087-943c-d74e5b004cb8", "comment": "Malware payload (Smoke Loader)", "value": "97a7a1f15fa0734049e37a2c4ca6092b2eb59623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246518, "uuid": "b3ac9db8-c4fd-4a67-b638-fb047ec7bccd", "comment": "Malware payload (Smoke Loader)", "value": "96508fcc7c73051dbfd6932cbbd1286f89c0c23f64fb3d49b99248dcb17a6bc2af549124e50dc6d8b3c65754fac695cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246518, "uuid": "495af17f-8362-4c21-90b9-6cf22ad7ddf7", "value": "T1D504D0D17AA1807FD2A740745920D6A0796EFC7197A1C4DB23481ABF1E30ED29AFE353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246518, "uuid": "b2fd50e9-fbe4-4d1e-9a9b-cd6536d8553c", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246518, "uuid": "4f10853a-323d-4ac9-b2d7-f5218863a369", "value": "3072:SXKZ/PN5HhBNjbRQISxxErGXgapWG1ACK4Xrdt6NlmkrFX/0Slwg:rhHh74xCWgapWG1rXGNMkpzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676246518, "uuid": "5af642db-9a19-4670-91ea-2b436f660076", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676246518, "uuid": "8872c26e-37cf-44dd-97e8-2100c5cea466", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246518, "uuid": "35fa12fa-94a9-419b-93eb-04f2d584dbe4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53e19db-abef-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676328127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328127, "uuid": "d46aab4a-6d06-474e-b0a8-73f06ef24d29", "comment": "Malware payload", "value": "a3e5af0700d9aa1e88ffa15ea6c5fd4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328127, "uuid": "f5b04518-223d-469b-b4f1-eaa86029b945", "comment": "Malware payload", "value": "777c533a168feea8a502501507934a656eb7aa0f2401b020149acaa36a99f721", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328127, "uuid": "dd35a7fc-e7b5-4493-95f3-3d7e9a80655e", "comment": "Malware payload", "value": "79c23bacd80ea3d191483f5fac4e8024c75ae817", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328127, "uuid": "555a5409-833e-4373-87a9-582c7eae8365", "comment": "Malware payload", "value": "89a37f572187b9a1b928d035fc6721c14638a47ec107f9d1fe5a1f5c981d301a279b28ceb144ffd7b5abcf5aa6dd149f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328127, "uuid": "34f4b0d3-90f5-4e95-a469-74c61026afe9", "value": "T19AF41207FBED9422D4F42B7018F307C71836BE614A38879B674EAD551EB22B162313A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328127, "uuid": "34b57979-ae21-446d-b143-5033240e7efc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328127, "uuid": "f0553ec5-517d-4093-b157-61c323cab67d", "value": "12288:eMrTy90OntVWVLs7sE7GMorYxXUW3keJ8ucJYWAGPctgW89/eAJ:VyfVOWs+G2xXUWV8u+oGktg9Ms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676328127, "uuid": "35773b2f-da45-4608-a137-3e81206ae0b7", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676328127, "uuid": "d967d626-afcf-4512-956e-b9fe01e0311f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328127, "uuid": "5e2f9286-32bd-4909-84bb-e1f9efcb3c0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e7886f-aba3-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676295275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295275, "uuid": "c008cb38-381b-439f-b8b9-fbccf455c8cc", "comment": "Malware payload (ManusCrypt)", "value": "20ceaf55515a73d64a5e98f3a3192700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295275, "uuid": "b149189f-8886-46a0-9c5a-36e21340686f", "comment": "Malware payload (ManusCrypt)", "value": "77a7949f1c2511971c674037e762400557453371346fc8ea1cc04e0d8a67e968", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295275, "uuid": "7e632b8b-d0b6-4095-93b0-fad57ad4e794", "comment": "Malware payload (ManusCrypt)", "value": "4ebeb78cfe34f52c0d08f4b61cafb7a4c2aad642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295275, "uuid": "9ba6dc19-6be2-4500-9baa-1c5a752534d6", "comment": "Malware payload (ManusCrypt)", "value": "dd76b24f8c29807bae1b143a3190cb0ea059cef338e4a35733170febe39597f87b46078ac120f2933796c8b804c35df6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295275, "uuid": "776db24f-a0c4-47c4-9563-3e3a628b1159", "value": "T19C14CFA333E09471D1B757319C29C2F47B7EB8B14A78A65BB7082B2E0E7C1D09972352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295275, "uuid": "93107ee0-943c-40a9-a6f1-7eadaeb3da22", "value": "b5b37a1e2171531433caad206e98583c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295275, "uuid": "5929aaa7-5435-48d4-b23a-960b52348628", "value": "3072:3n9/DFu6EZiP6UMH6ndA1pDAW7og04XL85WpTwcD3dZM:3ndDsDwP6UMandKDi5m8chZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676295275, "uuid": "ea1fed7a-c938-404f-bb54-ea3648170a95", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676295275, "uuid": "d11f2630-7da6-4a79-91b3-259ee965b1e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295275, "uuid": "744ebf2a-6bb9-4922-aa46-10adb2c41e4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b5fe09-abc0-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676307703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307703, "uuid": "55deb46e-8112-421c-b978-cb908e53af64", "comment": "Malware payload (GCleaner)", "value": "b42b0103025a5622d68f749ccfbe958a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307703, "uuid": "6e229b06-2f7d-4337-b1cc-4fac003b6674", "comment": "Malware payload (GCleaner)", "value": "780854a295a880176d2e23c228ea5dbeaf02fe85fe168aaa4d1ba14c9f366b5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307703, "uuid": "3b6799c2-dbce-4849-9303-0486c8d7e90a", "comment": "Malware payload (GCleaner)", "value": "cba307f2fa760a95cd265a33f05d34e4b7ecc1b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307703, "uuid": "61f2e93f-9169-41ef-895e-19ece72d22ae", "comment": "Malware payload (GCleaner)", "value": "97103cbfc0307fd859eb1887b8ccca49a43740b01011bb4580c8b868e4f2f3bb29fd3acdb7df2ac51cf36ffac218a768", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307703, "uuid": "2a1fe000-85ca-46f2-a28a-657f4c13af4f", "value": "T1C9E5127C3505C56DC290FDB4C82A98FB1CD66EE3E8A4A46270DDBF3F927C285560A253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307703, "uuid": "d589d9a5-2635-49b4-8f6b-3ce5fade64ed", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307703, "uuid": "c8feb00f-241d-4b1e-b7db-25211e0c3772", "value": "49152:rdHaDmZQArhH+xzShxjLElqxe/UTQTwem8KD4v/Qo9BwWIlGLCgv2MR:JHaDm6MXxjkrMTIwt1kQoMEv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676307703, "uuid": "cc330bdd-e6e6-43d8-bf29-149c0c074266", "value": 3136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676307703, "uuid": "0e2bbc05-799b-4fbe-9811-2dc7e8b09d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307703, "uuid": "d2bacecf-10b1-41f1-9965-1107c8f51d3e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94de654d-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676299753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299753, "uuid": "5a38a0e9-a9a4-4bf3-94ea-8a3fe7c1a3ea", "comment": "Malware payload (Smoke Loader)", "value": "299abe68468fbcfb0ec14c275adbaed5", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299753, "uuid": "d88fb72f-234d-4bc4-a6d6-2c461fbaa2fe", "comment": "Malware payload (Smoke Loader)", "value": "7851280eea304c7d6ddfb3640e06096567a9ced592c618814dc3c5e6bc158e03", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299753, "uuid": "55953fd3-63ba-497e-b19b-fe7e23e6e54e", "comment": "Malware payload (Smoke Loader)", "value": "4b19ce25da1c58584f9bf20dc63cad53aa1af576", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299753, "uuid": "06e7d5e3-e9c5-4a35-b722-bd62b55ad9d4", "comment": "Malware payload (Smoke Loader)", "value": "1d6e7266a3e08ceba165583b5de1882e09302f1d0c50e5b2258e476c6ae0b2ef7ecc93931ca641f6a133a3a2982917b8", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299753, "uuid": "8bdace3a-f7bb-421e-a15f-7aaeac574fdf", "value": "T10635F107F172ED2BEE16C57CE84F248382169C7DA919CA4D22C2B32E56327F45D3EA51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299753, "uuid": "9f883435-59d8-4551-bad8-bd8257c59ddd", "value": "12288:MFeXXtqSdgoA2hFeqqKjij4a3DjZqpar9dnVWzDQVO9UIoA88beyWibIJMRR6kH:MFeXXFvA2hFe5EezjwYXnCl9vOKjRRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299753, "uuid": "2f0b7a7d-8bdc-4b3b-9953-193de01cfb23", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299753, "uuid": "b5a24082-82f3-4c32-a5e3-125e38adb204", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299753, "uuid": "bd92fc69-5075-481f-9553-c7bd4582cbab", "value": "Inquiry.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322e4449-ab32-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676246759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246759, "uuid": "fbfb1976-371a-49b9-9cd5-61cba199516a", "comment": "Malware payload (Amadey)", "value": "a17888ab2061f7853e0f13e818a21094", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246759, "uuid": "38b7a0ef-1aea-4ed0-adfe-e42e68c328eb", "comment": "Malware payload (Amadey)", "value": "7861c3d75c036d7de5c664b55e1a9924f11e927dccc28a0f6f74cb10ad851b07", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246759, "uuid": "ef482478-6855-44fc-974d-6f8bbd33d8d6", "comment": "Malware payload (Amadey)", "value": "b6a1369aa0349a96b94796da33c65f113f1b5aa9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676246759, "uuid": "1a473f9a-ad96-4fad-ae8b-068f9f4e5460", "comment": "Malware payload (Amadey)", "value": "e9c6767ac02e5be90a1ac8ab2cff58965442d1a1ccd7ebea714a6c20bab413b9bbb6de16a3c8252d7ce4cfa96c18df52", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246759, "uuid": "45b0e612-47e7-4758-9f06-b96c29e53c27", "value": "T1E9F4120BB7EC4032E9E567B05AF203D71B357EA16A38825B134FAD5948726B4B230777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246759, "uuid": "450e07f4-5b01-40c1-aec3-e579ac56735e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246759, "uuid": "72dbde34-9768-4e22-b3ee-42714ea705c0", "value": "12288:3MrJy90oiquCCpvDWByyIlYbb6bnwfpEHG31eJsnlaoZinMEsAtnIm4Gyk:WyBiquk1fuLIamGsnAoTXsIzfk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676246759, "uuid": "590c5cfc-5a6b-4124-86e3-00575d5b0d3c", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676246759, "uuid": "f14c1473-9883-4d07-80f7-62619c557449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676246759, "uuid": "054436d6-a275-4d53-a673-b33df3669fde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "200e5171-ab88-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676283666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283666, "uuid": "de4bf928-f9b2-4458-96f8-11cbcdaafebf", "comment": "Malware payload (Formbook)", "value": "fa9eafd7f4957b5d48ff3f93f066f04c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283666, "uuid": "ab9d9aaa-7966-4dc2-8bca-e1715e18c368", "comment": "Malware payload (Formbook)", "value": "79059aab91f5ac92608b8cf4c141925f567300265c5828220487596094a5c4f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283666, "uuid": "40e8d9c1-6afd-43a0-b124-1a3b2b5c7d10", "comment": "Malware payload (Formbook)", "value": "63d5810ea804f6946ba66589685933a268f4cf76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283666, "uuid": "d817f2be-8349-42f6-be25-50be6e264f39", "comment": "Malware payload (Formbook)", "value": "2ee1b8708865603d705ce4cdb9cd4bd8cc3038abe5869502adc50599db0566ae542c34b4950938789caee59423294b35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283666, "uuid": "8a9c78a5-62ea-4db4-863a-cdc0bef95cf1", "value": "T1E14412517366C263DD6707310E3A462B9BBDFB061529630B63903B6C7AB6903DB0E772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283666, "uuid": "6c31e417-7d00-4f95-aeb6-21327491ece1", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283666, "uuid": "b390df21-0896-455e-a5bf-c3eb014103b0", "value": "6144:/Ya6Zgc1hATP+ZERfJE0PilplRc/Bsf94JLdeHs25wGmtg:/Yrgc1CTP2mnYq/0mZej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676283666, "uuid": "8032946a-f87d-4f25-a1d4-5c7ea002b2e4", "value": 278104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676283666, "uuid": "5a3c2b46-9005-48ab-abc7-409f363ea06c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283666, "uuid": "23e803a9-eb2b-41e5-b049-f8349edf224c", "value": "SIP101523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d2fd83-ab40-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676252911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252911, "uuid": "2cf8efc9-cdec-4e9a-803b-71aa1f8456fc", "comment": "Malware payload (GCleaner)", "value": "107489ba916b87537be70e895669c41e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252911, "uuid": "55dc4d01-5bd9-449e-8cd9-81df7840a3f9", "comment": "Malware payload (GCleaner)", "value": "7945a164080f4cab6a10931a9c820ac10df3084dad3fb23699e6e20e2fe214b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252911, "uuid": "6322fbde-5b4d-4a84-a23f-8ea550cfdc03", "comment": "Malware payload (GCleaner)", "value": "e9b8cb8af9ccdf4931d4d6171916ef5605db7ae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252911, "uuid": "0426ddda-4333-488c-a505-7a915d1fa60d", "comment": "Malware payload (GCleaner)", "value": "df4a4062e5abab071f42e6819a01e61b4c21d76c15faf25cf7cac1759b605ed7f0d352f169ff8bdbb401d862c1ab9f75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252911, "uuid": "ef59ed2f-86f1-493e-8f00-9071d830a526", "value": "T153F5123DB209C4ADD680BEB88C3AD4E75CD66DE3E9A4942270DD3F3F857D1849A19503", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252911, "uuid": "4b629703-52c7-4ddb-a071-b3ca88597630", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252911, "uuid": "5cad9562-8282-453a-9951-403f4cd404af", "value": "98304:JHuus67mHcj59nIBNY6lzCRbrm4clDv9qkjv2MR:dOR0TAe2Um4cFvbjvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676252911, "uuid": "8e1c298f-60ec-4389-8e18-fa36ee2fe36f", "value": 3569882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676252911, "uuid": "90d8c3a0-d2d9-448e-a855-5fc5ba4348da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252911, "uuid": "5c37abda-41cd-4d25-8b23-047299c4303b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059ce8e5-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272025, "uuid": "d34643ed-e31d-4595-98c9-da64b02e54bb", "comment": "Malware payload (AgentTesla)", "value": "2cb570b5430925cee5f459f9f86d8965", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272025, "uuid": "5548bbdb-8858-4fa9-b37a-f0cdffbc1a1f", "comment": "Malware payload (AgentTesla)", "value": "79bd77fe303838b7cc5c66f263a0fe501ba95202eda10bc4fd6182a357f36c69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272025, "uuid": "819e92b9-bd36-4ecc-b317-d09fc0c4417f", "comment": "Malware payload (AgentTesla)", "value": "8cb25ae876e280ae4b6859be704cc8efdc37a732", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272025, "uuid": "f5ee8c81-c335-4f45-87c0-0b677e5c1989", "comment": "Malware payload (AgentTesla)", "value": "0924d13914e24e971389eb5a4a0099932894692aa4b0994087af36c66db1b0d394f88bbea1ad5661bbd81c1a02579b37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272025, "uuid": "8027e040-a49f-459b-8aa0-2350a3908588", "value": "T1A5641342F1D5C597DA761A308FBCBA172EF1E5425AB8430B27503BC97C2A952CE0FB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272025, "uuid": "3f446e64-372c-4124-8203-b7dcf5c4b25f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272025, "uuid": "3a9d5723-7f1a-4f9e-9d8d-28d5ad3b53cf", "value": "6144:/Ya6FVq8FuV7+un8EWWxr05fJKQsnzZ5XoMk8GhR8Emv9zdx/Jcdo3:/YvVq8Fk8E1r0tJG7RbGhCzd7cG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272025, "uuid": "c9ff5fa2-41d8-4a3e-a6bb-93718e06993c", "value": 335897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272025, "uuid": "8caf356e-bce1-4129-8347-eab86fdabdae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272025, "uuid": "f81e503c-17bc-4be6-9dcd-0e9cfa505f49", "value": "Contract(Intertek) Re-certification ISO 450012022 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1227d4d6-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676276770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276770, "uuid": "edb397c5-27a0-441a-895b-edcac347fffc", "comment": "Malware payload (RemcosRAT)", "value": "82e47e2565f7a1af664b5303a112ee6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276770, "uuid": "907c4191-3f20-4989-addc-99f906c033a7", "comment": "Malware payload (RemcosRAT)", "value": "7a2d285fe35b5030edfc71be23f97d3dc8ace48f6a7183135bd59c14d8dfd33f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276770, "uuid": "30f7eee3-0e79-4b54-ad2d-b447b75e5462", "comment": "Malware payload (RemcosRAT)", "value": "13cecdfda3dc17d5387a1058774748d4bf328027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276770, "uuid": "e2cd2f3c-d0e3-4775-9b0a-8f345c96d1b7", "comment": "Malware payload (RemcosRAT)", "value": "3349fc0474a12721ebe0fc3e02c39ca7eb8395a46e9a9c9bc91a3492d58f75868bf393bc6a9df0a39c5bd9cd8e38019f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276770, "uuid": "8f6b7745-5d8d-4317-91a2-b421ea1ccd67", "value": "T1A22511503AAD9B24E67D4BF02465B040A375BE1B6A66D21D3DC671CE0E32B4B8716F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276770, "uuid": "5dc51b7c-bdab-43fd-b1d7-31f959663188", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276770, "uuid": "98b62479-eeaa-4c7b-8d4c-284b9de3b7d9", "value": "24576:clIrY/TKPzG7qRDU+tTBrRBZObu1F5DGt/xwhAuqYzuwLd:gISORg4lrRTObu1F5DkiOy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276770, "uuid": "dc394041-038f-4e70-bc01-052ab32f572e", "value": 1018880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276770, "uuid": "50c8c179-7152-4e91-b14a-46c588b832e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276770, "uuid": "44737d84-8d63-49d2-baab-199d2a118c00", "value": "TNT Original Invoice PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce168c72-ab90-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676287393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287393, "uuid": "d9c15bc6-7090-40e1-a5fe-b6bc0f48bc28", "comment": "Malware payload (RemcosRAT)", "value": "229502d4721e20ab0408887d21bd594b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287393, "uuid": "7cd4232f-91a6-442a-9268-657db7ce2ba2", "comment": "Malware payload (RemcosRAT)", "value": "7a4d0d31bb0250759bfcc1c939db0df5c90e55dc5a17510552e0a273d88dbee8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287393, "uuid": "05d8fa9f-1e9a-464e-97c6-427ca85e79f8", "comment": "Malware payload (RemcosRAT)", "value": "d224349847d85cd452fd726f5b746d3ccb8ae4e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287393, "uuid": "7f2e29aa-1f2e-4cfc-961b-52d489543577", "comment": "Malware payload (RemcosRAT)", "value": "d38dde04633ce3ae0e565901299a114c28badb7f708f2a1ad46cb58956ce800eebb68f5d8b4b404f752299d099af13cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287393, "uuid": "c8ef89f2-c66f-457d-a7e9-b8fc93892ef1", "value": "T146B423B89697E44BF49319734C3B922EA8FCE6020D9C97AF131057D47B171D9EA2B603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287393, "uuid": "f0b30e60-99c1-4f1b-864c-fc6742717a33", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287393, "uuid": "b3508ae8-2c3f-4e4d-be1e-e534a421b55b", "value": "12288:xYUMCtQsUqF9LfnXHURNEhTyAKRmnMz917Vr:xYUMCt0kfnEROhQ4nMJ17B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287393, "uuid": "5ee0c49f-15b8-4351-9ece-0ee0d5e5d725", "value": 519117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287393, "uuid": "84798ea3-e6df-44a4-bbac-e6baa214e03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287393, "uuid": "dd5060ff-c383-40d9-a30e-f56884647fa5", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4cc666f-ab8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676286036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286036, "uuid": "941410e4-84f9-4e86-9cf0-ead0098d0872", "comment": "Malware payload (AgentTesla)", "value": "583f665dfb640752604399d25a7ab44f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286036, "uuid": "52b97eeb-5f94-4e54-9479-534189d45827", "comment": "Malware payload (AgentTesla)", "value": "7ace08b1b886a524fc91f97cf3ac9e8367e5d53372193adf26c5179f0c3a39d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286036, "uuid": "f4dd7c77-27a8-4e14-8e80-1e010c8f81b3", "comment": "Malware payload (AgentTesla)", "value": "86f5bd0f8cc9615fddb3d4b7748fae878bacc9ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286036, "uuid": "21673d9b-fe9b-4539-8fb1-afd7e6e1ca29", "comment": "Malware payload (AgentTesla)", "value": "d720b2d496c6574c9e5d9d3c18d77d001116f1a52588484f74dfe474cc16182bf28606be194ef3ea4f2e54e61f626aa4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286036, "uuid": "2e86043b-2b16-423c-a58d-53581f68d8ac", "value": "T17B12C610E7A88231DEE64B36BC7367A44E74FB611CA7CA5EACC9200F6C25550B672671", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286036, "uuid": "58728139-3d00-4df2-89ba-a90cbfd50c9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286036, "uuid": "41ff41a1-c9ac-43e4-8150-68b6615e6179", "value": "96:VpoIY3SIigMLWmcVyRZBz8u1ej42vW29tjGk2b28cAKzLE2zNt:Dop8LjYyTNx1ej+295r2b28cAdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676286036, "uuid": "7799c9a4-5cb6-4d64-8ffd-681800a0ad56", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676286036, "uuid": "7903cb3d-fbc4-4b40-a397-39538db0967a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286036, "uuid": "0a65d42a-6806-4df7-ae2b-cf30ff931518", "value": "aust.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1784d99e-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1676272055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272055, "uuid": "63868f41-e608-4f85-a8e7-5bcfb7ed333b", "comment": "Malware payload (DarkCloud)", "value": "601d022219ce5a476901fa09faaa17b9", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272055, "uuid": "6a868e20-77f3-48c8-b46a-a374d496dd62", "comment": "Malware payload (DarkCloud)", "value": "7c11525bb1adabfb50433d788c6a969c6d554fb470b5ef7fba53f0a8d09f73ce", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272055, "uuid": "915b9514-faad-4e3d-9245-998c2566f562", "comment": "Malware payload (DarkCloud)", "value": "f53e3fdc1ff1f7312812df3a86fc5f8c086627f5", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272055, "uuid": "c97e07d9-dc9c-405c-8559-c5136f72e325", "comment": "Malware payload (DarkCloud)", "value": "1de45d45c1236dfbb71385ed0dc791fd47a7f99c1b63ff2447d02090dc5dd0707f4c1e70895000166e2cd1f122cc2490", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272055, "uuid": "057fd3e1-43e5-40a9-b4e9-92dccfa89117", "value": "T1B835221FBBBD9B2DD2994AB434B02970033ABD577452E29E7CD2B4CE0C71B844511AEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272055, "uuid": "08c6a7e4-4560-47bd-9b7d-b2ec720e5b62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272055, "uuid": "4063591e-8d8e-4e17-bb57-5a2bcb96f6fe", "value": "24576:HEawxO5dEkFB6PD3zV0Y1t+Y/2njY2ilnFg5w0VTjqZ:kTsaq6PDRVnI5f2Gy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272055, "uuid": "ebdbcb21-3f7e-402e-a5ae-0372431e4c39", "value": 1098240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272055, "uuid": "939abfa1-0816-4620-a3ff-a4b2a1dda919", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272055, "uuid": "3fa9c23a-03eb-4977-8a54-b101d4de0d66", "value": "Payment_copy_070223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723f0ce8-abbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (Stop)", "timestamp": 1676306137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306137, "uuid": "946a1520-c2fe-4a32-b238-71c6216bffca", "comment": "Malware payload (Stop)", "value": "805a09fc14592c2acfbb1eb90502f8a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306137, "uuid": "666aa569-bca9-4d05-8ea5-8cf37fa0bb5e", "comment": "Malware payload (Stop)", "value": "7c49006f7f3884f9c9b05d53bbfbee2160610f2310e97cbb66c4aa827089ee75", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306137, "uuid": "b1c09619-94fe-4178-b5b8-4ec490b15d85", "comment": "Malware payload (Stop)", "value": "289a454f384c9027904cfce7d69c7c1626c2ca87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306137, "uuid": "ce420cde-17b6-4c71-83b3-83141f5f446d", "comment": "Malware payload (Stop)", "value": "d3cf3942839e6cb03974d5fcef7f0bf2b6be11c20955712570afbc573d3e98e1bc3e21269d3ccb38911d707c29d8fc01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306137, "uuid": "276b36f0-7d33-4079-9dcb-4df094462a58", "value": "T112E4122337C1D032C1691A365D6DC6F67A2EF8729F79766B77681E2E0E342C09676301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306137, "uuid": "a1829e07-4228-4f09-b6e4-fc26c18b07af", "value": "a915562f5b4dfee9fa3c29b2972ad3d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306137, "uuid": "aa73a1d6-ff84-4eb4-a3b2-d69d7a333a3b", "value": "12288:H/WXVfA9z5ceiH9ExapEAGQWeGqlt/qnGL9qtjFLB8hAPmkEkAft2Vd1PaZRSH:HO+9zOeQWeG68nGLgjFFNPLitCDPaXSH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676306137, "uuid": "f90c8641-d9e7-4d5e-8ec3-c37823aad8f8", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676306137, "uuid": "eb80dbfa-0917-46eb-a38a-8765f869cc4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306137, "uuid": "3f21efdf-9f1b-439f-ad71-90c4fce4c485", "value": "7c49006f7f3884f9c9b05d53bbfbee2160610f2310e97.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1dbd20d-ab86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676283024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283024, "uuid": "89d6cd5b-f923-491d-86d9-3fa302a92e0d", "comment": "Malware payload (AveMariaRAT)", "value": "6bd59d7e9f71b0d2e72d71c265b083f3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283024, "uuid": "c24949ab-c325-43cc-9b8a-3ac4647f545a", "comment": "Malware payload (AveMariaRAT)", "value": "7c9f993439ce0b0855afafa57cb1d46af42843340088afa02d29387d6c3ccbf1", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283024, "uuid": "f5bec55a-c360-4207-a9da-12004e977252", "comment": "Malware payload (AveMariaRAT)", "value": "d6000ff5b4d63d241d9c36bb7658ad841a36caf4", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283024, "uuid": "bde189ea-a1d7-4df4-af60-c8a8b2f1215f", "comment": "Malware payload (AveMariaRAT)", "value": "b75d1bb14580cf406b3ccb6e69b40146e6d0b86aea7a6c18e0d2b10714d93addcb6e813a616f0e1eeae7d675e00a34a5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283024, "uuid": "7cf534c6-b4e2-4e50-8567-475b84a3675f", "value": "T181D4127939BC895EE2EE8BBB69B1034557FAA591F092FB0C0F8474D11FA5FC04215A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283024, "uuid": "027da608-3ffa-49ba-83e7-90065fde5007", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283024, "uuid": "dc6f054b-2767-4484-9a60-49b610f6fb61", "value": "12288:bRW+0h9pmKrKS98LDT9NETkigZzIGSeru2fx1yFSgYQlQX:81AQKc8XT9NETQUGSepx1yFSJQlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676283024, "uuid": "64099fd4-f5c0-4649-a935-0d59f09601de", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676283024, "uuid": "519844d6-1e25-4d7e-8b8d-2bfe474d90ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283024, "uuid": "53402f88-84e4-4d7b-87e6-195f8a3c3035", "value": "6bd59d7e9f71b0d2e72d71c265b083f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9380722-abba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676305478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305478, "uuid": "e5a12e47-eccf-42f3-92ae-8737cde16fdd", "comment": "Malware payload", "value": "b1411d4f34c30b20e1518fa1e6a42be7", "object_relation": "md5", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305478, "uuid": "d24b99de-bb6f-4697-9f0c-c30b982cc14e", "comment": "Malware payload", "value": "7d84269a8ca5defbf09323180aca1ea7a26eea614fda04d3367c2fac2783a26c", "object_relation": "sha256", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305478, "uuid": "f23cd38e-910b-4bb8-87a7-c2bb61d2ae38", "comment": "Malware payload", "value": "6dd6cbd92ab2adb7c2e9b3522f2d9ee287665aa9", "object_relation": "sha1", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305478, "uuid": "332f3bed-81ec-4b0f-945e-1993440470dd", "comment": "Malware payload", "value": "0426b01c129fa6d7042d2d481ffcdc430aaf11484074dab8da188bbd17524a12ecde6ae3f6f22b445f776285d3e098d6", "object_relation": "sha3-384", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305478, "uuid": "6d3d813a-7479-4f8c-b213-3e678c6c62ae", "value": "T114C3D106F3509046C3A50F315DD76E471352BE92B266832FAA97221DCEB0B10DDA6B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305478, "uuid": "67ed1a17-35d0-408d-8e34-dda6829135e1", "value": "1536:NCECfm+a5rIG2GzZkHCLJu6CvsDYajZPqbB/xE:Ndr/CHKJu6SsYxxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305478, "uuid": "a1f50f45-4519-4850-b3a9-e0f12a57a577", "value": 123908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305478, "uuid": "5e9aab4c-108d-472d-a13a-78a73016d7ca", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305478, "uuid": "700f1b1b-21ef-416d-b9f2-179d96147358", "value": "contract 2.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ef24c5-ab3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676252329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252329, "uuid": "66f2d598-3b57-4e9e-ad3e-85c9e5a05fb4", "comment": "Malware payload (Amadey)", "value": "1a9079ab98ed2164f07690da29fefc0c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252329, "uuid": "66b55f78-e713-49f6-8e66-36546ad5c463", "comment": "Malware payload (Amadey)", "value": "7da66aae498183769d3ccd4da6b8bc2d06724591ea091bab4643b810f5f579f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252329, "uuid": "366c3702-7b5e-4564-8b38-de8aa0e950fb", "comment": "Malware payload (Amadey)", "value": "738f5d5663a55d1da3774a7c594c320f0b71fb88", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252329, "uuid": "42c38790-0a24-4ace-896d-4f0d028dd6d4", "comment": "Malware payload (Amadey)", "value": "9615b5fd051188e71108febd33a25e61e63e877b15cfeb4e44d1ea722d9ca5b2ff6435cea4f2ac5ac39716da63b40ef5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252329, "uuid": "04747751-b034-47da-8d71-092a44a184f3", "value": "T1BCF4120BEBD88032EDB56B700CF743D31B327C515B39429B678A6D4918739B4A236B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252329, "uuid": "f7a1e76e-c101-44e1-af22-bf586d5b4cd2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252329, "uuid": "106aaab4-4392-48f8-9638-1f9615431b63", "value": "12288:eMroy90TICVjwSPztW58Rc1Nu9tbDpNy9LlHLLoeJ50lTu+a8P3qGc8uxYv9i/se:WyiLVjHDq1QnpNyllr9ClTuzZPFxMA/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676252329, "uuid": "6c8718c0-db8e-446d-91bf-4b87c89f69b7", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676252329, "uuid": "2af14495-e4a1-43f5-b63b-ad1c583f5963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252329, "uuid": "107c85b0-e555-4c22-8b4b-3760dc4bc242", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46d580b5-abbb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676305635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305635, "uuid": "5481374f-2d13-44af-8963-2b72a10bab8e", "comment": "Malware payload", "value": "03e1996dbae2c69e8526a3d2d4855bc4", "object_relation": "md5", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305635, "uuid": "e2b42c89-1b43-4e1e-9db8-8dfde0748266", "comment": "Malware payload", "value": "7dd17b8cb0639732fe6929a5d7e1431fedae58acd401a7810afc0be8f9c42ad0", "object_relation": "sha256", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305635, "uuid": "93f9190b-556e-4bb8-aac9-448365243a65", "comment": "Malware payload", "value": "84c9e4a54e28266aaf75534f1c9fa290e36a9d9a", "object_relation": "sha1", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305635, "uuid": "64344ed8-62cd-4e44-b90b-c5f701432aa0", "comment": "Malware payload", "value": "4234ca8eba2ee6d423d931a9d9c2c1e7b1dd34a9cfddfdbf6ec9cc6f059dac09c51361682b629197bf2138ec09c02f77", "object_relation": "sha3-384", "Tag": [ { "name": "1676282502", "colour": "#236CD0", "exportable": true, "hide_tag": false }, { "name": "BB15", "colour": "#3B8882", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305635, "uuid": "9b155503-8de0-495b-9ba3-25b864ae3216", "value": "T17BB45C6FEE0240FAEE07A8FAC547F7EF4E6813328974DCF2C69D6D19B8842641219715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305635, "uuid": "a2dc5ebe-79d8-431d-ba83-d9432e3e3339", "value": "5684749ec732d84594f077726c28f1da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305635, "uuid": "bf2c3efd-1d7f-4e76-856d-fda35cfef060", "value": "12288:XPkOXczzPUMZClzjzbumfoEG1Tn2AK2Y0yC7+:XOnfClzjnum/G1TnVek", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305635, "uuid": "5ed559eb-1625-4c1c-b2b4-8e6b7197fbc9", "value": 531996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305635, "uuid": "81c2e560-605c-4441-8519-ae81cc30a705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305635, "uuid": "c852d565-d6d7-4a46-b367-04d6c58b173f", "value": "09.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5ebd9c5-ab86-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676283165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283165, "uuid": "3ef42f4c-8370-4dd5-a3df-d22bc8391b21", "comment": "Malware payload (AgentTesla)", "value": "9efb387ede7756feb7945b96c7423d19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283165, "uuid": "f93cc3bc-a75c-4704-9761-35a7edce1c19", "comment": "Malware payload (AgentTesla)", "value": "7de0b2c2e48906ccb72e377a9a1f37d9278bafd6e202f85c3457590b64f8880b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283165, "uuid": "7a60ea90-c4c4-41f0-95ab-45b54bd4df98", "comment": "Malware payload (AgentTesla)", "value": "8421b16559ca1f8e0328aecfa458497af75074a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283165, "uuid": "b5dee407-a87d-4748-932f-fcbb6cfb4979", "comment": "Malware payload (AgentTesla)", "value": "bd6c1c8b6a4e86e6bdee8f4a628add9ea7b0de64705d6ce3ccd456f8ac715507ba5edac3605424585c0b41e0dad1464b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283165, "uuid": "e0530a8c-7d2a-43d8-ae8e-f3675c0d0902", "value": "T15DA423746BA8D2CCB17D25B5E252D8FAA814C334129DCD5A723484E8CEFD9E3C42D267", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283165, "uuid": "8c90f143-fec4-4721-a162-a33ecb7026f3", "value": "12288:c5zI+Pa3ueFB/80XtY1cVI8tsJyPYwXt7sIUf:mX4ZFB/vXtY1cVIXYLZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676283165, "uuid": "aacf7091-df4b-4c46-8016-f1d6c0a866d5", "value": 470231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676283165, "uuid": "6507163a-7389-41ef-891c-f24db85066a8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283165, "uuid": "1641d5c5-3e1e-4474-bf8a-8665ba891c64", "value": "POLICY_MR23-0213-3.PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5ff0db-aba1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676294427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676294427, "uuid": "89da9052-2bf9-410b-bc7a-693217b6c2b3", "comment": "Malware payload (RedLineStealer)", "value": "3f270b516912d9a39cd3a8024a22c475", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676294427, "uuid": "0d386b75-4cc0-411b-8b17-62ea94fe6c39", "comment": "Malware payload (RedLineStealer)", "value": "7e3cace6b747856dff1ad4172cef864955252f740163068f56bded7b417e94e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676294427, "uuid": "063251f1-fcbf-4048-bd34-1673f6f4344d", "comment": "Malware payload (RedLineStealer)", "value": "9a1a2d4c899456e8948d73b213283fb7224be2a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676294427, "uuid": "e70e3f30-2aa6-4ce9-9c40-e3eaca02e406", "comment": "Malware payload (RedLineStealer)", "value": "9028b3a4b7859c2d4d1bd5f688294edfc689a3089a73ac779c9becc8187e768b19f7f6e72629ac79efd0b6f28870a069", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676294427, "uuid": "7534965c-e527-4875-b700-a80b50f6c1cd", "value": "T14FF4124BBAD8D032D8A1ABB028F107D31A367DA10B388357678F5D550C73AF4A275767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676294427, "uuid": "448eed70-e285-4145-b67e-b58e4048fc4b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676294427, "uuid": "00d84e51-d2d0-43a6-a99f-10d8dc84237e", "value": "12288:+MrRy90gZxPpesfsPIl4HVxxeJxYav9FEtKwn4YvHMmn2DLJuY:vyRZxPMsfy1YLjbcMm2DNuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676294427, "uuid": "2110fc7b-644d-4edc-876d-a5863790e00e", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676294427, "uuid": "fddd4c7a-ff1c-4196-a575-ce6064c3f20d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676294427, "uuid": "6c839eb0-0258-4910-8496-5f1ba4336012", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c2957b-ab4f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676259375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259375, "uuid": "7987c69d-a9dc-43b5-be40-6492e22a0e01", "comment": "Malware payload (Amadey)", "value": "aaabdc03686db0774f0d966ef2239b2c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259375, "uuid": "d549b5c1-88b5-4096-8ae1-114e55ac9fe6", "comment": "Malware payload (Amadey)", "value": "7eb80ba3bf0f085c80cef62821db4500a3200bdbb7ad1f1bdb57ca70259e5905", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259375, "uuid": "9d554bc6-bb9f-4aab-8bf4-681d6f5f57b7", "comment": "Malware payload (Amadey)", "value": "3b8d6583eee1dd33e5270508c7a1d46db4ed54ad", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259375, "uuid": "5a63f60e-6a69-43f7-bc4a-f0d67240c6e7", "comment": "Malware payload (Amadey)", "value": "5031928afacf05c4eb8b0d18aaeb838da1a983609f572a550a630d28906385a9d18796cd8c7b30a360ddf507fa1bb6b2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259375, "uuid": "90075f3e-c7b6-4180-b28a-e5113d0c07ab", "value": "T1A1F41227FBEC9022E9B5677058F203D32A32BEA10738426E538F7D592C72675257076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259375, "uuid": "82d00416-578c-412f-a880-5af70f294a61", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259375, "uuid": "e1364247-99d5-4513-b39f-a4056b6bba32", "value": "12288:uMrsy90RwJc4Vx1avQXvKwT5WPrxkeJq8l4Ophj2daeEsOboyG:KyoQpV+vcKQ5WPTaehj2dajskG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676259375, "uuid": "8c27945a-5f8d-4200-84f6-c6bb116c6b8c", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676259375, "uuid": "9fad786d-822b-4172-82b8-d524190ce32f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259375, "uuid": "137af42c-e8a6-4ab4-90d4-43c75c120d67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f3fddd-abe5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676323645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323645, "uuid": "8854322e-1008-4386-b106-8d68078fd62c", "comment": "Malware payload", "value": "913b44178a582a8dc75880c821d369e0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323645, "uuid": "ec3e8209-10ee-4028-a8b9-6afbca9621ec", "comment": "Malware payload", "value": "7fc55a3bdf0ee36bcdfcfb8f2f99ee844773d5bf78b7c2988d6f718a9f322b16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323645, "uuid": "0eaa6014-39ff-4408-9633-9ececc0853c6", "comment": "Malware payload", "value": "766df9f8333f754570041b12e0dce3a6a0381e57", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323645, "uuid": "4617a943-5d3e-41a3-8cc0-f36230733d58", "comment": "Malware payload", "value": "069fcc881504c088aadb10ab3d5d76916acf39bde67949f69424202eda8981c50361d112366c8ab38de5580fbd5f9d37", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323645, "uuid": "e68f602f-486c-4c5d-8c5e-1b3c6c70246e", "value": "T17645BF12BD908076C15E0B3017626B7A72F9AF946F74EE4BEB44FA2E5B331C2671450E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323645, "uuid": "f5b292d5-152e-4dac-9613-6615da9ff781", "value": "fe7baf9cdd2f9b8be85bbfac12dffca5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323645, "uuid": "f8c1f56a-cb62-4c72-b1d3-6dd773a593ec", "value": "24576:2IZPtfPTxcWyDpIgED5kG6x5/6LcC46VS:NPNqprDGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676323645, "uuid": "9d2bbcc2-e988-4c8f-8b9b-594e0c4e63d4", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676323645, "uuid": "db9b3995-0266-4f06-ae6b-07fc4226715f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323645, "uuid": "817e858d-3331-4e08-8c20-6b87064ad1ef", "value": "913b44178a582a8dc75880c821d369e0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d9af0f-abba-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676305237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305237, "uuid": "d64be10a-85ec-4abe-969a-f1dd95b5cd75", "comment": "Malware payload (njrat)", "value": "ad4641d5b7d7f31232da635001105d64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305237, "uuid": "80a2a583-c46e-4108-9df7-b48a7fc3d987", "comment": "Malware payload (njrat)", "value": "8003c0d0a71a341ed9d1c3202bd5e9911f3021343b3c9a83271568ade69ec9c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305237, "uuid": "49b560b8-91c2-4e1a-86c0-58a77ea5d93e", "comment": "Malware payload (njrat)", "value": "b884652b00d4a32d58a4b0d185b50b1022544f38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305237, "uuid": "e4483bd7-dbaa-4dc8-a1d3-fd2711a74b37", "comment": "Malware payload (njrat)", "value": "829147f558dace68a5aa81ee3e31bd78ba35fcf388fb778f722b3608a66f827a0b8f5f3a1d6d04af7d9f15f0b2aaaaac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305237, "uuid": "a3bf61a8-012e-49ed-81fa-0310f86da2a0", "value": "T116032B4D7FE181A8C5FD057B06B2D41207BAE04F6E23D91E8EE564AA37636C18F50AF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305237, "uuid": "d5a20406-5175-4800-995a-0b83e344dd1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305237, "uuid": "48bbbdb5-2702-482e-b1eb-db7d6043c8f7", "value": "384:5t0ckxsgwi+/x3+j/NSysz+KcHfW3WwEfrAF+rMRTyN/0L+EcoinblneHQM3epzb:L7kalCNhsz+KcuGwCrM+rMRa8NuMOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305237, "uuid": "7c35f9d0-388c-4b6c-8360-0119810e76e9", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305237, "uuid": "c81da099-b00e-4d75-9652-9772d4ac45d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305237, "uuid": "5019548b-90d5-4fd9-b0ac-f62df95912a0", "value": "ad4641d5b7d7f31232da635001105d64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0aca1b-abb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676301996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301996, "uuid": "4e879d93-eba8-4be6-b50f-60c3472b744b", "comment": "Malware payload (Amadey)", "value": "846d2fa53f65144406f20690d3833e33", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301996, "uuid": "02b479d2-6e38-4dc8-b21e-bfeb805b7dad", "comment": "Malware payload (Amadey)", "value": "8074a8ce6428033c1a92e00369918106d7768e92e0a565efa2913d5c15a58eb7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301996, "uuid": "2763fac1-b6e4-4d48-9fdb-ac8e2fd25f0b", "comment": "Malware payload (Amadey)", "value": "6b18fc71bbed12859e2cfe4847066cd3a26c8d15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301996, "uuid": "3f4801ed-6069-4092-b2b4-80db581837b6", "comment": "Malware payload (Amadey)", "value": "9b54655587457ec28769219c205851c2eb238e5547d5c28ba43641a7cbb39c1827a7fd9f3c86bc2bb677992b27c46d42", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301996, "uuid": "cbf93d59-1d06-4cc5-96a5-7c9b882ae61a", "value": "T1F7F4125BF7E9D032E8B543B04DF313C31E3A78605B3882A627466D5A08726E5B739367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301996, "uuid": "86c1c9a5-ee49-4d39-b590-cca1b53ed00b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301996, "uuid": "8318bdb0-edc2-4c23-b757-1b385e939561", "value": "12288:3MrOy908PpQKRJA4zWpSzDlpx/as0CreJeEMaWdzoeUQt4PtlSfjfHs:Ny9pQKPt3has4eEZWdke14PtlQfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301996, "uuid": "4b68a98e-adab-4be8-9996-cd3b4ee6e941", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301996, "uuid": "8a329769-ad44-472e-8f93-e274ce8793cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301996, "uuid": "6d96bfaf-b03a-40d2-bcd6-670c7b95e955", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74518480-ab75-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676275646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275646, "uuid": "6b308a47-47f7-41a1-abf3-dbd5f2d63803", "comment": "Malware payload (AgentTesla)", "value": "811646e8c7a2cd6deeac0944b322a6ac", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275646, "uuid": "6809ccac-3f24-45cc-b874-2f2087592289", "comment": "Malware payload (AgentTesla)", "value": "81040d3ad2da909b682a953ef6c9abf9746b35999ceb1a36410574f8eda8cbe0", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275646, "uuid": "f690c671-8097-472b-a30c-6652252ee0a9", "comment": "Malware payload (AgentTesla)", "value": "3e19f52054c7a4df9e45b862a1bb79859d18a96e", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275646, "uuid": "0724a89b-4c07-4c28-9fae-6ad3bebba2c9", "comment": "Malware payload (AgentTesla)", "value": "c4703da1876a2d03eca996f83235afebb18c3a4941bddbc00495f26115865538930652b4377b282a74e99a867863ddd5", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275646, "uuid": "7e02bad1-08e3-4655-9020-7c8b6db88eda", "value": "T132F423B1E07AB6F94D3579DF561AC5CDE2342CBA0AB8626E0BD52F97C0B0185C327621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275646, "uuid": "a35655bb-29a2-417e-8901-6b5e8e1a8142", "value": "12288:569cVRZHw+nXNKkmfdDUKHKoJkKzruboL7p3DQb1LOTdTa5W3fUAfqncg44qtDg:56itpXNKfHBru05K1CTdeO57Pn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275646, "uuid": "c886e7c2-14c9-4a51-bd82-e32645bbb10c", "value": 767560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275646, "uuid": "6d1917a0-da87-40b1-b2db-71fff53cc761", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275646, "uuid": "4e1ba16b-c8e3-434c-8993-4f5cdb3c6998", "value": "BPN 021930656402001.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b239b235-ab82-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676281334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281334, "uuid": "3e4fd3c6-02a6-4fa0-93a5-a0fd022c8af1", "comment": "Malware payload", "value": "f07e9a83615c8070dbdaeb8be90fb7cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281334, "uuid": "d327e543-80d7-4321-b9a7-a005bd18242e", "comment": "Malware payload", "value": "8173d1af58c6af4401204a92eba5ac55a3163a6a258eac78048db90fb1a5e72a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281334, "uuid": "63939f11-1ff3-4263-a5cb-820879445050", "comment": "Malware payload", "value": "30b4da1a8b7af2c235c995c9b3dde7deef2c620a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281334, "uuid": "6a4ae398-f0e0-4acf-98f6-e7e66ce10b46", "comment": "Malware payload", "value": "c8dc8293bc53ab82c0f66ca009cac6ace31a0c6f26149e22b030a8e7275a43a6b284cd60630e3d6ba5c2aed0f0d21c7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281334, "uuid": "71ae8fad-3799-4d4f-907c-2135e2218956", "value": "T18BC2D79433AC9F62C67C47F50417619043F2992A68B1FB1EAFCB90CA4A67F490B21F57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281334, "uuid": "78645ddd-04c8-4b39-b536-d2aaf2f3ab5c", "value": "768:8juLLm0ZAungCxxqBxp8Fu/Q7xLH6nrcg:0MfvgCbqBD8Fu/Q7xzwcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281334, "uuid": "56fdffc8-15b3-402c-9f9b-eff73d0efb7d", "value": 25734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281334, "uuid": "3323d234-11ac-426e-ab67-e161518ef42b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281334, "uuid": "ad8870a4-0eb3-4b3c-839f-69e4edfe622b", "value": "f07e9a83615c8070dbdaeb8be90fb7cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4fe098-abb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676304039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304039, "uuid": "a3caa7fe-cccb-4c9b-9fb7-d9f07315ec91", "comment": "Malware payload (Smoke Loader)", "value": "5d9ddf96915b5cc3112a2fe444eb4582", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304039, "uuid": "4fc3a2d6-6e99-462a-9cc2-9b6e4780a22c", "comment": "Malware payload (Smoke Loader)", "value": "81da8a4b8cc7c53a8363843231c14a1953512fb1a69431630b040289fc55b078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304039, "uuid": "b636e72e-da3b-436c-a395-ab3eb0644924", "comment": "Malware payload (Smoke Loader)", "value": "006004ac0660ea7f2250a00d6374e4f9dcde9ba2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304039, "uuid": "8e30f314-5b7b-4112-9d03-3146a6e4a590", "comment": "Malware payload (Smoke Loader)", "value": "da21dd2ee1a4959f084fb3726e58fbf9c1bec98f18ebe4b1da696757ddb5691fa75093ca09dacf97f23e5b67d0f9f43a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304039, "uuid": "bdd667f1-462d-4ade-b766-8983a6686863", "value": "T18314CF2232D0D472D37617311C29D2F46A6EF9718E7BA59B376C2B2F0EB12D09635352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304039, "uuid": "42838802-86d9-474c-8737-3ca37b458e0c", "value": "a915562f5b4dfee9fa3c29b2972ad3d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304039, "uuid": "a01383cc-87cc-4bf1-8b59-c6d04c2266e9", "value": "3072:YHqdEHBKV+GRV1JXGIe1m629yZochfvnucRl673b:YHQEh+1RV1lGIAZoSuq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676304039, "uuid": "940c8fc9-de75-42b1-8e7b-fb1e39bfc579", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676304039, "uuid": "411df18f-7d9e-411f-b2c8-6316c2b03fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304039, "uuid": "2195de5b-32a9-4a4a-b90b-fd863d865b09", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b148d47-aba3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676295307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295307, "uuid": "fed4c778-dc95-4c2b-aade-feeb19bf7ef5", "comment": "Malware payload (Smoke Loader)", "value": "c1af8ff36551ef71a0f2f0568910f0e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295307, "uuid": "803542d2-6468-4505-b761-d50bf1832999", "comment": "Malware payload (Smoke Loader)", "value": "81e3af79ce1210e976019e4cec7dcb494fe416d3518c9c3feffe1a96b5fefeea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295307, "uuid": "6cf9763e-6378-452c-b1c7-7420dbe8126b", "comment": "Malware payload (Smoke Loader)", "value": "06bd401c2e634c7e02720270b2ee0406a4c0d4ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295307, "uuid": "9cb71194-9e2d-4622-9e75-dbf0848a9f66", "comment": "Malware payload (Smoke Loader)", "value": "c31892fa396bb2f2de39019865d5734d84e6fd1ab5b55d559de58e7cabc6f496b2ce623b277918e204d755151139af74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295307, "uuid": "557a5e75-a4b2-434e-ad91-2ce5cc98b89b", "value": "T14414BE1333D8E671D1F756314C6DF6B86B7EB8B04A389A5B37681B2E0E702D09672352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295307, "uuid": "523e5adf-7aad-4a29-884c-68dd1e44c8db", "value": "b5b37a1e2171531433caad206e98583c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295307, "uuid": "49fa4e6b-2e3b-4720-9fd0-ea02a6beb1db", "value": "3072:dn9T6Xodo5TymXo1aPKxrWuKlYqgYjpI1qtPIoceXjftjfY8yCfpL3PC:dnx6YOHXo1aSxrObtm1tejFfYLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676295307, "uuid": "180c8bd1-5521-4d6c-adc1-e47b1fd9f72f", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676295307, "uuid": "bfccd52e-fde2-4557-beb3-099867b47117", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295307, "uuid": "d1212e78-1599-4554-b200-2fbf6680cdf5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54161e33-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676301362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301362, "uuid": "4db8e77a-43e1-4bd1-b87c-407b32ce56de", "comment": "Malware payload (Formbook)", "value": "ae25f9677f5730ec5c5f0ea75579ab11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301362, "uuid": "c7e1d824-aed4-4de4-9e5b-01074ee21380", "comment": "Malware payload (Formbook)", "value": "81eeb17cfcd81f15427dcc3c88390712bfba7d19aa3f3e7e8d9ac43401456eb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301362, "uuid": "3f6fa533-9177-4bdf-800f-24d19bd26f53", "comment": "Malware payload (Formbook)", "value": "493cefa2395033b1378a7f74da0c20a88f3139db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301362, "uuid": "8ae8b157-68ae-4d0c-bb6d-fc6890cc1824", "comment": "Malware payload (Formbook)", "value": "090feec7b5a3e0f47ce97267b3a3b5e56e5d8af012d0b8e58e75d8e7aace22f8b74caf40c8aec1a93d810cf17ce5914d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301362, "uuid": "1b2d5ade-3c05-4a6c-aab5-0427a40c8a79", "value": "T1D2F402003AAD5B28D47E6BF42835608093397F562AA2D71D3DC671DE1E32B478366B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301362, "uuid": "51d222af-9d94-44ad-9c17-5d78e4936ab5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301362, "uuid": "714c933e-3789-4d86-b10d-7136221924da", "value": "12288:UQfHeyZh6q6/TKPzG7JTmo7F05Cqqw5VQyg9BMyFBlUFoQF6P7J3jOqO71eCZR4C:UQfHnY/TKPzG7xmoh8hqw5VQygTMUE2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301362, "uuid": "190befb4-26b9-4cc3-a40d-bded6a4967b6", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301362, "uuid": "0a03af13-59b7-42c0-8981-fa7a18c4ef89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301362, "uuid": "937e877f-8910-4b32-9dbc-3f1ed388f9cc", "value": "ae25f9677f5730ec5c5f0ea75579ab11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4a249c-aba3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676295440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295440, "uuid": "64da52e8-098e-408c-a084-1050f8df302c", "comment": "Malware payload", "value": "c941facbc4f08c64b37b048e20caac7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295440, "uuid": "24f805a0-5ccc-454d-9e24-666424116a5d", "comment": "Malware payload", "value": "81fc9f1823d6d875b9dba1948106d90bcd3f6930d1ee2399c4050762938bddad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295440, "uuid": "f16e0f3f-5fcf-4e3e-81d8-52236af82f05", "comment": "Malware payload", "value": "4f7301ca5a3a7eb60ca7079d580269fc420105a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295440, "uuid": "eb0f1ebb-faf5-42a0-9053-190414d428f4", "comment": "Malware payload", "value": "265863b85aae82985c8867aab6ef332b7b6061c731b60db750f08eeafe485a834b451e99896927badc1ca5b66e432f2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295440, "uuid": "8aa887dd-8020-4d48-9b4c-7cbfd114bb65", "value": "T1B4637C517A80D032E08754316958C3F1AE7FB8321AB9C8877BD9177E8F717D0A62B386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295440, "uuid": "fde05d0e-a32b-4474-9ca7-e1a81fa7d24d", "value": "98a9e1a48515fe77bee918827e222acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295440, "uuid": "e06cbdd1-849c-4d0d-9d4a-cf3fba0b9b9e", "value": "1536:mKS08oajARsdI84N1/L+LBr0iZm4xB9we9Gd8LlkXJTX:80T2fdI8a/LeZkWWXJTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676295440, "uuid": "a860dc29-2bde-4fd5-bc86-2e0091290b3a", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676295440, "uuid": "8d21c2ef-d07d-4f6b-8950-7b0d8b36c42c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295440, "uuid": "d0f8ff2a-d97b-4a14-ab92-405f1e8b8e37", "value": "RunUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5cf5943-ab48-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676256402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676256402, "uuid": "c3d36f5d-9b27-476e-a5f7-0fbf4775604b", "comment": "Malware payload (Amadey)", "value": "234489a5877f4ff9b51f22264b4cab3b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676256402, "uuid": "8ae2cc92-7394-4496-8c70-1020f1bedb42", "comment": "Malware payload (Amadey)", "value": "8299d921aaea6060184095f6522c125816b333f0ff1bbf5453d4ef3c9912d5dd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676256402, "uuid": "9194cdc4-c5d8-4480-aff2-427c03045396", "comment": "Malware payload (Amadey)", "value": "fee11bd750ac5a8f7f6e02556f02c83defa836c0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676256402, "uuid": "620dc442-2f68-41fc-998f-5a55d1d0f784", "comment": "Malware payload (Amadey)", "value": "5438e69d8c2645d54ac9dc535797826849a8daeb7a1980b26f9c8ee73cebea1abcf7494c9c5eacbb81bd0494d3f4b0b8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676256402, "uuid": "4b0d427a-fd98-4f2b-b9b6-db6ff40a0018", "value": "T17AF4121BBBEC8022F8B557711DF303E32A397E616738835A278E6C580D729B1617536B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676256402, "uuid": "cdf48d3c-8270-4cb7-8436-1b22f35f8318", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676256402, "uuid": "17c9a79a-d410-4d49-93a4-d21fec44fbe5", "value": "12288:eMrly90i4tb/V4UNu8XLJVIsTp+aeJtTjcxvGYAsKJae6JObo0Pzf:zyR4tzV4Ou8QsTAtcNZAZJaNJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676256402, "uuid": "36581c72-0331-40b8-ae01-7c6775768ec1", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676256402, "uuid": "66aeeb7f-76c4-4db5-a8bd-94a28a4efd5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676256402, "uuid": "6fc20b23-9f60-468f-a69d-644bcb7b0b2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd0c8dc9-abdf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676321349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321349, "uuid": "06397291-726b-481c-96ad-81c9650fdbe1", "comment": "Malware payload", "value": "999e9fc8e39e4d68d87c6df7c164b48a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321349, "uuid": "9ccbe985-4b53-4737-bdf2-a7147cf7ea20", "comment": "Malware payload", "value": "82e4aaa11c00142ac6392578d23f3b60e64328fb62a0234687f0abbe05b09413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321349, "uuid": "3c74b354-6d0e-4b25-b276-50a3f2fb842d", "comment": "Malware payload", "value": "449b98d0ca00d43b742f28a426a5b9344812970d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321349, "uuid": "4b05cdff-bb07-472e-a4cd-900e56fb7778", "comment": "Malware payload", "value": "efb5d8d121ea2c8a4b32f18e1d4380599a5572ff5bc08e0403de83b8c33ebbc7bd1621c28f15a0ef43b31115e4b7d8ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321349, "uuid": "217cf17d-ef06-43af-9e22-51c109954594", "value": "T1C604CF13F792E872D56206305DA5C1F13AAEF8111A75AA8F37E45A3F0E702E18A76371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321349, "uuid": "1488d156-e639-49cb-a204-342825ea9d86", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321349, "uuid": "9c5de35c-87e6-4763-80c3-834060dbff73", "value": "3072:aKfBET6dksHeErxDFPnPj5z1s9oPnD/ZTSVGwK14TC/EV:aqBU6yYeErPfPjrD/tynC/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676321349, "uuid": "f12487ab-cc35-43bd-a4ee-391b427175e9", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676321349, "uuid": "66307667-d02c-48bb-8aee-bf4da4a3e18d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321349, "uuid": "64eceea9-5247-4ac2-9f3a-c6ce1aaa4a0f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1303646-ab75-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676275856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275856, "uuid": "d4c83bbd-7621-443d-8c0b-550e24356c64", "comment": "Malware payload (SnakeKeylogger)", "value": "9322a9c5664a842016715a9b1ed974af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275856, "uuid": "34a169ea-28e7-4df6-ba35-aa26f944bd8e", "comment": "Malware payload (SnakeKeylogger)", "value": "842241f23f9178cdcb83209058c79da72d59eec5eb49da2dc33ab361dda85a79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275856, "uuid": "6c85c778-8a1e-4072-ba68-b1169913a894", "comment": "Malware payload (SnakeKeylogger)", "value": "7c423286197690108ae6e6cd8d33674a28ab41d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275856, "uuid": "3e72f65e-a46c-483c-9b4e-a5eb35ea6862", "comment": "Malware payload (SnakeKeylogger)", "value": "922f6827ac7912ea4b938aa62e5f13e6ae564f5db6eb558b6ebe51becda70fa4e37c7d935ef67c24f2756d529f73b332", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275856, "uuid": "296a746d-6b50-4af3-ace5-c3bde156d7f0", "value": "T169E4F1003A9E4B18E97D67F41471B080A3767E5A29A2D32C7DC671DE1E71B968312F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275856, "uuid": "15bb737e-0657-4dd5-86a4-46d48e642c91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275856, "uuid": "5aafba7d-0fe1-47af-80c1-41e19ccefde9", "value": "12288:21UfUZh6q6/TKPzG7MT5//fLvfIDO+ouWNPmpM3DTybZFArpwFQF3payQ:21UYY/TKPzG7O5jgDOzJmgqZFAFi8Zay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275856, "uuid": "10847b8a-0b43-470b-8af0-c443d93ebddc", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275856, "uuid": "488d9bee-17e7-4c78-828a-16417b335c85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275856, "uuid": "b6b66311-9e39-4c17-a765-af0fd33bc653", "value": "Requirements Details Attachments _\u1100\u1167\u11ab\u110c\u1165\u11a8 \u110b\u116d\u110e\u1165\u11bc \u1100\u1165\u11ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee95ab5-abe2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676322345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676322345, "uuid": "86c1c73d-5ec6-442e-a2a7-7c8c0b6219b4", "comment": "Malware payload", "value": "c79e2577181e6e0a04687fb9180438df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676322345, "uuid": "10e93caa-5945-4af4-9331-bbc97673fad6", "comment": "Malware payload", "value": "8461704f19f95f168fcd342f67b4df76eefbf0053dec66074d192d61da147995", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676322345, "uuid": "457d96b1-66db-4a53-9fc5-d887db88780c", "comment": "Malware payload", "value": "9acf0852a44365d45498cc39c77e9f4422fab6cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676322345, "uuid": "60ac756a-2085-4056-9146-758b9a234604", "comment": "Malware payload", "value": "b9f4bc58b78a0d4159595ea24ebeedd0093da5b205b50d78fa04edf2693b94d868b0bca6bce449b887a54ef8bd418ace", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676322345, "uuid": "c017d5d1-c160-45db-90b5-e3e62f44f363", "value": "T19EF41207BAE88031E9B457315DF207D72A3ABD616B3483DF238E2E691C71A647135B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676322345, "uuid": "c158f345-7ac4-4b60-a91b-a290e639e132", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676322345, "uuid": "761b98fe-0256-4623-9999-0f59a79c7b10", "value": "12288:wMrby90mDet5OxMWH+ovPgavRzEVleI94s/fzIedeeJiE35GwRVL5twcetPzvOP:7y//GWeovP1wVlFiSzIMTpx5tBimP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676322345, "uuid": "6ceb6548-c42f-447d-b1c1-9af21dff4adf", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676322345, "uuid": "f01a7fc9-a4a1-4a4d-935a-73e0ab0ddc19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676322345, "uuid": "da0346ae-79ce-4773-8092-42778d9825ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af04005f-ab42-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676253841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253841, "uuid": "06204c12-8a43-4969-8155-1133afa8de0f", "comment": "Malware payload (RedLineStealer)", "value": "84a8a349b7ed908939c405b7200b2586", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253841, "uuid": "d60323fc-ab1e-4dd2-9544-8276a19ba4f9", "comment": "Malware payload (RedLineStealer)", "value": "849c98d6953d216f8a8cb3fc3fc078fdeda92bfd43d82ac07753396710c57c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253841, "uuid": "a6981bdf-03fd-4f75-ab18-e4ec5ad37020", "comment": "Malware payload (RedLineStealer)", "value": "5ec78654fdb0730602224f7d2f83fa53b7a871e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253841, "uuid": "fb551ae9-1fd8-4205-aa03-8e562ecc811c", "comment": "Malware payload (RedLineStealer)", "value": "36334a8f13b0ad86cdc296109aa490fb658c7c9f505ef3f7caf69ccf70ce9925bee15945b4a847976ce89f7544720f85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253841, "uuid": "2676be87-6aec-430c-8201-252fcdc4a380", "value": "T146F4120BA7DD9023D5B1A7B00DF302D31A32BE211B38835B668A6D5C1CB1AB4B57577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253841, "uuid": "a09eb14c-3e2d-4249-bb09-c912c2ce6f7a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253841, "uuid": "6a063330-308e-43b8-88ef-9c45aacfa3c4", "value": "12288:mMr6y90sEPxDCzP0B8IeScq7q72UxZnZteJ+zcpaAhE00ae7mOboZX2:sy2E0OINWxxZnQ0IaAhEVacm/X2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676253841, "uuid": "eb0d94b9-3617-44da-bfd6-397916be5afa", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676253841, "uuid": "afca33d5-78b6-46ac-8229-824fc7c19a8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253841, "uuid": "a5f1fbaa-25f0-49ba-b309-af8e44aaffac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b57f5a-ab53-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676261039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261039, "uuid": "9b5c2682-62b7-4d9f-9a97-de18f035083b", "comment": "Malware payload (RedLineStealer)", "value": "efab752cd032424a862fcc909c8ab42a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261039, "uuid": "886254ae-92af-4ce3-8e42-3144686f0862", "comment": "Malware payload (RedLineStealer)", "value": "849cc0cc97d1e1ae432387ba45095cbf9b28fa58920e316224e8aeb218e3a107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261039, "uuid": "65fae99f-fed9-4501-8633-80bb1b018dec", "comment": "Malware payload (RedLineStealer)", "value": "782e24a7ce7cae25c4ce68e61b2e7015e72d6bf8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261039, "uuid": "847c32cb-86d4-4e25-a7ad-e5b380b273a3", "comment": "Malware payload (RedLineStealer)", "value": "29d4c2e54adad5badf0474fe08af03112b6e734f2be1c98ef5020d62edfe1c0fe781386e329446208805435e8e2b740f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261039, "uuid": "c9727d08-9276-465b-be52-87ae9385b0f2", "value": "T179F4120BA6F8C072E9B5177054F703D31B36BE614A78C397238AAD591832AF4B172767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261039, "uuid": "5b8c62ca-79f3-4e1a-9598-88886b88c74f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261039, "uuid": "09cfaa0b-2736-4662-b974-31f70d744924", "value": "12288:zMrDy90OFyqbJlXLGthKOH5wJMdghHp69seJooh6TxerMMgu4lTQDpbbLv:0ytbfLGthx5wJhh0HCxY5gzTQDZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676261039, "uuid": "b827fb6d-51aa-411f-aa26-db36220222ec", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676261039, "uuid": "8f539657-9570-4a9e-8e79-3589d53185cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261039, "uuid": "511c8537-a936-4584-b358-679109b0062b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd6c634-ab4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676257520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257520, "uuid": "d05f4884-df35-479a-8d1a-2151e9ef907d", "comment": "Malware payload (RecordBreaker)", "value": "3a30c406adfe874ec04ab3ee40f7f738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257520, "uuid": "8dce8901-db51-454a-b6cd-04c66808bd66", "comment": "Malware payload (RecordBreaker)", "value": "84c339ffc033a8318d9bcc54e5445993f28dd057ea2181347d053c7c19617065", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257520, "uuid": "f80ee082-abb7-4409-b6d9-91500d23ad23", "comment": "Malware payload (RecordBreaker)", "value": "f056a2f843cf431dc7fceaca2c21413a8310a70b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257520, "uuid": "f932fbc9-64c2-4711-8d75-ab8a21424ed8", "comment": "Malware payload (RecordBreaker)", "value": "707b9c2c75290249bcf3488023128d2f155e4d8c52af3d76b17ff0885909a309026589a6c5a61652e058a0eebd06f265", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257520, "uuid": "034ab17a-7c6c-462e-af79-2e4e4c2929b0", "value": "T1DD14DF323690C0B2C7AB1530DC24DBA45FBEB83156758A5BBBA5236E5F303C0667635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257520, "uuid": "98f7956a-7a13-4276-a602-cc05ebb382dd", "value": "af0a92fe52cf161a7b179d1f32aa9186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257520, "uuid": "f5c28ae0-ddb9-4965-a658-aaefd4478c58", "value": "3072:nYtOuLYn+lLQpvoTWCPn530D0CB9f8nEUzu1M/a9eTaJE:nYtgALRTE0CnmEUzZawT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676257520, "uuid": "c4cf209e-4332-4b33-a4a1-a6ecbe6d6734", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676257520, "uuid": "753f6805-07d9-4a59-a67e-b0979e19b1c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257520, "uuid": "6c911d68-837a-4b10-b5ca-01ba121c6e7f", "value": "3a30c406adfe874ec04ab3ee40f7f738.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e54aa4f5-ab8c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676285714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285714, "uuid": "ca4892be-1973-4f7b-b71e-b7c5d6413222", "comment": "Malware payload (DCRat)", "value": "9aed4e8d858dc3de24db487b7afac168", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285714, "uuid": "8c62b048-e27e-4ddc-bc7d-84b7df824236", "comment": "Malware payload (DCRat)", "value": "84dcb40e0aa6be8d21ef8e9dd4506c7896c42e77a51cb5f665e7b8ac5cfdcf9d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285714, "uuid": "c8b3b69a-47a7-4598-b403-474d24e6856d", "comment": "Malware payload (DCRat)", "value": "10ce53bd88fac2bd2caefde973b7f21522f3f4da", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285714, "uuid": "ec504f73-1b74-45a4-838b-7ed9ae9b5fa4", "comment": "Malware payload (DCRat)", "value": "c8085c36cef23108264f1b9e55476bf49012e8c848a628f0318c20458c0456306776cfc639c2cd67cd1cd3bb7305bf84", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285714, "uuid": "d092778c-e0b3-44ff-bcdf-9b96c933be7e", "value": "T1C9657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285714, "uuid": "589f1274-550b-4aff-ace2-c43523b25b31", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285714, "uuid": "3179f0b9-ad2f-4d25-b88e-9fe62023ff14", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285714, "uuid": "82269ae6-4a82-4d70-85e7-ddfceb7ac497", "value": 1410222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285714, "uuid": "2e9d715e-a615-4f39-a4e6-058c4886d80e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285714, "uuid": "05fe6f0f-442a-4bb3-b46a-108af33c3753", "value": "9aed4e8d858dc3de24db487b7afac168.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0530165f-abc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676309820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309820, "uuid": "4b8d6e85-fbef-4c49-87f9-e6de6f0e3361", "comment": "Malware payload (RedLineStealer)", "value": "9e88fc2348c9f054cc45d339efc5b1aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309820, "uuid": "dae3ef3f-a78c-4e8b-b064-5fcf688209e3", "comment": "Malware payload (RedLineStealer)", "value": "853551be9bad033a9a707db1d3af2b873fa999ceb80ea87966cd25b2c5e73a66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309820, "uuid": "bbc19a07-39ac-47bc-80bb-bd9a580e3df4", "comment": "Malware payload (RedLineStealer)", "value": "3ef8e621ec74fc8fe5cf78aa9d1607aeb2fdb6c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309820, "uuid": "744aac59-ddb6-43d7-9bff-9fadda6cd679", "comment": "Malware payload (RedLineStealer)", "value": "d61649b5d8505041a77df62c7c99f5df2a472575d32530cf063435d818c2d6783cd7bdd38c5299430ac8cbbaf14c5ea0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309820, "uuid": "4eed4b33-6bdf-487d-83d0-782a7e317365", "value": "T1D9F41247E2EC8172D976977059F203C31A36BEA11A7457C7164EAC2A18723A0FA3177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309820, "uuid": "e2b6ac50-ad41-4b61-ae00-8d64165073d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309820, "uuid": "41e52f65-d2ab-4db2-9f9f-4f535ff30059", "value": "12288:cMrMy90mHZ/TdbV3LIt0nf2ct3Gi88k9XIPhvQ/aT5MAl7lCC9:YyxFTD3EGnfj1Gi88k9XI5oidMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676309820, "uuid": "f673d4ed-1fd2-4083-b6ad-a119406976d9", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676309820, "uuid": "c51e70df-5226-46ff-89b4-f3baa6bbe817", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309820, "uuid": "af72eb63-f6e1-4b0c-91c6-059ac02121ab", "value": "9e88fc2348c9f054cc45d339efc5b1aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46afcc1e-ab74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676275140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275140, "uuid": "45d82a52-dc09-47bb-b82d-e39c17922df6", "comment": "Malware payload (Formbook)", "value": "b341ea7c0b8edbe554f0181542eee0f8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275140, "uuid": "355a1ae2-a7b2-4c48-8ea8-54e95792fb3d", "comment": "Malware payload (Formbook)", "value": "8565170871451d3f8f3f886e3cfc024904c517c50e697335de6b517cf20cf8d3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275140, "uuid": "898f1529-1737-48a4-98c8-e631b7f9caf7", "comment": "Malware payload (Formbook)", "value": "c304fb7c21594bc6bce7c9b90f62191b6a96bea8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275140, "uuid": "bdf8962e-7ff3-445c-ba70-7dc76ca994de", "comment": "Malware payload (Formbook)", "value": "50f0f4e823e9ae08757bbe852ff6384d8fae1dfc6aa0035486f3ea7b3da5480d1c50f3acca6eba36e5c7132cce462952", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275140, "uuid": "d39a2742-2189-416c-8292-0597b6eb6c27", "value": "T1DD4423A088DB81F2A2868D257D20AE5D805FB874357B77AB44C211D287DF87CBD47CE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275140, "uuid": "4ef13cfd-adf8-4f8c-85c3-e6af9a4db6ee", "value": "6144:/StkjpAiAEJsiN2kzJswzHXhWY9Nv35jVKRRvs5G/U4:qtkjpAW31zJLsY35pK/05G/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275140, "uuid": "b62c5b45-e8fc-4777-b86a-b46415bd6f6a", "value": 270261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275140, "uuid": "7b8a95ac-4087-4389-b7ca-20f3d43496c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275140, "uuid": "419a2bbe-8b61-4fc8-92f0-94f12f042e34", "value": "Revised Document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fffe97a4-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272015, "uuid": "33b883fd-b413-4eb9-baa7-5a555808cc9f", "comment": "Malware payload (Formbook)", "value": "6036aa1bb059db77e67d0163c0d23f49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272015, "uuid": "6298e495-e750-43df-8d53-61e7a2c65479", "comment": "Malware payload (Formbook)", "value": "860942d3b0190341282f2ae2d76d65f0374698fc48852aeda79966130bd68216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272015, "uuid": "b0262c55-16f5-42a9-a328-e62e73e81471", "comment": "Malware payload (Formbook)", "value": "19ec478159081f73ef92bf2ab3a6d96d7d323062", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272015, "uuid": "ff0992b8-e975-4a4b-aebe-37873ee621fb", "comment": "Malware payload (Formbook)", "value": "bb30906ccef7af020125a3a289f6f13e37890ddf91801ea42ef055a32c8821ffb90d73e7eb5ef69bef088d4370879816", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272015, "uuid": "06146da7-04b6-4e11-b58c-72d9a0cf4b61", "value": "T16B04AF32D651C071F2B251B4F67D0BBB483D0E353295A4EAA3E616E06EA49E5F13930F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272015, "uuid": "dcf223dd-45aa-454c-8048-349f4c95570b", "value": "3072:5Go6CkmJlwL7Vx39cQ95fgbEEvcbIKVm1xhRXloxIL7:i6uBt9d9NgbEEvcbIKIxRaxIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272015, "uuid": "59831f1b-7718-4ffe-b772-aecaab3581b7", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272015, "uuid": "2e794dae-ee5e-4074-88cf-d9d3693b58d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272015, "uuid": "9e8e2c33-2f5a-4092-b0be-ba163b437c53", "value": "860942d3b0190341282f2ae2d76d65f0374698fc48852aeda79966130bd68216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97c79e8-abbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676307653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307653, "uuid": "3bebc766-e113-4636-9110-e4d3d6b86c9d", "comment": "Malware payload (AgentTesla)", "value": "4bfd3f854ca4c4fc84755a9665d3b2ae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307653, "uuid": "ca4d8dc2-15a0-4c97-86f9-4c1e6bfbb09e", "comment": "Malware payload (AgentTesla)", "value": "865d5468ca9348d4469a7c74b0bf15c9fec739175bb2336e255c9e7e033f19ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307653, "uuid": "07153650-61e2-4f3b-948e-948c4bf01d75", "comment": "Malware payload (AgentTesla)", "value": "cdc98538fc0dd2c2fc4b33d9392c75a92e47e805", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307653, "uuid": "97d35461-38ce-454f-99dc-1ba31f83c2fb", "comment": "Malware payload (AgentTesla)", "value": "795d08b857e810821961c9b9686abc2c17507c1e23186ffaf34ce23eedf0c9406b375201e5d21f9b0b7f1d6670dea0a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307653, "uuid": "235fd513-1f94-4411-9383-c296f31d2031", "value": "T132651253D979BE49C46FC73CECDE80220402AC317651D8162855BEED957ABA06E3E3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307653, "uuid": "d3aa98f3-ca08-4b03-b29f-5de285bea363", "value": "24576:T7YV2radzMN2Tt6XZxn8XxEYr2H8Kt2Tt6XZxX1NO9zhvuh9MLknV1JDPgAz:eEaZ+2Tt6Z+xBAl2Tt6ZfNOtFubML6Vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676307653, "uuid": "c0126972-59a1-48ef-92d1-65a3e3bc08be", "value": 1503232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676307653, "uuid": "4d1176e1-843d-4699-bbde-d55f0b4679f4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307653, "uuid": "b8a371b1-a183-452c-92ed-8943d5c39f22", "value": "PO.X2100002XRX.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ac75e19-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676301266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301266, "uuid": "2e362cea-daf7-4cfa-9f28-dc6a016a7430", "comment": "Malware payload", "value": "0a83d5ad4a668d87f23318b404cac4b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301266, "uuid": "b849e769-4264-4dd2-ac21-c1bee3a78e8f", "comment": "Malware payload", "value": "866aa6561a85c6adfae9a51ecbbcec4f9a00cf04dc8798d0b1cc23bfb6483f41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301266, "uuid": "83615e2a-82f5-4373-890a-81c681ab5875", "comment": "Malware payload", "value": "cee57ac856fa5c91441a8c4b3ffa7e1e22d18f11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301266, "uuid": "1e52f9ab-1b63-4322-a350-fba345bc5ff3", "comment": "Malware payload", "value": "9cd56473ac88e4fb9afc0ee84ae1c3da16bbb23a1ec609b620f911316419db151ccfdd0db7543d4be41900e9b74ee1e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301266, "uuid": "f6196242-ee5e-465b-82ec-87d65ec85f1d", "value": "T110563382B180C8E1E96E8138C49209F9D761BC22C366E60B17E4BE673F772E15D37756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301266, "uuid": "0490f469-3400-4e67-89fc-8a2d27d1cac3", "value": "ba5546933531fafa869b1f86a4e2a959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301266, "uuid": "dede4520-0d5f-4a20-bcaf-7d713f56cc23", "value": "98304:ujWjD1azb71QGQCPDbZfzuOqV6lORkBMjq86uUTWcCVU9Lvek5DIiLw:ujo6dQmRrdA6lakaqdVT8UF2yDIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301266, "uuid": "3647d376-5bb2-4d82-b423-edbb544fd19a", "value": 6124144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301266, "uuid": "bcd77365-b1c6-4436-a0d1-aff46dd50b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301266, "uuid": "354531dd-7ff0-4ecb-b234-5c915fcc1eee", "value": "0a83d5ad4a668d87f23318b404cac4b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707e2c62-abda-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676319019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319019, "uuid": "447bec63-908f-4efd-b4f2-f1eee8c3fc34", "comment": "Malware payload", "value": "79e2373a8233cb7a74709f8d4fc969d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319019, "uuid": "aa1d5d1c-e0af-48a2-b578-32f2ae39146d", "comment": "Malware payload", "value": "86e58927f94717fba42aef47fa96d69ce01a6117b83102a151dc577abe07ffad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319019, "uuid": "cd814fcc-4fe5-4476-9465-11f1d51ac7b2", "comment": "Malware payload", "value": "092f40a9c2e3794b68813f990d79946f694a38f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319019, "uuid": "e0f1f1fe-e207-46f6-a339-fc7dd582ff74", "comment": "Malware payload", "value": "987a792a3e730a0567cb3dcbe2b4902f7eb8985e68325db3422f63d0fde2e50cd73cfc3af16c579fc425278266c3d22d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319019, "uuid": "7137c935-e088-4735-93d2-17b957f85dcf", "value": "T19404BF2233E0D472D56236309DA7C2BC767EB911DA74AA4B3BD46A3F0E702D1CA36355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319019, "uuid": "c8a6ecf3-073c-4b5f-ae14-b7a4546e505b", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319019, "uuid": "540a8a23-af71-47a9-b243-896b42539ab2", "value": "3072:vCLr55StGHuwljxNVcWXlIy3f7c9vr8UUO+vxj3K8jYpPne6:vernyHwljDVcWXlJ3zevrxU464z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676319019, "uuid": "8bc16da1-89a7-4d2c-82c7-0a3d83671424", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676319019, "uuid": "792d83d4-a5aa-43dc-a8aa-f55ab8843a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319019, "uuid": "3bc048a4-fd19-4066-9335-0d31d5cf6ee7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1713223c-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676280644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280644, "uuid": "979feff0-d2ed-41fc-97dc-49acaec296ba", "comment": "Malware payload (GuLoader)", "value": "0ec3df8f1d946eb4d0df42ee45f27774", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280644, "uuid": "fe449d1f-7844-4f10-b1db-7c262ae3a73b", "comment": "Malware payload (GuLoader)", "value": "8733576273cf1567eda6a4be3b5acc79bc13d257ace1b47e01ec60efefc45757", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280644, "uuid": "ffaf03ec-ac92-4992-b220-90a44a4771da", "comment": "Malware payload (GuLoader)", "value": "a36d109f597555176a142aba059d3be0ea448008", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280644, "uuid": "832f98e6-872a-4fd6-998a-d8abddc37f40", "comment": "Malware payload (GuLoader)", "value": "3501fd16a9bef900a289d5aa29cb638c64894406c815ef843be94ae934b5b37222c02dae0fd8c9a4171bdd49f4ed37ed", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280644, "uuid": "fb99c3a9-e75e-43af-ad12-9d527ed342c2", "value": "T1B074EF509E269952C84F0EB1DB970BCFFFA01E9A50B1C4D518F5C2C90B2218D8D7B9EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280644, "uuid": "3b651c38-b5ac-4a91-bc32-8c5a202b4de9", "value": "6144:iZsNHkctLHRfX++LEKDwt+1QlsVNKNEGk6PJLivf7sRUiDy2KjDw:4sNHkctLHRf2vt+GrNEL6PF5RbjKjM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280644, "uuid": "94b49c53-b5d0-4147-9a28-8e78ca4b4de5", "value": 350412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280644, "uuid": "fe5fc2ff-76da-4138-b725-ce542346efd2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280644, "uuid": "74c0a8ae-ee7c-4dac-9905-49e8530538be", "value": "Facturas Pagadas al Vencimiento_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a5ceb8-ab49-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676256860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676256860, "uuid": "17ebaf5a-a70a-4eca-9cf9-de42edadfd68", "comment": "Malware payload (Amadey)", "value": "d6265894b78ccf3477fc967b9186b29f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676256860, "uuid": "b6d30fea-2994-4eac-8e01-f237b1c09103", "comment": "Malware payload (Amadey)", "value": "8754bb97c3de82334f00e81ec57acd9631ccb0c0171f15aa3d2832753c3bd6ee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676256860, "uuid": "bbd17e45-30ea-4377-ab19-dd42649bcf15", "comment": "Malware payload (Amadey)", "value": "d1179142704ba727019548da21cc55921a39083d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676256860, "uuid": "05c51ca0-48b5-46be-9643-a902bb8f824b", "comment": "Malware payload (Amadey)", "value": "c289df102df65a5bb17025be45dd25eda706e234d3c8671f31cd7bb1a7cec5549cc56caeb31f1de11c8400e6cd851a29", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676256860, "uuid": "068e1f92-36d5-4e17-b29f-7fc872cdc4f3", "value": "T1D5F4121BBAEC4122E87197705CF603D31A36BE615B34424B278E6C691D326B4B6353AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676256860, "uuid": "cc432891-1630-4dec-bf7a-b541ade19931", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676256860, "uuid": "f70dc0f0-96c9-48e8-ac19-58e71da25b2e", "value": "12288:NMrty904GYP0Ao3LIYTu6eyQUxvKn1eJQb1lAbYAs0iae8iOboExSYI:wyHd8XLIYCXrmQBOcAHiaPij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676256860, "uuid": "4d98020e-c4f4-4553-b8c8-6021a885a171", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676256860, "uuid": "29cfae87-a764-4678-aadc-67de5ded5e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676256860, "uuid": "ae6f29c3-2c95-4bcb-8e2a-e3e429e7ae6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3adddf-abd9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676318740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318740, "uuid": "41514137-f8d9-4061-ac2b-52264ac26615", "comment": "Malware payload", "value": "37e07863b33d8c7a3355a3c0e1668520", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318740, "uuid": "0b9179e0-a420-4edb-aa8c-b31725532abf", "comment": "Malware payload", "value": "87789525666ff30d7866ebd346e712e5cb17a029e892036d2798c29568e44ce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318740, "uuid": "8c79b2f3-ff1c-4b48-b500-ac860d36e13c", "comment": "Malware payload", "value": "df032c367668b89753be6b4c7cd6ffc5dcc7b32f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318740, "uuid": "c63d7d64-b736-4534-9d3b-b071214da8f4", "comment": "Malware payload", "value": "799253d52bad557b6bd867c63746317e55d9afb5711cf51fe9392a24aafb72f0a3937b527dbd679dcd94958a8fb120dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318740, "uuid": "bf609397-02e5-4441-9a7e-9524e584cdef", "value": "T1EE252A81B2ABED83C6082373C098D8716F78EC869B16F31AA4E51BD36857379DE435D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318740, "uuid": "2531af4d-e07e-4eaf-80c9-0c866685d02e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318740, "uuid": "cabc1f68-7d18-476d-a797-0c7660d25f5b", "value": "24576:+dVoBXgmjj3YnmGLp5cuS+gDgCYfHT+eLK8sAMt:eLKKT+eLKLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676318740, "uuid": "637ad898-a3c2-49b2-94b0-60590cd2e973", "value": 1041408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676318740, "uuid": "876b4998-f449-4d03-a620-176f0b2f0553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318740, "uuid": "59edbb95-02e5-4361-8f87-be055f27c8da", "value": "Coinbase Checker.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e37c13f-ab3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676250215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250215, "uuid": "e783a79e-98e6-4b73-9545-ec4168036105", "comment": "Malware payload (AgentTesla)", "value": "0b38beeaa74c58cb3a4520dacb146db5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250215, "uuid": "4bb0f327-3236-40f4-acb9-6b93666b978a", "comment": "Malware payload (AgentTesla)", "value": "87e59c9688182f1292e492e79d2298f1abaf9d4dc3204f20ba1f1ec39908d5ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250215, "uuid": "f9ad4068-5093-4ebd-849c-1191edd4b59b", "comment": "Malware payload (AgentTesla)", "value": "8a89e1cf58904686256e7bd4ef69fd9abfca443d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250215, "uuid": "d228fc4e-4ffb-4de7-bf65-4a96e36b43d2", "comment": "Malware payload (AgentTesla)", "value": "8c29e5fb476f005ecb9b491ce5d25606b0c31392ad0a14d5103059cb3dee8a40e2c4afe15d06cdccc34f2085cdd72c8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250215, "uuid": "5fc8b6c0-25e3-4d2b-a2df-f50dd56c24bc", "value": "T14725FA243DFF901DB1B3EFA65FD8B9E7D96FF632360A646A105003468713981DD8293A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250215, "uuid": "d20178ae-6784-4d0d-a3fb-3bd1aaddbb44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250215, "uuid": "1bd23240-d34f-4ee6-9684-0ff90f0d54c6", "value": "12288:QRQEemYEsAahN/X4QXHvuNgZQVcQAS+9IMqbBbGbwWlZtxF6rGQVPnvQ7zqhgKZK:Qtsd/Z+/KaowHAv7EfxhZZI2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676250215, "uuid": "5417b2e9-3bc9-4671-9ae7-d233dbb3c1f1", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676250215, "uuid": "34028f4c-57a3-4d16-b618-6033c4488392", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250215, "uuid": "e0bc76cf-7186-4632-a250-86a8d33c9c93", "value": "0b38beeaa74c58cb3a4520dacb146db5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364bc700-abc4-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676309473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309473, "uuid": "882829e7-0a0c-42d8-9aa4-d65f2477fc56", "comment": "Malware payload (RedLineStealer)", "value": "73789a431c86d1eecb4cc3bfab1ef3fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309473, "uuid": "0ad9ff6a-07b9-4f46-b08c-8ed709c07c83", "comment": "Malware payload (RedLineStealer)", "value": "8835bff6cfe62a2fc2ad7c8f91e6ff0c048b2e77ad0ca4c60959b45e3bc89ac9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309473, "uuid": "2889d350-7c85-4645-9a1e-0078479f4ba6", "comment": "Malware payload (RedLineStealer)", "value": "0de3c152dabbe981dd3e539f3aa265754509c4fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309473, "uuid": "864a9988-0a26-443f-b53c-a4ee6b866600", "comment": "Malware payload (RedLineStealer)", "value": "859872b7fd44fc51d21e985543c637b4738fde9b2abe536d078d46d3f9734c819b1f021c5d2266beb2f76772d1ffc8b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309473, "uuid": "91bdce60-0bcb-4923-860e-287a60396116", "value": "T10EF41247AADC8032E8B8A73059F203C31A357E606B749397278E7D560D756E0A23677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309473, "uuid": "5c53a2b2-cff7-46a0-a0b6-dcb9896e57a1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309473, "uuid": "79d0a469-6046-473c-8026-a999356740fd", "value": "12288:FMrwy90SuHFwUNbYZPrVubwuSa264ZcLQZe6eeJ90EqQjDl7liGo6BCH+Z:ByfuB6oy+Ul90tgk6Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676309473, "uuid": "9d269c54-057e-4184-b01b-689074f52466", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676309473, "uuid": "23d0852f-7905-4e91-8cf5-bb369178a4e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309473, "uuid": "4e58439a-b989-475b-9355-b3e3b07cb057", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec9c5d8-abec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676326801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326801, "uuid": "b3a806f3-b879-4f97-8997-1e5a163fed44", "comment": "Malware payload", "value": "5ec7c93c5bd4eb79ec7972bef2fcd3bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326801, "uuid": "0cf26d85-10a4-4d05-ba07-283c596817d3", "comment": "Malware payload", "value": "8853715caa4502209f806afcded94a839120cc0885196b32d8d25f7e4a43dca3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326801, "uuid": "a201c6a2-36dd-430c-bf88-1887951e81e9", "comment": "Malware payload", "value": "836489770811a3211cdb3742dd2c0d0dd18727a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326801, "uuid": "db84c9f3-f4d1-4476-9cbf-8124d0df9ec7", "comment": "Malware payload", "value": "e0faf983d866ac5b24996ccdd307a09cffea0bc868abba8060baf61b7fbbd4b65a1654a96f3246182f58726b9a767f95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326801, "uuid": "ab81843d-8326-4869-856a-24af4c744813", "value": "T19744E02372D0E831C97222329C6AD6F5267FB5218A39A64B37E8173F1E713D29632355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326801, "uuid": "6623ac25-8e31-4d81-9bb9-36ea7e8012ab", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326801, "uuid": "4d958b16-cabb-4cf0-a704-073ba97ede90", "value": "6144:BjF9RIFKu+51FdOrA2ujKfmbORxsCL6Mdz:BjHcKuK1Fx2mbOLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676326801, "uuid": "23db7848-ec2a-46c1-8d98-3e00ca872e36", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676326801, "uuid": "fbae6c7b-5a68-4c5a-bd10-932af23a47eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326801, "uuid": "4842ec24-d9c4-48ab-b65a-d8a6f0f6c57e", "value": "5ec7c93c5bd4eb79ec7972bef2fcd3bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0305278f-abd0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676314541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314541, "uuid": "8cf225e5-f023-4ef5-bcc6-41648ab4776e", "comment": "Malware payload", "value": "813cc4af52c70bb16be2d2be37a37ca4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314541, "uuid": "c0b2416c-dc5f-4b2c-9ce7-efd97bb14b4d", "comment": "Malware payload", "value": "8876d87aa56af501c3332fb4f3ea519b2dfe440a65410430bc57c4d414129eb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314541, "uuid": "4013d5f0-748e-40d8-8a6a-e50619a50461", "comment": "Malware payload", "value": "9f297803979b12f22958f429fbb45ead7abe799b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676314541, "uuid": "a61da26f-c379-451a-801e-3ecd1c61cf95", "comment": "Malware payload", "value": "746cd1be2a4e180cc49ac564804d1c3548b734a9ee1e6ab865b8118194d41596e93398af598d5ca20b18783636c049b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314541, "uuid": "e09d3809-e284-4178-9699-1220a0ef9c34", "value": "T123722CE552D85352F75352B2D43889FCF7709A9B1860ACD43EEC0109AB2F4CD2A65F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314541, "uuid": "fa0b89f6-64c2-4f4c-b56c-81836a7ee9ff", "value": "ff054882fb584b35cca03e1f00d97ebf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314541, "uuid": "a9a7f78f-7b3b-42c5-886a-705ff1845b10", "value": "96:rUEPHtSO3WXBbMyMtQAqrX6qq6tX6MX6a8X6vX6f4vX6uX6yJ5zj5QuFMLfXc1QU:QEftSHOFb3anSASxxPyAHyfqgz278", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676314541, "uuid": "b2f5c3b8-4e2f-4f3f-ad0d-327ad9356db8", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676314541, "uuid": "5f99d683-76ff-476c-9c3c-e384bba16201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676314541, "uuid": "6fbe472c-0cfa-451f-893d-2fb07c4baff1", "value": "VDA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adaf846e-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676284762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284762, "uuid": "6256f992-e122-4587-871e-467ccae1bb3e", "comment": "Malware payload (RedLineStealer)", "value": "2db118e9eeda80a0ccd36db3eef4178f", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284762, "uuid": "8eef74f7-b952-44be-808d-2ed6f8d6b003", "comment": "Malware payload (RedLineStealer)", "value": "887ea81a93990d17c9f2c7124b288eb30c8a66ee27f5d418f9aca3d72bd8b2d6", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284762, "uuid": "3bd81075-2839-4c6f-9a32-bfe38799aaf3", "comment": "Malware payload (RedLineStealer)", "value": "c7414294691f7bcd0133585fe7f02f132bfc45ec", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284762, "uuid": "a3a5e49d-5d59-4aff-81c1-608e2a3c9243", "comment": "Malware payload (RedLineStealer)", "value": "46876cb5b815624352a75cd0a5cdc7e9f18fd8ef69f4e5d26def8832dfc2397e66522c168c73eeadb35c6506d2f81f02", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284762, "uuid": "68c7910e-edb0-4b21-b1c5-f2ab63923e4b", "value": "T119F356313B0C97EF84D6E1549B66F91C7A203F7EC95DB2EAF2C21BCB569C801AD16064", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284762, "uuid": "ab609e05-dff8-47d2-8703-994a943ca839", "value": "3072:WjeXQ4k3RD6UfoEqto+mxA/m2s51gYa1lScfga0LtkocvDLO4IHr:eeXQqCoEq+G/ta1Xa1EcoyRIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284762, "uuid": "8cd8fb23-7041-4803-bda4-8f6ad5a6ffee", "value": 169665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284762, "uuid": "c08a4eb1-6578-4ed5-b877-dcd2837bfd03", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284762, "uuid": "2274f642-8fdf-408c-a8d3-575e57a7bd0c", "value": "Loader-Cheat.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deecfefc-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676301595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301595, "uuid": "db37a140-a5d1-4ee8-89d9-dae943a1235e", "comment": "Malware payload (RedLineStealer)", "value": "14fc28f9be0f9c33f41890eb0a562eef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301595, "uuid": "d62a613f-a48e-40a1-b0a0-56464d917c14", "comment": "Malware payload (RedLineStealer)", "value": "889c2f99e77a11d058b9e445ce4f9b3744a3beb218bc371436806ef047345675", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301595, "uuid": "1c2395ef-d6d5-41c8-9d36-679ec1cb8473", "comment": "Malware payload (RedLineStealer)", "value": "5ad034ffbf7c7095fca698936ef5596097e96fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301595, "uuid": "9ea485a4-4a78-4651-93a6-65155e885aae", "comment": "Malware payload (RedLineStealer)", "value": "08247837aedda4a2c7d123b182f61bd67a2cfdc5fb0eacb8b845075c493b04f45840cb6e755d86ffdb9ed575454aa891", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301595, "uuid": "7fe4aee8-7e29-4abe-ac46-d175caa3a172", "value": "T196F4124BE7EC8133E8B457705CF603C71A3A7CA15B34819B279E6C1A0CB26F566353A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301595, "uuid": "beb6aad2-1419-4dde-915d-8ccd80832f0e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301595, "uuid": "94f069c8-ad75-41eb-87b9-ffb152d139ec", "value": "12288:XMr3y90R5o7isMwz/3T10pBcqZOHNmueJwtl0E0fTqUttrQ9lU3jftq:oy47sMwzbUfZOtou0qirQ9lef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301595, "uuid": "20ae4276-10a7-4580-ac25-7b94488b46be", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301595, "uuid": "772c3d02-9524-41b0-af17-a01478ca5204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301595, "uuid": "7f13c135-1e90-4aff-95df-06747d1dd357", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6b1975-abe0-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1676321433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321433, "uuid": "c43c58cc-dda8-42d5-ba89-d94fa753a79a", "comment": "Malware payload (NetWire)", "value": "0f9a0f87d345043fe299242869d0bd40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321433, "uuid": "08fbe8e8-20ad-4140-bcc1-12b7c8c6c079", "comment": "Malware payload (NetWire)", "value": "88ba7e0ba10304a03661c41a262e6c84ff67d37e7d56a174ca8a64ee36b0f03f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321433, "uuid": "91e65ccd-943b-491a-9715-ccc538aba1e0", "comment": "Malware payload (NetWire)", "value": "9daec976b7832eb7d07aeb63dba737a3aec0e159", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321433, "uuid": "78779177-6153-496b-b70f-df59f627d830", "comment": "Malware payload (NetWire)", "value": "98889e7424b0e2764ba0ffed72a49b08c8897efdf43b7ae65ceab65a0ab9233ff762e9261082769fc8789ead9ceeaeaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321433, "uuid": "0f08db35-05f4-48e0-a81d-800e08fd7beb", "value": "T154F31718FA87A4F6FE0B1D31919BF73F0B757A01C130CE92EF541E85EA23C26150AA59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321433, "uuid": "546cf452-239b-4055-8d71-93062623f94d", "value": "4563c74acbd357d386b177e402b96ce4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321433, "uuid": "4cb18b4a-1664-49f4-906b-8fe9e50140b0", "value": "3072:jOzPcXa+ND32eioGHlz8rnAE0HCXh0edLvuYMjMqqDvFf:jOTcK+NrRioGHlz8rz0i/uzQqqDvFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676321433, "uuid": "5641bcda-69e7-492c-a061-a19dd455c81a", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676321433, "uuid": "ba5b4c33-2527-4ddb-835b-a586537ef90e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321433, "uuid": "34e24912-dfc5-4c9c-b390-4539cb8e6db0", "value": "0f9a0f87d345043fe299242869d0bd40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "569f3ecb-ab35-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676248109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248109, "uuid": "affb4c21-8724-44d8-9d70-70cd630835dc", "comment": "Malware payload (Amadey)", "value": "f192eef09fbd2e7ab570b8e68e0f25fc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248109, "uuid": "6c8d2c69-4c6c-49f6-a037-03317c694ec3", "comment": "Malware payload (Amadey)", "value": "88bed4f36c8c5c1e4c33061124bf170178da1ba2e2edf1475100cefad596fa9e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248109, "uuid": "58666422-ee85-4624-9e50-ca1f1b105c0f", "comment": "Malware payload (Amadey)", "value": "23d03c673bf3770432bb5f53e450c632bae07f21", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248109, "uuid": "4b36c942-b925-4830-a18c-9e1e8285788f", "comment": "Malware payload (Amadey)", "value": "d4acfa56d24cb36d3381356b14bc0f428bfc81e9664272544f2c4bc1e267950bdf25e1a5b29478b00c3a76016c0a6dfe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248109, "uuid": "4231d62c-31af-470e-a61f-2355b920bf39", "value": "T18EF4120BA5E96532E8F0277059F243C30B39BD606A39C26B634F59290C726F1F23579B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248109, "uuid": "fc665f6c-9727-4c2c-aea1-1fa7c7068959", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248109, "uuid": "be31ffd6-fe0d-4d64-b3e0-126c08fca359", "value": "12288:5MrPy90+uZefDG8SHCdSfOuHG6C5eJCL1CXlTAFOf541inM6sIU4Pox:Gy1UKYCdSfFxZCL4aO8hIU4PQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676248109, "uuid": "ca363563-6d40-49ce-836c-d5fd88ae6c7b", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676248109, "uuid": "57172e8f-e969-454b-bbb0-8a6b67b458b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248109, "uuid": "957a1f5b-f110-4f53-9dc9-02ab68b78f67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c160b324-abe2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676322591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676322591, "uuid": "14408058-e070-438b-b155-e6574c3ff78d", "comment": "Malware payload", "value": "e5428c4cbc05f4f24531ff2dab54fa19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676322591, "uuid": "5ba512bb-ab77-40ad-a1ff-33dbb9a60369", "comment": "Malware payload", "value": "88dfba0740a40a094b584b8cbb1298ece2b55ecb6fe4a9d211e4dba27988c8b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676322591, "uuid": "a08c6fcd-a975-4ae4-828d-f2e2bdc92864", "comment": "Malware payload", "value": "8bd00ed013bdd5cf6a0c32cd7f6c26a316972ebf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676322591, "uuid": "17c19002-411b-4af1-ad56-1a6391088bcc", "comment": "Malware payload", "value": "e11617e774b855656b67d50c7067b5b66e6fe6373e3c588fe67b63dbb1f592f9dd956821c05f72bd3e4e37f121b01313", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676322591, "uuid": "2476183d-429f-47b2-9f0c-d357ef83c1dc", "value": "T156F4130BA6E89125E9F01B712DF602D32A37BD605B38829B278F6C191C32B64F535777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676322591, "uuid": "5b88baf4-cef5-441b-9d5f-e1bf67c5a02f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676322591, "uuid": "cb43ea06-ad84-4ff6-b599-9517490a628c", "value": "12288:vMrEy90sH32gbGBVM8hui0FNlz7Hd7J5MExZeJiHSPUNOKUXcVv5mwcUviVkRZ:Ly32XVM8hpa77JKEc6ScCX+5mBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676322591, "uuid": "1fced5bf-d86d-4fd8-98eb-3fb6e6aa255f", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676322591, "uuid": "221d46e2-da11-4787-bb3c-0672e8ba3462", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676322591, "uuid": "d34f012e-8567-4abd-b83d-70a2eaf0c414", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c28bbc2c-ab3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676250867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250867, "uuid": "2cf3de85-691e-4791-b8c5-7e6a2a5bdc4b", "comment": "Malware payload (RecordBreaker)", "value": "1f30d139479c2dcd05202b054bb57d1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250867, "uuid": "c50288fc-37e4-4af3-b20b-183953f36a76", "comment": "Malware payload (RecordBreaker)", "value": "8921de84dab3549e7a44327491ad8ea19288931828a080de254ba80da9ad4af1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250867, "uuid": "a51a057c-5087-4597-beff-d0fe71b72b1b", "comment": "Malware payload (RecordBreaker)", "value": "d7f9b4f58c7b257e59f27220557ed0cc0dd58d1d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250867, "uuid": "97d00373-fe99-4d6a-be54-a404cb67a74a", "comment": "Malware payload (RecordBreaker)", "value": "1e3a2345ad28530a88234e8e02d0f2068b82d8c1a09531d84006c7438ed32e38d8f44f1a1b4d206f4145985ee1556bfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250867, "uuid": "a62c0080-1e44-4301-818c-0885af0adc0d", "value": "T17B04E0827EE1C073D55780712921E2A06A7EBC7167B5C48B3B84DBAF1D312D18EB5B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250867, "uuid": "02ed3fb5-5fc3-4d9b-ad31-58d40a3bff1d", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250867, "uuid": "65fac048-919e-454c-ba10-10c98394bcea", "value": "3072:4y4OVo6MQ35XTtDvhV1ZVR9K+VM3sOVy7eVnpTG+OGDplNdw6:4pQBTtbhvZZ/IVOeVpTG+OGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676250867, "uuid": "40ec3251-68c4-4656-b18e-3bd0caa48c45", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676250867, "uuid": "9af4d5ef-e3ba-4775-b494-f709590b291e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250867, "uuid": "8c95c66d-0a15-4385-98dd-f4d704381880", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f86050cd-abd8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676318388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318388, "uuid": "4c38193a-8f5f-45ae-8363-cefe6553f112", "comment": "Malware payload", "value": "e847800fd32d87c656f6ae8cf41c47eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318388, "uuid": "c174e230-ece7-44dd-b060-ee82b7e189b2", "comment": "Malware payload", "value": "8a22d6963d9bdc6a945137281a21f2a037703b73aa463cb3080f8eec71b3762b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318388, "uuid": "6f21c8f8-5cb3-4e27-a078-a39a410baccb", "comment": "Malware payload", "value": "1a17ed42ca526491ccb76b15ea38721efd05e6c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318388, "uuid": "67bf5fd0-36a3-4b97-8977-1094aab96e45", "comment": "Malware payload", "value": "c4143f75e2cb388ac688ba00970a408149928900d2972aef909a2d0a1adcae5b37a4db32ef40d86c17226b058d314f6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318388, "uuid": "d836a71e-56fd-4c3f-a893-fbee0a97bad5", "value": "T1CAA53B37BA93E8CAC4CED9354223D05D68A37854A0707FA537C6E73948E9F19AF09712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318388, "uuid": "3a5d7895-6c10-4e87-ac94-564e841634f9", "value": "49152:S+fyK2Xuj92uwL7maVbRFxOKnEDy2e+mpcK9M/Wgwr:SCXbjaFVNQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676318388, "uuid": "00399b6f-2f0d-41a5-a7c6-e4e704848aef", "value": 2123378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676318388, "uuid": "17ae409f-e61e-490f-8a4e-f117abc2d8d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318388, "uuid": "93eacbc3-85d4-4739-bd52-3e03d717f7f8", "value": "elf_8a22d6963d9bdc6a945137281a21f2a037703b73aa463cb3080f8eec71b3762b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd1cc84-abcd-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676313351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313351, "uuid": "71a7c0e5-5c6e-4c5e-b243-5ec9f9d52e66", "comment": "Malware payload (RedLineStealer)", "value": "acc4fc9f202c93e89c0d41d531afc896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313351, "uuid": "8c1ef9f9-ea71-48e1-be23-276ec980b971", "comment": "Malware payload (RedLineStealer)", "value": "8a53ec4d29d169c7dfe2c61d4b4b0982a725a977f536969947bd3e56d4a5e303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313351, "uuid": "39d1edf5-3504-4cf5-ae1f-966cbcc4f79e", "comment": "Malware payload (RedLineStealer)", "value": "ff879403ff66001d15a0972c3fe8ca7b28acfd07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313351, "uuid": "d2d20511-c492-446e-bf3a-85fe4bdc3787", "comment": "Malware payload (RedLineStealer)", "value": "46826dda500ffbeccdc69cfe311a3d71ff56c5ebcae5e16f83e8d2bb593f940c7be586fe4c92254bc6bf7f63b380a487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313351, "uuid": "0686c503-0a09-4890-9c12-72351d108e3a", "value": "T147F4120BBADD4032D8B5673019F303D32A3A7F914578829B1B8EAE5D4D31961B6347BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313351, "uuid": "7c2dfb3d-12f0-4524-9d25-1e34c124cc1c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313351, "uuid": "f6601717-8b49-4ab7-8188-abfbc37716de", "value": "12288:mMr/y90+LG+KkNfyM3HlnnVQ708hfveJrQZ1k7XlQlsdf5:hyDGZk91BVU4rQU79f5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676313351, "uuid": "aa9ecbf2-f9c4-42bf-9830-35b2619a8374", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676313351, "uuid": "76216721-9bb4-486e-9283-ad2091445d0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313351, "uuid": "3aa07106-e949-4f43-9ad4-942bb5d4a944", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ba4316-ab33-11ed-88f6-42010a9c006e", "comment": "Malware payload (RustyStealer)", "timestamp": 1676247215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247215, "uuid": "b04f9315-7a70-4dd2-a094-1b23902f55fa", "comment": "Malware payload (RustyStealer)", "value": "bc42a7babac07fa67c213c29cf9e8edf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247215, "uuid": "a64d3c5e-2ead-4e4f-89f8-262d0af32323", "comment": "Malware payload (RustyStealer)", "value": "8b65240ab4b290785dc4433c16ab85ed62847f17a0eda89db58344d26cf76b4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247215, "uuid": "a3fd8329-63cd-4ea3-98d1-d0fe98ede8f4", "comment": "Malware payload (RustyStealer)", "value": "d896bcbe4e75ee3af67e03a24fb638617857bbed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247215, "uuid": "3934acb9-3500-458f-b6e9-cf1e804dec01", "comment": "Malware payload (RustyStealer)", "value": "371a1522b582dda2dd31ab5522d51a23da23a9c48f0c01e02a9ef9717a4f868ca92e5b054a4f8b53b990c0e40e1bebca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247215, "uuid": "7e28d442-71b3-4f11-881b-cf156d333cba", "value": "T1D5B633795D8B18E1EAC72C3C984F6EC770FD02A419A38A1568C59C8E6B7DE70D06BC53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247215, "uuid": "4d13e1bf-fea2-4c54-ae2a-1566f782b8b1", "value": "881ebfb4b8b20e1f3b3657fb82622ad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247215, "uuid": "0f6b60f7-ffa9-4d3e-bfdb-bbfca2b95f3b", "value": "196608:itPpaOqyCQAuAANu5+j6E6TRH2YguNuoY4XCyEDTzQWkc8LBh7u:8PHdCQAiEcjdPusb4X6/t4X7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676247215, "uuid": "4f2fc307-ba25-4902-9ff2-2d95140888e4", "value": 10829112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676247215, "uuid": "214dea8b-0949-44b5-b391-b845d153067b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247215, "uuid": "05fd7e04-a64b-4196-8ec6-91d9672db26e", "value": "bc42a7babac07fa67c213c29cf9e8edf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c032f69-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676280625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280625, "uuid": "6d40ec5f-08fd-4ddf-8f9d-5264d623ef59", "comment": "Malware payload (RemcosRAT)", "value": "f64fc1f7c9d03819bd76645aab99be48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280625, "uuid": "97ada729-ae6b-4314-9c87-1804d40ddb3b", "comment": "Malware payload (RemcosRAT)", "value": "8b6a0f607c8aa32a95838d10b496bdbd68b86a457ef49f8043badb21f5b12b2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280625, "uuid": "ee0de1aa-d098-47a6-ba0e-82b8aeaa1835", "comment": "Malware payload (RemcosRAT)", "value": "11513e335fefcc3a302aba54ea5f5911f3290b9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280625, "uuid": "0f3b66d4-b345-4ed2-ab18-fe8920873fdb", "comment": "Malware payload (RemcosRAT)", "value": "0cc90b657b7c5a06f268c0accc0c99a0a12454de67a385d3a47c9a9de448530b006ec51208cb85643a11c71948c7225e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280625, "uuid": "9ac54d6e-50ab-46de-a6d1-aec65849cd72", "value": "T1853523553898D7A7C23D87F8DD31682853B3BE6634F2E2A72CA6758F3174B32045A643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280625, "uuid": "11c06618-b966-43bf-b92a-16084ba6407b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280625, "uuid": "cfda3253-fe0e-4d55-8b18-53f2ee351267", "value": "24576:wYXIQ57jS4qoLVNVS9nqi06jz8ajDTEnU6D5RJ:x/5+oxS9nC6rLR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280625, "uuid": "9fc5e180-23db-44e5-896d-7814014f330a", "value": 1088000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280625, "uuid": "43d4143f-6b14-4a2d-ac91-52e555953f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280625, "uuid": "3d860285-536b-47c1-81a5-81c52d3262c6", "value": "TNT Original Invoice PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8648c9-abb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676303198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303198, "uuid": "9456c280-7022-419a-b040-117bc291b7a3", "comment": "Malware payload (Amadey)", "value": "2f99bfdc4302a7048bf57c8fb000f0c7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303198, "uuid": "ddef7030-48ab-49ac-bbdb-f2b606d493ee", "comment": "Malware payload (Amadey)", "value": "8b80add0dbd3267a5d00c91cc68265fe99b2d4cad59a3cc570c3b39593e68467", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303198, "uuid": "356d82a3-7711-44cd-b44b-c158f6236959", "comment": "Malware payload (Amadey)", "value": "3ec8db694efd4aacbbbf8cd74c27ad00f0d74e3c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303198, "uuid": "838f7941-812a-4e9c-882d-750c7f3bd3a2", "comment": "Malware payload (Amadey)", "value": "a18118fb418b18b206e4520e53f0a726b604ce4cca4f662568e4342b3747448bdf1373ac154c7163ce823ae1b088184f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303198, "uuid": "41809a5c-b549-4315-b14b-77cc42149943", "value": "T14EF4124FF3D98231E5B427B019F752D31639BEA05E388387178F2E591C712A0A67276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303198, "uuid": "9e3b033c-a8b2-45ee-9f2b-b013e468c456", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303198, "uuid": "df180920-49ca-4d46-92a6-2ddace66550b", "value": "12288:3Mr5y90MyyeIVdJ4T7210mdmQkFQTqBeJsr9qShzEosuF4dNo5whfv5j7s7URD:Kydyr2yT7m0PQTPsJ1wpBhfJs72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676303198, "uuid": "47e9a971-157d-4803-b09f-d129b54a084e", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676303198, "uuid": "b4b0d1d2-52e9-4781-93f7-87ef7a7f4c1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303198, "uuid": "1d79b289-546c-48e8-8a84-f38faed696e7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f172ec4-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676276819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276819, "uuid": "45c53c07-f1a3-48f1-82be-564e14703ddc", "comment": "Malware payload (SnakeKeylogger)", "value": "56a801666311fe840e5ff2d774cbb47c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276819, "uuid": "8d544148-914e-43a4-9e9b-7b755f71dbf0", "comment": "Malware payload (SnakeKeylogger)", "value": "8c668b6de8e9a4ed1474bd66b871eddcca4a7fc0ad1d07db47015edfcde82bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276819, "uuid": "3252332c-324e-471d-a7dd-8903daadab51", "comment": "Malware payload (SnakeKeylogger)", "value": "21eea4a716a22a05b242dca14eb40abeff90ebfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276819, "uuid": "dc07bdd4-7c8b-470c-9a5a-5fb51e7ebc62", "comment": "Malware payload (SnakeKeylogger)", "value": "879f0793fbbc453f82df35d70bd7865e38ca930b7fa0683977e015ad44007cd163b1c561e095e3e64bf0175156ef44d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276819, "uuid": "f79766fb-235e-4452-84ac-d0dfe7fa8de2", "value": "T1D2E3095967F88400E2FF8A7705B15112C776FC52192ACE1D16D2F51A2A3D7A0CE1BFA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276819, "uuid": "cc82200e-1461-40ac-8ee3-bf86a3e1002b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276819, "uuid": "2bca5251-8f3b-4cad-81eb-7ac1fbc85c03", "value": "3072:ZAgAEcCv/IgOYrvQDGKjb8RIaqSwBWjOrFbY:KFyI6tKjbCORb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276819, "uuid": "96b6880d-04ff-48a8-a181-79ecd70dc2b0", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276819, "uuid": "1561188f-a3c4-4bf7-8fe6-ec847ad3f0e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276819, "uuid": "623e9fdd-3dc2-4db6-ac88-e917acd789d6", "value": "56a801666311fe840e5ff2d774cbb47c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb2cb0e-ab5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kangaroo)", "timestamp": 1676265436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265436, "uuid": "687d274c-bade-43c5-81c2-22a4c830b2de", "comment": "Malware payload (Kangaroo)", "value": "7b4084ee0c0257b2804fd8850010f1d6", "object_relation": "md5", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265436, "uuid": "e9462e03-0333-4786-b7a0-5d49f72748c7", "comment": "Malware payload (Kangaroo)", "value": "8cd3efef630f7245728e19a0479f72eafdef02f491ee64ec6e4d66994f08d898", "object_relation": "sha256", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265436, "uuid": "4b420a51-d038-44b4-85e3-5951ad28b69c", "comment": "Malware payload (Kangaroo)", "value": "59af9c471c42ea22dc619bb1305325c20f31d871", "object_relation": "sha1", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265436, "uuid": "b8942211-347f-4770-911c-3adb4a0e3798", "comment": "Malware payload (Kangaroo)", "value": "84d12213e845be4569fd7f681c53a302260aa0f70740f16f2e3f1fc5f5d042e66afe59f29ccda02e92448729d2835ff6", "object_relation": "sha3-384", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265436, "uuid": "b616938d-aae8-427d-90c4-0fbced89aa44", "value": "T1D362E9471FB80D66FBF1DA7014FE7806C1777829AB39EACB06185C0819B25E0E57C7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265436, "uuid": "27a716d3-604d-4c02-bab5-04c08f6e016b", "value": "745d7f50636fb2b25f5ec7f180ef6ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265436, "uuid": "24694f54-19f5-4683-99a9-5cf6d03fc472", "value": "384:1duTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99zd0WKhWu:1du9CaxEovcm/BCvXdsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676265436, "uuid": "0e5d288d-2f37-4e45-9fa6-1e8cccba7353", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676265436, "uuid": "c467874f-1ca3-422d-b20d-55fc0322fd42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265436, "uuid": "9b8e3fc2-4e9c-4f4d-bc61-c0eaff5a1caf", "value": "2023-02-12_7b4084ee0c0257b2804fd8850010f1d6_destroyer_kangaroo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e3c8d70-abb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676304466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304466, "uuid": "9bbb1061-2e0a-4008-8013-19e446849699", "comment": "Malware payload (Loki)", "value": "11f406b1ef314cca6060886c952bedb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304466, "uuid": "6690ad2c-a4bc-47a9-a21e-8ea0180fc4e4", "comment": "Malware payload (Loki)", "value": "8cf5acb58e1cff07fa0279f116cf73a1f288aa186c138677c35a6baeffca0a83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304466, "uuid": "8b17ef0f-5981-4ed7-ad50-64ffc57d16c0", "comment": "Malware payload (Loki)", "value": "e7d789623a9d64af4c871ee065c3136b254f7d01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304466, "uuid": "a3b6ccdc-de5c-4890-9fe8-916a39589410", "comment": "Malware payload (Loki)", "value": "ab69630ef2848653d1a149d8acd073e80979ef7f096941221bf2a5b6be47dd5d1217b3428afed4c8945f0b96c4d53a04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304466, "uuid": "9ffee650-fe83-4f07-91e7-0ebe175dded8", "value": "T13C040112BBA4D9A7D0A20BB20E3B6B429FF7ED051874D30B6304DF4E7476242D21DBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304466, "uuid": "67982db5-48c6-464f-805c-d5879c1d5483", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304466, "uuid": "ab78cb96-ba86-4396-acfb-27d705588c8a", "value": "3072:XfY/TU9fE9PEtu1b23dstUs3KMvIcxBoMF/gPqYjFoIIW1Pm9QydgJzb3XBDE:PYa6L23dAwcwYgiYjFoIILuyyJfxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676304466, "uuid": "15e07c25-f869-4ff1-b03e-aabefa9c3ed6", "value": 184142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676304466, "uuid": "04168110-ff5e-466a-b0c4-152d28e3e7e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304466, "uuid": "7aa1f953-d661-4c4c-855f-8ae94cc5dd21", "value": "11f406b1ef314cca6060886c952bedb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ff772e-ab4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676257282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257282, "uuid": "f0f865b0-1b9a-45e1-99b7-e4281f53e103", "comment": "Malware payload (RedLineStealer)", "value": "b3d047c3570f226162552c902283a3df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257282, "uuid": "890249fe-ba23-442c-afb9-708636f599f7", "comment": "Malware payload (RedLineStealer)", "value": "8d3ba1d343cdab1defc430603a8a020ef55a0a78a8d68f2695fcf47d99c19bce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257282, "uuid": "d61fb643-024f-4a06-bc2a-31f1c81cc50a", "comment": "Malware payload (RedLineStealer)", "value": "b2cedf02fa8d2d453868506bf10c9f002bbb1f5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257282, "uuid": "4a257e8b-0432-426b-b07a-2b03945e4bab", "comment": "Malware payload (RedLineStealer)", "value": "c281cc52260b4a0d481e42322bf6e179391c6b137ca025b4c00f66e414596d013c25e7a9199605309576ba6c6d666240", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257282, "uuid": "2f9e3b59-6e07-40a1-bfe2-67aef97da00d", "value": "T15854F211BAA5D033D1B389751921D7906A6FFD337AA4C44A32042A7FDF307D29B7A326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257282, "uuid": "a488294c-2ff8-48d1-9582-0e0b94785a39", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257282, "uuid": "1ecf9a25-03ca-4d6d-8ee5-1918cecdaf92", "value": "6144:6Q5BCZWvodRJYUO7eZB59yb2GWJfbTAxQ/iL:IWvyD/ZB593GW9AxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676257282, "uuid": "d2453bfa-d84f-4a8b-8790-d0536956edd4", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676257282, "uuid": "4615b82c-b05e-4274-8447-490037d415ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257282, "uuid": "f904652a-25e3-49c3-a94b-76e3e0fa7ffc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc4b617-ab84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676282078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282078, "uuid": "6f1aa6be-b72f-489b-a50e-7a5ee614221d", "comment": "Malware payload (Amadey)", "value": "9f642811b47bdff5983d6cf57f4e31a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282078, "uuid": "c762a24f-9b25-4021-a7e0-84ebed15fa06", "comment": "Malware payload (Amadey)", "value": "8db27a565c3373ae43d5a9eaf9d4a0268c9551fc9aa353d985308fc27da57df5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282078, "uuid": "01c93699-0c24-4a58-a19b-1b4063d2f654", "comment": "Malware payload (Amadey)", "value": "511d732a58f7287eba1e8956c59ba6ae9d9a8dd0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282078, "uuid": "ba2d947c-702e-4f18-b613-3d935d98c1a1", "comment": "Malware payload (Amadey)", "value": "fe46cb9a311cac889587a3eb7c4a1fd9d3b509813cb14f1f2b349c257036f4f64647ff2539ad1ef0b26bf29e5bfb4dcb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282078, "uuid": "a3d301ff-9989-4ff4-a099-62fa758c80a2", "value": "T1E6F4124BB7F44422F9B1177019F607D31A3D7DA1AA34438B634EAD6A1871AB0A23537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282078, "uuid": "4a151db1-401f-4cea-b270-fa33b976b0f8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282078, "uuid": "62f25f7c-2a00-4dff-808c-494ac9abd083", "value": "12288:jMrmy90eMXOWVATfIqo35lNh+jrw0Hl6jceJAGDWUHQuH8TCa0eZiM:NyEO8ADIq2N+rw04JppwuH8TFxZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282078, "uuid": "fd61892e-1fef-4cdf-925d-43fddbd6a1f4", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282078, "uuid": "31f4d1a3-5722-47ea-9d9b-68997cdc87f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282078, "uuid": "1834dde4-9528-4c2f-90c2-1bd1deef6fa6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533a0ae3-ab5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kovter)", "timestamp": 1676265712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265712, "uuid": "06b914ce-0e86-4a3e-a61d-406a2c55d4c0", "comment": "Malware payload (Kovter)", "value": "c0e737f5d4d9d2994624c8aab05475c1", "object_relation": "md5", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265712, "uuid": "686ba39f-96f7-49b1-a8b4-48113380d0df", "comment": "Malware payload (Kovter)", "value": "8e4aa5a69a20e6a4efd973ac05879ac65d95c34903941c425db43e47f896e2ee", "object_relation": "sha256", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265712, "uuid": "cd1029f0-6a09-425b-958d-a491c0811506", "comment": "Malware payload (Kovter)", "value": "c8087673f93f1fadf523736646eeb13cb43987ad", "object_relation": "sha1", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265712, "uuid": "1f18bb6f-bf6c-4ffa-b192-a8e8c46366d0", "comment": "Malware payload (Kovter)", "value": "f54ce72a9a2dca9a33c62167c0248b81cccd65212d025a4a2dae0d0e67b4d03b0797a3d29eeefb46c11143da6d3a7027", "object_relation": "sha3-384", "Tag": [ { "name": "Kovter", "colour": "#C8F4B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265712, "uuid": "68a2852f-9457-473c-8c35-ea6908e494bf", "value": "T19EE55A19B7C4C136C07F07364C63D2852371F8679E2346AB35E0A72D7E757D04AA2ABA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265712, "uuid": "7e61691b-8fab-4761-b46b-c2d9e11aa6b8", "value": "70ecac21951390289e31a1a3b129c186", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265712, "uuid": "456df81d-2454-468e-aa50-15354d3ecb5f", "value": "24576:HWrfdt2Zj1vpo4ajyKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKd:2jdAp1PagjLuSh3i+FtvkMzT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676265712, "uuid": "ac8aab5e-a4ab-4d6d-9d77-53dc0d239793", "value": 3056144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676265712, "uuid": "29f0cb91-b755-4079-92c8-652936b17d0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265712, "uuid": "afe3704e-9bae-4f80-94a2-6ad6a84746cd", "value": "2023-02-12_c0e737f5d4d9d2994624c8aab05475c1_kovter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37d8919-abac-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676299375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299375, "uuid": "50fc39c1-6a94-4de5-b346-9543259eabc5", "comment": "Malware payload (RedLineStealer)", "value": "deed96e26f1f9e18a7817e7dff38d8c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299375, "uuid": "dff7767e-98b7-4e4a-98ee-aff6bed7f908", "comment": "Malware payload (RedLineStealer)", "value": "8e86a38ddf27767838e7b4a04a2da4af3bf5c42e55e135a9ad9fb41f8a72fb40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299375, "uuid": "98574e25-425e-48a0-83f2-adce942ba973", "comment": "Malware payload (RedLineStealer)", "value": "91f279c584f61f32ecbde86165cdf1889a7c9ab8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299375, "uuid": "ce6d2ae8-0f09-4ac9-8dd1-f6cd1eebc90b", "comment": "Malware payload (RedLineStealer)", "value": "736fa8c52967794cf2adf7c259f58d75538de2bbc22f8595b0e73bfa33f036888fa1ed5e3562202508a9fc0473dc3a9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299375, "uuid": "99d2cb32-b264-4b71-b310-018731d886f0", "value": "T15DF41247E5F89133E8B857701AF643C31A363D610A38439B778E6DAA1C716E066363B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299375, "uuid": "7f7d90a8-5bcc-4599-a784-d55e87c62e2a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299375, "uuid": "d6eb1dec-1e77-4f6a-a963-5e47411fdd10", "value": "12288:lMrBy90MVhygTsuhN5npXev1tsMeJIH/7Rao7hUdtHQAFz71:IyzyC3n55ettGIf7xCHQAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299375, "uuid": "c146946c-33dd-483e-877e-5f35a94ef49f", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299375, "uuid": "df04aff2-e2f1-4680-b89e-4cfa753431bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299375, "uuid": "bed78447-fe3e-4fa6-8923-08310802889b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83410da9-abb7-11ed-88f6-42010a9c006e", "comment": "Malware payload (XWorm)", "timestamp": 1676304018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304018, "uuid": "125bd1f7-7f68-4430-a6f8-77bd5c572d9d", "comment": "Malware payload (XWorm)", "value": "8a6765a4608f98be5600adf08dd94378", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304018, "uuid": "345a410f-877f-4a92-8545-bc95a0f3a8ac", "comment": "Malware payload (XWorm)", "value": "8e8f5453c938c96bc1599782b134f57a1e897cc3d2813f8c162e7dafbf791dc9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304018, "uuid": "cd1f00ab-04f7-435f-aad1-0aaf04304690", "comment": "Malware payload (XWorm)", "value": "93304991bc2dc31f6f438b9ae09314597d83b764", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304018, "uuid": "c0f9c819-cfef-4be4-8903-2117748bc469", "comment": "Malware payload (XWorm)", "value": "1d5fea825f1d166b57a4fa9ec9f807722affc0c6d37b61150672b7067b042de99f237cede29b0e7f87715940b9ef737b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304018, "uuid": "95941b41-2c7e-44da-8935-141e91a85e27", "value": "T15A25E01783D1FA79C639B970CC2FAD499B004EF05E87ECD8B7A8A55A4D020ED4DE11A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304018, "uuid": "94f0a883-4d9a-4e68-a4eb-2ef0e7c07432", "value": "1536:n4tu7suXJSJPGow1adEjvjM1XAsKzBaRfy/Wr:4I7b5SJPGow1tvj2XAsKtaRGe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676304018, "uuid": "4fd7bc7d-cabc-4f33-8b60-46eb38fc540d", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676304018, "uuid": "cecfc741-3d4c-4b74-8810-edec0148b9ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304018, "uuid": "4d94540c-36eb-40fc-9ac8-87101541890c", "value": "excelsetup.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9af49bd6-abe0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676321667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321667, "uuid": "9cd83697-c38b-44e0-9977-0e20e8d798fe", "comment": "Malware payload", "value": "868ffdfc1a8da8187418ed72676cbf8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321667, "uuid": "2098f0a3-55f4-4050-ab3d-c65197b54400", "comment": "Malware payload", "value": "8ecabb42fe3cbdb6a89a113eb3d160817682d6546f7f629811a4621e2cbc8842", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321667, "uuid": "13ad92d1-c5fd-4394-b9b1-350de0e556e2", "comment": "Malware payload", "value": "47f02374991b47bc9c0b66df0694750cfd3c96f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321667, "uuid": "3044bc3b-9aab-4d9d-9e91-48c7d294701e", "comment": "Malware payload", "value": "73829828803bfe1b9d1b4a63b8162b38290d27cfd6f048e046a8c57b5064003c1c4a9bdb7b9145f8459cfc4704f3d484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321667, "uuid": "af2cf56c-4ff9-455d-b434-ae3fff3614e4", "value": "T1FFF4121BE6EC8433E9F52B301DF706D329357D105A38839B278F6D2918356B4A235B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321667, "uuid": "cd7fde49-6720-4f93-87d4-8566cfba3f1d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321667, "uuid": "86976d27-d360-4308-a695-1789012dc2dd", "value": "12288:EMray90ZUJfRuHv9R7mS9FV97C8THVKeJ+xvYyGRg9AXeoVH5vwcKebku79CzMbF:OyHJfRIvnX91C8TxagjR/XT5vBOaoMbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676321667, "uuid": "ae943ae1-26c6-41e3-8d7f-95a5c06c7aef", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676321667, "uuid": "0bc22b11-2f99-42db-a41e-b4b84d963104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321667, "uuid": "5066ee70-23ef-4508-8b5d-5dbf499fbfda", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba745af8-ab4b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676257725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257725, "uuid": "8004db2e-1d24-4fed-a6a6-db13814f9c1a", "comment": "Malware payload (Amadey)", "value": "8f2f2e1bdc6a01ea2a7fb2f7c67cc96d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257725, "uuid": "3fd0e25d-0aa7-4040-a933-098590ae2025", "comment": "Malware payload (Amadey)", "value": "8ee8f06b3acb1421dc7872a68438fe0250087415856288fbceba010d94c3c885", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257725, "uuid": "f87ea5a8-932e-49eb-9fa2-30cd8e5bfae5", "comment": "Malware payload (Amadey)", "value": "469bf87677851de2c0dd5a013de431e79abef7b8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257725, "uuid": "d8e423bd-e038-46c6-8576-037433557b8f", "comment": "Malware payload (Amadey)", "value": "c6066c03219e36f4f4a5ce1d7e231846f38b9b8e5abc4b2eb9f5c4b7f389fe8eb4c8be0100713fe79e00cc4329894037", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257725, "uuid": "93dfce71-5645-4342-a931-057d27b8d6da", "value": "T16BF4121BB6EC9022E87107B01DF613D32B36BD615B38824B378E5C582D726B5A53637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257725, "uuid": "4b1091dd-1d05-45b7-805d-e4c68dd328c4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257725, "uuid": "70ae3bea-ff79-4f55-b130-93c2077aeb09", "value": "12288:NMrny90mz2canz/cILDFgVsLoeJWEb1lbaYAsXqaeGlObo6xSz:GyJfLILDFgyWEBhtAKqadlj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676257725, "uuid": "4d746079-dbee-4a56-9cb5-f501a45b0fc5", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676257725, "uuid": "125d2888-95e2-43b1-a621-37884732e307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257725, "uuid": "246079c1-9a42-4f99-acc8-4aa5271347ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc95367-abf8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676331817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331817, "uuid": "fe4395a0-beeb-4ef3-ae04-c1146ef14135", "comment": "Malware payload", "value": "2d3cb3161a09332dbcf632025a30f991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331817, "uuid": "f4b07f46-881d-4fd3-8838-d6fa2ce7b628", "comment": "Malware payload", "value": "8ef6acdcacf9b4d3b3cb1757ba259e569c8c779e613fd456435d8e2e552b17f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331817, "uuid": "b5a4af45-d2b8-48de-8a12-5040735ace56", "comment": "Malware payload", "value": "9185303e1d3d79d0d20062fec253cf03808f3e81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331817, "uuid": "e9fccf75-f8a0-4f9a-a285-dad511a172f7", "comment": "Malware payload", "value": "09c35806f3c8291c8fc7d4c80e4af6bf929c353f1491f2e6b88006be816cb640dafdd0d09d3ca2aa2d307bd5e8e0e152", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331817, "uuid": "9893a22d-e5bd-438d-9134-a40fcec0ec69", "value": "T194F4120BB2DC9132E4B4677024FB07C31632BE6156B8825F578AAD9E1C322F4A57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331817, "uuid": "61d5b6da-0d1a-46bc-8db7-bd91997153e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331817, "uuid": "71656008-7e0a-451e-a9b0-2ceace925853", "value": "12288:LMrzy90m8joKkli2s0AlFuf0D2Px4peJcxEfsSGrY2FmVFtIBX9+:UyL8jonli8AlFK0D0xcxE1SY20VFtI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676331817, "uuid": "268cd8ac-3fb4-4150-b5df-07a1338e5ce4", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676331817, "uuid": "0e058c26-44e5-4c10-a670-3fb6028c5e6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331817, "uuid": "29ff53b5-b81a-4c74-a25c-0e74215017c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09aea762-abc4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676309398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309398, "uuid": "c53a6fb8-d6a5-4a52-89ea-222272410870", "comment": "Malware payload", "value": "f9bbda716dcb45b26ef75c5abf4163ad", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309398, "uuid": "cdd13d9b-893d-4fc7-aed4-cdd8e9f2108d", "comment": "Malware payload", "value": "8f2071e2108a3b9e9714c6fce50d41bb914c48e15445370f002e71b87e1ca9b6", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309398, "uuid": "91d7e478-88da-4358-a866-7142a9dfb814", "comment": "Malware payload", "value": "e9a88bf99e4ea674c3b5d34786ed2ef02dbffb7f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309398, "uuid": "03ea044b-dfe1-439c-9d36-42277938bb0a", "comment": "Malware payload", "value": "c94192d2f82f01c0f49e77d12dbbfc92496aad17eb4b1c364f4e9c2ef24bc1cac51afc85435a1c1cc908588c1a7b860c", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309398, "uuid": "e2af36a4-ed55-4fe3-acd9-8e034813434b", "value": "T1C615234A63428787D5697130C4FB053D03B77A896E37823B32CC535A2B133AB99E6F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309398, "uuid": "c2f9f0b4-fd1e-4105-ae33-ae116568d009", "value": "24576:lRqZvtqaShiBjjmcK8PpgHsHKdeNqKFWQCki:lRqrqTAjFpysq8Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676309398, "uuid": "6c81afff-b9d0-4a76-83ab-19e6bee3ed40", "value": 940032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676309398, "uuid": "01399bc5-d5b1-4394-884d-57caec91747d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309398, "uuid": "676c13a2-f1c6-4575-911f-739f1c548cc6", "value": "fedex09877665.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d2c794-ab90-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676287224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287224, "uuid": "cc2efaf0-b9d2-4bbe-a03e-2e1f33f99ae2", "comment": "Malware payload (Amadey)", "value": "3e962972c35ef884fbacadc2e78e76ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287224, "uuid": "adb26fbe-d7b7-4545-8791-10c1a16bd5d1", "comment": "Malware payload (Amadey)", "value": "8f927ca99777c680314c1bd3b33327ae3e4c26a214c72d4ec18014821e9f9f1d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287224, "uuid": "ea473b46-c3bd-49fd-98e2-fc0b9702c207", "comment": "Malware payload (Amadey)", "value": "b0fc41f84d1e0864147629abc76a29ddeddc8e76", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287224, "uuid": "30087c68-3579-4328-bca0-99b171bcb130", "comment": "Malware payload (Amadey)", "value": "5a7147fd763d65b2b1e1e87c4a9e7d798a8f04fa8bcd3eb2f1c35a81f5609c51a2760fba58f0b6c09d75bdb1e35b6595", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287224, "uuid": "a15f0249-b2c4-4a28-a6de-d7ab0f885bd1", "value": "T1C2F41207AAED9072E9B463700DF603D31A317DA25A34039F138E6D182D75AE4F539767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287224, "uuid": "241b8f18-3696-4fb5-ae9c-9616645a561b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287224, "uuid": "4d67e06a-0a53-41be-b3a9-8f5130e72f4a", "value": "12288:UMriy90X0HEQjyowCb2u2YE7LTI1fvrB+eJkiL33f6rwh5o3Lki1DJF0aoh:Gy1HEQJwCbwLk1fvrVOrPIi19F4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287224, "uuid": "ac2865fa-42c7-43f0-a9b4-b59223887c1f", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287224, "uuid": "6c3fedfe-51d6-408f-b336-cb14f411cf21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287224, "uuid": "7fb878c6-3d76-497e-a643-0dc495895b64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255a74cc-ab3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676252321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252321, "uuid": "f8023b9c-a354-4126-bf64-d49983ad6dbf", "comment": "Malware payload (Smoke Loader)", "value": "0c1ecbc874d13b9d9b4c29cf0a74fc3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252321, "uuid": "60ce90f3-ad9c-4218-9a22-578139e24ebb", "comment": "Malware payload (Smoke Loader)", "value": "902796b39890a6fa63283b0fc5a07500d49071046a0e4051e0f9eba6c07540b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252321, "uuid": "9fe69299-a742-4edf-bb54-a1ab1608dfd0", "comment": "Malware payload (Smoke Loader)", "value": "1b590a1d85a8c9080b1e12372200b9eb606b0ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252321, "uuid": "24e7ac45-e8c9-498f-abc6-eceb820dc73e", "comment": "Malware payload (Smoke Loader)", "value": "fe95717fe2486836eff7d54311bebbf5bb76f2f4bec82ca5c1b0a022ef45b2891bcb3f8ed768ff02cf36feb0babcf600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252321, "uuid": "206a3583-11e2-4405-9c20-cd7cc9489d72", "value": "T17404DF3235F1C2F3E4678571B420E6A06A6FBCB567A5C09B734816AF2E303D19A78357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252321, "uuid": "d32c701b-f9a3-46f7-a22f-82c8e1302b7c", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252321, "uuid": "7ddb872a-59c8-4edb-998b-df651060a5c5", "value": "3072:HYKq5zdE35XtPmIC5qNK3REYnStkovr6DfLlMVvrdIMBQOm0/6:HnEdEBtPmZkNYREYStADfk5I2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676252321, "uuid": "e3f24d14-5e63-4c15-b3d9-e4e5fdc074db", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676252321, "uuid": "0ead82b9-fbb2-466e-8e38-bbbe0ba73eac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252321, "uuid": "9f77b197-d05e-4a5c-9375-2dc1fb53aae1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c4ae4a-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272017, "uuid": "ffdd8777-a056-429b-9dd1-811611ce9227", "comment": "Malware payload (Formbook)", "value": "ab8747363ec56d2b6c83ee08e763706b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272017, "uuid": "64d77282-2954-4a92-bc0c-99c1e1ac8bbd", "comment": "Malware payload (Formbook)", "value": "90f8a6e23c16788ef3a7adee0b9b9a03cede0905367d71a8be46d3dc24b7b759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272017, "uuid": "298c95be-b040-4b51-ba0a-3032aefca2b8", "comment": "Malware payload (Formbook)", "value": "1a6ae2a8825f0cbecfac25c31d2a52635bef07fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272017, "uuid": "2c79fb42-a05d-4baa-8085-b741b0e227c0", "comment": "Malware payload (Formbook)", "value": "c3f4291337101cbefa3cd80727096d1ab44f5a15608a9e72422ead91694bc318e13ea1938d6853fad053464aef3a8a8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272017, "uuid": "ad43fdf4-cbbd-4e40-946a-e7f7ac8c3908", "value": "T12004AE32D642C071F2B251B5F67D1B7B483E0E343695A5EAA3F516E02EA09E4F42931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272017, "uuid": "68e9a1e0-5f31-48ae-a240-2baaedcaba8f", "value": "3072:GBOxy6U7+PYnWKmjQmf/1rEqrNJkZ3T4BuIrb3/HYs1Z0e98/bytFZ:4aKmTf/frNeZ3T4BuQbPH+cC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272017, "uuid": "be2ef25a-c312-44f6-aac6-6a2cacd7169b", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272017, "uuid": "e315b060-c206-4112-9076-deae9059b1d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272017, "uuid": "9d8f8024-e36b-4b0b-b781-a9e38f533dd4", "value": "90f8a6e23c16788ef3a7adee0b9b9a03cede0905367d71a8be46d3dc24b7b759", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3d0d5a2-abab-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676298919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298919, "uuid": "22c352c6-989e-44a7-902f-6fcf44ba85c6", "comment": "Malware payload (GuLoader)", "value": "2b97bba2c3586f53239de1202dd5a589", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298919, "uuid": "0d5f9a0f-4ba2-415f-b387-bb82f6a2845e", "comment": "Malware payload (GuLoader)", "value": "91c2e0730c8d4f84cd8095c2b21ab42046d6248ca1b068afc02cf41769b5dfda", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298919, "uuid": "23fb42a4-7ff8-4ac4-8fca-0d93de642bd3", "comment": "Malware payload (GuLoader)", "value": "18fd9d9b2992399b87b23ab66b711301ba38f693", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298919, "uuid": "280eaf05-3f82-4b20-b8a5-8a6e647aef1f", "comment": "Malware payload (GuLoader)", "value": "6c4679af54a3e2883ec1c87a24eccbf1dd6d3b4a3cb463251eb890eaf4aea2bde7515d5cab7e67af4ee940ae7b043062", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298919, "uuid": "483162f7-b690-4010-bb19-12329672323a", "value": "T135741222F2D75CEFE58619B106A2C32A537287684533E2137F2DA731F9563435D1AEC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298919, "uuid": "bfd6b52a-9b3a-4481-bcfa-809366508eaf", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298919, "uuid": "e531670e-6a79-4803-833f-824ceaa495da", "value": "6144:/yIB9qSljbH5svbNAvVgVX1U8faOsrX6Oc/XR6jbUaEgKLC2K4:79BOvy4UqaOsrE/BObGT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298919, "uuid": "a10a1d41-ea35-4a10-9336-f772d78e808c", "value": 346728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298919, "uuid": "aa1c367e-087e-41a2-8ca8-124b4b07377f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298919, "uuid": "db181e2c-696a-463f-9af1-140eb7a05d20", "value": "HSBC Payment Advice.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f55b1d4d-ab8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676286171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286171, "uuid": "95904ad1-5bb3-4f3f-b002-0e50885e3cff", "comment": "Malware payload (GCleaner)", "value": "c79114d16a31ee76aed1dc96c5c75484", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286171, "uuid": "84efd345-22c9-4e0e-9158-de2fdbd36957", "comment": "Malware payload (GCleaner)", "value": "91d77908db911b13e192f9569d98592af99013480fd04798fdc16b862d8c0d4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286171, "uuid": "8c1a3a58-8a2d-41af-892d-f411e4c4515e", "comment": "Malware payload (GCleaner)", "value": "001e44d5081c6ff83abc15b7409f998f2437193c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286171, "uuid": "1f684c35-57aa-441b-9547-1cda96064ea1", "comment": "Malware payload (GCleaner)", "value": "dcb25cd2f57b9287f069d9c647db2c6f48098140919149cded35d26c38600803b2220208ded137ccd268b1a07745a406", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286171, "uuid": "16d7bec9-73cc-41de-8392-cfdbdcbe1bdb", "value": "T165E5127C7106C4ADC290BEB88D36E8E76CD76DE3E8E4946270D87F3F95B9285460A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286171, "uuid": "80eb848d-5446-48c2-bdf6-5d2b85827e5c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286171, "uuid": "7eeb1a8a-46d5-4c34-8d7e-51576f2fdde4", "value": "98304:JHAlza+B0rFzIkOkNth+N803ctQiwv2MR:dSWkkOknh29cwvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676286171, "uuid": "2304ba8d-a744-407d-85ae-30129b3675f9", "value": 3147964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676286171, "uuid": "21645cb6-9bb3-48dc-a864-e15b3853be6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286171, "uuid": "7573f153-569d-494f-a4bf-f19d1420f36f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29814bbb-abd9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676318471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318471, "uuid": "b0d9a0dd-9d74-42ed-bf6c-ce8108a6543a", "comment": "Malware payload", "value": "21ddfc4a4ad5c55ab4189aa655564c2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318471, "uuid": "4630f6a0-d90f-4365-a7a9-5cf9dcd39b52", "comment": "Malware payload", "value": "91e4140b1b374c5d900a8e09f09b930006bdf29f9aa5f51c2e8e70e7a2f7e2bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318471, "uuid": "54b26187-acfa-4aae-bff6-b0664b1e729a", "comment": "Malware payload", "value": "ab8f2ce918c97bfbdf7c131ab8f5931baa3332b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676318471, "uuid": "80b3c867-6a19-4d87-b3b2-8e957ad91d8f", "comment": "Malware payload", "value": "0a2d6930561cda7aeb3b0562aace5828f4a1783899497b9cedb902cd1a07bc3a456a7e621aeea43f755082d0d7c49d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318471, "uuid": "71b676d8-86db-447c-bd95-06e8c1503598", "value": "T1E6F4120B63F85422ECF06B716DF603D31B31BE618A384257238E795E0D726A572753AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318471, "uuid": "186e4147-07eb-4e02-b209-1a93551d639e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318471, "uuid": "f59eeca3-d9a6-49ee-836b-7d100bf44d9a", "value": "12288:DMruy90QvhuYGnm3Ya/VHIwl9gZueJ2G0r8/lLT+vfmvKPEMb1l:VyA7nOlNH1ai8UOvKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676318471, "uuid": "bbf563d2-13c6-472f-b2a0-daf003856a7c", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676318471, "uuid": "4fa9aa32-8379-4bb8-b6e9-9d83590da41f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676318471, "uuid": "deb365c7-5b84-4d29-8543-20362faeccc7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d20602-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676300660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300660, "uuid": "7e9d792d-641c-4b65-9e2d-5247c26dfff8", "comment": "Malware payload (Formbook)", "value": "b01057424da70f1003046a80df1dca0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300660, "uuid": "83af407d-9edc-41ae-a546-0cd6a531a01b", "comment": "Malware payload (Formbook)", "value": "929bb5ebaacd2750b9f7cbabb07e7fdf678d2958b8552af4e7fb705bbb92c21e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300660, "uuid": "79358385-09b2-493d-895a-bbffb6827b8e", "comment": "Malware payload (Formbook)", "value": "c0f491fc9b8c8611f0977e6af84018abfc065d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300660, "uuid": "1e7efc8b-e155-414d-aad2-19805ba8c3f6", "comment": "Malware payload (Formbook)", "value": "44dd66304072ff12ed55c7948e41ada70950569f47dba98beeda3d8d602f427dd28a5ae73d060512fe3bcdb8d8db01bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300660, "uuid": "02ea1fc8-389e-4e77-8076-924f9170e3e9", "value": "T13484E121F54CD49DD4A05FF08895E4E32899ECBA393B9AB2E2F2732E613D50D4178763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300660, "uuid": "f963f089-cc50-40d6-8279-f82b7fba2196", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300660, "uuid": "8c69c468-2352-48a3-b359-2dc806d50003", "value": "6144:2Ya6H9sssssssssJZ8Pd47Mpb4vgQu8TtfkWAy+hl3dhX3TqYy7Fs53IOAd5R9it:2Y7sssssssss38V47MSVuIkWAywzq5BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300660, "uuid": "f4e4fbd3-5e95-46e7-ad99-d27dcbaa6085", "value": 388067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300660, "uuid": "83729962-b739-4a62-b090-7824a82567b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300660, "uuid": "c7680b98-0904-44e3-88f9-7f154b096ca2", "value": "Hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fa6995-ab3e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676252025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252025, "uuid": "a23ce001-27ad-4f6d-bc2b-91ef1fe68b92", "comment": "Malware payload (Mirai)", "value": "a783427ab38faf1c09d1e9d291d75e69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252025, "uuid": "61459ba7-2c7b-4d1d-9c11-524328e15698", "comment": "Malware payload (Mirai)", "value": "930ad0f5a885264187561deae225ddcb010d590ee9ec02fca9b5f2fe6a59de92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252025, "uuid": "f78cda72-311e-4f35-b85e-f14a715d969a", "comment": "Malware payload (Mirai)", "value": "c4bb0b38a7905d4cc73ba3c1c496070319906863", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252025, "uuid": "8f849e7c-f4cf-43f6-b167-8c5bace4b681", "comment": "Malware payload (Mirai)", "value": "db92e3ad6aca54affed85c6d4045ca4357a3e6ba1c589377a32301f54a04d2efdf183adb376309594f4c3978b5954392", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252025, "uuid": "91fe000a-b246-4de5-a3d0-e111b6747b01", "value": "T1C5F2E13D11E299F3D166C9FD22C806D05DB20FF7B3C388558185D92FE72A4617D92AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252025, "uuid": "75741839-b3a2-4d08-bcf9-512c8f7176f9", "value": "768:ibSu0sfOPNUkqdenYhqYqjh60kb3YsX8SaSHVGZJgGlzDpUYs8U:iRCEenYhqfSX8p0VGLVqYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676252025, "uuid": "c38426a1-0241-40d2-ac46-cbc5ce0839ee", "value": 34996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676252025, "uuid": "4346ba85-d617-400e-ad31-0bfe1d632e99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252025, "uuid": "bf2fc195-46ef-4b5b-a4fd-1fe0f7947678", "value": "SecuriteInfo.com.Linux.Siggen.9999.31094.8832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0309b563-ab9c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676292207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292207, "uuid": "54ab2ce6-067d-41dd-a9dd-d3059c389f53", "comment": "Malware payload (RedLineStealer)", "value": "58a6816f165b4f7d8e7408bec6bb150d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292207, "uuid": "30aaffe8-801a-45ab-b1d2-50540b28169a", "comment": "Malware payload (RedLineStealer)", "value": "93a5730f5de2023071639c557d5b208e23d94ad273e26d2745aa1515a5046e1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292207, "uuid": "54723c11-51de-40b7-9419-97dac6221aa6", "comment": "Malware payload (RedLineStealer)", "value": "0687129751b840969841a3002c3428e4de7df101", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292207, "uuid": "c6a44484-dcaf-4ed2-ba3a-e05824202991", "comment": "Malware payload (RedLineStealer)", "value": "8da7866bfddeb4b2457c50a17ab35d0531033f18746d7113ddf4db63a9c2b06ebafa630ed9fa3e766173412977c61599", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292207, "uuid": "fc7017f2-880f-47ce-95a6-348f9c07021a", "value": "T194F4131BA7EC5112D8B4ABB14DF303D30A327EA2973492DB238F6C4558726E16135B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292207, "uuid": "b366024a-9b97-470b-bd64-4d1b77b10070", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292207, "uuid": "d4a03dc1-156d-4e69-b391-13dc3fe89a55", "value": "12288:MMrqy90AtBLiVly5ojVp671zyKZeJTyvxyJ2lvrroEeRnFA8jzCK:myXHLOljmZzy9qxyJ2RUEGFAQCK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676292207, "uuid": "fb2a4260-0201-4ff0-85e9-a27f7071fd75", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676292207, "uuid": "c571c477-5f4b-4f03-82c5-0b0210636e41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292207, "uuid": "a8096614-4d6b-4779-b84b-8a95dd978158", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba850770-ab7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676277912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277912, "uuid": "180217be-24fd-4202-a19f-a2e3385ab567", "comment": "Malware payload (Formbook)", "value": "9af3decbbd26bf35fc99b948caf85bf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277912, "uuid": "708c2040-5d37-466b-b40d-83ae2dfc9c10", "comment": "Malware payload (Formbook)", "value": "93e9640423fb4afef5c9255f3489af80b7961696350cf0c30cb295711bb50a8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277912, "uuid": "b4ca9ce5-42b6-4ab9-883c-fa6c98436cb3", "comment": "Malware payload (Formbook)", "value": "8aa64735c8ba5a38a4438b40adfabb17d14208a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277912, "uuid": "5865a8b6-9610-47e9-aad3-e67e87ba4dd3", "comment": "Malware payload (Formbook)", "value": "8b6c48d09d0b6f1b9c46ee97ebe8c170dba193e05aff58291f69139d3b4091535c177ae76241f09d0dc3c16df634086f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277912, "uuid": "a130eb41-3e78-41f9-84f0-40bd8f1f2484", "value": "T1B245E04A3F3C8946E5282D794CB75A2F03399C5098ACD686EE773DE52E336C17C161CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277912, "uuid": "6b5831c1-0fd8-460d-bcbc-9125ac2d41b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277912, "uuid": "91747bae-fe42-4ded-b4e2-02e0f5ad9439", "value": "24576:KYXVQ57j10pizRsndjCVM3Ui/5xJWUMwQhrb:7S5eiFsdGVM3HxJxMwQhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277912, "uuid": "d66c95aa-09b7-4d47-84a9-e99b1ed30165", "value": 1234432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277912, "uuid": "a1491779-424b-46d6-946e-3ec275f31a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277912, "uuid": "c9bf2097-1a67-4470-adb4-5b3d2934a99f", "value": "RECHNUNG0028377387.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3758f9ed-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676276833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276833, "uuid": "ab3aa0a4-4395-4c72-8a67-cec777ae7a30", "comment": "Malware payload (SnakeKeylogger)", "value": "8915a13e817125a4bbe7b4dbf1cb34a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276833, "uuid": "73bb72fa-a55f-4633-a241-7c099874e600", "comment": "Malware payload (SnakeKeylogger)", "value": "964339c281e30c8d5d322f25bfa791734c9e6056e993321b127844c7a5cd881c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276833, "uuid": "e93553cd-4ef6-4f01-8b9d-e02620f39ddf", "comment": "Malware payload (SnakeKeylogger)", "value": "ad0a0957623a0fdd2f75436f38e4bb89617306e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276833, "uuid": "e03b0495-f96a-417c-880a-d15b8b45e42c", "comment": "Malware payload (SnakeKeylogger)", "value": "cd51439130f30493f3235e46afceecdd5b34f3c1b79e5c2d1230b6641100e93954a6d4c30fa8796bbf15cdf66118efd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276833, "uuid": "77d9f285-fe41-4a9b-8494-c5e57b5bb750", "value": "T18C3402C817E947DEE7BB01B18919944303B4819A8160F437EEFAF8C54861FB1CA67D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276833, "uuid": "46b50633-8fc0-483c-aee1-b3304872b8d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276833, "uuid": "f1e5589d-c3c7-4aad-8c8c-49d9944b04eb", "value": "6144:YuFDutOc6duxKLolSPNWdrQw1NLUGO4OOdQskTkMfoCDcg/:rFDutOc6duxKLooINLUoQsI7AE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276833, "uuid": "ab099a07-8eec-452b-9d1c-b974e6e51c5c", "value": 231424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276833, "uuid": "fcf03663-46c6-4cc7-918c-f85483eb5ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276833, "uuid": "e954e65f-61a1-4fa1-810b-028787090543", "value": "SDP0434578900GK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d0cc81-aba9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676298201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298201, "uuid": "6bd4f846-80f3-4aa1-921d-a8720f19a97b", "comment": "Malware payload (RedLineStealer)", "value": "5159c66781767ca58726d35aa8f3afe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298201, "uuid": "7060ba59-8991-4165-84e7-3890a04b7077", "comment": "Malware payload (RedLineStealer)", "value": "9736a4ee6067d54d37990bb42a81dc7b43b51f5b3e8f71452edcc4fa2eec542c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298201, "uuid": "df1bdb40-1471-499d-b27e-e798834d02ed", "comment": "Malware payload (RedLineStealer)", "value": "c7acad88c8065d0f039214ef2272a519a0209919", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298201, "uuid": "d583cc00-f7ea-435f-9290-9d707e2bc0d1", "comment": "Malware payload (RedLineStealer)", "value": "05ae9482b9274f661231b36fd78e72d0d26c837ec5f4fae87be48d651433fc428c94ce9b20647ce5db523c5e90cc06ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298201, "uuid": "76cdad69-e963-4f5e-b25c-e978a33410ff", "value": "T12AF4124BE2E88433E8B4577009F61BD716327D614B38829B37CF6D560C72AA5A63137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298201, "uuid": "509387a1-36f8-4877-beb6-cc39b7aec9e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298201, "uuid": "f396221e-201d-4103-a6d5-2c5161944fe3", "value": "12288:ZMrcy90EC5GhE3siINtgwAtEeJdl3/rdzVA9VFUftx1I3OMs:dy+Ei8rAzd7zafFiHCBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298201, "uuid": "a711b05f-0057-41c3-a280-fdea9c8c9f4e", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298201, "uuid": "f4810b91-213a-4043-825d-959b53f24609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298201, "uuid": "5c3b24c1-0377-4622-b64e-12efde877179", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48e2f12d-ab34-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676247656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247656, "uuid": "9e076007-7ace-4df9-85c4-3357941f1e54", "comment": "Malware payload (RedLineStealer)", "value": "445c892a2214a52f39c2b1ad02bec4c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247656, "uuid": "eaa21a61-990a-4547-9847-a700d58ac35f", "comment": "Malware payload (RedLineStealer)", "value": "97dae4129ff58d345d41d83f9f262966a6e4580af39a6d5c6714d221a2a2ad1e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247656, "uuid": "0fa3d2e8-6bab-4612-8a93-7477aa4caf87", "comment": "Malware payload (RedLineStealer)", "value": "2d9228c35eb2356d74e75ed067e72cef9a41dfbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247656, "uuid": "40face41-a623-4dcc-9842-966dfccf6c68", "comment": "Malware payload (RedLineStealer)", "value": "0c869b36e7c5082a198c6efa6a1698951d189fee66685fd2fdef6c7ba60b4ec51698a986aff1c205087ee46e42cee511", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247656, "uuid": "1ab12515-dfb9-4f86-b3e4-0afbb9198301", "value": "T1DEF41217F6E81021D9B157B018F603D3463ABDA0667882AF27CF696D04736E5F2347AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247656, "uuid": "8a592f5f-5c1d-4ef6-943e-901edc5c0512", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247656, "uuid": "0f16f15e-081a-4e16-87a7-d5e644f8087c", "value": "12288:cMrOy90ZPK2M7XJbQ0Q6hs0T1ciGSDcJmeJdo0Z7kwp1inMHs2jnIm4GRI:aysS2M7XJbQh6hFZciVSd9Z73FMkIz2I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676247656, "uuid": "d29f700b-b4ee-475d-ba8f-b989c24ec9b7", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676247656, "uuid": "f44ce028-f6bf-45a5-8f5e-8b7ce9448300", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247656, "uuid": "53533a30-f77b-43c0-b184-60eb8aa7b054", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bfbc51-abf0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676328645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328645, "uuid": "c188764b-3df9-40a2-a686-e5814c0b2285", "comment": "Malware payload", "value": "737ea588298ee5d292f9c59303436a9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328645, "uuid": "675f2d76-dcb5-4ff3-801f-5f9856f37805", "comment": "Malware payload", "value": "991f4cb0edc4204510d0dead5468ea3def66d2239546157432a79bee4af1edd0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328645, "uuid": "8dd2ee73-930d-4563-87d9-c2faaadfc9f1", "comment": "Malware payload", "value": "957cccac8421251843c3db7e78282aaaa78210c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676328645, "uuid": "5ce90cfc-4911-45c7-b708-12d6135d3311", "comment": "Malware payload", "value": "44f92def03c44f3a686b22abd27b40492fc279312d033a985c1ac94b83402b9f1495de202614c1ba00d95bf397f006d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328645, "uuid": "079f2e86-2c81-4069-a438-05183e1f5983", "value": "T1EAF41247B7EDC022D8B15BB01DF647C31A357D109E39835B638EAD1A0C726B0A5357A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328645, "uuid": "f55e992d-64b0-4e7a-af04-4587f7ae5fc3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328645, "uuid": "af1271d1-e81e-4423-a866-387888d826d4", "value": "12288:jMrNy90dkYocukMSRB4i9H8jFGyUNjV1FWeJegp/IXXuZxfW1cWPW8A9V/5Z:2y4EiRB+j4yUPDWGWP92Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676328645, "uuid": "d6a3a9a3-286d-49da-b70f-67442c560ee9", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676328645, "uuid": "9e789ea8-8ea3-4acc-b1a4-c4a274c8b543", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676328645, "uuid": "51a7f574-4c8c-4e0b-982a-d5847a8638f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f66bb04-ab3a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676250137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250137, "uuid": "d4c6ea43-09e0-45d4-9fc9-9dab2c78fd75", "comment": "Malware payload (RedLineStealer)", "value": "2acdb12641f94a1c65944502ef5c2db3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250137, "uuid": "1e2fbb57-66de-49b8-a907-f536445fd9f5", "comment": "Malware payload (RedLineStealer)", "value": "99c89da9e496f81332c02c82f4a294dd4b23525aa37ea859b3b926d1f16c7762", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250137, "uuid": "ede332ae-640e-46aa-b494-bd57c67d0463", "comment": "Malware payload (RedLineStealer)", "value": "99d52ae3bbe9d0311c4f46fe8cd96d59437f9753", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250137, "uuid": "21492909-4e28-4be5-8f07-ad42f516ff49", "comment": "Malware payload (RedLineStealer)", "value": "b2cb94fff57bdfd4d9fcd003d9d3d20d9294713cd9a1e0c01edd1191a4d2026f924bc84056ddd5a550bf127bb927df53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250137, "uuid": "eb40364e-c11e-41c0-a302-ba6cbfd331c3", "value": "T19754F11169A3F072D46794781432D5A9697FBC76E7E0C0CB3A480A7FADB03D18E27366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250137, "uuid": "51d356ec-fff7-4eed-ba1b-95b4ae5ba732", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250137, "uuid": "52f73e95-638c-4d95-b79e-e101a82f03b3", "value": "3072:BUcZlyk5HVKYLoxQqO9Hnn05qHlXXoqKoXhe/H/Cb23VKN4XAsJzmg0Z5IbIqepq:vCS2O9uiXvPXU+23VZCknPSf50Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676250137, "uuid": "ef98f706-086e-40e7-9c58-cd0040751f58", "value": 283648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676250137, "uuid": "c42e79e5-a034-40bf-a7f7-a46ac8ab997f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250137, "uuid": "7283271d-084d-4c97-ac9c-fe96dd698fd5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8506ab-ab83-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676281754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281754, "uuid": "7fdcbc7b-71b4-4908-912f-9ba2570fa4e8", "comment": "Malware payload (AgentTesla)", "value": "61c2d34e955dfb1ab1919c0e5dc4ac43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281754, "uuid": "2e60217e-3a6f-4925-ae16-9dae3f5d0d66", "comment": "Malware payload (AgentTesla)", "value": "9a442ff6604cd89ee5f4fdf085e272ff9b0f3619ebe3b94652ae0c25679c3813", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281754, "uuid": "24c8c6a5-ee0d-4a53-8b90-5d663f1f5d74", "comment": "Malware payload (AgentTesla)", "value": "99e9fdf5ecbbcc854955dbd1188deb10d9d36059", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281754, "uuid": "5ff2c0a6-6e0f-424f-ab16-b0d6ba6b2fe8", "comment": "Malware payload (AgentTesla)", "value": "110531f5a79d5100e99e2ee1530a0135f12fad3af7e52ccc0396d3b78a73b32c300580e75e95a30a2f219844a99c1b75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281754, "uuid": "2744b172-7427-4613-9cb3-17126342d8be", "value": "T132A42324F6897FAEE9F903FA1CD76C0003F29962776DEB0A6C8067D245277901564FA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281754, "uuid": "b1245490-1f33-46df-ab68-b1ff79a543f9", "value": "6144:GaNc1rUxOSgurNkGrIYllsQ3NZF9O8SMytNSeeCUsAcdhkgH0QwpWqflsTz3HxyS:/YbSz5rn2E9OTMybvepqT0cPTMs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281754, "uuid": "8f1f7149-c3ec-44da-941c-02ef7c453ca9", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281754, "uuid": "f536afdd-5b95-4fa6-b14f-f76195bfc26b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281754, "uuid": "3eda16fb-235f-47c2-832f-3c6c09b5a7a2", "value": "Shipping document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed356d15-ab58-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676263394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676263394, "uuid": "251384df-bfc1-4fbd-909a-59afb9873c4e", "comment": "Malware payload (Amadey)", "value": "91e29dfc91ec823f427af1fbf721dfd0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676263394, "uuid": "d0da40c8-c4df-490c-8e1d-dc277c678787", "comment": "Malware payload (Amadey)", "value": "9a55216ffd00bc7600386f52d7274e66d677f710591e6c92414103d6b13f2c1a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676263394, "uuid": "bbc337d8-4143-48e4-9fa4-6134b3c14099", "comment": "Malware payload (Amadey)", "value": "9e5de4a670ca87500a37c10907f8ebdd081afa4f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676263394, "uuid": "2496f93b-fa35-4362-993a-92cc7736fa95", "comment": "Malware payload (Amadey)", "value": "01b299fcc11a75b99a043b532e2e143cd0d8d2f57db17b014bd6ce55f04ab6b8af830c86da03a115f78040325badb88c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676263394, "uuid": "57a6c783-ea05-4e35-8860-3e7c587c219f", "value": "T14BF4120BE7E98072E9B55B7018F202C30B317DA05A78839B238B5E591D726F1A73576F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676263394, "uuid": "765cbde2-b4de-4ce7-a2d9-527a1975e91b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676263394, "uuid": "f4935bc4-0d68-4815-8a6b-8c69570ce8e9", "value": "12288:rMriy90wreGVd5IEuEjrqBkpqS+eJGu24ZXZ3QGMgw67TQ31huTbFwPV:9y3VEEuEjrqBLGGujdRQ3glTQFkTiPV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676263394, "uuid": "79135fe4-5a17-4764-b53a-388f3b94ac9a", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676263394, "uuid": "1b6a7f79-4bc8-41fe-ba88-7b0a8aaa48d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676263394, "uuid": "29179d4a-e17b-4f87-b293-ac3746999cc2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a4c07b-abec-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676326831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326831, "uuid": "f54a392b-7ac6-498e-9c02-9d6783d48d84", "comment": "Malware payload (njrat)", "value": "4e17ba845b59d9774b44d50cb03321c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326831, "uuid": "87712b88-2983-451e-837b-d1c6c34c7c38", "comment": "Malware payload (njrat)", "value": "9a8ffdcc519ecff638fba893018ef880d6eb6d8f8d46269153058401361799c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326831, "uuid": "00e23a1f-96a6-4e05-9041-1f5a843bf85f", "comment": "Malware payload (njrat)", "value": "a83852796888292b9670bc4e451a8fb63daf372b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326831, "uuid": "4c94c029-41a2-4cb4-8309-61b4ceeee302", "comment": "Malware payload (njrat)", "value": "2be6aa8e8df8bca54e2ff916129900877b4062c6d0d6fd2c87b3a73a458cc7a5b65b62c217074a3267d52f7866eeffec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326831, "uuid": "7b15a353-913b-4db4-b85f-f8c770781ca3", "value": "T1D214015162088DB7D869C7367C23EB381136BEABA8555F3F3490F78B28327816D72D19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326831, "uuid": "d4d266d5-25a8-435d-b3d7-e690836cc7dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326831, "uuid": "662eee6e-95c6-4986-a2e3-a8aa59d2e909", "value": "6144:fu0rAyg/0lGDQQWH+bLgka9vbA392+4sdeETvnR:GTyg/0lIHWnvbGIsUED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676326831, "uuid": "873e2738-925b-4363-a19d-0525cef7a80c", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676326831, "uuid": "94d5e65b-42ab-4ff2-a7c3-f6343fd0f307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326831, "uuid": "046d847f-b44b-4122-8abc-511138ceef1b", "value": "4e17ba845b59d9774b44d50cb03321c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d480529-abd6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676317215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317215, "uuid": "cd5d1514-82b6-415d-a665-dd8fe56059f9", "comment": "Malware payload", "value": "8e51d757414e0746c0ee7f6ea524d53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317215, "uuid": "5488587e-49a1-4bea-9a11-f392e51cc5cc", "comment": "Malware payload", "value": "9a9f650919a04cecdcaf201717c62b55d069841e4c5ee2f7475089dc7d40bc99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317215, "uuid": "50bf1b69-85b3-4ded-9a5b-f9c46a471503", "comment": "Malware payload", "value": "730d3e303524149d51ddb7e1591cca2fee79b263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317215, "uuid": "cd1e06ea-3ffd-420f-a444-fa5587a37949", "comment": "Malware payload", "value": "38c9140abcc4bab398939d18586535e42aeb075dfd85c14d5b86ccad6742349745f9fd9b49823181fc2b8c6ddca64dd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317215, "uuid": "dca7b92c-b9d0-418c-aca0-3ba454832119", "value": "T19BF4120BF3E89453D8B45BB169F643C30A327D619A34829B238D6D2D1C712B273757AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317215, "uuid": "2df6747e-01e5-478f-a463-8f25b375b657", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317215, "uuid": "d7412f61-4b6f-4fc5-85e0-588df41fb740", "value": "12288:QMrhy90NpWs6V/snWOi9mJd5uyeJ4gV2VYeMZH1CwviaVduWxpNS:hy2WPV0nWJAJwdMVA2aVdZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676317215, "uuid": "ff06095e-0a76-4762-86c6-466df70a84f1", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676317215, "uuid": "01e171f2-8059-4450-8da2-0bdf8b800723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317215, "uuid": "93f74efa-bbc4-4ee2-b46c-9f3e7ebe7491", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d839dc91-abb6-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676303731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303731, "uuid": "34d08d5d-1161-4dd7-87d8-7772f80d5b61", "comment": "Malware payload (njrat)", "value": "ace3e0bd095eee38c540eea858dd73c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303731, "uuid": "96186f84-7a02-4d89-b044-a7361c5a0fbc", "comment": "Malware payload (njrat)", "value": "9acaaa5be33bd847e2d5925b3555db028f02c251791efa21f05f7252a3f09f34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303731, "uuid": "8180a4c0-e1b8-4f32-b7e7-0e0566631f5b", "comment": "Malware payload (njrat)", "value": "d63a3c32bcfcf01bea156f70d6f5bd0ffb759623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303731, "uuid": "2d3a5c57-ba35-4bd9-8cb4-e95da7730dc1", "comment": "Malware payload (njrat)", "value": "9e87f4c04326924cbaa10526ecefa3307e633959bedf99b4e0310a785818c34cb896d277f430094c7dbbbfa76f82c434", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303731, "uuid": "86376da3-9d34-4544-b53c-81995fb99977", "value": "T1F805D717B189CA9AD1D51937DDA7C33873708CBA2A22C7D9FA88B7A50D31356DC0BB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303731, "uuid": "77c3adf4-e26f-4703-b3da-c6df72fe6d11", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303731, "uuid": "0233bfe5-0886-4c06-8e3d-3accc6eb071e", "value": "12288:tCPg2DW7/6ZUbnPXGm+x5PQbY56Jx1g83YhN2ohF+rcgv:tcHW7/0NPv8JxZ3Yh8ohF+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676303731, "uuid": "8e791a03-e6e2-4923-bdd5-dd0218992b31", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676303731, "uuid": "a9be7450-7c1e-43cf-b619-8c1860ef42c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303731, "uuid": "c49dace6-2beb-4b04-964c-d70bbfe6519e", "value": "ace3e0bd095eee38c540eea858dd73c0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9ea272-abb8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676304490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304490, "uuid": "d8ce3c86-5065-4708-8db2-d793bea48f9e", "comment": "Malware payload", "value": "96bfddb82af04dafe000ceef0fe9f5b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304490, "uuid": "5144701f-7c89-4ce7-ba4d-48ffa3212f2e", "comment": "Malware payload", "value": "9acf49fd90998f2c03ff3cf8721974ce1325fffbe367f5d8e495f653d4a07781", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304490, "uuid": "7adc8a98-a5cd-41d4-95e1-f6cb97c74b7f", "comment": "Malware payload", "value": "4be11b493662beb2781a96479c100b78e447569c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304490, "uuid": "257fbe7a-7f41-4ce2-babe-1352df434f6d", "comment": "Malware payload", "value": "e010b184011c4dbfd3b3bb59ef2645458d7bd159d5f98e4974644c5461d3d9cc6c0cd649f1515ae18081c5ca653bd267", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304490, "uuid": "ed9e17b5-2d3e-4cac-b602-d9e57413ef15", "value": "T142545EAAF6EA46D0F95C4CB074DB8135171B3C32BA9C19E1D80B37D313F52A8609ADE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304490, "uuid": "34089632-29d2-4a9e-ade4-e00aab32f73f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304490, "uuid": "3a713431-0af1-4ea0-b46b-c693e9766125", "value": "6144:zee7vYYo2U4YRNNbKL4pTYdkhVoi4Fc+dVkR52:zdvYYowYtiisdkEDFc+7kr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676304490, "uuid": "b91565a8-4356-4bdc-9665-0c82de3073dd", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676304490, "uuid": "6874cd39-c184-4992-a6a1-f01671bcc866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304490, "uuid": "3433e535-b41b-4dfc-82bc-2912bb4a0b7e", "value": "96bfddb82af04dafe000ceef0fe9f5b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d000b44-ab74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676275124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275124, "uuid": "691fb826-c3aa-4b7c-bea3-e4fd6badbe89", "comment": "Malware payload (Amadey)", "value": "fde5751c0e6dbf21f1f854d2960cdb46", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275124, "uuid": "4fff0733-22d4-4aaf-ace9-d0e6606f188e", "comment": "Malware payload (Amadey)", "value": "9adf2a924949aacba65fcd4ef2d42f9d3e5e9645b6f876bda95f690e92ade1c1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275124, "uuid": "658e904d-1ba5-4cd9-8ac7-f379c62466f9", "comment": "Malware payload (Amadey)", "value": "f1825ebf2fe058956059e94303571487b35804e2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275124, "uuid": "a7dca5fb-2609-4c1c-a880-9c77070b5fbb", "comment": "Malware payload (Amadey)", "value": "e7e1be6da8b7f8dd960efecffa1e321d6b6c833a94fb1da0b13a2573dbae264a8f079ecfcd608fd12d7e3104ac734031", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275124, "uuid": "5b514f37-d97d-44ba-a4c2-68e57c387492", "value": "T15CF4120BA7FD5162E5B4237048F303C3263ABE51AA35C35B778E6D1A2C325B4A435B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275124, "uuid": "470e0965-c2ee-4d4f-8688-e4b405301d9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275124, "uuid": "f394bd53-7582-4a45-98eb-e806a5494696", "value": "12288:zMrRy902+ZTFEZMZlkapRexvr20X6b+DkeJVFKAxkBSnfS5waBYIc6m6arEs:OySZTFEZMHpYxFqb6VFy0iB9c6EQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275124, "uuid": "569f85a5-3860-4e33-a5bb-076f52493b2a", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275124, "uuid": "428727ab-af82-41b5-9001-7ed9e184d027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275124, "uuid": "832aa216-2a61-44bf-9793-d2f3b53d65e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba98e661-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676299816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299816, "uuid": "4928d495-e901-4e3b-8263-4ed5b63bcc63", "comment": "Malware payload (RedLineStealer)", "value": "9757a38f124f92756af6d8ba21c88e76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299816, "uuid": "98733888-bfff-43ed-9bb9-9ae5db812fc3", "comment": "Malware payload (RedLineStealer)", "value": "9b0125ca7d77f5220541bc439bfc35722e4dd2afb6cf10609f92d498a84469e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299816, "uuid": "f172a27b-26de-4277-9ba6-d76ebf197a72", "comment": "Malware payload (RedLineStealer)", "value": "18c8c8e98c13a65f3276345f1ae055c0f3c58fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299816, "uuid": "5458bcdd-1de9-44a3-b287-836bc7ea1f5a", "comment": "Malware payload (RedLineStealer)", "value": "d2f4a17186db2d15566c6192a45f55830c2786c9304bff44a2f6652c9c7d08bb668828590b2ec274e42626e76083aa93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299816, "uuid": "7d76dedf-bfb6-46ed-b7c5-c7efcb460479", "value": "T1B5F4120BE7E89933E5B457701EF103D31A34BD501978835A378E6E4E0D72AB1A63972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299816, "uuid": "39ac097c-e071-4924-8806-61e18200b587", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299816, "uuid": "bd8d917a-2eca-4b7c-8c66-47f4494902c4", "value": "12288:nMrMy90IZvSIWtS8FxJmVZnbV59L1keeeJo2TGSeZYYMeFUKtCvS8bfD:by/ZvR18FAbVPeuo+aZhFrCvffD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299816, "uuid": "87323ea0-5764-43d4-8a35-e2257739f96d", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299816, "uuid": "2128c454-7aae-4802-b5f6-031a73078a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299816, "uuid": "fe78f249-ab0d-492f-b0f0-e8ef8878fe29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9736deb3-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299757, "uuid": "e748af71-25b8-4ea8-9dd5-d5b15c4d0944", "comment": "Malware payload (SnakeKeylogger)", "value": "7d8ffb273bc7812cc53d575891e9a7b8", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299757, "uuid": "67c5b4a6-5845-429f-88ab-2be3a709ea0b", "comment": "Malware payload (SnakeKeylogger)", "value": "9b8771a438cba87dfb6e5edafd442fba674345f2a2fc84dcfc542d15c39a3b32", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299757, "uuid": "912cc876-dd6f-400e-a9b7-0512bc09346d", "comment": "Malware payload (SnakeKeylogger)", "value": "d63fa2c44506c4fcb650fe5b05dd7e26e21d6784", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299757, "uuid": "7d258859-73a1-4f7c-a708-b8862595f45a", "comment": "Malware payload (SnakeKeylogger)", "value": "2cb21c4361707e88798c8a04d03de8ff435e670b4da40ae0d8a23bc9f28672bb9a3862ebde740345520e2d877d484fe3", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299757, "uuid": "596836a7-9daa-438d-a1dd-052d7ee6d8e4", "value": "T1BE03185AE39E12A4CF5112B3171B0A8996FDB73EB31054B1746C937433DDC2E4266ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299757, "uuid": "ab84a07a-67e7-4aaa-aa94-a3fba0465542", "value": "768:3uFx0XaIsnPRIa4fwJMHu9q1lobILg5VJXw+NIj7K0Y1:+f0Xvx3EMOI1u8g5VJX/NIfK0Y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299757, "uuid": "3d0b66a9-7d4b-45c3-9557-d6391c3b88e9", "value": 40331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299757, "uuid": "ada7ccc6-3f88-412c-9e24-b6fdd6009bd6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299757, "uuid": "39eed3dd-24b2-413e-93cb-392c74759a3a", "value": "specification.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375dcd4d-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299596, "uuid": "b6fc4233-9c3e-495b-9fac-aa0fd4e0b84a", "comment": "Malware payload (SnakeKeylogger)", "value": "4b03ea66a8ddbd1531a690e912551894", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299596, "uuid": "d57427d3-2a28-46f5-bc90-cd9122dcaf0c", "comment": "Malware payload (SnakeKeylogger)", "value": "9b9baf8a4d781b315971c83eed8a9c00d72ceed5eac36657dd5c1033115798ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299596, "uuid": "2cf501ce-e2e8-46dc-bbc2-0e3e3302837c", "comment": "Malware payload (SnakeKeylogger)", "value": "b27dc953f7e3ee7d46ffcca9c074e342279a50ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299596, "uuid": "fba04952-4dc9-4811-b640-46d73c5f8634", "comment": "Malware payload (SnakeKeylogger)", "value": "31675be923c01dde524ce3a7a67b0330fa0159a80e05efddc1320fd30994603d34c86529e39c168e63c1b346dfe160cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299596, "uuid": "2fdbbf17-6cf1-4657-9026-d837780a578c", "value": "T1B364E1A49474573AE4B227B202979EE00FF4822F8C13F13E484127C89DF69F699A6D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299596, "uuid": "a0ea5a3f-ad1f-4745-84ac-3ac9b2625712", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299596, "uuid": "30350b17-7d72-48a6-b6fe-f1e66a4f66f8", "value": "6144:0e9LQrUaf3w1lKia2maCdDSHspGz9aaMjubs4:92UWMg/pGBaaAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299596, "uuid": "641ffd1f-ddcc-447e-b285-7a28baa91ebb", "value": 308224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299596, "uuid": "7850d19b-e998-4d47-ac3f-029cecfe56a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299596, "uuid": "9eaa5931-bc38-416c-9eac-ec9b643dd733", "value": "UPDATED PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f16560-ab51-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676260100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260100, "uuid": "cee8debe-f77d-439a-bdc1-d7fdece36337", "comment": "Malware payload (GCleaner)", "value": "642f3de86b6bf74605766236f8003a65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260100, "uuid": "e56d64fd-43f2-48d3-97f7-d140ca44786b", "comment": "Malware payload (GCleaner)", "value": "9c3a6d1deb409cc0d45d3a0ddcb2474ed614f74d7451927b344c0f30a8ac8c9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260100, "uuid": "4924bddc-ee6c-4008-8478-6ed8972c4a3f", "comment": "Malware payload (GCleaner)", "value": "4166bbc05902f403825d14cc31906e2ce145a0a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260100, "uuid": "c193cd23-c786-41e9-9b36-eb0c2182403a", "comment": "Malware payload (GCleaner)", "value": "98201dcca10855c315f1284f3e237190cf611bb1ba51b99b0a28d0f1e3b5b919a224c06f2695cda21b3c80eb922b4f1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260100, "uuid": "827cb862-1ad9-4410-b2f1-37709519ebb1", "value": "T1F3E5127C7105C96DE280BDB48C3AA9E75CDA6DE3E9E0A06370CDBF3F5279188561A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260100, "uuid": "8504b5e5-2509-42d6-8ebc-e2f24eef46f3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260100, "uuid": "103ecc15-ce60-43bb-95b2-814fd14a2d69", "value": "98304:JHPN7SBleKuUJ5Npd7l3pV5wfFKKsv2MR:dP9SkuLDh3pnwf8KsvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676260100, "uuid": "090e8ed3-c2fb-4411-903e-67342868779b", "value": 3305287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676260100, "uuid": "5c0a3f0b-c9b2-438b-bc4c-9e606415f8f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260100, "uuid": "af33f80e-aec3-48c0-bc01-9768a9fe702e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf8df1a-ab5e-11ed-88f6-42010a9c006e", "comment": "Malware payload (WannaCry)", "timestamp": 1676265727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265727, "uuid": "b83ab191-b2e6-4494-b851-9d1782b32e58", "comment": "Malware payload (WannaCry)", "value": "440db193edf0d4554fef2021d72aaad0", "object_relation": "md5", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265727, "uuid": "7d00cb6c-ec24-4cd2-b013-b8687602de8a", "comment": "Malware payload (WannaCry)", "value": "9d0c61609bdd9cb96f492450788d8edcdc145ed31b024b3e58fb483306104763", "object_relation": "sha256", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265727, "uuid": "f4d196a0-a0dd-47f8-99e0-7a9c58296fc4", "comment": "Malware payload (WannaCry)", "value": "e584c6c572844b7a65668793424ae149743adedf", "object_relation": "sha1", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265727, "uuid": "6f207ec0-7e26-425e-8a58-94ab18f8008f", "comment": "Malware payload (WannaCry)", "value": "f5e3cde20ad1cb633214279c79b2af77b1d57c7e67144c96da6518bb770e33bf3806adf090d3f8d2266545e41a23647b", "object_relation": "sha3-384", "Tag": [ { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265727, "uuid": "3b679875-8d41-46fd-bd66-4f88385c3d26", "value": "T1D0D5F1CAB35204E2D41AA97A4DADB505627E386ADBF988CB3E8475101F737D48F35F80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265727, "uuid": "0e3bf6ff-4253-46c4-8547-c707689314a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265727, "uuid": "5364d728-1b8a-4f49-ab89-a7b4444642ab", "value": "49152:pNCV1hzfPJDZvqAuU0njQqMSPbcBVQej4:KVLfFZv0F8qPoBhk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676265727, "uuid": "040f30f5-e2a4-4da8-875f-7052550750a1", "value": 2809228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676265727, "uuid": "defb55a5-f7c4-4b04-902d-32d89bc3d74e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265727, "uuid": "0d2707f4-c420-420b-8750-1680e940bd29", "value": "2023-02-13_440db193edf0d4554fef2021d72aaad0_krakencryptor_wannacry", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dfada6-abba-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676305289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305289, "uuid": "dda0c086-2a38-401f-a3bf-828a5846580a", "comment": "Malware payload (Amadey)", "value": "1d582847b5ca7a01105673a25ca1577a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305289, "uuid": "bdc1f49c-4416-4efb-bb41-ea1371c23c1b", "comment": "Malware payload (Amadey)", "value": "9d170299a6c1463fc5f3bd7765a1bab8f9d52dcfefbc916b3878c9f44fb1247b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305289, "uuid": "57733fbb-125f-4b7f-8f0a-2bd3328e661c", "comment": "Malware payload (Amadey)", "value": "a1c995e7e7f69f95468e083762011c5867292a76", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305289, "uuid": "47fbac22-d7ce-4aaa-894d-eb7f88e615ba", "comment": "Malware payload (Amadey)", "value": "2f19cbbed304a4781e5cdc2fee519f3fd53b7ca780b250748f30e204c1d1dff99434a947c17736cb6ea77710569cfd4d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305289, "uuid": "c604b80e-a87f-46a9-a356-2e0671467045", "value": "T130F41207E6E85023D470A37018F613E31735BE505B3982AB678F9C6A6C326B17735B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305289, "uuid": "65d95b82-0a6d-41a8-8dbe-c7938531d340", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305289, "uuid": "0c2277f0-3d0b-4abe-b42f-cb0cee472e05", "value": "12288:EMrty90GD7B0y7RDGQ1eJyZ2emCNH5N0/u8gyD:JyR77RDKyZ2C0/uP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305289, "uuid": "b2a2c2c1-985f-4f1f-8699-ea04a4236edf", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305289, "uuid": "abaf5a72-a901-44b8-ac98-6b856b572739", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305289, "uuid": "4d3ab7f6-0717-41e2-a8e0-4beb8468c849", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2ba12b-ab84-11ed-88f6-42010a9c006e", "comment": "Malware payload (AuroraStealer)", "timestamp": 1676282127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282127, "uuid": "9c3b2d99-356c-456a-a588-1c7fd90ad9ad", "comment": "Malware payload (AuroraStealer)", "value": "8fef3a062676cda862c7a3281f7c672f", "object_relation": "md5", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282127, "uuid": "7b7c3879-e30a-4b95-9c86-b18f779d8d38", "comment": "Malware payload (AuroraStealer)", "value": "9d2321341dc5804543514a81cab9aac8dbc52466c77bad98a3835819cb9d9c7d", "object_relation": "sha256", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282127, "uuid": "7e035c6d-eb2d-4f24-bc86-b21d0699550a", "comment": "Malware payload (AuroraStealer)", "value": "ec2d8e9278fb366d338f7c94d601f51c1db2e3a5", "object_relation": "sha1", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282127, "uuid": "fd229078-12e6-48f0-9d94-42b53bf92f04", "comment": "Malware payload (AuroraStealer)", "value": "edd7d2a789d2d887faf55f074d3f013be6c97d5b2cb323dcaa1aefcad6d50e6d793549883c6513c302258f9db0bb45f1", "object_relation": "sha3-384", "Tag": [ { "name": "AuroraStealer", "colour": "#51F769", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282127, "uuid": "d7e66b67-b699-44ad-90bb-f1f1208357d5", "value": "T113672331758BC43BC56211B0192CDA9F9228AF760BB255D7B3CC2E6E0BB55C31636E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282127, "uuid": "6dfdecd8-c6c1-4d5b-8c7b-9602dd20dcdd", "value": "9b3add16ca003c686638e0e2e116f685", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282127, "uuid": "42ac1cb0-347b-4959-a59d-654902eb9800", "value": "786432:uZuA/ghq/LEGnD351tC9Tv55/DEhSslNRb6tg4dg9TqnQ:uz/g0N1kz55/0Sslveddg9UQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282127, "uuid": "034a4747-0c8a-4d16-b60c-02612b9a574b", "value": 30970804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282127, "uuid": "2f3cc872-6789-4b1a-a290-db7de16ea4ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282127, "uuid": "9be4551d-ed41-45b5-b46a-cf31955450dd", "value": "8fef3a062676cda862c7a3281f7c672f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e45a380-ab93-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676288494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288494, "uuid": "b5dc1491-3444-477a-b168-7f7a9866ad67", "comment": "Malware payload (RedLineStealer)", "value": "23259ab60eddce2284ddff40878cb75e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288494, "uuid": "712ca9a3-44ae-4815-b368-2b1e3f52505a", "comment": "Malware payload (RedLineStealer)", "value": "9db0e4552ab159c13b2630fd5655633f553982844dd2465ede04208b524d75a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288494, "uuid": "c9490b72-1f72-4fa2-b579-697c50f7cac6", "comment": "Malware payload (RedLineStealer)", "value": "1811c08a5d4b0b23e045875147c32e1ff4e5ba5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676288494, "uuid": "bf12a41c-fd7c-4ac8-a430-8266ce4d543d", "comment": "Malware payload (RedLineStealer)", "value": "4c7605abaaad793c55de7ccc20ca738942a594b9a3c122f27607ae3045f62275fc57807453641131f70b0c20c4d8bdd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288494, "uuid": "2173b607-696a-4c26-926e-eb1c1d02be3c", "value": "T189F41207F7F85532E9B55B7119F607C31A32BC6096348787278BAE1A0C727A0A23577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288494, "uuid": "8a952fa5-af05-4c4f-840c-d449580eb77e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288494, "uuid": "71d77670-4cd8-42bb-aaee-b7082e1ce6f9", "value": "12288:RMr2y90e7Ddu3Q55cjiCmsqdd4/PeJQJf10B20bxHa5o1LkvnaQYTdxC+ot:Xyhdu3XjvVaHQtM9IvnuDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676288494, "uuid": "083b9d01-c08f-4c80-b437-3e8ca6b3f78b", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676288494, "uuid": "7eca2fe3-a09d-4fd3-93d0-0a331e361ba2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676288494, "uuid": "addfe422-b5e4-448d-8f40-8856fe475946", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5d04f9b-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676251731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251731, "uuid": "3727934f-22d1-4727-9681-222adcb4389d", "comment": "Malware payload (Amadey)", "value": "e45dedf8fa69d79ce50899b991113de9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251731, "uuid": "f36e2b33-4b80-410c-af3a-8da29fdc1f7e", "comment": "Malware payload (Amadey)", "value": "9def5a77efa44b135a54b36124b0778003035c9e0fac3db95551a8b989125f5b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251731, "uuid": "d89b95d8-e99f-4a1a-b2dc-024500ffbab7", "comment": "Malware payload (Amadey)", "value": "95205fff7c7a17de29627f1061f7f0c3a6194cc0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251731, "uuid": "876f4f13-c1f5-4908-a9d0-ae4f678a9697", "comment": "Malware payload (Amadey)", "value": "039bdc6cf7f154fc0830887e87f8e77167463880bdc2d91584a3bf00a65d1e6186a8cd38b13e3ad6000616f38b8d9e5c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251731, "uuid": "83f35537-6656-4a12-a54c-0e6bc80dde95", "value": "T1F9F4130BB7E84032E9F867711CF703D329327D609A78879B538EAC5618765F4A13672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251731, "uuid": "7815124f-ae23-4a96-bc06-1088ed346151", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251731, "uuid": "e4a99c2f-00a1-4c63-a207-7e348cf9da5d", "value": "12288:+MrCy90wcd0VgC0yyYOw/5sEK0eU08ReJbkTor2Mha8PCqtE7uxYv9Dcj:kyXc+Vgiyc/3h+bkDME6SKxMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251731, "uuid": "06d2b6e8-5d18-471a-a979-687efa592d87", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251731, "uuid": "f572ef80-25a7-4f61-96b8-e1049df34e62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251731, "uuid": "78a0e72c-244f-4f1f-b2d7-61ee74ef5b71", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c7f193-ab36-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676248649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248649, "uuid": "ceafc51f-0c27-4dc4-bd85-795c6e469de6", "comment": "Malware payload (Smoke Loader)", "value": "c44c8a2c62b1b8d8bbc0b040d81c5808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248649, "uuid": "19bc5694-ad75-4381-857e-b8bd7c8ed273", "comment": "Malware payload (Smoke Loader)", "value": "9dfab3aef735589cc63be1424624e63cb7e113c9ae17a88af19f9fff91b0f6fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248649, "uuid": "e2b6818e-fea9-400a-bd8b-ab0b6ebc86ca", "comment": "Malware payload (Smoke Loader)", "value": "7e6d9b47ceefd2b1866bbd0d47bb13d7af2ad05d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248649, "uuid": "54bb24ca-0df8-4d5f-b5fb-e83997fd8132", "comment": "Malware payload (Smoke Loader)", "value": "45899a09e88d2774308976d80c99a2b3b227587e1b3c56883b93a71e749e1086c1be96fc3e80ab1f0cca29c19464635f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248649, "uuid": "28f2c560-b0c3-4e55-b6cf-f38f64782939", "value": "T16304D011B9A18073E1A785B42630FAA0697EBDB167B0C1DB3344B7AF1E303D19A75357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248649, "uuid": "2d87ac77-4162-4b47-ba24-1ac95848181e", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248649, "uuid": "0689ef04-4e3b-4796-b806-857586de459e", "value": "3072:lMlZfvk85HKSi4YXMPar8KwdQ48fKL1P+IGE5eyja+gy:qSaitXMPZeAh5F+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676248649, "uuid": "131672e6-a63b-46b4-862d-682bce54c9a3", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676248649, "uuid": "cef2e634-0092-43c6-a854-d0c096bd578f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248649, "uuid": "71d9e10b-2093-47f9-b619-a0ec22845fc9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8302f88c-ab88-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676283832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283832, "uuid": "cf040066-18c4-4ec1-ae72-cdfff224ac3d", "comment": "Malware payload (RedLineStealer)", "value": "6f2b4a7976442f3d4e4bbce776746827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283832, "uuid": "f044c451-04a4-410e-8a5c-bac65a95b42e", "comment": "Malware payload (RedLineStealer)", "value": "9e27f26774f04853d7c01f5b2cb23ccdff492643ef55b0fd088a61f7790cd20b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283832, "uuid": "f5e77a60-e429-4e9a-bfec-d22a76641f9b", "comment": "Malware payload (RedLineStealer)", "value": "15659391a9ad11d984f633cd8f207203af454e67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283832, "uuid": "1424aa67-a023-453a-8332-51a659197481", "comment": "Malware payload (RedLineStealer)", "value": "6029ca34111e42e4a8b7d4f6a68072765e515027ea92e079d00894e4bb22c8ec4eb69f20db7303d732741342cb61eca5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283832, "uuid": "c036935c-4823-45be-897e-45b10125adc3", "value": "T136F41207F7ED4032F9B853B06CF606D31A357D318AB4529B228E6D5A0C729B0A17676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283832, "uuid": "abe73eb3-ee7e-4c3d-831a-65f12b8fcbfe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283832, "uuid": "615ad432-157a-4ddf-82c0-2bf10efc4e4f", "value": "12288:GMrdy90lgS7P7kuNPjMXGCsrHEj5eJ3mX4S7y8iCauvYyiY:7ybS74uNbGWHdChm8iFMvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676283832, "uuid": "dab836d6-2631-49a9-8062-80e439e60200", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676283832, "uuid": "78bd7d88-7660-4d8f-aefa-e3499be1da7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283832, "uuid": "708db0a6-e893-47a8-99e7-1d08afc5f984", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6419415a-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676284639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284639, "uuid": "0af39f00-2820-4e32-9035-095cf0f44383", "comment": "Malware payload (AgentTesla)", "value": "782b173b7512c3216f4d22bbfdcdebd2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284639, "uuid": "db9f6a55-fa6f-405c-9bdd-87cec5a708ac", "comment": "Malware payload (AgentTesla)", "value": "9e6673ec8013e61cf5d5f88cd7b5f937f00c586a1cd41029bb9f204be7f940ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284639, "uuid": "8aebd220-2b51-402b-9867-4350f79781ae", "comment": "Malware payload (AgentTesla)", "value": "c1471a7a20167040e6e8a6c63c3f61e1dcfdae9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284639, "uuid": "4657a85b-b290-4bbc-b50e-fd5a9cd6df0a", "comment": "Malware payload (AgentTesla)", "value": "fe05c3b0a7878a543f72369314e75a8a96489de6b1bc27e216f785c6a90a5b934887d3812cdc1b13cf9d8216bc090623", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284639, "uuid": "fbd0b6bb-3420-430d-87a2-2e3ae18f5334", "value": "T17D64137436E0C16BF5B387B60A7F245792D8103224A01B4B1BA07B19F7FA7456E7DB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284639, "uuid": "d507bc57-74fd-4c1b-8ab6-8107ea518eec", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284639, "uuid": "50dae788-1d85-4ec4-b92f-3f611501c3cf", "value": "6144:PYa6v/IdTHphgqA2tZniPqxoCtl6JfHpNJNT+T83ryjmqjx:PYFAdgqfttUqxfti/JNyCq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284639, "uuid": "9999fcce-82df-40ba-b249-d0295f6d1fd7", "value": 306570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284639, "uuid": "7d1612a5-da39-43f7-846a-51329efe20a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284639, "uuid": "39aa9c3f-5843-4e4d-8f94-ae80ce056eca", "value": "T.C.Ziraat Bankasi A.S_Ekstre_20191102_073809_405251-PDF.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08415851-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676272029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272029, "uuid": "57e90188-0cad-4f04-b08e-d1a29d8c38c5", "comment": "Malware payload (GuLoader)", "value": "4a21881d7ed8c5cd95ed12c8e6bbdf07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272029, "uuid": "b7071912-f865-42f9-bb1f-4fbffc5c1c16", "comment": "Malware payload (GuLoader)", "value": "9eddf41c4a04d6f1a7510480bab531956b0d5efc55e43f2af52255bb8c2d09c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272029, "uuid": "63fd0e40-72f2-4b5a-a149-4e763ea9c93c", "comment": "Malware payload (GuLoader)", "value": "bc3cd6450fcf20139c430cfb157081a11ca1bc12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272029, "uuid": "e4c6826c-6c64-451d-9972-9bac22faf892", "comment": "Malware payload (GuLoader)", "value": "aad8a14fbed22de40dba0465635a304e1d6771abef5a2b9b945d8574e862a7821049f6f894df16d3f77b4f1833f892c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272029, "uuid": "18017b34-3c89-4c42-9f36-2944ccef6cb5", "value": "T1C1A449D2B841528CE9795EB3712B1C2217755FBA662C105CB6CC328D09F91723EEF86E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272029, "uuid": "10b251f1-6abc-4533-b78c-8d3d4209660f", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272029, "uuid": "88ca2662-06f9-40dd-9c18-e717bcb94aa2", "value": "6144:jp0+DpuPJFjJYILWt3NDuLkB5iwMVAfETXI3Z/5tZU4clFUp5sssHr:xwFjJnKlNDu6/OJXU/BfclyiHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272029, "uuid": "9386fe9e-06c3-4cc1-bebf-cfeea59cefd2", "value": 459760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272029, "uuid": "312a9e66-101b-42a8-9e3a-0947a28a562c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272029, "uuid": "53ea0f68-41af-4b46-a1ed-10d533a3f32a", "value": "DETAILS AND INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a604bcbd-abb4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676302788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302788, "uuid": "3a6da159-e3a1-4b25-9fa3-8423fc782657", "comment": "Malware payload (Amadey)", "value": "aed315dc45e5a29b9217e0814d857029", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302788, "uuid": "9863e89b-5713-4e06-ae1a-18fa8ca899ed", "comment": "Malware payload (Amadey)", "value": "9f1e29aed196fa2200b92fe7f5e13c0b60426de6faa76cad6fc13a1f25dc9ce4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302788, "uuid": "3ae73efd-133e-40b4-b85c-a6da1e94b797", "comment": "Malware payload (Amadey)", "value": "acb3155d8cb9a316ad78300c8b7a1597dd29a471", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302788, "uuid": "76be210e-6837-4c33-864f-38a7465242ff", "comment": "Malware payload (Amadey)", "value": "da8d422911c6afdcf58002e36ffb9b87516a25247d3519825f369eba04f55362fa1a81a25ed5233248cf3bfc45526ff4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302788, "uuid": "9c43fdf1-9d72-4ed9-af31-1c1877388ca4", "value": "T14EF4124797D85122E9F02B7158FB07C31636BE608A3853C71B8F6D490D31AF4AA7672B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302788, "uuid": "0436709b-d5df-4251-a51d-863d3ddfa2d1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302788, "uuid": "b367d955-0ec5-4242-b82f-8c5aed91fdbb", "value": "12288:5Mrby90HIimWoYmCyEV3bPoWSvim722GnfvKILleJWOrddCtZ5Aq+CwgO6w:Kya0YmCdVLPRMim74vKTWOZdCan5B7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676302788, "uuid": "ae22c53a-6c23-46c4-9d74-e8a7f4b6e4ae", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676302788, "uuid": "d9100674-a67f-45e6-90ac-c73bc7013b12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302788, "uuid": "6223e214-f64c-4381-b391-df024dbdd3ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7ac53e-ab96-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676289803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289803, "uuid": "aa4c3699-b9c4-49c5-99be-1a11f2c3d877", "comment": "Malware payload (GCleaner)", "value": "58381f3e638df8239db41f7d30f1b7ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289803, "uuid": "b10fe545-0bb8-43ca-bb0e-629540526934", "comment": "Malware payload (GCleaner)", "value": "9fb31ccfdea5a85f6a52e5396049864568b37f2677c4e29d823457fdb6d3cfe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289803, "uuid": "b042b20e-6888-4922-8313-574c194f52bc", "comment": "Malware payload (GCleaner)", "value": "af498cbef39209f2aeadda9f98c2c4b3628830c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289803, "uuid": "92633fcc-1dc5-49dc-83f8-d8805db8db8c", "comment": "Malware payload (GCleaner)", "value": "7d9bd8247182ebc5e24bd19a56226ee56a75ed1b79d5a6ad93454b59eb6044881db66fad9a74ad244354684836f87cc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289803, "uuid": "0fe0d0f4-2444-4491-be15-76efc4e07aef", "value": "T1D1F5127C7109C82DD690BDB8DC3AD9E72CD76EE3E594A06670D9BF3F91781884A0A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289803, "uuid": "ad8801b2-65a4-4ac0-9832-da64a538f011", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289803, "uuid": "c6212553-7b68-4cfe-afff-77a23151dd0e", "value": "49152:rdHVi6IZRMPeccMdPBqvD/oh4n/CjwpXWAWbNOFKMYhcE72uaLCgv2MR:JHv15c+qe4n8wpXWAWIKMBEQv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676289803, "uuid": "05a01ca5-f5af-491b-b5f9-d94f0d9fb253", "value": 3333164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676289803, "uuid": "f15fc17f-3be4-4280-9ca4-ba10c39c24b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289803, "uuid": "3d5d876e-9b3b-41e7-8a5e-fe5bcda3e308", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac83338-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Matiex)", "timestamp": 1676299602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299602, "uuid": "ab6796c4-fcc8-4f1a-b1b7-5009c7d4b879", "comment": "Malware payload (Matiex)", "value": "638d983d397e9ce408d91ae82b632106", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299602, "uuid": "48058e48-4d19-4151-8d03-9f44b7d51d2c", "comment": "Malware payload (Matiex)", "value": "9fe57643fb90f5f1ca560a6a9861296d58290795f061f22b15dd19dcfeb882bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299602, "uuid": "e0762afc-8010-48d1-989f-37338f361ee0", "comment": "Malware payload (Matiex)", "value": "477a1c06ff37abf3494373de86cfbf2d44d6bc1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299602, "uuid": "bc19b7fb-d241-434b-9eb2-82724a202682", "comment": "Malware payload (Matiex)", "value": "39c832d7c9cf9c2c11626eecaf43e2a6bce3f5d671f67a52b4e4a3161f4533dd17abf5ea2b1e76c792f420dd459b76b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299602, "uuid": "53107c4c-eab4-41bf-b7eb-4bb40c871ff0", "value": "T1D2D40191A32480ECC46BD1B4CA046627DAB3746817783EEF4BA5CE614F23BD5F43EA15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299602, "uuid": "d95c02cd-831f-4e0f-a7a5-c70d4dc78d02", "value": "755b26ee88bff31382938e00e4a0bfa6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299602, "uuid": "82612234-1074-4d10-bb8d-75c500a15c36", "value": "12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZW:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299602, "uuid": "9e60fff2-71ed-4315-aea1-2fcf30a13ec2", "value": 655510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299602, "uuid": "dfb9eb0d-c296-4135-8ece-78225007d10d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299602, "uuid": "a90f17fe-999a-4662-ab11-ec2c47bcb317", "value": "638d983d397e9ce408d91ae82b632106.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f03ddf4-aba8-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676297461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297461, "uuid": "d48793f5-6d7c-427a-92e6-84768b3f37ff", "comment": "Malware payload (AgentTesla)", "value": "b3c209753587d601c945dbb098840005", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297461, "uuid": "a96bc9c3-bd0d-4e78-9d93-d16f5a67cf2d", "comment": "Malware payload (AgentTesla)", "value": "a1519d33c6fa8f399cc2d26f4014ac913d9b5fd0a710111032cb2106a39e41a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297461, "uuid": "eba68bea-61be-4da0-afc9-299c7db2fd8f", "comment": "Malware payload (AgentTesla)", "value": "152c03ae9638d68aae3ea864a03d2073ee2b4c5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297461, "uuid": "5cab9ed5-2037-42af-94fb-15e10b3fe13a", "comment": "Malware payload (AgentTesla)", "value": "2e49071acbed032ee4f9b24b946f27dae15177bdd4321e4c513eea38b684943cf6be049a923e4206c4aefde2dccc4aa6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297461, "uuid": "0f614f79-a957-48eb-a7a5-f7615a75ee78", "value": "T1CD2512B1B2EBCFB1CC8C1975C0E64C3453F1939961A3E74CBCC61671ACA77909A8E5A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297461, "uuid": "f576e022-bbcb-4d6f-9bca-44d2bff1792c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297461, "uuid": "04b48124-eda5-4595-989a-9afef691c40e", "value": "24576:YuN1/h4ueDx4KQPSDH3utfoTLnpxwPv01zH1hkh9xHhB:BN12ueV4s3utfo60dH0fxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676297461, "uuid": "7ef62575-0670-47bc-bd9b-88f5803915af", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676297461, "uuid": "860e0952-6978-4669-a2d9-9c6139f11836", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297461, "uuid": "be0d874a-ae3b-47bb-95fa-9429b762e971", "value": "TTRES2102023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0f8331-ab45-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676255074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255074, "uuid": "ed117197-680f-4908-bf35-fc5765ed154d", "comment": "Malware payload", "value": "8a1539979f7194a3305961ebb6ce919e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255074, "uuid": "a92e40e3-cfc2-4d52-8aaa-57c2e0a253a2", "comment": "Malware payload", "value": "a17a4fa9ca6fb21693d2d38819e1d64a535e82a999733fcaadd8a556d7fe35ae", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255074, "uuid": "73fdb017-eede-42fc-b1bb-0a85de7ec52e", "comment": "Malware payload", "value": "58c8018ee7dfb5347ee62e0be7f705cb98bed31a", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255074, "uuid": "e9ef81dc-e464-4852-881b-37293c3d443a", "comment": "Malware payload", "value": "07cfa5885e5a1c3728db29bff68e75685b9aed1811dcca93a020cbe1f66aa80bf5bab79e8696a610de6eb87bb1f07c56", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255074, "uuid": "6e96ef26-c7d9-4a08-9687-475214e47722", "value": "T1522733631806ACDAD032A476457F2345AC75CE2D3DE27B221044EAB7D5F39A5CACDBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255074, "uuid": "af9735e0-440a-4430-8af8-2472ea90938b", "value": "393216:iYsJA35z7A79L+s8X1mbgafiubc7ZLbRT9i/zVN2I+TXGpmKpPbNiRSKcsKJi:8JA35z7c5OlmbBffclLbi/zVN2Ik20W8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676255074, "uuid": "e60c2412-adc7-488d-8a6b-a05fcd6447d2", "value": 21502542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676255074, "uuid": "dd3a60a7-271d-4eed-b603-01d68b3b6c23", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255074, "uuid": "36086591-bdb7-461c-a70f-5dd2590f9134", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4cdcabb-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676271997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271997, "uuid": "f8fdd6f6-1a3b-4cb2-8862-f1d7b1933d96", "comment": "Malware payload (AgentTesla)", "value": "536cc8e8ca737c134c95335be33a3d5c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271997, "uuid": "f30729f7-b1e5-4193-870e-5d96ea3377f2", "comment": "Malware payload (AgentTesla)", "value": "a1e8ee6f5b4ad378969898347ca74004cece8bbef7ce2693d69cfbea6b713825", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271997, "uuid": "fc4e3d0b-d793-40f4-9150-2e9612392bb6", "comment": "Malware payload (AgentTesla)", "value": "138bbf5fa6d9376ab9e5242082efe6537b6c913d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271997, "uuid": "8fb9cd81-59a6-4474-b44c-e4ac62863403", "comment": "Malware payload (AgentTesla)", "value": "c23a9185d843aacc983f182e28e73650b62179f0b02984cd01d0831c5df49af6e9073d45596e467e0b45c281420fceeb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271997, "uuid": "b14839ae-157e-4fe5-9b70-be2035115df8", "value": "T1FCE4063E297652E2E0B8FB7112E28520B5AC4082731FD959DCDADAC47F411827ECF69D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271997, "uuid": "c7ae0ffa-023f-4819-a477-f116c9962fc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271997, "uuid": "5381dc9b-963e-4e3a-aa94-1ea49bda4479", "value": "12288:wiae1jfIsPb+HT0qE8S6S7ztLHKNu+A+/1bVc9xJPmH5xaLW85B34Gl0eZCM4Jc0:wiaetQ8b8vOztLHKNu+A+/1bKFPHP5d4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676271997, "uuid": "1c0f8070-1f3d-430d-8b94-596ea1a8f879", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676271997, "uuid": "e1e3b370-5c22-4038-a4b1-5e7523c571d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271997, "uuid": "fd347a32-85ff-4d61-ad78-284ecdd08300", "value": "02-06-2023 BKKS22087405.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34aaaa7c-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299591, "uuid": "1e5dcc85-43de-412a-b1df-20abf5f789eb", "comment": "Malware payload (SnakeKeylogger)", "value": "190c7362ac303dcc7683512c3a59223e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299591, "uuid": "f77ac0ae-14a3-44c2-a0fe-431c07780489", "comment": "Malware payload (SnakeKeylogger)", "value": "a200aa32fbe6af2935fe45423e0fe5c53b44cd4012a29426fbccbd947c319749", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299591, "uuid": "3ea53c3e-dbf6-4647-9e11-e659a577f206", "comment": "Malware payload (SnakeKeylogger)", "value": "9a437ddffada51944d52348cb6ab3f31adb9aa95", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299591, "uuid": "003cba95-8779-4352-a0b3-c8250f232dc1", "comment": "Malware payload (SnakeKeylogger)", "value": "b32e5bb0692b96b0b6551bb0fab9ded9a931b7f87b62aa612562ffc722c2465384702a57cbd1d90205ceb7d14ce7258a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299591, "uuid": "f9dec38d-4e38-44b6-9410-ca55765662ac", "value": "T1A7E4F1503A9D9B18E56E57F42474A08093367F5A39B6D32C7DCA30DE0A32B578326B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299591, "uuid": "68f35426-5161-4ae2-98f6-7d1e5460fb88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299591, "uuid": "57517cc4-c7bb-4e88-9e05-4446c355fe18", "value": "12288:wDvz8Zh6q6/TKPzG7Ls9TDzRHyCuBV46VbAND8sN9d0v3Sis0DacN347TTlE:wDvcY/TKPzG7LaDzTibS+Cis0ai347vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299591, "uuid": "5773d718-985d-44af-86e6-be440fd31d21", "value": 668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299591, "uuid": "5ed391bf-80a8-4866-92a4-efaf8e3cc402", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299591, "uuid": "9f801772-9912-452b-b3d4-a9d611f0d069", "value": "ucqAI9Z7V6CUaoi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e332e2dd-abe6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676324366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324366, "uuid": "6a8d31c3-1227-4f80-a921-b3c23e997868", "comment": "Malware payload", "value": "b380700b7e2e4afe7d73514a142bc63c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324366, "uuid": "ab6687b2-6d82-4e96-9fa2-e2c3b746ac18", "comment": "Malware payload", "value": "a243357d733b7a9b3470c28061f1c8915e2c97e553ce8d45800c54fff57b219a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324366, "uuid": "d16a6edb-ac55-4451-b30c-e75c45c4a6ed", "comment": "Malware payload", "value": "5a783a66c00b601c01b4578246056f688c64c289", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676324366, "uuid": "cb07c1e5-a68f-486d-8202-aabe023fddd2", "comment": "Malware payload", "value": "aedc8f5d5be11a1e4a485e1f829d87aae1b54c8c22507019ccae03084d397b7ec970d046c63db0b6b42032f64d644a9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324366, "uuid": "e075f087-b8b9-421f-8b11-e41444c40135", "value": "T136F4125BF2FC8522F9F46B7118F613C31A35BE411A35429A238F6D9909735B0B6343AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324366, "uuid": "729887c0-2f51-468d-b5d0-845b57d3d21e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324366, "uuid": "8ab1f791-7887-4a9d-8def-d24e85f05480", "value": "12288:ZMrgy90BH3G5AkKVoSpQtQ49lXpcWfc+nYweJLw4eJKKe1BUh/7lnmkgBn:JyUH3GqvVFQGY4d8JZfnmRd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676324366, "uuid": "04e82482-a091-4ebf-87e5-4e6804855a4c", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676324366, "uuid": "244a0e78-53d4-416c-9b6e-59a72e525abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676324366, "uuid": "17316a79-ca4d-4158-8159-8f6f232e29fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33891080-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676251486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251486, "uuid": "1c918edc-788c-46cf-9c4a-b438a6e61071", "comment": "Malware payload (Mirai)", "value": "2c68629bc44d81be6c779bc740477648", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251486, "uuid": "86fe96c9-f4af-434d-aa3f-95d46d1d4206", "comment": "Malware payload (Mirai)", "value": "a2af4b5f50f3e6a428c07a119789487996541838a193f3adace87b945d4b340d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251486, "uuid": "8a92835b-df5c-4fb4-9272-ef205efb523c", "comment": "Malware payload (Mirai)", "value": "a5bc8896a2ac19dc95dc1569559c8fb33527c20d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251486, "uuid": "7cb938b8-c8be-45ea-b2f9-87b26757983e", "comment": "Malware payload (Mirai)", "value": "f6c05114b5e0979deff090b70726e904b28564902cc50c0f70cf69acf15b5b845c269d84f4051542d8d4f6709e7afef6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251486, "uuid": "e52f7c7c-53b7-48e1-b7ec-6cbe30e13a48", "value": "T101430271D6F0AA74A19A2D37AC7949437354CAB2D4F421F61FE8D3698BC0281E4DC0A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251486, "uuid": "2c7ed9a9-4445-4475-b3c2-80f5d247da83", "value": "1536:ICX+efT1svz/kBphqLjvElCPaS4KevcJ1KCXbpknXYfmqFkxb:xX+eLY7scPElCPrz1fknXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251486, "uuid": "8696ab7e-2e35-4cd0-8332-0f52cfa6dcc6", "value": 59280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251486, "uuid": "cbe66471-ffdf-48dd-9d44-935fbfa97a1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251486, "uuid": "250b5a93-7759-4cdf-8dfc-f9355f041c57", "value": "2c68629bc44d81be6c779bc740477648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "284b1b6a-ab75-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676275519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275519, "uuid": "ab7bbe8d-e48e-4a7e-a97f-703de4192707", "comment": "Malware payload (RedLineStealer)", "value": "f13fa76249887ac42a3405cc0919f8f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275519, "uuid": "c218398b-2b65-4f65-bbbd-b3f99802c9e8", "comment": "Malware payload (RedLineStealer)", "value": "a2c956fffc29a1edf6cfc2a44b5517c54104b43f34f97dbc72a58f9888b361dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275519, "uuid": "4aa47ffa-5326-4941-92d0-d1b8e86b7498", "comment": "Malware payload (RedLineStealer)", "value": "5a868cc57a375ad725c19a20eecae61328706f9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275519, "uuid": "0d270e83-db6e-4e9f-938a-a6b32946ab69", "comment": "Malware payload (RedLineStealer)", "value": "f359793ec0d1d01b852d4fc1b34c5166f243a430bfacf54ec9059638b48847fd0fe53be349beae3edb420dc2f60b3436", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275519, "uuid": "af6114bd-06c7-40e4-a64f-94797c4b639b", "value": "T110F4120BABE98173F8F557705DF303C30A3A3E216A38925BA78E6C1558336B460357A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275519, "uuid": "357968bb-413b-41f1-a0b2-9d49657a2539", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275519, "uuid": "9e7a3172-251c-430d-b0b5-b6f84049e86e", "value": "12288:AMr1y90Sy0p5R+EHpiFynXy0yB0s4Pmy8neJYsuRXFwkGynfS50P+ksQgPLCBK:FyPy0pyEHpiMw0s47dYLwkRr+2gPmg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275519, "uuid": "1ed19a3c-901e-4c7f-8c80-a2bafca47be4", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275519, "uuid": "fbdea1fc-e469-4f82-98f3-f6d7075536cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275519, "uuid": "f0634ba2-a2a4-4580-97c4-1d3470bcbc6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85bb98f-ab7b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676278311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278311, "uuid": "8d67dfbf-9b2a-4279-9303-9759b22ddd51", "comment": "Malware payload (GuLoader)", "value": "f3a9804fd02a79f03baa34c927567847", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278311, "uuid": "e5b93f8f-348f-4806-98e2-365d41da9043", "comment": "Malware payload (GuLoader)", "value": "a2d2cada1b167fcf06ac9a85fb47a71738187152544484b5d280a523adb93d1c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278311, "uuid": "c98c6b50-1bed-4b3d-b545-259b183c2b2b", "comment": "Malware payload (GuLoader)", "value": "61ddc401e537e878b3a0f67c7877ae4c953fafcb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278311, "uuid": "5751638c-bd91-4d5b-8404-f8a5ffb46d18", "comment": "Malware payload (GuLoader)", "value": "9a12923b7fad1d31254d25aa0c7f4d485ea5db0822de77edd16ac652e23bd951730239d01d506b68c70b885e98e9e255", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278311, "uuid": "949b4eea-6d1f-40a2-9e7c-e88c64aac1ac", "value": "T140335B60BA362924CD290E395F831F8FFB6A5D24A036D46D2CF017CD270725ADE7B166", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278311, "uuid": "deaf1080-5366-4c89-9c42-5856d05883ae", "value": "768:P5MV9DybrUJAhATljcJBgYspgasqSQmepk1+R5SK:P4GhhA5jqI+aWQdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676278311, "uuid": "2c01cc87-ada2-4b56-b0f7-2cd4cedcfef9", "value": 52973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676278311, "uuid": "6fcfb87a-c433-4eda-ab24-258a2cbe5938", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278311, "uuid": "65a4a695-8c62-426f-bddb-5769a6474648", "value": "Invoice copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5158c853-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676301358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301358, "uuid": "7f5b175c-7308-4697-ae4e-9137416c0bb9", "comment": "Malware payload (RedLineStealer)", "value": "7b54906621ec5e810b4f7ea3033f4314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301358, "uuid": "58a7801f-9399-403b-8c71-df9fe1be037f", "comment": "Malware payload (RedLineStealer)", "value": "a2e02dd24df4d967d05af67ab37bfa4dd21eafad8c93833e03478a3bdee76cbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301358, "uuid": "0efab097-4f82-4557-95c0-8536d3a48f78", "comment": "Malware payload (RedLineStealer)", "value": "c30d8ab49d25c434b3052ce462f39566f256fc9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301358, "uuid": "7b2b5663-3d6a-4016-9e45-2d33d6d78216", "comment": "Malware payload (RedLineStealer)", "value": "ce076bb28daf56a3723ae7f8dea8b56f50b0919d1f7c7152851484d0a607a06ec504a82b2d98758faf6e27f70332f717", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301358, "uuid": "691a4110-588f-481f-9fa5-d70c6ad05a8d", "value": "T1B124E01179F1D0B2E067867631A1D2ACE66FBC31A361855B37041EAF1E307C1EA6936F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301358, "uuid": "081c7eeb-f7f1-4f3a-a07a-e3b032454c5d", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301358, "uuid": "162c20a0-f317-4461-9373-c1e1b3ff0693", "value": "3072:y4zXNL35X5qOW9Jbknjw5C+bd23kvJH63Jpwewk1NO1:y2LB5jOO4d23ktGUePu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301358, "uuid": "4a4666ca-fea8-422c-877d-4852675d7924", "value": 227328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301358, "uuid": "be47d6c9-aa61-4195-840c-902055185d41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301358, "uuid": "220c6133-608c-45da-b1ac-2ade568e2187", "value": "7b54906621ec5e810b4f7ea3033f4314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53dc918e-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676301362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301362, "uuid": "31e1f7c6-2eac-4301-9b8e-601c067009de", "comment": "Malware payload (GCleaner)", "value": "c759a901f71676d08f76548811827964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301362, "uuid": "802808aa-6ff7-404e-b108-0a7d1c66b4da", "comment": "Malware payload (GCleaner)", "value": "a30a378110341636fc17e33ad56d8e672f4d2af870a1c54cda9c2e1dd9dd03d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301362, "uuid": "aaf7d876-cfff-481b-85a2-60023d309397", "comment": "Malware payload (GCleaner)", "value": "a4bb2782c38a1c2582b0cc534b73a3b7a591c9a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301362, "uuid": "adb31c4b-63cd-4426-86a5-9dc409772393", "comment": "Malware payload (GCleaner)", "value": "525876697d51b3cf0be76d4978c0a7e3d9345ec63149f7662194ea9d31d6a7d9aa1a03f1367f7471efa78dbf43e64459", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301362, "uuid": "764727db-79b8-4589-8cfb-c4b6c16adc75", "value": "T189F5127D7255C4ACC680FE78983A94E75CDA6EE3E9D4A063B0CDBE3F817D1844A1A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301362, "uuid": "de243d56-2e48-49b7-8827-29f34302a787", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301362, "uuid": "a9a58db5-4ae7-49ee-a01f-4b5b9039bfff", "value": "98304:JHEbOPomgRHj+AKjPEbe5m11CIILxLv2MR:dEbOmy0ym1UIWLvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301362, "uuid": "01a23bfa-8d58-4e96-9fb8-51abed4136cd", "value": 3323668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301362, "uuid": "2485c5e7-c280-4685-ba8f-e811efc5ddcd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301362, "uuid": "8a05026b-53a0-4e50-b752-0052fb0e6c2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac96e770-ab47-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676255984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255984, "uuid": "b976fe98-69c8-444a-bf97-c158ef1c60a1", "comment": "Malware payload (Amadey)", "value": "cfc6d3f69f05c2d28f431fb50c233f16", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255984, "uuid": "9ca6bad5-6e7f-415a-956a-132fe22e517c", "comment": "Malware payload (Amadey)", "value": "a31cadcfb364a17105a841756a1a8fc7913d30a443fc6490ef13dd86e265dac4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255984, "uuid": "a8c3661a-4e4e-49ae-8de7-b3ebc158ba5a", "comment": "Malware payload (Amadey)", "value": "cc02f5b219c0b1d5cf48400b1b453435dd4d39c8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676255984, "uuid": "5ec3e7f9-ebf5-4f0f-9505-0fbaf83f9068", "comment": "Malware payload (Amadey)", "value": "19c1625c970608cf3d35c8f1d1fc09b988b8410a9c13e14ca51ab5cc1cd58d40906bd7f4d1d343a433873653a03e1bf1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255984, "uuid": "57c10fc8-46a5-4c82-9774-e091ab6e4bd7", "value": "T1F5F4121BBAD88122F87057300EF643E32A37BDA14B348357678A6C191C727B5B6B1767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255984, "uuid": "1c7f852b-9853-46cd-9b2d-a44f5c7d2dc0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255984, "uuid": "7aaa1779-2de4-4eaa-85df-f09218416eb3", "value": "12288:ZMrOy90QvgZV7HqHs6LrHjlGyRyAeJdjuNje6KvaeAbOboE:fy7v4V7HqH3nlGyIdjuje64aHbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676255984, "uuid": "93f106b4-6fb1-427c-9ff1-097402d1b98b", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676255984, "uuid": "12454be2-817a-4000-9a9f-5a3386d9a16f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676255984, "uuid": "b79dd34f-c0e3-4462-a461-3f1114773ba0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe1e62fc-abd1-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676315391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315391, "uuid": "ea20c950-4c31-45ef-a1cf-2329f571c225", "comment": "Malware payload (AgentTesla)", "value": "e90288e2395d40d06dbf9456f1b5e10f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315391, "uuid": "e1708c96-804c-440d-9880-b94c4deedce8", "comment": "Malware payload (AgentTesla)", "value": "a36ff39e64912bbc12bd359ed18e07e42fca43caf09c7a56b6c538cb8de8a08b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315391, "uuid": "04b8ba08-6ca0-46e5-85e8-77b9dfc2dff6", "comment": "Malware payload (AgentTesla)", "value": "b24bffe0719e64b132fc9ff3c19a6d62746d69ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315391, "uuid": "15c5c7ce-2bcb-4841-87ca-95eda8ff3116", "comment": "Malware payload (AgentTesla)", "value": "b414ee1dd8816be9ec143003079d5be07a2194a2712a0120f704cdc015d20503be9f1cbf052b32de1386cef0b2c39e34", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315391, "uuid": "5a10a1e9-6be7-46dd-9f74-eb57203167a1", "value": "T1FA04064072DD012428F76D6B5F17F2A80B7FF6D5083ABD4891CD4A0AA7DEC09E9217E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315391, "uuid": "0d14c778-8cea-45bf-a8d6-df201bb74be6", "value": "96:D8h0zs1VkB3wTJq3Av7fq3Avzq3Avmq3Avp999991M99999B99999F99999E999i:D8h0wVkB3wTQXvQmPxGZPLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676315391, "uuid": "143de0b4-cad6-49a3-9d6a-a40703a263bc", "value": 186518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676315391, "uuid": "3b11cdbd-465e-4084-b82a-12ac6d731c7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315391, "uuid": "0fd2f786-d363-42ba-871b-ecb24ed07e8e", "value": "DHL On Demand Deliveryconfirmaci\u00f3n y correcci\u00f3n de la direcci\u00f3n de entrega.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75e469cc-ab59-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676263623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676263623, "uuid": "f521c235-5960-4684-a741-2f8b50b07327", "comment": "Malware payload (Amadey)", "value": "a01ae2e6d6aa6a685f47695f1cc8c3bf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676263623, "uuid": "b4279dcc-88fd-4d10-8fca-00d536849811", "comment": "Malware payload (Amadey)", "value": "a4c19a708b0ceb59e0b340bd038b142d1b8c32acff9f3ef6710e4c1f26fed623", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676263623, "uuid": "0b8ac0ad-b9cb-4d93-a465-8011275d53f7", "comment": "Malware payload (Amadey)", "value": "6c505209086fcd180ef956219d5529562c89b52f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676263623, "uuid": "d4c0df68-0bd1-4d89-a649-27e5d02b90d9", "comment": "Malware payload (Amadey)", "value": "b84194f07d0941bf9905ccf18394f2c62539a70de91831ff35229bff9e48c6e2b107084319d628df0172ab5749991800", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676263623, "uuid": "c507cb1e-d4cc-43cc-bff0-d4f2191e733c", "value": "T1D0F4124BB7D8C132F9B427B058F607D31A367E61AA35839713CE691918726B2F631327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676263623, "uuid": "06bf956a-c7e0-42bb-977c-c54aee39cf4f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676263623, "uuid": "af7f565f-48f6-4347-8b4f-8ff1eed1bf33", "value": "12288:QMrEy90YBWn1FdNd14YXm5EfgXteJgvswxDEcMgDAeTbnIVwQ+CQ:Ey141FJ3W5EfBUxIpgBTbIJtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676263623, "uuid": "b089959b-b2f5-4ef1-9e1e-1281d910a397", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676263623, "uuid": "b4e0af84-e4d6-413a-b7b1-c44c6f37bc44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676263623, "uuid": "505ebf4d-b00b-4bc0-8c58-0c66a74df9e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e89a13-ab62-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676267326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267326, "uuid": "94afb418-9a47-4583-b6a7-0ce865c44766", "comment": "Malware payload (RedLineStealer)", "value": "4e5dabbe74be5ad1c570f52d928c0c69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267326, "uuid": "28f3fbc2-a699-4351-8c5d-d84bdc8b34ee", "comment": "Malware payload (RedLineStealer)", "value": "a4c3cc8f9324d6f40d7506cd7930bc3738398d581f8ba043e0f283500cb82d66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267326, "uuid": "83531aea-e205-408d-97dd-6ba26bcd02ec", "comment": "Malware payload (RedLineStealer)", "value": "6657c4093116c1c9e7388528ad4da3499a242fe1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267326, "uuid": "a26c6c8c-b288-417a-aa56-02c791e08261", "comment": "Malware payload (RedLineStealer)", "value": "4b9ce0d91f45f71b9dfa9d1c3730afe88cd9a87b57ef37c1bcf3445b12b4bbd945c66dd53bc47b5a24de244ee637d05c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267326, "uuid": "2a9b3014-56f0-4aae-9ccd-33b30c8ded42", "value": "T15FF41207E2FC9032E5F517B049F202D31A3A3D619B74925A578FBD5A1C326B0B6317AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267326, "uuid": "8231c58d-5187-4f75-ac62-86f9e8913b6a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267326, "uuid": "5a3a728f-b13b-411f-9cb4-98bba59d233f", "value": "12288:IMrWy90fM4ThGmwjXIvce6KAP38ZneJFHvJe0ZS3t0G//9EcB/b:+ycThVwTIvce6Kk8GFHxe0E3tbrF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676267326, "uuid": "46e375f0-a0c0-4c2f-b8ef-8f24fe25620e", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676267326, "uuid": "5f09e6c0-8f59-490d-a6f0-733aea4c8ca6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267326, "uuid": "f358d70e-0988-45c5-bb42-bd59e8305a00", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3cc9cdf-abf7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676331614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331614, "uuid": "737bc589-1d6d-45fd-aa62-573d0122e77f", "comment": "Malware payload", "value": "9ec94f3612523a4ba7e89633a1ab9b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331614, "uuid": "93c2da0b-bf4c-4c0a-bc2e-662afab1e34c", "comment": "Malware payload", "value": "a4d06cb6aa10608e307a7f8b358dc9a32f4c0ff06b5b11685f68aeb05482d4cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331614, "uuid": "430b0f50-8d4a-4f34-99a4-cdf2945c00fd", "comment": "Malware payload", "value": "ef7ddb012765b18e2049caa5890dbec2f57c86ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676331614, "uuid": "fab00d3e-592a-4eaf-8b7b-7430c3e44376", "comment": "Malware payload", "value": "b60c0a1c869628c67e46af658b5ef24163bc8947400591e4cae9aa0de9589751dd980053b664cd64cb5ae2746d20e6b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331614, "uuid": "a41c2aac-cf0f-4326-8b28-3449d2610d89", "value": "T1B504CF2332E0D431D46316336C69C6B5FA6EF412FA396A9B37A42B3F0E702D19671365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331614, "uuid": "8a5fa5ba-251b-4793-b8d7-df473db2ec20", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331614, "uuid": "375beede-ac3e-4af8-a2aa-d9d95a06f94b", "value": "3072:Gy+Jb4H17wBF0GoX2FZgv3OuCU9rGFhwCLy76:GTJMHGb0GoGFK2uCUVQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676331614, "uuid": "e212e11a-e1c6-4dc4-82b5-f80e09bc9e45", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676331614, "uuid": "5c8cab3e-484d-495e-b89d-b7112b7e0130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676331614, "uuid": "02692d6d-a5c6-4a65-a970-6b2483991cf0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabef3a9-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676300783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300783, "uuid": "2a5fc118-bdba-4793-b9a5-d1338fe33376", "comment": "Malware payload", "value": "463eb9f9295fc7a5f7a6d8578f83ec5e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300783, "uuid": "5881f3b4-5334-458c-b376-961bc3477e52", "comment": "Malware payload", "value": "a4d85e3fc614ac87b0cd6a335bc264c3f3ff8ad3725392ee2ce20de1f22499dd", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300783, "uuid": "2c9f9b4f-1680-4d34-98e0-f194a65893fb", "comment": "Malware payload", "value": "6de984d1e99fb7ca11ce67a38672a5b0f1057d1e", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300783, "uuid": "dc313b18-6df3-4ce4-a3fb-ebb2ca1c3920", "comment": "Malware payload", "value": "a7be30ea8d6338f0e6494e092a627dd3159e293e0aeea7749197bed707f12cf01aec9c23f1d7cf01f99d516cf3a0cabf", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300783, "uuid": "353dd0f9-b980-4606-b1f8-5791985e3a57", "value": "T1F4641216DB199F5E85603B9C44F408452C3CE99E0264A3E8FF6E5C6BB06ED19233D78E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300783, "uuid": "ffd27ca7-1d2f-455f-adc6-058eb2a19bbe", "value": "6144:/rOjy6gCXuCl+X4AEei79zClcWm2yj2jlpBl+CpqL2x1VwuCXONQM:/ajykXZ+X4WiJz9SjlpVZCSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300783, "uuid": "eb930663-e9fd-443e-be9a-81ef147baceb", "value": 315383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300783, "uuid": "1d207a61-deb5-438f-be8c-54d903c41eb3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300783, "uuid": "9868deab-b771-486d-b7ab-f9555c887481", "value": "Report-Feb13-226094.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fbade1-abeb-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676326174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326174, "uuid": "98c880b2-0190-4914-b413-0c52ad8f35d7", "comment": "Malware payload", "value": "6a23c189ce7698d8fdd6a1e40e973fb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326174, "uuid": "9184a6d7-826d-4c28-83b8-db9e281d8381", "comment": "Malware payload", "value": "a4e6ffe86d09c83b01c7fbd2c6636d69943c7b5426e1d549d86162097e363b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326174, "uuid": "695b4f3e-bcc5-4650-b163-c31461bdb1b9", "comment": "Malware payload", "value": "2cd76e311315d6c06f21ac314df0818ebc0d23ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326174, "uuid": "470f806f-e9a5-41c6-8fcf-1ba038ed9572", "comment": "Malware payload", "value": "bd10b1d7044232c0f2da56889313d480f9eeab9bdbe9e1ac104f3083f514d605f09817804e26ca6654cb61b46ed09b79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326174, "uuid": "aa562e7d-c931-484f-b00d-9e0078bdc8ab", "value": "T1B104CF2332E0E832E56256345D65C2F12ABEF8110E78A64B37D86B3F0E706D1BB76355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326174, "uuid": "314bbeb3-0943-40b6-be81-83b42702a5cd", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326174, "uuid": "56feaf8a-1632-4b71-9e95-b810048171ce", "value": "3072:iKFC/MiCc6hOdFf7+uM7XNC39ZAWIVvpAjqUgiGnu7xfG46UUrEHq5d:igC0ZVhOdFfCuM7XNCEWIVajqUxGudfR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676326174, "uuid": "debc5703-6c96-49ef-ba70-6919ed9e2986", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676326174, "uuid": "8cefb6fc-0dfc-4fac-953a-8947fd05bded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326174, "uuid": "10ae7272-a75e-4503-b449-30d0c6a877d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceaf273c-abda-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676319177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319177, "uuid": "2f434f07-6d61-418a-b712-34af49415473", "comment": "Malware payload", "value": "ba13275f9f69313ba652bec06c7d20e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319177, "uuid": "b1638b9a-a172-438a-84ff-5bf7edd633d5", "comment": "Malware payload", "value": "a4fbcacf4ba7718c8383499105851bec6ea84a37aa71a28edcd4f4263daa4249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319177, "uuid": "31a75e2e-13af-49fc-a6e0-de9d80539191", "comment": "Malware payload", "value": "60201b670d0f5d33616d0f8cd1cfb06a8a01f708", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676319177, "uuid": "2de4fb62-bd87-4943-857a-ef99d1a7bacc", "comment": "Malware payload", "value": "d16c2438bf6356d238eeb5a4a1061fbbf0064e11228bafd171ced6d4b6d4c2d604f9e8dd0009df923846354f98c5cf97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319177, "uuid": "d11566ce-7ba6-423a-8a2f-bbf9ca57b305", "value": "T17FF4130BE6FD8133E87057B059F207D30A35BD612A34976F238E6D5819326A4A374B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319177, "uuid": "fd786305-d11b-4d84-9ef1-fcf46901b750", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319177, "uuid": "6beabae9-90c0-44ea-b72a-2a2ea1b0e824", "value": "12288:6MrKy908+JFpkVjCkJdoSAmDjj4TpcRUIeJrjFjMZj/yVP5ZwcdjRhT:4yF+JFS0xrsj/s5ZBFRhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676319177, "uuid": "da747fef-7f30-49b8-848f-241eaa4ef90d", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676319177, "uuid": "f890193e-7088-406f-acae-4395d37c6669", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676319177, "uuid": "4d0ad33e-4fbd-4b4d-89af-98d639e606cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24250003-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676251460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251460, "uuid": "77f24dd4-2a54-47cc-b4ce-fde4f95d3dcc", "comment": "Malware payload (Mirai)", "value": "c7769b208ef2a256b58f8ea45d05ff43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251460, "uuid": "b26a1e30-2b05-4c52-ad2b-9147f5e08480", "comment": "Malware payload (Mirai)", "value": "a534b1ed355e934cd1749c8b91b93ec31b56e1e4eecdb15ec1f7b501c46fcbdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251460, "uuid": "8bff4daa-60f5-469e-9272-4a4cae64d1d1", "comment": "Malware payload (Mirai)", "value": "7bfd47acb853211ce46aaffa48193d47e7c8c5a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251460, "uuid": "d91e584e-b904-47c4-b513-8f75acc51b4e", "comment": "Malware payload (Mirai)", "value": "4cb7e6e04fa4b6074669b2c3ad1403942330addc149a62b63b16a473ed685e7e3adae8e9861baa5e9b6e44e5b3389f4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251460, "uuid": "e94f3730-fbce-4a6c-9120-fdac62a4a427", "value": "T149E2F120624588F59870E63446BBFC9E420643BCD9D627B52B781AA4F9D90D236F851F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251460, "uuid": "475a970c-1e0c-444c-84d4-8cc23b00f782", "value": "768:9OzN7GY415SuPjDSpbA6FMCA3mqDB8i5DgXL3Uy:UJbCPjDSpbA6SnBJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251460, "uuid": "aee8488b-59a6-4476-9dc3-7eafde09a0f5", "value": 33616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251460, "uuid": "6a3e5495-d451-4239-8396-4ee71103e652", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251460, "uuid": "b41ab464-f871-4672-a2e3-0094abe93d71", "value": "c7769b208ef2a256b58f8ea45d05ff43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd0ac6f9-abbd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676306719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306719, "uuid": "7f70cd01-fb85-4f6d-91e7-4b7f1f55ada5", "comment": "Malware payload", "value": "a0e7a3a0722e9d93a44b4199a5e9110d", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306719, "uuid": "567699bc-e34b-497f-acaf-cd38be4d97d1", "comment": "Malware payload", "value": "a59cef1b258dbe7533623107408f53e16b79ae56e6f617449b10781ebd854ce6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306719, "uuid": "68e7c3d7-1757-43cb-b9ea-15b08c71b050", "comment": "Malware payload", "value": "bfee1537df639e3fa3d63851e400b41b5c01a864", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306719, "uuid": "7554257e-6330-4007-b795-f39f1a6eb6ef", "comment": "Malware payload", "value": "f63a70b9694c7a5a1e77a7290b7adee71616822390532a02578d1c1788143caf47b366e8748921845c99edb2074f94a1", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306719, "uuid": "187376e2-df8b-486d-860d-15b1eaafe262", "value": "T1D33533D01F202A1145946246D13BFE6F7511BCE177A3DDCA66AF4AFCF60A0A2362C3D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306719, "uuid": "455f018a-4e8d-48aa-bbe5-71d87208e852", "value": "24576:UeQnMNbI38abtKTbnkrGntsnZqyR67WDRmMr1BhzWw:UeQnM9IptKTyRh15rtzWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676306719, "uuid": "c144270c-7a19-4064-a16b-ffbbbf6fc52d", "value": 1117242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676306719, "uuid": "a4159d88-0792-469a-810f-92535c365a72", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306719, "uuid": "e6ad8bf6-2864-4546-857d-9d0a943f006b", "value": "doc-PurchaseOrderFeb13_PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f88d12-abb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676301880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301880, "uuid": "f1426799-39dc-4f0b-a28e-1b9987e68a9c", "comment": "Malware payload (Mirai)", "value": "548ec83a2b38d0347a3c5acc551808cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301880, "uuid": "a6ce5f75-baa4-4c15-a4aa-1c68bb384f21", "comment": "Malware payload (Mirai)", "value": "a5e0950cb468426b76823a24fb821ef72ad153139f854de61d4911bb08c481e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301880, "uuid": "e80258e4-14ad-40f2-a5c8-459bc495950d", "comment": "Malware payload (Mirai)", "value": "b09eee4cac85428b7d4b9ca126ea66f6f4ef5bb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301880, "uuid": "7def27bd-3c84-4a3a-8438-0f29a3e18e35", "comment": "Malware payload (Mirai)", "value": "00fe74ff188be24ede99b8210136b67aca181f798b5a772ce191a0a578cd667f485badcaf4766e6f62a618fa0cf23901", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301880, "uuid": "34258c60-ffb3-4085-b680-b6c6bea35cca", "value": "T1E7633AC9A5C3F8F5EC040A393037ABB699B7F13B6138EDDFD7982563A941642D1016AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301880, "uuid": "44da3a7a-a505-4bbd-b140-0cbfa6c87681", "value": "1536:m4/aT1T71yYlupXqMmJmBr4vMFnKi/IFO2418H4QjW5BiPm759Qpb4Rf:b/aJT7MxNpmJm94vMFnKHF/4CH4TBwYp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301880, "uuid": "dac2f3a1-15ea-43f8-8458-6bf95f3d0814", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301880, "uuid": "bbcca917-cf18-4764-b7b6-a17f6c1f3aa6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301880, "uuid": "d89ef32b-1264-48c4-b613-365549f5d629", "value": "548ec83a2b38d0347a3c5acc551808cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51cc1bbf-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676300499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300499, "uuid": "b0308a9e-f154-4db0-9178-c3f80a2fd9b1", "comment": "Malware payload (AveMariaRAT)", "value": "a835914540d636d21b4e8d4d4f951d7a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300499, "uuid": "a7853c03-4a4c-42cc-a4ac-c383c46116ea", "comment": "Malware payload (AveMariaRAT)", "value": "a6bb5c773ad10d84dfbfe5d765286e1e13aed4538128084b531147a34d94b5d3", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300499, "uuid": "13d5760a-4403-46de-8f1d-a4a1ccfee830", "comment": "Malware payload (AveMariaRAT)", "value": "26f665f17081cf9217ab2e155daa41f67bdc009b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300499, "uuid": "1537ffb2-f450-4f57-84e5-0990b539d703", "comment": "Malware payload (AveMariaRAT)", "value": "236cd4d9c643275822ca17f9e21adcae5fa4ec70b6249b6c519d01fed7209858b4279e88451165d45e8e0610c0cfbbb5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300499, "uuid": "07979bc0-3145-4835-ae54-52b126b89f36", "value": "T19105D0276F34E867C55C47B820A35F10D2B5D65E7223A78A07B6906CBCF37C09E16A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300499, "uuid": "8a7f369b-8aed-4402-8655-7ab9eb3322db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300499, "uuid": "81cf29fa-a5df-4c47-a040-2a1137c6e1d5", "value": "12288:eYIDfyMmwxVGaAOKYd/wOWukIl3QgGIwZ1lxCjzjDOGi9pjZEXkmC:ZITyMmwxVTvWPhLlif6Gi9p+Um", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300499, "uuid": "a7c96328-9b44-44a0-b0f3-9d17f50d47e1", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300499, "uuid": "7cbbdd6e-82db-4acd-9bfa-e7818ace2a38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300499, "uuid": "e727ed00-719e-41c4-96fa-ab9c72736f75", "value": "TT-Copy_hsbcsf_00002-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33c1be17-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299590, "uuid": "101338bc-8879-44e6-95d0-9b306ff3d425", "comment": "Malware payload (SnakeKeylogger)", "value": "93ce26ec6aaddf9ceaf7c3b775dc534e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299590, "uuid": "b96af168-58b2-4a75-b691-4949d56e4d4f", "comment": "Malware payload (SnakeKeylogger)", "value": "a6f00b73a005bf4649b09871312a4db3719e23f277b61f1e62139055e974adfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299590, "uuid": "0e56544c-efca-4caa-8943-35b56f82d50e", "comment": "Malware payload (SnakeKeylogger)", "value": "945004442e667ee6236536a940babb1c04390754", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299590, "uuid": "abdf116a-9aa4-44f3-a4a9-b8f89fc05219", "comment": "Malware payload (SnakeKeylogger)", "value": "7ac3a68295a621b7632b4c94fb648b6e41616eb5e30cf0224a8b23484e59e623fd399a24d0035e8ceca3523837b947f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299590, "uuid": "c906fe88-6482-4e9b-b7b4-f359eb16a7a2", "value": "T19FE4127976F88E4AE2AE477A59E0024457F7E581B1B2FB2D0F4830D51FB2BC0C226567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299590, "uuid": "29bf46d3-084d-4543-91c0-7b6c2f1858f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299590, "uuid": "d6f1d849-858c-49d5-9531-23b32aed4e3f", "value": "12288:wNUWbXg2YO0bgha0r6baEPFhbOLvI3GUrzYnwSiH+TyU+QlQX:ZhO0bghr6xziCzY4+TyU+QlQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299590, "uuid": "5aedc4f5-24a0-425e-bcd2-9b032147bf88", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299590, "uuid": "05dfc42b-a8d6-4aea-b132-088081e67dce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299590, "uuid": "f16f8626-cf6c-4ccf-b6a7-f605f1d9cbb9", "value": "93ce26ec6aaddf9ceaf7c3b775dc534e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01830f25-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272018, "uuid": "87e536c4-3532-431e-918c-02df174fc55e", "comment": "Malware payload (Formbook)", "value": "0c634661059410e2433edef79e15edb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272018, "uuid": "17e465b3-8442-4742-8870-e40e623cd28b", "comment": "Malware payload (Formbook)", "value": "a714e41091a1a9b5c1a5d5dde50ab30d9ba44655ff38e4a99e69d2e6118f63a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272018, "uuid": "d8a9e05f-463d-4cd0-88d5-f3bf1aed1ac2", "comment": "Malware payload (Formbook)", "value": "0dda88f2ec1955d2ec7a877cf171259d6aa6a136", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272018, "uuid": "307f0534-a636-4a7e-a007-0f6a5a9ff898", "comment": "Malware payload (Formbook)", "value": "755e01abe19ceb7b41048597a256c6570f06921fd77eef06765ca90392531eaa1f47470e153a535392bd716853b1a52c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272018, "uuid": "4a8cc5e5-b072-4aff-81bd-7a072e65bf42", "value": "T1C10412C61BCF2B53F954217BE43F25F3584D6F253469481E1ADC086E4ABA2ECEB26443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272018, "uuid": "585747bc-76f8-42b5-b4d4-c907c748eca7", "value": "3072:ZHuwQVdi2zNoHeRxEY0Rw6SSPMsnYo/FpYO1TBtQXZya7zJoXySSsQ7Yzn0bu1KI:ZHuwZtHeKWoPxYo/HCnwnoYznd1ME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272018, "uuid": "c01b71a3-dac9-463d-b73e-82069b70196d", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272018, "uuid": "ecd15892-6c65-47f8-8fca-511c19659751", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272018, "uuid": "41f24c99-58bb-4c22-a49f-eaa56933b499", "value": "a714e41091a1a9b5c1a5d5dde50ab30d9ba44655ff38e4a99e69d2e6118f63a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccc4805-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676277110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277110, "uuid": "b05036a5-b951-4670-9cfd-ecacf3c534c4", "comment": "Malware payload (DCRat)", "value": "7e7e37166e62f371b20f869ac5a73709", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277110, "uuid": "78259a4c-e519-4a3b-a033-4ba9bdf8f0a8", "comment": "Malware payload (DCRat)", "value": "a73b8b3a6c73d218b5ce0d85d36b8cabbfd63e2fe858a3631c8f46225e47ca22", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277110, "uuid": "41062544-36e6-4117-b2da-459838f28045", "comment": "Malware payload (DCRat)", "value": "1593ffad19317bdb5827b57e87ce31de2e62358f", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277110, "uuid": "0a93e383-a53b-45e1-b099-3387a9f3ae58", "comment": "Malware payload (DCRat)", "value": "47576fdc5326c7687651e3cb4194f6af6529d18af35e65a4c295f3b864c56fcdcf4433c04bd2496bdf67ceeb888c8c95", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277110, "uuid": "527a54ba-f5e1-4247-b844-45e3fb2c6f2c", "value": "T166235C403798C139E2FD4BB4ACF3A2458275D65B6903DA5D6CC814AA1B53FC68B036FD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277110, "uuid": "ae7a6577-ddfd-4277-a952-fe26c444dfa4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277110, "uuid": "c6432a6b-e5d0-41f2-9206-5832acf6d8da", "value": "768:laIO5VILWCyh+DivGS2LtPiH3iF8YbpgeoFySAKKvEgK/JLZVc6KN:laPNvGSERiHozbm5F5AKKnkJLZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277110, "uuid": "18037487-6f81-44a7-8275-f543fae4b7aa", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277110, "uuid": "c4e80d51-2437-4672-b0e7-46ca067b5b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277110, "uuid": "667d74f9-b3cc-4f69-a1c6-56c9155dadc7", "value": "7e7e37166e62f371b20f869ac5a73709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023f7b7c-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272019, "uuid": "7a946a0e-2214-49e6-b366-c7a63f1f1b81", "comment": "Malware payload (Formbook)", "value": "7fe7d5cb5f187fdb9af15553e21564e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272019, "uuid": "b58ff9de-eb7c-4f14-9b58-a00b284be609", "comment": "Malware payload (Formbook)", "value": "a7c74a43e1521ed01621bfe4d28e223f87a9e2999c8c5f8103a5c71ab93945bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272019, "uuid": "efe3f183-32e0-496f-b1b4-eeea40fca00e", "comment": "Malware payload (Formbook)", "value": "d219878884c807fc48a1b9ab1f359d4dccf6d4a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272019, "uuid": "746aff0f-3501-4f4a-b705-b1b6879e9384", "comment": "Malware payload (Formbook)", "value": "36a677ac69fd9212c28d38aa575bbcf7522d19d5bb2b1617373f0e369b10c857baf735cf2b4303ef4f7921f6c3515c1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272019, "uuid": "29400d84-96ec-47e2-bff4-3cea30f966a9", "value": "T15D04AE36D642C031F2B211B5F6BD1B7B883D0E353355A4EAE3E126E06EE45A5B42931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272019, "uuid": "4329a43d-4689-4a7d-a346-0f1b245c62d5", "value": "3072:xhUGkDYGoZlE713FCjBl4rjBUQPMGAruJV8DE1j5qntnETX6:/CZF8BmrjBUQsMOAR5khETX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272019, "uuid": "623ce47e-6557-465f-96bf-2438b0ba21cf", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272019, "uuid": "6c531833-6a74-4a3c-98be-2e9d8f80b524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272019, "uuid": "02a4099a-b226-4feb-ac63-c436f7068fa0", "value": "a7c74a43e1521ed01621bfe4d28e223f87a9e2999c8c5f8103a5c71ab93945bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f29a72-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676284665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284665, "uuid": "996221ae-8827-49be-bcee-53fff0b7c028", "comment": "Malware payload (GuLoader)", "value": "a7d3d24729ec8e088d4358b9f37d7486", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284665, "uuid": "0dd1f37e-e82b-4034-84b9-f7c42b84c3e9", "comment": "Malware payload (GuLoader)", "value": "a7e25df59ef9730adda20035b02a904e2a9d2bf3ed74b9236899867ed093e4dd", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284665, "uuid": "df79d335-d512-45e6-a838-69ad19b6ad99", "comment": "Malware payload (GuLoader)", "value": "8e54990bda05247b908065e2c7f0125326dd6671", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284665, "uuid": "f640b5b6-3231-4068-b358-4c5af9a6562b", "comment": "Malware payload (GuLoader)", "value": "964fe813a2b9e4c8750834850fe524a74850960d386c4dee8ddee91617ed7cfce8cf237560d75804e4c4c02ebe648376", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284665, "uuid": "53de0331-f6ab-41d2-9f73-1f28be04e682", "value": "T125A4F1306F2B1A08691F167EBC470F48DC26095F5139B139AEE5B3EE5602355B3EF21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284665, "uuid": "8d0cd0bd-579b-46c8-b142-70b17ab2545b", "value": "12288:div0VZMgiQRCjww7rDCHeaOD6v2h4n9zY/KYM:JVZMgiQRCjRfDCHbvemf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284665, "uuid": "cfaa270d-c584-4dc0-8e98-5093f4ade1e4", "value": 473818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284665, "uuid": "6684020d-9f53-4981-a64d-9851ff6b6507", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284665, "uuid": "110e67a1-60ed-4a76-89bf-11c2120328fc", "value": "New Order - ZKTECO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f82b3e-ab3c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676251139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251139, "uuid": "91fc5c6c-c45f-4f82-bf1d-059a55d5a6a7", "comment": "Malware payload (GCleaner)", "value": "fef109fa2c782883ee7815b9f2c8458b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251139, "uuid": "b157711f-d95c-4541-80eb-9c2aa4c54a13", "comment": "Malware payload (GCleaner)", "value": "a8d141dca92562299305642daab2cf38a4a74036cdd4f187e0b77b08edc0e346", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251139, "uuid": "a28175a7-7c61-4655-b4c1-01f69594bbd6", "comment": "Malware payload (GCleaner)", "value": "225c0c26f01347fed530f697581755da0a475922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251139, "uuid": "14a3cdcd-e46d-4414-a0db-4ec733bac505", "comment": "Malware payload (GCleaner)", "value": "0f5e9421d31741e0beff0cc22b8f89a7dc2d22fdcb39049717e52687174926b0d699425510c40f6e2aa9dcf3c94f23a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251139, "uuid": "0a75bc90-9be1-4be9-a05a-8dff569bd303", "value": "T148F5127D7605C86DC284FEB48D3AE5F31CE79DE3E894906270C9BF3E52B91884A19607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251139, "uuid": "656c9556-a6a3-44ef-8546-4ed088fe56ef", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251139, "uuid": "02b6ebc9-ff34-4a3e-a6b6-dee33f04a92b", "value": "98304:JHTuPmBbeyDWfK1o7vuCqm84L31EsUCB+dmRjJGv2MR:dTv6yyf3LuCqmxbOsUCfkvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251139, "uuid": "6f8b8c1f-e98a-4d7c-ade8-25d2b7758bf8", "value": 3624251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251139, "uuid": "45bbb930-038b-40ac-bf99-e48bbf6be8fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251139, "uuid": "77f3194b-d878-43c7-b0b9-80001584a232", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb2fe3f-abae-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676300201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300201, "uuid": "f995b8a1-82f9-4cc3-b8e0-bcbfdb56de69", "comment": "Malware payload (Amadey)", "value": "577f90e22c44592f6665000242e32621", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300201, "uuid": "3c13afd2-f3af-4942-8d14-bfbbcb2637bf", "comment": "Malware payload (Amadey)", "value": "a9114e50b13b939df776897d2eacb58307739258337a996861e2983565c32d3f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300201, "uuid": "96da1ef0-119f-489f-9500-e00a4e6de5f4", "comment": "Malware payload (Amadey)", "value": "b95e7e0b9aa69289b5cb0b10069ef4c4064ed07d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300201, "uuid": "fe10d7be-f992-471c-abd7-962ceb4e2be0", "comment": "Malware payload (Amadey)", "value": "aa7d33ede3ce0a731f322e41ca9abfd47b483f1377e95981cb1dc8bd218dda97b823c53a689cfdc0dcb0272d87b214fe", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300201, "uuid": "efc5e09f-622c-47f7-b08f-338ac9459087", "value": "T19DF4130BE6EC9533E8B417B059F203D71A363D615A78836736CF6D560C72AA0A63533B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300201, "uuid": "39a46051-d52c-45c2-89c6-76ed24f8b673", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300201, "uuid": "350bf009-f226-41a6-9898-dc1f0d049f6f", "value": "12288:2Mrey901kzDQnur7epwfEYd/feJHcBhUPYwOH9U0tbG8sbfQ:wymk/AuveiMYeHgUP69RbGBfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300201, "uuid": "8387a5f5-3371-4072-9bd9-747032f9b01e", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300201, "uuid": "702b6228-3a55-4b78-8cf8-927635840d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300201, "uuid": "604f855f-d129-4291-985f-228b57622273", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f89ee9-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kutaki)", "timestamp": 1676284662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284662, "uuid": "783017bc-94b5-474f-9de1-288dd6e1a35a", "comment": "Malware payload (Kutaki)", "value": "f43202e4bebcf98b723283a026cbc982", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284662, "uuid": "ff783905-3d59-47b9-bc4a-c998e22db044", "comment": "Malware payload (Kutaki)", "value": "a93dded89afc2572e5984fad3b5bfdbd98d19c465f7ce3c8241875963eced967", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284662, "uuid": "5f69672d-c6f1-4772-8912-5640030b2159", "comment": "Malware payload (Kutaki)", "value": "f688b48d7bac3c788ed6d26d0591291d56b58135", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284662, "uuid": "151db6f0-be5e-4b39-959d-cf1edb2df19b", "comment": "Malware payload (Kutaki)", "value": "47d387fd5fec7fab2bb1d3beaf5daae0f9ff49781683a6297f8a5be846b093c4d692294f09465d78a7b753c8935ae6ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Kutaki", "colour": "#94557E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284662, "uuid": "bbd0b665-6ef0-4797-a6a4-2d55005abc8b", "value": "T111C5D1079D058B83E56897F8BE034EAC5F5A3B0DE98236FF54225EDB3D206215C5E12E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284662, "uuid": "9079c2d7-a5e8-4965-b7cc-ce3e295b2795", "value": "9803e125106e036cc1787959d25f9062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284662, "uuid": "aa307689-8db1-4368-bf23-badfc868c634", "value": "49152:PkWk5cS7a+9XYaQPZehc4mTYJ78V9gyBn4cqfmP/SA8NwfmP/SA8N:najJIZ942KQV9hp43fmP/SA8qfmP/SA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284662, "uuid": "40e0ecaf-225f-4942-a291-65cd394c823b", "value": 2641920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284662, "uuid": "c73fcc80-a70a-414a-b6cb-995b1fb30dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284662, "uuid": "49933de6-f57f-41c0-bef3-4bb3732e361e", "value": "Payment Confirmation.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392e03ff-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676272111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272111, "uuid": "0108e3df-6bf5-47f3-a0c4-2712363fa6cc", "comment": "Malware payload (Amadey)", "value": "7d44653141f9b334e6633083ae2818a7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272111, "uuid": "2db5126b-e24f-46ae-a047-41de3a079e2d", "comment": "Malware payload (Amadey)", "value": "a9600894bc127ef809208ae0307f46a7957edb30c29dc7b8bed20939432f1aee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272111, "uuid": "949762fc-ae00-4c03-bd06-c5039f8a6b0a", "comment": "Malware payload (Amadey)", "value": "315a4959eda35f36c3b25e0344e886b221110aa1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272111, "uuid": "d09d1a6e-4e76-48ba-9c67-ffaf00175307", "comment": "Malware payload (Amadey)", "value": "2c7d9ce4371e87fa833e3858c093857f2d5c47d694ea75bf15c9dcb9e0ba518fda661e90c17b6c390335495a39572ba2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272111, "uuid": "fdae2f16-45bd-4c2d-b6ac-04ad0dbc405f", "value": "T170F4121BF6E89132D9B5A77009F603C31A367D615F38835B73CE6C1918325B4A236B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272111, "uuid": "dbbf9d97-0497-4056-a2dc-e9a9a5284807", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272111, "uuid": "ba792d52-d073-4961-8145-5667e17d3bbb", "value": "12288:TMr/y90otq4H6akzQliK1oDhep+QBeJRFvG7m1kqF355qeHPNVm433:oy7QnmoDYp+dzumyE35YYPz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272111, "uuid": "35b97ed5-5853-41ca-ac63-6f293da5590d", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272111, "uuid": "a06189e2-91d5-4c69-a647-2650666806ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272111, "uuid": "5f03c09e-652e-4be1-90a1-222398d86e49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28f8450e-ab9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676291411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291411, "uuid": "8fb81d1e-ed1e-466a-b3f6-112e422af2e9", "comment": "Malware payload (Smoke Loader)", "value": "ffbe671eefd2a3ef081205fe8a3d2095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291411, "uuid": "f75d2963-2f3c-49f0-b861-8555a9fe2bd6", "comment": "Malware payload (Smoke Loader)", "value": "a97e9b6b2d782625ccd00a2177e55c75f6e6dc87d9a33655e521ded0369b5306", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291411, "uuid": "5c68f714-aec8-4004-b412-c7f053fe50a3", "comment": "Malware payload (Smoke Loader)", "value": "73fe6a35bcd2355d87beb89a47997fc4d25c4521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291411, "uuid": "210cba7d-746c-438d-be54-cf1322e78929", "comment": "Malware payload (Smoke Loader)", "value": "b5eef001b6b693ccbe40259e6919ea7826bb77fd8f1ad4696df44af65406b3e5c7afbc0db6b1b7aa238b425fc3bdaa73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291411, "uuid": "5ceec7ee-f639-4e4c-bcfa-ca6049594ee5", "value": "T12014CF2332D0E872C472C6316D69C2F46A7EB8B15E78699F77581B3F0EB02D19672352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291411, "uuid": "3b098b11-ec9f-47a3-9a63-a617607d342a", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291411, "uuid": "29401141-1d8c-46d2-b2c7-3b29e54618a9", "value": "6144:XpAx9OIQPPvqlNJHWCf0hNP4o67dBV9u0:XpADJ2vqlNJHrf0ngo6BBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676291411, "uuid": "f3fbc81a-db41-42e8-85ac-b4e8f265b953", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676291411, "uuid": "cdbd9ae7-8922-419b-a5bd-47fc75f8d8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291411, "uuid": "b794b8d7-7fca-4f09-80ba-0942e8a977b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf04d97e-abae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676300280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300280, "uuid": "8fcc078b-851a-4c07-a715-0c4f69c9ccd6", "comment": "Malware payload", "value": "b5090687f985d6b6c1fc929fef285271", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300280, "uuid": "81e78b76-ba8b-4435-aa4f-60add7edb77b", "comment": "Malware payload", "value": "a9b245cfca99a6e8e9d424dc4cc0f0811cfe2d0be5e1c8721b2ba50ce10c276c", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300280, "uuid": "4073c9bc-c07a-4def-8e7d-5174b2a517e2", "comment": "Malware payload", "value": "5653eccd0ae427c7e854795ec007e63c397bdd9f", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300280, "uuid": "1acb5e43-d734-4fb0-8fc5-855405a1340b", "comment": "Malware payload", "value": "7433473abc24f17d0dd7582a6257f4d8fd723b5d8206228a6dcdc929dfdcd3e5a826b88f38df145b4c0ba1a7c7579a07", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300280, "uuid": "b882f02a-d217-4fba-ae82-7d584b1c4278", "value": "T135717492C7B594FBE519033F5113CD9D327C27209361474D1764692F2852E92BD44972", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300280, "uuid": "ccf4c80a-f4f9-4553-86bf-4373549b52d2", "value": "808b7829622780b812b9cf702c1b652e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300280, "uuid": "81369363-10c9-486e-828b-d315f0dadbe5", "value": "24:e1GSSuqmbORJ2aPXDhljd02s5wgJ2Aum+uXwxn81zhehN8sV3PnRuV:SSuqCJaPzzd0OgJxW81zhehN8CRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300280, "uuid": "02948a03-2a7c-4fe4-8ef8-aff276636703", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300280, "uuid": "e56510d9-2c7d-4798-b5d5-aa8ea537311d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300280, "uuid": "371fac2e-4481-48cd-8fbd-0ae0c8f5c406", "value": "Quote.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35926bc9-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299593, "uuid": "ab95e259-aa0e-4657-934e-ec6f16568b23", "comment": "Malware payload (SnakeKeylogger)", "value": "11eb5cac6e0b51e22880225b464b1391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299593, "uuid": "44048c62-4b31-4ccf-bc03-f47cd16d451c", "comment": "Malware payload (SnakeKeylogger)", "value": "aa1ae5f4ed9446576dbd7af18510705811dd7ce85bd06bc0ed988d65e855b963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299593, "uuid": "2ef9824a-a92c-4c86-91c1-073313c8898f", "comment": "Malware payload (SnakeKeylogger)", "value": "ee6a5a302957fe78b00d4d31d67651f12c4728be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299593, "uuid": "c4ca3636-acfd-4a77-8aa3-158063ecb66d", "comment": "Malware payload (SnakeKeylogger)", "value": "17f3b027573a89e975225c145ea0d6c0a347c267db6d4670a3e88acf26c97e279f902c9676bf68e00aea0f20bdd9e648", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299593, "uuid": "17f80cc8-a091-421c-a7b1-44891cd0c090", "value": "T17554120169F08AA7FA52CB720D7C972B6EF9F21588562F5B17508F4DBB67903A30E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299593, "uuid": "0e707c0c-0933-4a43-ba48-eac36f7f706c", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299593, "uuid": "fdc31c5b-2b0d-4bd9-81d2-8a888aca9de5", "value": "6144:4Ya6KDmzD4J/VRI/WWspbdZxBOOb1xAEYC27wleaW6:4YMWD8N+WWYrxBdb1xrFW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299593, "uuid": "b4732c60-c595-4d53-a714-8e3f3c4c99da", "value": 284609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299593, "uuid": "83dee0b4-fc57-4aac-9586-6bec804abb41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299593, "uuid": "c721b71b-446d-4e95-a85e-0f324575ebf6", "value": "INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5640b6c-abbf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676307538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307538, "uuid": "45c4b6ea-cac0-41c6-ba7c-faccbccc72f4", "comment": "Malware payload (Amadey)", "value": "20e011abdb5d492491a787420cb8f720", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307538, "uuid": "12a55c98-a9d1-497c-80b7-2444df7df5af", "comment": "Malware payload (Amadey)", "value": "aa3f20064190a225bad7209ce998a86249c6722854e8ea674080a63323de9161", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307538, "uuid": "0ee767f9-7e10-4cb4-b3e1-3357698ed17f", "comment": "Malware payload (Amadey)", "value": "e0f6ccd4686f1f17e51871e0b0e1a68ed27c610e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307538, "uuid": "0667fe1e-e7ad-47a6-a8c7-96475dd69bb7", "comment": "Malware payload (Amadey)", "value": "00d900c08583a1ea66ad4275c7c6b9149eae950041b4c64375038f836d16dc47782792f6369e6bdb3b6d60c6aea25883", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307538, "uuid": "5b953c4f-ca21-460c-8b24-23dc32c385f8", "value": "T16DF4120FA3E86032E97557700DF603D71635BDA01E3892AB278F5C4A1D329A5B3357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307538, "uuid": "7ce9e31d-2081-4310-a85b-133f4bac0296", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307538, "uuid": "2b83c6ce-d36e-4a8a-8289-d89467940a4b", "value": "12288:oMriy90bYjfeDaFPAmHGBejxSijZeJZ3GHVVr5qnczOF+5Whr502ZO:ayjjaBBeFSzJot7SF+Yr+oO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676307538, "uuid": "23c70bb6-83d5-4611-ae16-3e69faaa77bd", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676307538, "uuid": "e325b521-4dfe-407e-9a0c-e4134b1f2e8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307538, "uuid": "74656945-4450-4a1b-b459-dee79c585d94", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a69e8c18-abd6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676317392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317392, "uuid": "a8be7eb5-6493-4c12-aa97-67b739082e17", "comment": "Malware payload", "value": "2d8abdd2097d5f098f432ce1b32b2c5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317392, "uuid": "0d936c9c-5db7-43d6-8cc1-521c0b8ec35f", "comment": "Malware payload", "value": "aa5ddc6b84299545da8c1ff54902d2689815edaf3f59784499c21fff1acb64a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317392, "uuid": "2032d900-c703-42c3-90da-fb3918628be5", "comment": "Malware payload", "value": "6f0c12a087ac597d507111a236fd4711c78a3fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317392, "uuid": "a31b6e23-019b-4f2d-a7c5-a5fe2dba7a46", "comment": "Malware payload", "value": "e82cdd3d49995839818d4ffa6cc826fc9af4bae53da8c97d8324ccf48bbf3fc0dbe1863f3decf6db729c1668650a5160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317392, "uuid": "6854cc20-74a1-4caf-9be1-95eb387853ec", "value": "T18A662332622448C1F2FACE39FD67BDE831FB433A9A40547B25D9E1C53A766E09123592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317392, "uuid": "247f2fb4-0af7-4a30-bb70-9354d369ff2a", "value": "e15d8fdaba025278971a192141f26d80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317392, "uuid": "81522a2d-2fbe-409f-9a7b-88cfa397a401", "value": "98304:gK/8BzYk2iIbIUbj0dtzyg+ow41NaD1XQ07PJYMddjH14BwdEpls+gLSGfXGavD:gBx2Wo0dL+oPaD1lTJYijHTdEpdgfpvD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676317392, "uuid": "9a70f638-0c7e-4898-9be5-38e58f65a5a1", "value": 6811656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676317392, "uuid": "0067f1cc-74f8-49e5-b085-8496a5a41fd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317392, "uuid": "bc48c158-b819-408a-9f68-5889cdbeba3a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc4d8dda-abd5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676316999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316999, "uuid": "f8f3a32d-8d7b-4669-87d4-562b47a08c5e", "comment": "Malware payload", "value": "e16b21fd058f1b5563508c3e2a6c3e48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316999, "uuid": "2e647241-7424-4696-aa2b-409ba7459d0b", "comment": "Malware payload", "value": "aa6ed491842a453990f757f8ce077d7b079f869c34c7095a4d70bc817e7a6fb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316999, "uuid": "9652dcc6-8cb6-444c-8df2-67a49be0e08c", "comment": "Malware payload", "value": "28fca8c9a1e8be1952ddc88af2f3d6d6a737008a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316999, "uuid": "c7ad06b4-d314-408d-9ee3-5ddc34097653", "comment": "Malware payload", "value": "8b7691ce03519852efe793699b446abc13d56360aa38478b010164334547a67e61d4e7cb1a632e066ed5c8035361506f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316999, "uuid": "6542ba1f-2255-433a-adff-28a60aa2d64a", "value": "T1A1F4120BF3EC9473D4B623B05DFA03C31935BE514538A25B278A6C4A1C729A4B6357BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316999, "uuid": "71eda0bd-bbca-4c6d-9ecf-db51af6e32d0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316999, "uuid": "e14a37cd-d6ba-4e98-abf0-9d0abfc2e56d", "value": "12288:sMray90Qe4Fb9EM9izyYqFeSlseJkUd6NFIjdDfc:+y/e3zy8Szkli7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316999, "uuid": "c92cd7aa-f98e-4f3d-abb3-36c21d983d1a", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316999, "uuid": "afd8cd90-5423-4f40-8fe1-62f3ef5e80bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316999, "uuid": "4133ac14-9ec8-4792-be3e-4b3e30a9fc35", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02f70aa7-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272020, "uuid": "6242bf04-b462-4108-bc43-73ff6fa94d58", "comment": "Malware payload (AgentTesla)", "value": "b24ed43146a0279c1fe931f2ced3f276", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272020, "uuid": "cee1495d-85d1-41e7-8053-c0f837761a25", "comment": "Malware payload (AgentTesla)", "value": "aac69257da45858aa1a7457a934625a228ee83504c8ee874bd0341cc6c282560", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272020, "uuid": "7142e54c-11ea-4a3a-91c8-5472eefce854", "comment": "Malware payload (AgentTesla)", "value": "561d1f5de85dc29b89f8574e70518170583f8f4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272020, "uuid": "ae191553-72c1-48bf-99d5-4f53bbe44c39", "comment": "Malware payload (AgentTesla)", "value": "f52c282cc8a323b431cc9141ea9af6ac0f06984f147dd47145f79b77343f2a1fb069c9e9686e7285f60f288b32151b81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272020, "uuid": "c7ff0e5d-8d0c-4cc8-8bd0-68e57608dd08", "value": "T1D8F32B2F92C58E56C73D4CB4C8A0315407B2A14B4517E76D5EB4ACF63E867C37E2E8A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272020, "uuid": "68fe8409-6768-4539-9536-b2854755cc78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272020, "uuid": "16e6c519-619e-46f0-b13e-d89111a229a9", "value": "3072:GQgND1K1YSVjDJqCj8C6MTbqMUPlYE4jdfTvV7CODJD:XhVjlSC6Oe2LjdfTtukJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272020, "uuid": "9b2c79dc-6936-4296-bba5-d344b05b3532", "value": 168448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272020, "uuid": "0d0b3295-512c-47a3-bf84-01a0a113e043", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272020, "uuid": "a6c1e45a-0baa-4cc2-9938-f12e81b233f1", "value": "aac69257da45858aa1a7457a934625a228ee83504c8ee874bd0341cc6c282560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45545cf-aba8-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676297739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297739, "uuid": "787d86f7-c4e8-46a2-b84c-04bb6c6a9799", "comment": "Malware payload (GCleaner)", "value": "ca165a346ee67838519254f8688595b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297739, "uuid": "f3971e2d-1b48-42aa-a127-8807cb2202e8", "comment": "Malware payload (GCleaner)", "value": "aaf54eee0035c256f677a616c304aa2ca6b2f3a590704c968bae3a569ab91ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297739, "uuid": "bacc4bfc-7c84-416b-910c-3f608756272d", "comment": "Malware payload (GCleaner)", "value": "45701fe69543a980b284e6bc0f4cde050dae5086", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297739, "uuid": "295f3075-440f-4576-b305-c3e71b2cf13e", "comment": "Malware payload (GCleaner)", "value": "bd0a577130b152d80657ca2cdaa2fa067b4ba747d9df99cf40bec82b6e2f127b09d844623c64fcaf4ac90034edcfb296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297739, "uuid": "bd77237a-c655-434a-8a7b-fc0b56574164", "value": "T151E5127C7504C56DD280FEB4C83AD4E75CD6AEE3DAA4A06231DCBF3F5279288561A243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297739, "uuid": "5afe96a5-181e-47e9-b1fa-f43be9b03176", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297739, "uuid": "8ae311be-5c8c-47a6-bb11-787ff4b3075a", "value": "98304:JHgSgBpmDhMxoOqV7ApNA70a/JJDVs0v2MR:dgh3mqxoOqV7ApNA3JJDtvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676297739, "uuid": "21523df2-c0a8-4170-abce-5d77308d975c", "value": 3319831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676297739, "uuid": "c11d26b8-3e83-431e-86e1-5e4998be8469", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297739, "uuid": "b3701a21-fd5c-49e4-83ec-50ad2139ec1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26457eee-aba8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676297420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297420, "uuid": "7e9653ec-ca33-4331-b8af-139ed165826c", "comment": "Malware payload (Amadey)", "value": "7c65c755b5768425c8f17ad61bf5901e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297420, "uuid": "2f77c987-7557-4876-b666-81b3c62aa2ae", "comment": "Malware payload (Amadey)", "value": "ab6612691e4d6130d1e6dedc90f5cd75c05a222c7caaafb89f6482fb11aaf218", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297420, "uuid": "34b3d833-e266-4edc-bbff-a78cfb0f529f", "comment": "Malware payload (Amadey)", "value": "86fdd96375b132613462a66dea5b715a4b8e8ad0", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297420, "uuid": "38454c4f-43ee-4f71-bf24-bf91f18dee78", "comment": "Malware payload (Amadey)", "value": "11525aa2a4a098575185a3df6404d94d01e5b9dde5a46c5055561e0368a117c7c77f4bf903986bc5fafe28aa6683646e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297420, "uuid": "8b99e6ed-aa86-4502-972e-1ddb96854cd7", "value": "T1AFF4120BEBED8132E8B067710DF702C7193A7DA14B38829B278E6C4A18725F5B535767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297420, "uuid": "b2f0981d-9048-4659-ab99-ea6d153e1c9d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297420, "uuid": "3b756db0-4064-410a-bfb6-fde3f0340c8f", "value": "12288:LMrKy9081jiTSFjCEmYkG5SThsiMeJ735q5+KpwhMU4teQ9NSdjfZK:1yxsTCwGzQ7pq5+4EMleQ9NOfE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676297420, "uuid": "9b49c3ee-46d0-401e-95ff-80cbb32f12a2", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676297420, "uuid": "9bcb76fd-97b9-4520-ac82-96cabfb453dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297420, "uuid": "ef54abe0-0c10-4981-a235-699a05480df3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2f8447b-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676277040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277040, "uuid": "90e014b6-10ee-40cb-91c8-bdeb63d27645", "comment": "Malware payload (Smoke Loader)", "value": "5b42d9c07fc801c795b7b9c749d241a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277040, "uuid": "76a046d8-5548-4e4f-9e8f-2f109e4a3732", "comment": "Malware payload (Smoke Loader)", "value": "ac0be227de529682141ed29af472483abf7f10527b22aabc2ea3a81fc30a0a0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277040, "uuid": "00bd2a69-aab3-45c5-a234-237942194de2", "comment": "Malware payload (Smoke Loader)", "value": "1d7c2d9c7f0bc6ea0a508a8d4ee2a89e05123909", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277040, "uuid": "e8ecfd37-9705-427c-95c9-6ce3bc6db052", "comment": "Malware payload (Smoke Loader)", "value": "b95a826fac60974b8ee8a5567c9b9b0d8ec98eed44d9acfa736072826cda12b0d75d98352852a381193feac2e7c1bb36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277040, "uuid": "db237e48-2e5c-4b24-963c-bed980292711", "value": "T1C814CF1332D0E471C03256325D39C7A56B3EBBB54E7866AB37481BBE5EB02D18A37391", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277040, "uuid": "2438c643-d9b9-4bea-b2f5-3b51958fb86e", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277040, "uuid": "2bcdbe14-443d-4c80-a0d6-fc8061f108cf", "value": "3072:4zfQVaZRSbTK48S3vbpA8C9dc/Z0VwBV7mRgXC7kWHnzLnE1v6oXO5Kl1I3I:4zfmamKXS3vbpA80dc/ZRV7GQWsC7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277040, "uuid": "85fed34c-887c-4872-a44f-8407355561fc", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277040, "uuid": "34230bf3-3fac-44b0-aa60-8882d285ed40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277040, "uuid": "f1a8acde-de0c-4896-9c04-d4ce9ee64d34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e81889-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676280887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280887, "uuid": "6c5a73cd-6d8c-4d08-82bb-3efeb2de3854", "comment": "Malware payload (RedLineStealer)", "value": "14f732cb05dbea7f013dac01f365bda3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280887, "uuid": "12fd6ce4-8798-40c1-8cbd-495b2ee14ca3", "comment": "Malware payload (RedLineStealer)", "value": "ac90f0dbbbfd17dd4b5bb75a3014aa91e85ad4481381b92869359ed71e15b4e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280887, "uuid": "5b7d562f-82f3-4907-8f94-e0762a0be796", "comment": "Malware payload (RedLineStealer)", "value": "6e290932e9d14149dd912782df18ef8270c0264b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280887, "uuid": "862c2168-1d96-44d5-a558-47ff6e1c2a5a", "comment": "Malware payload (RedLineStealer)", "value": "a69452dbaefb0b0a192932902f4f4ff03ce9c067cafb5eb8b921986db8b812b44a55da10d0c4da4d50b5f9ff5b34f745", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280887, "uuid": "efa8ea46-081d-45d4-91c8-8597a4ecc065", "value": "T138F41207B7EC8421E8E1677009FB03D726397D509E34936B578AAE595C326A5E23832F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280887, "uuid": "db4725eb-f715-4424-9db0-5243bd1dfb83", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280887, "uuid": "a8752c5d-7d45-4ad1-b11d-7734af613317", "value": "12288:+MrBy90xogaJTvfsOkgWpSvtHoeJdNbwnT3XYc3cWXt2yI:XykaJTvlHvjdNbEruWXt2yI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280887, "uuid": "bc68d87e-5374-44c4-9efa-3c9e10938966", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280887, "uuid": "a9e98285-a003-4f68-a871-8ca2ff207d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280887, "uuid": "102eda87-d770-4b77-b139-9680e1cb0f6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe4f9e7-abee-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676327689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327689, "uuid": "3243fd44-9546-4fde-b2a7-f5512cf7390c", "comment": "Malware payload", "value": "cc87afd21be3c5cb0efe88a99b8e274f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327689, "uuid": "bc13d044-e752-49fe-9267-71386f9d48c8", "comment": "Malware payload", "value": "acc132d51ee2389e6fc498ed53b513d36f2567c52201895b6453b3667e847998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327689, "uuid": "1599c75b-beac-4fb0-8f37-fc17fc23ef99", "comment": "Malware payload", "value": "209fb53d38b9c0cc7872a378d02f08a0ccf3a4a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327689, "uuid": "781e9400-9ce1-4d16-9b2e-76486779bd29", "comment": "Malware payload", "value": "f066c462030e2216c723bd06277da0e2be02b2cba4220d8137ab955dd4a1f35753a6c3962e1164b866c1c473bb831089", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327689, "uuid": "2d47e929-3251-4989-ac2b-935882d1af27", "value": "T1DFF4120BB7EC9022D4B9377018F707D31A35BD505738475B138EAE9A1C72AA57632B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327689, "uuid": "67333fc7-9c29-4408-911e-cce9bdac9f5c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327689, "uuid": "c4362c0a-7c9a-4e23-8486-02bf2c3ebfea", "value": "12288:3Mriy90ZK6Dz9r1eOVExy32T64cvnReJrdD+uglc+uW8OPkBsf0j8t:1yY2dxy32T64ca4b2+u9wPfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676327689, "uuid": "7d63b46f-2c13-4a3c-821a-6bb9a7bb4fe7", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676327689, "uuid": "65901f99-662d-4a5e-85bf-d0662ba9466b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327689, "uuid": "5cc21e88-d3c6-4783-ba96-5c6eb4ddaf55", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990e8761-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676301048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301048, "uuid": "0de1b758-3cd1-45e8-8b35-8f8b3e82f742", "comment": "Malware payload", "value": "089a8904cb38d86723136ade0f63096b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301048, "uuid": "f0582aea-b4b8-41c1-94bf-ba07c01a690c", "comment": "Malware payload", "value": "aceaf89b1b9a0a796605906b645121582afd8ea403b65de5147a03ea1d36d47b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301048, "uuid": "179ce3f9-6b3a-4819-8f46-a5a2b8a1ef0f", "comment": "Malware payload", "value": "9b4221b3f5219d8c029db56f33ae680dcc2140d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301048, "uuid": "d9e64a76-cec7-4275-9ebc-850af4679175", "comment": "Malware payload", "value": "08c5ab1038ca810d08abdc9188a9c28a8781b451ff262cd099f57300a16c802320338e65c9ead989952a328dda79862b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301048, "uuid": "6fc8114b-d7ce-41ad-879e-880789b0d358", "value": "T14B95E06910AD42C8D2BDD0688A86650FF3F4BCC56329CBCF586149EA1B236F5777F290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301048, "uuid": "1ade1c49-1178-4d77-82a9-91c7ff42e69a", "value": "24576:VeeYql/FhIMp2uujwvTRa3j0Q2TVqck0BGy1zZDbyB68viSFzdY8lJ:Vv08Ro21Buke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301048, "uuid": "9fa42391-f938-46ce-83c8-f6ee6e7e78cd", "value": 1937165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301048, "uuid": "26482ee5-3ffb-4d32-9bda-f63ae7035e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301048, "uuid": "079f9ea6-0a6d-4802-b374-4c3110900529", "value": "089a8904cb38d86723136ade0f63096b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff32231-abc4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676309811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309811, "uuid": "c3a004d5-ec35-4c7f-ba35-3842c1f5dbe0", "comment": "Malware payload (Mirai)", "value": "b84c01783bc70e1a518ca47c9fcd78cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309811, "uuid": "5fcbc290-e023-4e8c-a57c-e6c961c1155e", "comment": "Malware payload (Mirai)", "value": "ad23b998d3d9e79708fdd79122c18ac4e8c15c00fc69742ccd3a4ed71b08bbe9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309811, "uuid": "62b9409c-6071-4ad4-9868-925a8f43c6de", "comment": "Malware payload (Mirai)", "value": "33f7e02873bee85d3d6c23b86db8697fa0d44a3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309811, "uuid": "c6ae8c63-7521-444a-b541-55483854ea76", "comment": "Malware payload (Mirai)", "value": "4a32f9d204d12e505f10cb3d8d341229935a6d44e5d796d24993857f7d704cec4ef35592575796d96e5db57b5de7e315", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309811, "uuid": "7cf4a6f6-b39a-4e32-a651-2407069037d0", "value": "T1C8E2E084CAADC3E0E6BAB53530DE7C0E0E3BAA5DC51449F7A7CC442294A2E59572B253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309811, "uuid": "ab4b76e4-0eba-4a89-bee4-602fa79e8501", "value": "768:zMdQo6DxGSZQGuGaC6s45ilaNk26OzSp8nbcuyD7Uiyq+:ZvFGSZQWr457kDOuWnouy8Zq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676309811, "uuid": "de8c9e7b-8f83-4f01-a197-8e0b6d13faa0", "value": 33016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676309811, "uuid": "34b9b881-1591-43eb-9007-ea00bfe67b04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309811, "uuid": "4e768320-31a9-4325-9eac-8a98f6975e24", "value": "b84c01783bc70e1a518ca47c9fcd78cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1f43d7-abc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676311420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311420, "uuid": "a91439e6-8fef-4d70-be5b-f711ac42e495", "comment": "Malware payload (Smoke Loader)", "value": "b0b9ce55fcaf77e380620a6f405548bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311420, "uuid": "b437d5c4-46a4-4f6d-888c-47fd0e8f615c", "comment": "Malware payload (Smoke Loader)", "value": "ad3ffbd78bf2c43edd09accfab1589d1d159f0847ed234ef51728f1bc979fcdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311420, "uuid": "1a827c32-bf08-4e39-9e48-8a37cde61fbe", "comment": "Malware payload (Smoke Loader)", "value": "d621e50856b7a2838198236dafa763ac9439b4f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311420, "uuid": "8ad70097-4c03-44c3-88a3-97001236f7e1", "comment": "Malware payload (Smoke Loader)", "value": "3bc57ac819f4fbe482955e3571a6b7bc7d2f4b01cdfefbc45d803757fca7da71a52e3ca4a231ecb9902e4e152e30e473", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311420, "uuid": "f6573b9d-0354-4c62-9d58-b1a80babaf5a", "value": "T18004CE2332F09871C0621A315D79C6F1366EF9217E78968B7BD42B3E0E70EE19A76351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311420, "uuid": "0c79e2e7-7c84-48f6-8f8c-0303a8bed92e", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311420, "uuid": "b73ee20f-2227-4554-9efc-0a01e4147eab", "value": "3072:OohmDZvrSPZqk7ATVfeJhjTidAXt3fjDuqQw7703lqE/O7dmS/:OimFj+ZN7OWJhjTWCcEqlqE27I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676311420, "uuid": "b92714ea-4ddb-481d-a563-a851daf19877", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676311420, "uuid": "d1ecc8b3-7129-433c-b2d2-610e8300918e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311420, "uuid": "7086e3e8-e785-4123-974a-ff4eac67f683", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e740b3-ab3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676252354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252354, "uuid": "5008fc8f-600c-4b8e-b612-72da1826e1b8", "comment": "Malware payload (Smoke Loader)", "value": "3b6cc62392688dd7479957780b3509fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252354, "uuid": "2d3d8985-c4d3-4efd-84b9-dbe3f57619a6", "comment": "Malware payload (Smoke Loader)", "value": "ad493c1ce8bef7d86e047baac8324e5bd5fec0aa83fc9303ed7e131c04cd0a3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252354, "uuid": "4e6199bd-81f1-42c0-a09b-07902c02554c", "comment": "Malware payload (Smoke Loader)", "value": "2fe3b587a5dfef50692a685424940d6ef5420ac6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252354, "uuid": "82007d66-11bf-4f75-974b-a7965568be1f", "comment": "Malware payload (Smoke Loader)", "value": "727a8cdc0b873079bd607a7f26bd2026ade7b0339e3f27719e7487be6673970cb57f9fdd7c5461989c179f05e6adec55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252354, "uuid": "8a2b4ce4-127a-40f5-bb02-5579f6f562d0", "value": "T11A04DF12B9B1D073E1A78D712630D1A0696FBC31A7A4C147B35426AF1EF07F18AFA356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252354, "uuid": "5e655304-42a8-43a2-ab57-5c52d9f6c2d3", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252354, "uuid": "edc3ca64-daa8-44d7-9efa-1f3db47f9ce7", "value": "3072:Vkbuk6C35X8dTvZqOMcIV4YSe6NQqUazgQNWNdole:VxCBqZTIV4YSeaUaQNde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676252354, "uuid": "f7bfa9a3-9506-4e09-9225-e41a23ee01ac", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676252354, "uuid": "c2132b86-b348-4b1b-a29f-25ea2615f44d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252354, "uuid": "e704b8f8-bb1a-4c0c-b355-cd5acf508b69", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e16810-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676301065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301065, "uuid": "1fd989f7-3ba1-47d2-9ad0-b802b36d1a2e", "comment": "Malware payload (RedLineStealer)", "value": "91fd1e884074fe60157d77f40a164898", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301065, "uuid": "12ea8711-3240-4410-8ecd-357c46c60bec", "comment": "Malware payload (RedLineStealer)", "value": "adc5042b9a43b86f3240998bc0c5482d2fe700cf996446e67d8d3c64876fc905", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301065, "uuid": "b0613e2c-28ce-4b7b-b548-3e8aab396b65", "comment": "Malware payload (RedLineStealer)", "value": "622047947bcfe78a7fcaf6dfc868fd1f13b3e16b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301065, "uuid": "77ad6d54-853b-4adc-b64f-21ca1218f9ea", "comment": "Malware payload (RedLineStealer)", "value": "c3c6d2573373acad2c23489a162560d07dda1b6436c086c6ae076cee4886a2efa8d041bbc131b9853f5fb9dc11d61de8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301065, "uuid": "e1cf2a5b-a5f9-4b6f-8176-1ba1d8cdb021", "value": "T1C544E02373D0E071D46216309D29C6E47A7EF8717EB4A93777461B2EDEB06E09632346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301065, "uuid": "f2ce5fb0-47c1-4742-a02e-f51196944c43", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301065, "uuid": "4742b207-78b2-4c50-9136-05010237adbe", "value": "6144:bzfWa0KvB5PctK/XFRseKPMliNzs/4kRV:HfWQXPctK/1Ge4y2s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301065, "uuid": "f1b22c3e-e01d-4697-905c-4f4b98a00011", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301065, "uuid": "5cdb25d2-f7a8-4d80-81d5-ba782e7138fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301065, "uuid": "859af9e3-bb4f-4964-bb54-92a8a6efba7d", "value": "91fd1e884074fe60157d77f40a164898.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c49c52-ab4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676257288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257288, "uuid": "f487a475-f2d0-4193-8acd-c90d972a3e52", "comment": "Malware payload (TeamBot)", "value": "80b50e333e346fc877328d1ad3e2c0e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257288, "uuid": "a8ee20b2-1ea7-4204-99e6-37c3af572326", "comment": "Malware payload (TeamBot)", "value": "add69770f4358bdab9abf79757b3f9e8dda2e183c6c08e575ffef62d25671c15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257288, "uuid": "541209b7-acd4-4d29-88c6-52ed0d080b78", "comment": "Malware payload (TeamBot)", "value": "dc968b26bcd01cefb79a5865087b3f872394e29f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257288, "uuid": "bdad07ec-5905-4b03-adc2-5508fed5b293", "comment": "Malware payload (TeamBot)", "value": "3570737caa89654794505e2566806b43e2378dfd9617097ddbfb1318284305906bcc09dd6ed1c4bf3d1e4cd542fb2e74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257288, "uuid": "d9981695-8e7e-4de6-a78e-00bc8ce92c09", "value": "T1C504D00275E1C432E557C5755831EAA06A7EFC72ABB0C0CB33441BAF2E316E19B6B356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257288, "uuid": "43ce3fa3-1d3f-4f46-9876-beb15e9c597b", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257288, "uuid": "1a6aeb98-52e9-48be-a269-d4e5b102d864", "value": "3072:Q0ovZm35XQfcNDgG60Lk4n+MN6RszRAzbp5s5k:QZmBPgGFHGszu54k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676257288, "uuid": "ca5dd7f7-9773-495f-9b98-e18d339f3297", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676257288, "uuid": "17ea968c-1047-446d-811f-361df3e1b95b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257288, "uuid": "afa28cba-e3d4-48d4-ba9f-c0b4864f5fb5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e3d53a5-ab38-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676249303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249303, "uuid": "bd4f4005-70e3-4a87-88d0-468846902d2d", "comment": "Malware payload (Amadey)", "value": "08b243150f13d995e630e408c00fd970", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249303, "uuid": "0f4f3f54-c7b3-481c-8f10-9c71fb6587b8", "comment": "Malware payload (Amadey)", "value": "ade51e60731579d049da4a233d55e758620cf1addb93fbc39b60a9af2ee6496c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249303, "uuid": "e2a136d6-f86b-4842-8f79-d216f6c392aa", "comment": "Malware payload (Amadey)", "value": "53a6d4b8e93009e162c3d2434704583b3354acbc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249303, "uuid": "ed2ff072-8f33-4b67-8965-b2e1ad0103d9", "comment": "Malware payload (Amadey)", "value": "e35b98b662860da5a435c1c5a5a7e8d8989a84a8d7957d81856c6e6122eab8064c043b57c6bb60ea5b6b23e3fd184daf", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249303, "uuid": "e2aa29f0-215f-486c-b9ce-c3f168eaa748", "value": "T187F4120BB7E880A2E8B4537059B643D31E397E521A38835B679F5C590C72BF1B2357A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249303, "uuid": "2579544c-ed1c-41a9-86d6-c4b4efe3dc72", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249303, "uuid": "67d4af48-1baf-4c70-af2c-f248ffb681a9", "value": "12288:JMrAy90+Sx6FoKGG20Kuy8U8CABBeJ3uSxYU6q9OUQn7cbi+:Ny2x6Fd203JtgdxYGQn7yi+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676249303, "uuid": "e5e74d51-9cfb-4411-b45a-6cc5e74d9c46", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676249303, "uuid": "4ac6b677-fe51-41dd-a812-5c9820f44c46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249303, "uuid": "6803d993-11fa-409b-9739-289dc6684de2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39deb9af-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299600, "uuid": "909357e3-ab4e-4709-b48a-2f8cf0a70e63", "comment": "Malware payload (SnakeKeylogger)", "value": "6f4cb9c2ccba214a55ed2f72f12bdb57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299600, "uuid": "486debe3-16fd-4d9b-9724-b4e73788ddd2", "comment": "Malware payload (SnakeKeylogger)", "value": "adfa6855e5e2e2084a7e3020af97dc346abd7c5965aec201fd5275f400be038d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299600, "uuid": "895df6c1-eb69-48cd-b093-090061ae23d4", "comment": "Malware payload (SnakeKeylogger)", "value": "b7d5c8183728eaf5cccfaa6d3bf9e1be2749bbdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299600, "uuid": "55a2dba5-8c43-4c6e-8e8e-797a6e9dbc5e", "comment": "Malware payload (SnakeKeylogger)", "value": "52ff52b5278179ad530659c385891b2df65849f517675dc1666c9a76ddfa820065cab208e825902d6e14174901ee6248", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299600, "uuid": "cea5946a-40db-441b-a99c-76b656507006", "value": "T187A4F7C118CFC40DC35E3633A5E1C52968D4CA32645B632EB31AAF8EF43BB4A574E659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299600, "uuid": "736a652d-bc9c-4c06-90f9-019338afe265", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299600, "uuid": "60fee784-5656-429d-924c-5ef83e4ebb08", "value": "12288:sYjpFXxHYDPmkS/FsUBfrzcCYnNXjmmEl:sYd4uJ/VBDz0Xjml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299600, "uuid": "b1bc8985-ce43-4ed9-8d42-66ae82fb5668", "value": 473048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299600, "uuid": "e983be4b-1100-4689-a45c-a29f8f4d2c5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299600, "uuid": "4601eccf-fe47-404b-a8be-eaf4f14c8000", "value": "payment.arj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183e4ea9-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676280646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280646, "uuid": "bda3596b-3303-4552-b4b4-10a5507c6635", "comment": "Malware payload (RemcosRAT)", "value": "fbf7d89f524698b90d05e23e73fe1de9", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280646, "uuid": "fd7743d5-19f2-4991-a613-eae260dfe379", "comment": "Malware payload (RemcosRAT)", "value": "ae38cc19bf92dad5883251e38b103efab7682a5809af2053d7325629849a8214", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280646, "uuid": "82d21727-298c-455a-a7ce-eb02850b9202", "comment": "Malware payload (RemcosRAT)", "value": "157329cffcd701a13c1bc82f8aa1aeceab9f4431", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280646, "uuid": "c83a2e7d-7624-4566-81ab-a1e775fce85e", "comment": "Malware payload (RemcosRAT)", "value": "10f0994178143c4a01be354121bcbdbcd24d6c41e5048fe7a41d1225a8460cc002630607150ab10a141e7ece2c688b35", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280646, "uuid": "9891cd98-dbff-46d4-8fc8-772d3cd58e5f", "value": "T1CEC38E60DB190509892B2B39EE613E44C47A4939633A21F8BDEDE34E1606FDCC67F719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280646, "uuid": "f786418b-1c77-4644-b476-1176bb36a477", "value": "3072:yilPwpdpAUmpU6qz8Xq2q1HS11Bu+DyaDK6QrBRI:yilQpAUWUQzwaBQrrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280646, "uuid": "f2b8cea4-29d6-4b58-9077-b2f958d20db1", "value": 129448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280646, "uuid": "944713ba-8b4f-408f-8728-de9bdb85fa08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280646, "uuid": "db9781ab-b9b8-4eb3-8ec3-1d09ba3f90f9", "value": "draft_BL_132023.pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfeee68-ab9d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676292948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292948, "uuid": "5ead4843-efc0-4b13-b185-2671c478eded", "comment": "Malware payload (AgentTesla)", "value": "a4104fd5a7cc9acdfa2da784c96d9186", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292948, "uuid": "8462baca-550b-47f3-bace-2dedd51eea8e", "comment": "Malware payload (AgentTesla)", "value": "ae773800646505a74d624672b6a3bf5d74c92dc78d7d1fdb9df1842d692c21ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292948, "uuid": "5f40de57-040d-4283-9730-4bf7b9540391", "comment": "Malware payload (AgentTesla)", "value": "c3f2485424eafc12d38005124651cd9a601f162f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676292948, "uuid": "2d4889bc-649e-4bcc-97f1-4b95bf72fb9f", "comment": "Malware payload (AgentTesla)", "value": "a5ddc33e2580b35908023541a84f3d711342a45198d5889a0a77c92d3458010d6a0b2fcf26d5ac31300a6941222d96ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292948, "uuid": "ae5273b9-101c-4395-8236-d0368c8029f5", "value": "T1F2E401503AAE9B18E5BE17F42435B080A3767E0629B5C31D3EC670DE0A36B568356F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292948, "uuid": "2b40c76a-3e71-409a-8a63-808cda516c64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292948, "uuid": "f2da5150-1a0e-40ad-8042-096ff3e26a34", "value": "12288:xuu0jrZh6q6/TKPzG7tzmXebkHE4YBtfPtABNy/pc4X26tsRBIwY606T0T5:xuu0hY/TKPzG70akkrtajyG6sRpYR6T4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676292948, "uuid": "30b4f9fa-3584-476a-8200-dc206252791e", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676292948, "uuid": "e030833e-5555-4d95-bb85-a0d706744d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676292948, "uuid": "f6dcba34-e77b-47b8-aa2a-d581a8be624d", "value": "SecuriteInfo.com.Trojan.Inject4.52580.3165.31161", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d47b38-abab-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676298887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298887, "uuid": "5016b54a-cebf-4e24-bf65-9f6e7932582e", "comment": "Malware payload (AgentTesla)", "value": "c245f014d04a484d2612f4963e05226f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298887, "uuid": "308f1694-fe8f-4963-9366-97be809350d0", "comment": "Malware payload (AgentTesla)", "value": "af2a4df6137e85a5f69a4e5478992d32bee91b7208757879e3b98aba9ec88919", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298887, "uuid": "7762979f-4a4e-4f1f-889c-3ccdbfa9446a", "comment": "Malware payload (AgentTesla)", "value": "f90de5146a34a93eddf87f46810a4dba729237b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298887, "uuid": "eabd52ca-a58f-4a11-938a-753d477d5f89", "comment": "Malware payload (AgentTesla)", "value": "a8e68e230cc99336bc7f246058b0567732acd084899c687cc78d63cb3a1867ba748169d7db7af5b0a9739e1ffd8b0c92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298887, "uuid": "08126f7d-bf56-447d-baae-3c5e34d2bc89", "value": "T178F401403AED5F18E46E17F82471A090A7797E5A3A66D31C3DC670DE1E32B468326B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298887, "uuid": "f89fabcb-9c37-4cdc-bec5-0b9367e112fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298887, "uuid": "5c8f4e01-abd4-4c4c-80e5-ab127c5c256a", "value": "12288:IZid7UZh6q6/TKPzG7nKR5OI6pdieA7d9MWd52P170BNxTpsVwdhmm1TIjWo56NO:IZidcY/TKPzG7oIfieKjMABBNJ2gmmTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298887, "uuid": "d973d676-2532-430d-a57c-7eedd98dc62c", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298887, "uuid": "3ef3a81d-45d6-469b-b341-651dfcf60499", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298887, "uuid": "72b0edc0-24cf-443e-bb6e-7c464b9ec6c7", "value": "af2a4df6137e85a5f69a4e5478992d32bee91b7208757879e3b98aba9ec88919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105337d3-ab86-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676282780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282780, "uuid": "4b71e17c-5385-43e6-918e-0ccf16e1ea2f", "comment": "Malware payload", "value": "8623a1d1247610af78ea40f61c11474a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282780, "uuid": "ffd7cded-e714-4c02-963c-a36f1ea8a313", "comment": "Malware payload", "value": "af31f575ef17908f38218967fbc3c3da3e9058cf8281833140c96f7a8f5f990c", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282780, "uuid": "ef7aaed8-6eba-400d-a327-b6bfb02e9b47", "comment": "Malware payload", "value": "d5822e1c729b84a956439782878a917a35d2248f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282780, "uuid": "70e41930-03d7-40a3-8c73-7fb553089090", "comment": "Malware payload", "value": "cea92b49292f5b5175b1a70d65aba7f2e6fc95fc71d8a0623994025c26b7f4092a4b365337dcef059a25274c2781955c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282780, "uuid": "f99919a3-0bbf-4c33-892c-668fdc7db2c5", "value": "T12964237EC4F3AD522B1089E0D81719D79602D8174868AD7C3BEE9F67F18064DBDEA930", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282780, "uuid": "d5e2a116-fccf-421a-8812-bcb7ff87f0d1", "value": "6144:KobrlntVenNFkCuXxKCh2BIKN33FOCXjxocdeO/8vH682C:VbptVsECuX8Og9FOiKdOUvHv2C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282780, "uuid": "5f12a6c2-9963-4fc7-a895-1eb444abd296", "value": 323729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282780, "uuid": "6ba427e3-52fd-48d5-bf9d-a0403deb254f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282780, "uuid": "ed71a03b-3a18-4e02-b278-3fcb78056b1d", "value": "Wyciag.rar.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fcf0a1-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676301147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301147, "uuid": "c490feb5-b81a-4967-888f-3328fa16ba6b", "comment": "Malware payload (Smoke Loader)", "value": "847df7499a12b558a430705d38bc102f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301147, "uuid": "0b528835-b0ac-494e-b27b-a5cc41de8885", "comment": "Malware payload (Smoke Loader)", "value": "afb9be9201a75b4794d6565b9edcbbbc9419adae67797a52dcbbc1da899b3708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301147, "uuid": "2a8d61b3-d7c3-4bd2-8c61-cdb3bbfbb634", "comment": "Malware payload (Smoke Loader)", "value": "1cb8d00b5c6d59017fcc726752f92a897675e7e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301147, "uuid": "4cb39df5-67cd-41c8-b408-210285d81b28", "comment": "Malware payload (Smoke Loader)", "value": "bda4cef219ed2bbda2dfd34e058f72b2874234293d7a47c2a251b6137fadc88459183b1d55cb5652b880ff5a9d6992c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301147, "uuid": "1bc49c30-7636-458e-b166-b4e7321da05f", "value": "T14D04DF1279A18072E46BC4756431E6A06A3E7CB2677DC4DB33B407AF5D337E18AB8346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301147, "uuid": "6f1a725b-d820-442b-a3f4-1cca30ce0616", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301147, "uuid": "a2da5638-3bed-4f02-81f8-05f11b0a30f1", "value": "1536:qR51PFCTj72kma5XBm19H2dazhHhSVriS52h/+Rch4NxQpUJKJJYvIybq41t0OEo:qJPcL5XBI5YaNHOWSwl3yxKRJYdq41E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301147, "uuid": "2284a082-db6e-4f9a-b5ee-e047a3e7b924", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301147, "uuid": "9f3fe75f-9178-47b1-84f4-9912ebbe34bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301147, "uuid": "2f4e9fe1-b52a-4206-b197-a89934311495", "value": "847df7499a12b558a430705d38bc102f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697072cb-abf9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676332322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332322, "uuid": "4c5cfac2-9d37-49a8-af4a-77f04913c094", "comment": "Malware payload", "value": "d66cf2d99521c145cbc1c5c129f407ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332322, "uuid": "f5e63f3d-5f66-44f9-9bdf-ec62db42e00f", "comment": "Malware payload", "value": "aff301abf0bfc117729128b6ee08ca28a83dea17b526fdf980cf7a65c9ea62d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332322, "uuid": "b4840108-1cae-4f10-ac0b-feaa8eef48a8", "comment": "Malware payload", "value": "6dd5e17ac1c354ab3a0aa7d7e1de2ac4de8f7c5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676332322, "uuid": "554291f2-35f9-4170-a784-e75113f08267", "comment": "Malware payload", "value": "981c68920ff30e18f3f93ea28f5a266b82ca102c1411b82dbb8b7511eb6cf8fdc14d5d812e449bd3f94b61978a5f020f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332322, "uuid": "8bd86bc2-cb2d-4d7a-8533-f250d432abf4", "value": "T160F4121FABFC5422E8F0A7B01DF207D327367E589634816B634A7C9918732A565343BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332322, "uuid": "168679f5-faa5-4078-955d-01d3c898e82c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332322, "uuid": "ccadbf32-3358-49cb-bd4d-6932354ae1a5", "value": "12288:hMrDy903KLktbLz9VhHzsIe4yVk0bRLeJo/ayBCLNmHcrklGyocFHURo:eylwdHneTyZ5yILEDjocSo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676332322, "uuid": "075eca9b-4fbd-4e42-b728-e941370edb3a", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676332322, "uuid": "0f9bdbb2-0d00-43d3-bd64-e6b58634129c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676332322, "uuid": "a24eb946-d8c3-47e6-9f31-fc66da3ba542", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d54e3db-ab83-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676281540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281540, "uuid": "babea9a7-8efb-4eb3-9d7b-e5eb7e4ea29b", "comment": "Malware payload (Loki)", "value": "deaede81e1a63cf78275369efb2f139b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281540, "uuid": "0ed26cbe-c67d-4673-984b-a3b55fd3791e", "comment": "Malware payload (Loki)", "value": "b025aa736501aa8e35c72ffdab8eb87129ee252e5a74ecb9a03681cede5ae077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281540, "uuid": "a299c36b-7e17-49ae-80bb-06028821ad74", "comment": "Malware payload (Loki)", "value": "a19078e8626dad4225df592501f1bacf5d968cf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281540, "uuid": "7283fa0a-d284-4d7e-9542-3566a3baaf2f", "comment": "Malware payload (Loki)", "value": "ea48dc8b9f75d468a6fb8cbcd33c4450bbcb2a04fc64f0788e003ab3f2f4cd77df5fed1474475e9d7af42c881e8d926b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281540, "uuid": "e4d2e4f4-d26e-4ea8-8d2c-134a19547a57", "value": "T1B8E4120B2E1C9713C53987F85D2194B493F26D7464B1F3662C8B3AEF2274BA08867B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281540, "uuid": "0972bc32-18e4-4f9b-b556-00ca81583ca4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281540, "uuid": "57777d8b-57c0-4596-95e1-906a76b78817", "value": "12288:kh6q6EMTYC0ND571Vd8O1StIjkNVaLaojf82O1ogII:kYXRQ57jZUijeKnf87P7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281540, "uuid": "95bdcc43-3ac5-4e3b-9114-9ff529d6521a", "value": 705024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281540, "uuid": "7f17735e-0fda-44f6-bcac-e208624c06c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281540, "uuid": "22cb7311-8e2c-40cc-94d3-b26b5186ed54", "value": "deaede81e1a63cf78275369efb2f139b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d30bb6c-abd4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676316410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316410, "uuid": "da9e7ac7-4334-44d3-8235-9e1fe3b42027", "comment": "Malware payload", "value": "e71892bf9632bc5732ec2d654d6b9c15", "object_relation": "md5", "Tag": [ { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316410, "uuid": "e7dbaa9d-40db-4c40-8c36-2626dd8e8bea", "comment": "Malware payload", "value": "b042b92b14066a70fb2c5be8de844b2d770589ee8910f40b3882f8d9c8be62ae", "object_relation": "sha256", "Tag": [ { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316410, "uuid": "71c4231b-fd01-42cc-8d94-359f77aa272d", "comment": "Malware payload", "value": "54de7688d20cffe53988fbb837dcfb6920b833b9", "object_relation": "sha1", "Tag": [ { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316410, "uuid": "a3d21bab-8fce-45f1-acae-0a985b9c1403", "comment": "Malware payload", "value": "47df6f9e5db97a7842016db1412f3bceb3a4321d2081d48f2226e236d9117db4e7a93f621e5cae71256db60dba595a26", "object_relation": "sha3-384", "Tag": [ { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316410, "uuid": "fefdcd22-7a6d-452f-8541-39610cbdc3e9", "value": "T11AC63B47F89191E8C0ADD175C6699292BA313C844F3063D36B60FBB62F36BE46E79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316410, "uuid": "22a340b7-89b7-46f5-b3b3-18ca2c8f426e", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316410, "uuid": "023b1a1d-f7ef-4351-ad8e-adf9d2b9ac68", "value": "98304:hI3OXp6oUgXINsQ6HVMu1heVvA7yIUEHnNZ9b323Jam:hwODUg6VvKbtHV3mIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316410, "uuid": "788c05bd-453d-4355-a529-b1f7317ebe0a", "value": 11810304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316410, "uuid": "0b993329-1682-4312-b34c-5e29629b5ee5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316410, "uuid": "86fecb07-621e-4f84-945f-5816a4998626", "value": "MsSgrmLpac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1036a151-ab83-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676281491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281491, "uuid": "1a8840c2-39ce-4c25-822e-71956f9ff7b8", "comment": "Malware payload", "value": "2044012d6684d5a87515892ab9eec02e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281491, "uuid": "d1e61ab6-e783-4a3a-8201-75c1542c67df", "comment": "Malware payload", "value": "b0a38f0543ce16eaa98ab1df157a0dd74186ce0778e31a3d36e500f5eae26c1e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281491, "uuid": "a2c544f1-158b-44c6-91ba-6b1cfba2d633", "comment": "Malware payload", "value": "259a9c7e676c491fd7a2124c48d7559443425ea0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281491, "uuid": "64f9d121-bf9a-4350-bf8d-d6b85b37c8df", "comment": "Malware payload", "value": "491f5c7de92450a25d14c8b7bcddf08d570bad59fcbd778b2f61a6d0d03d191f0b70a5fed5963079dda0df7f8eb97901", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281491, "uuid": "1f557f14-e6e1-49a3-bd75-e32695b9126c", "value": "T16EE2BEA9131FC5E8F60412706B487635F65329814350AF10DC62D96CF9EB3BAB6B3A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281491, "uuid": "4f5af303-2dab-42f3-9a67-12fcd58b562c", "value": "768:uuYjLHbXa3v6Rc04/Gn9yXLvTcPPjEnbztYYrPkA:hv1OW/JtYgkA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281491, "uuid": "a9f09d7d-f89e-4e3f-b6c9-63a797858277", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281491, "uuid": "7a9a8977-79e6-46c1-ba7d-1829e4a904cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281491, "uuid": "4efe24e6-fa57-4db9-83ca-9e190a3e7d4e", "value": "2044012d6684d5a87515892ab9eec02e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f1ab30-abc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (IcedID)", "timestamp": 1676308148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308148, "uuid": "11f9ff45-98ca-4f56-8e98-32ab09419426", "comment": "Malware payload (IcedID)", "value": "d332de88116f1767fd5b5dd1389b5369", "object_relation": "md5", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308148, "uuid": "c2d4e7a5-c47c-42fd-a13e-c90902199d33", "comment": "Malware payload (IcedID)", "value": "b0df936105f5f5ccd9a13f4abc6b7e09cf64d8c1513e21dea87883201aacbabe", "object_relation": "sha256", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308148, "uuid": "e4b222a2-4619-4802-9043-f486a5fc0d29", "comment": "Malware payload (IcedID)", "value": "57568cea1f2ec6f825d14993ceb12c38e9f0af86", "object_relation": "sha1", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308148, "uuid": "1583713d-4994-401e-9551-6e756b4257e8", "comment": "Malware payload (IcedID)", "value": "ad17785250ff6ef0f378ff54804e6dc3216de0a618edd11e4c9ea3aa3042aa707e648f6b9d0ca83a33da909d8e9c8d01", "object_relation": "sha3-384", "Tag": [ { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308148, "uuid": "ba269694-ace9-4db2-a9ae-83d864af4e7f", "value": "T10423D015E0988CE91FB69A74E047E80DB807F63787DBBB78D832A7C5B041D9A93F1191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308148, "uuid": "7af45d08-43d9-42b8-9311-dc9a9280e330", "value": "768:fje8aSVurhcJIDxX96mOQyfX22xEsIxVgXFTJMpqK7A5KPYAyq+KnSo2:LBurSIDxN6mOJX2k7Ie9mmM2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676308148, "uuid": "347d0dbf-2c7b-421c-9a1f-07e7b2af1ca3", "value": 47655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676308148, "uuid": "603dabdf-d62b-468c-a76c-b459ecc5728f", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308148, "uuid": "9a5e2edd-d241-4dcf-8750-e3b92823ceab", "value": "INV_Copy_02_13_#99.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31ca6ae2-abd1-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676315049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315049, "uuid": "ce1e3d9a-da58-4b34-80f6-7715f027c51c", "comment": "Malware payload (TeamBot)", "value": "f550f0743a78a74f2a449ccccc9878fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315049, "uuid": "3f74ab95-0092-422f-8fda-aa815fe1b0e6", "comment": "Malware payload (TeamBot)", "value": "b0fcdede2b3431f2f8ad1805fcd55afd26bead2bad2b978d76eda5b35efa7c40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315049, "uuid": "9cc7434b-c422-4168-874f-4269a4a74b47", "comment": "Malware payload (TeamBot)", "value": "9155c756c361ba3754926d16254d35b68f20ce60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315049, "uuid": "24fef12b-f656-464a-a6d1-6a16a56fd762", "comment": "Malware payload (TeamBot)", "value": "5d58d84c96626fe9640f1850f2c79e6cec1b24dc583715b54170a87f431f095fef7b4bec339b294615c1b41863e3c810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315049, "uuid": "df33d200-e376-4c1a-85e4-f873008b3546", "value": "T14D04C02332E0E472D46616319C69C1B17A7EF9110E786A8B3FD85B3F0EB02D19A71F52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315049, "uuid": "fc68a2bd-b952-49ad-a9ff-1aaec3693314", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315049, "uuid": "ce26315b-52e6-4098-9a1a-25df5a3fbc82", "value": "3072:RIKKeWePbk/Ak6jTWuUCd6oqd8ube6zeK6FSLjDWVa:RhKfMYAk6td6TdSO1XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676315049, "uuid": "4704872e-27ff-49f1-abc9-c6d246be7e04", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676315049, "uuid": "42a8bd5a-198b-4c91-855b-bc549b862892", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315049, "uuid": "806bfb03-94b6-402e-962c-a344a3e00564", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6d56d6-abbb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676305837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305837, "uuid": "f7b121fe-0b3c-4cc1-8c9a-608a9be0f2d7", "comment": "Malware payload (Smoke Loader)", "value": "3ac1ab8780473d8322f7d39c3c0fe10d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305837, "uuid": "46bbc1f4-bdfd-46a2-a3cb-0ab328779f55", "comment": "Malware payload (Smoke Loader)", "value": "b12711df7f8d7ef20330754448ba05922085ca8b2c78d180c02f2913212483e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305837, "uuid": "1cdb2ce0-8272-4a8a-b78c-3006c15de4d2", "comment": "Malware payload (Smoke Loader)", "value": "bf1cd5198f5b822fd6e2496e1e2a09028dee0309", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305837, "uuid": "20082f41-2c16-447b-bb21-0a061f602767", "comment": "Malware payload (Smoke Loader)", "value": "db3ed12e867a8796fafc2cdc5ba6d0a3c17cb76e4e5d4f66592296ed08d6eeb6d03c22662db223e1059afc7aa4633eb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305837, "uuid": "cd0979fd-6eb9-47e5-9967-2262cafc995e", "value": "T19714CF2332D09431D13616329DE5C2B5EABEF8214A79695F37E82B3F1E702D09976392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305837, "uuid": "8d4fb4a5-5433-40a7-8480-7fe7412e2f8a", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305837, "uuid": "30807298-c401-4270-bfe7-a8a1261b0146", "value": "3072:DOyy5B4doKazq7LfAeUACv1+dMBWA2gV7f9P4N6iwn+BkJUx:DOD5mSq7LYeUAQspA2gJVWqwkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305837, "uuid": "543f1258-0b67-4d7f-9dc8-8d65c67a2aea", "value": 193536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305837, "uuid": "e38b1c87-cae0-4b25-8c68-1df872c0e7f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305837, "uuid": "bb542c75-caa7-4461-b498-ca01275251f2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9998dd3e-abab-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676298902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298902, "uuid": "1fb7e4ff-c16d-4038-91ba-9a12973e0ac1", "comment": "Malware payload (AgentTesla)", "value": "3386d715eeed326e62df9653371d4313", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298902, "uuid": "dc8fba93-4e61-4135-8bd5-e95e69679131", "comment": "Malware payload (AgentTesla)", "value": "b159d4e94f3db24a3cc68ef49fa4a6d2fa87fd55ae86e4980749740c9689c8b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298902, "uuid": "9bbd20a3-d494-4c1c-b9d8-4b300f57c1b5", "comment": "Malware payload (AgentTesla)", "value": "41c0882c487a2fcf4b689ef25853a1ce15cfffa5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298902, "uuid": "a174aa19-0424-441d-a052-407c530b563b", "comment": "Malware payload (AgentTesla)", "value": "0d6e8d1375cbb27632962d1b1db632e992adc88becafbc6232f52b44b259200d3e3d1d8245a1adecefea711a7f859b45", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298902, "uuid": "e35625d2-39f4-41eb-98ee-69439606e964", "value": "T1CDF2E55AE79E0264CF511273171B0A89AAFDB73EB35155B1346C933833EDC2E02666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298902, "uuid": "4db4390b-f808-4e1a-89a4-d87774a1c35a", "value": "768:5Fx0XaIsnPRIa4fwJMicCKUBAeQmy9xEgwD:5f0Xvx3EM4KC7Vy9CZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298902, "uuid": "1c335728-c5ea-4736-8a24-31077e0bf122", "value": 37463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298902, "uuid": "d00afc35-26c2-4735-a29f-bf385f6ba3d9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298902, "uuid": "ff57b4f4-548f-4320-89a3-7faecd288d48", "value": "PAYMENT PO.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd8ea13-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676272062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272062, "uuid": "0739989f-c436-47ce-bb99-d2d0d3198436", "comment": "Malware payload (SnakeKeylogger)", "value": "72589d5b6093e2dcd67c9fcd4c40225f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272062, "uuid": "42501de0-b789-4b17-a2cc-7107d757307a", "comment": "Malware payload (SnakeKeylogger)", "value": "b1cbb8af1ba57f6e2a37e6941cc72873c44f1b682afa4ccfbb5e244bb0315cec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272062, "uuid": "fcca9e77-4d7d-4452-a021-4b4cf1607ae4", "comment": "Malware payload (SnakeKeylogger)", "value": "d91d2a829ae79aa4682df33e93e3843d4079f4db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272062, "uuid": "31d1b4a4-ba20-471d-a059-262778a8fbad", "comment": "Malware payload (SnakeKeylogger)", "value": "72de089ff4b95981ec70d7d076b5966bd887a1d07fca741fd4a0041e9114cd6f66dd07c41f1d1e249768dd51ea2a5148", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272062, "uuid": "89d307e2-99c1-4227-aa58-f39c8c227998", "value": "T1CBA48E97344485ACCE7E55F6A217844033A5CCBFC508E61A6BC933A75EE6FE21C2271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272062, "uuid": "d2c2b462-3014-4769-a93a-d2664676942b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272062, "uuid": "23aa8caf-755d-41e7-b60b-6e068666de74", "value": "12288:qFimar5aFDutOc6duxKLoVaihcWmsupRzEev6nnjqKoe:wWm3pRz96nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272062, "uuid": "d3511e48-6f9e-4ec1-b2be-074c71954084", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272062, "uuid": "cdde3f0d-64eb-4aae-8446-c1262a5d7fc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272062, "uuid": "b17de930-f6df-425b-8829-20560b6ad676", "value": "Quote N\u00b0 MSFSUB191205MULTIRO_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b6587c-ab8f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676286930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286930, "uuid": "756c1e5c-4867-4316-a925-9fcca95c961e", "comment": "Malware payload (RedLineStealer)", "value": "9b25deede4511de18e00c1214ba32532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286930, "uuid": "a8e04018-f28e-48d1-91cd-3e035e006fff", "comment": "Malware payload (RedLineStealer)", "value": "b23551685f437c0209057195a157c249b4f5489b5237c15a8c641190eedd0ada", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286930, "uuid": "c184a628-cc68-4207-968c-f7c70cbdaea1", "comment": "Malware payload (RedLineStealer)", "value": "92374218b01d94a546202da87045a6ebe0133694", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286930, "uuid": "9b39ac2f-3803-4526-9731-121bf5211da3", "comment": "Malware payload (RedLineStealer)", "value": "f072150f8d23121a4f79e73f5a3b55dcad26584dec13e153fe21e86e248702cf0f625e62f892ca559ff7370b2a1b3bff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286930, "uuid": "8d9a529b-8ffa-449a-a54d-f47730873b4d", "value": "T1ED146E18BEB87E1DD7A8577C0BB18DC307BC54F26503927ADBF3B4D90916A8542723A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286930, "uuid": "17ef6e71-e49b-48d3-b830-46e0ffcfa4b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286930, "uuid": "c47aefb5-c214-42b9-82c8-21cde4dc51db", "value": "3072:8nnzI6K7ai46tt8OK51cx//xGc3iU66666666I2:8nnzI6eRtPt66666666", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676286930, "uuid": "845864ec-0677-4156-bfb3-b8e74c783415", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676286930, "uuid": "e7f1f4ea-c4da-4223-bd00-a7ae0152d355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286930, "uuid": "1f2b35f4-1da3-4b58-8316-315c497b302d", "value": "9b25deede4511de18e00c1214ba32532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16228e36-ab76-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676275918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275918, "uuid": "21dba084-a2f1-41f0-bf5d-1bb2eb8ef263", "comment": "Malware payload (RedLineStealer)", "value": "c9e8bde7cf77733bb432838984df3f3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275918, "uuid": "36bac696-80aa-4b3a-bd82-7612719ef10b", "comment": "Malware payload (RedLineStealer)", "value": "b245094cb097a1e2178af822f33d8ae1f1e55505c2875e467c38085602bea254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275918, "uuid": "d50339af-0263-4927-a371-283397b5fe22", "comment": "Malware payload (RedLineStealer)", "value": "d43c4527b7bcfe21587b5c6c3b128e484f0abf69", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275918, "uuid": "9fa60416-3f8a-4781-abbd-3ecd8790de35", "comment": "Malware payload (RedLineStealer)", "value": "17a9e9080c248d66cc078bc08db6120705d93b0f940b02e6a23b8c296e93b140d3ebecfeaaa85e4b03a4b27a9f1be2bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275918, "uuid": "d29e75c7-3a71-4bdc-a32b-e5c50c848c54", "value": "T1BEF4120BEBED9132E9706B7028F703D315317EA45A3C8297224F3C591C726B5A2B576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275918, "uuid": "2367a4ec-42f0-4db4-86bf-7b5ff38dca68", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275918, "uuid": "76ff4fe3-4937-431a-8b84-08be9c828db5", "value": "12288:gMrOy90z5KTENfCbKyn06IeJuPKCnenNZryWL1nunfS5WdPaxisqqpqVRc8:+y+wTENKxn0cuPkydfPtsqqpH8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275918, "uuid": "e0c8bef3-331c-43a7-9d20-1e89cda0b7bf", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275918, "uuid": "b695b995-d318-403f-b5cf-b3d135f5ee7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275918, "uuid": "4f9d8f45-ffa6-44cc-a806-76508024a231", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "201b14a1-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272069, "uuid": "a83e8791-4b90-4197-a5e6-26d2f43673dd", "comment": "Malware payload (AgentTesla)", "value": "505c4031971d5b32d14d214135d7ccc2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272069, "uuid": "38293301-b8b4-4626-b8df-e31c842dd5ab", "comment": "Malware payload (AgentTesla)", "value": "b24875538ddcc55614174775c9de31b7f9ce4a681f3984b3fc88a534a116a277", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272069, "uuid": "8d9cd6de-f0fe-4cb7-aa5d-5c315c7f7c06", "comment": "Malware payload (AgentTesla)", "value": "5bf64adeb0b553a4c2ae8818022c1477222cbf70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272069, "uuid": "777a3d03-8262-4dee-b579-868e75db2dff", "comment": "Malware payload (AgentTesla)", "value": "b99c6fb1364528c1ca439fac499b3167f39bf6ed6369f1fb4428e33bac360f083b2400571b89922481a6123ee49bf2ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272069, "uuid": "9a067ec5-dc92-4e80-b5a0-af4be4963772", "value": "T142C4913D2D7616E2E1B8FB7196E68420B5AC8182330FC91ADDDADBC07F016826DCE55D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272069, "uuid": "01a7b8e2-8a2d-4e56-848f-e5454cf4a32f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272069, "uuid": "e0eb3a97-9863-47d3-a798-db3c679bedf9", "value": "12288:RrQ38Pb+HT0qE8S6S7ztLHKNu+A+/1b/g9G9ybp+T6VzgqlkF3afx1gO:Rs3sb8vOztLHKNu+A+/1b/gmI++/1fx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272069, "uuid": "8248c31e-6f28-48dd-9d08-745291c3fa8a", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272069, "uuid": "b3f49604-4387-4458-b325-598aa536e6f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272069, "uuid": "bf9cb3bf-4463-4f61-96ae-5b9fb4f051c2", "value": "SWIFT COPY $47,000.00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589b4ccb-ab5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676264433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264433, "uuid": "c390f1b4-c7f5-44d9-a58a-0213e05655f5", "comment": "Malware payload (ManusCrypt)", "value": "46de5533299ec397c04dabb10f3bb157", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264433, "uuid": "e016db5b-9424-41e3-a0d7-e3ebe4808d37", "comment": "Malware payload (ManusCrypt)", "value": "b266486b81e48f59ef21b02c6151f26fe2aa77d0e1cce73718342a4e0e703cc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264433, "uuid": "229c4a16-4cdf-4873-86e7-700a8bad8ab3", "comment": "Malware payload (ManusCrypt)", "value": "764e0fa6f5db8e7f352a632a53e9632ee2fcc772", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264433, "uuid": "da3fef9b-fe61-4fce-b3ad-0d730f4f06aa", "comment": "Malware payload (ManusCrypt)", "value": "27b3b470ab73e92745258a0e95c22d146a2bafe222142fc8944da061d570968ab3acbbe3e2bd1eb76f9d815ba365a0de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264433, "uuid": "a6a611d3-aba7-4699-a438-45708a930993", "value": "T1C504D0317AA3D873D167C9306531D6A0296FBF716BA7C08B33081BAF1E312D1BA65356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264433, "uuid": "3c33c903-a43c-4e16-8cea-39de91d384a0", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264433, "uuid": "64f0f834-c6b7-4fce-bc44-54364a199d89", "value": "3072:Z3w4bK35XbKMw4F6AYbdJbHPglGmjI9J0TTOVV:ZhKBbKIFvYvAtI9J0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676264433, "uuid": "c1866acd-64b6-4738-ad27-b64f0ff4ed13", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676264433, "uuid": "bf0c6256-b07c-4ff5-bf26-c6888627a172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264433, "uuid": "ffbfb7c7-d668-4abe-9ec2-beaf1a56b31c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3168e7e-abb2-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676302032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302032, "uuid": "acf7ea12-09f9-4cce-ac18-b105f70bd3b9", "comment": "Malware payload (GuLoader)", "value": "6c640cd57a5f9d01eab1fca8dcb5497c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302032, "uuid": "ba6a8613-eae4-40ce-a46a-e0dcd1708ea3", "comment": "Malware payload (GuLoader)", "value": "b299104880cf3679baa26e9239c4028aa70da224646091fb1775fb264611099a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302032, "uuid": "2b5b9c12-e97c-4080-a405-750e068da58e", "comment": "Malware payload (GuLoader)", "value": "dd0cb4124817be43be24e977c582033f9d87b763", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302032, "uuid": "8eddd2c2-7ce7-4994-a535-471d15236ae8", "comment": "Malware payload (GuLoader)", "value": "f4b852d5d03f2fb04cde200c69597365ca1d662b54717203a4bd7540f30d1b9a7e07abfb4e574acaae60cee5138dee98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302032, "uuid": "6804e62c-f953-4fc2-8b7c-21974ef190f6", "value": "T174841241A392D7BEC0A102F070B983749BB18D136EA35F9357B4B96C1C392C2DE5B979", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302032, "uuid": "bb7a48ec-dd5d-4bdc-8210-c84936a65efe", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302032, "uuid": "6f4f0199-e7c2-4f86-863e-97bd9fb101d7", "value": "6144:BbE/HUw1icBZLV1tf09o/T0JgbYMBk0lyRUUq7JkgggH4H6lxWckqdJ0oD0CsJPd:BbMpZKob06b7BHwOb7a0YH63Wvqd6bl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676302032, "uuid": "45b47d54-1c3a-4ee8-a9da-a4a4d623869d", "value": 405602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676302032, "uuid": "6ac773b6-2983-42c4-a971-e2ca051a811c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302032, "uuid": "3e3bf178-cd70-44d6-9c77-c96d0f804f5b", "value": "Facturas Pagadas al Vencimiento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597d890b-ab44-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676254556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254556, "uuid": "8a486e0e-9721-40e4-8616-0944f99796fa", "comment": "Malware payload (GCleaner)", "value": "e56fa443d0800751bc87d38bb185f455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254556, "uuid": "cf01d3ce-75d6-49e7-bf90-02b46dfd0ec9", "comment": "Malware payload (GCleaner)", "value": "b3344c4a01307c6d106136dcc989efc68875c00ab007fbbf2931501598881e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254556, "uuid": "bc437e5e-1ebf-487d-b27e-2d07996d461b", "comment": "Malware payload (GCleaner)", "value": "80ea271f8e839596bae7f4b1e779e79d5dd8dedb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254556, "uuid": "198e320b-1f79-48f2-94a8-dab0b51b57ed", "comment": "Malware payload (GCleaner)", "value": "ac6fadb9c4bdb347a98966ddadf584be8e29d756a6a95653f5d54e8da16786bfd30a00ceb8e3d07c8fa01bdebe126499", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254556, "uuid": "2cfa411d-74c0-4405-be72-b84743f4ee2d", "value": "T1A8F5127C7005C86DC290FEB48C2A98F70CDA6DE3E9E4A41270CDBF3E51BD2855A1A657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254556, "uuid": "b910111c-9540-4678-8e45-88813f848eff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254556, "uuid": "a577e3bd-3058-4335-b4fa-a54978a2eb7a", "value": "49152:rdHpsny+u4m4woKqW1dGnUnaH4qkgRDjWhDWniLr/THKwQiAFeE1LCgv2MR:JHpVD41GMUaYqDDyhCni7+e4v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676254556, "uuid": "05fdc156-1c12-4ea6-bdd7-cf2f54cbb0c0", "value": 3436673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676254556, "uuid": "180a14b4-d579-4930-a8f6-289b22f6d923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254556, "uuid": "7ac81478-6c23-494d-8d28-87c6741add68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49036dd-ab6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676272828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272828, "uuid": "5f829133-eed2-4b49-bbbf-08b23c22e137", "comment": "Malware payload (Amadey)", "value": "d45d5625f381bdcfa8e21a8babf7b20c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272828, "uuid": "4d784a36-6950-49a2-b3f0-208b110ba6e0", "comment": "Malware payload (Amadey)", "value": "b3d73e6174ecf8bdaa05709cf5ba5903102e337bc0f34b70de126e4f178ce963", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272828, "uuid": "104974df-a4d1-42ba-870a-3330f4c579e0", "comment": "Malware payload (Amadey)", "value": "570225667d24122ae96cd3a79d3bc347eb3bdcfb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272828, "uuid": "c7ad194f-ce08-49d5-bc0f-6a698a935554", "comment": "Malware payload (Amadey)", "value": "e3fce945dea5256618ce61c44651d7a8d3d5f05f3ca329e8630aab712e8b3e3caa5ca75b6b47d6b7726f0ad8e0dd7bdc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272828, "uuid": "0878b235-00e2-449f-8fbb-2a3dec6f0f69", "value": "T1FBF41217B3F89172F8F5A33019F203D7293A7E515A38525A978B6C5D0C326B0A63937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272828, "uuid": "a89233b3-3ea3-4242-ab64-4de7687e1226", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272828, "uuid": "b73eff29-db32-447e-91ea-559a2e7ce6d8", "value": "12288:OMr6y90E1XEBg3f06b8KKjUD9QOlleJZMc1905qem1rej2:8yjZH3Bfca9QOcZMc12YJ1reC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272828, "uuid": "e9e28609-e14b-4982-a8b6-b7cf658e5262", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272828, "uuid": "d3730a7b-2664-43e3-8d8a-14eed59ead63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272828, "uuid": "83913df5-71ce-4db4-bfa3-a2c1e0668ded", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5121109-abd5-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676316987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316987, "uuid": "ca2557b1-7828-41e5-9758-8e835d952225", "comment": "Malware payload (RedLineStealer)", "value": "a016c4dff53b6efabb3e86054fb50d72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316987, "uuid": "a02ab163-8d9a-4235-9f37-88f97b0de264", "comment": "Malware payload (RedLineStealer)", "value": "b3f74afa48a218269403908637b7a2f209861f6c55f9ba4e0a7c09b15400f50a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316987, "uuid": "2e6d31a0-6ea8-49ae-aa0d-3803f920b405", "comment": "Malware payload (RedLineStealer)", "value": "c335f9137f78d778cf81cd89d9c75880446983c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316987, "uuid": "f74e56fa-6519-411a-b791-7dd3b0999cbe", "comment": "Malware payload (RedLineStealer)", "value": "23a8725f9dc2920e40f8c6a23cdf353fb3cf9e20e44a73f7af2579c959d2b36bba25e00d76742242da2834b2f1573292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316987, "uuid": "842ad2be-8686-40eb-af42-9e9a742fe6ab", "value": "T1B154F12333D0E872D47606309D6ED6E17BBEB0219A355D4B37D81A3F5EB02919B72316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316987, "uuid": "c1bc864c-9951-4831-8bd4-c6e1ef93b9cf", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316987, "uuid": "71eae1a9-a389-4dfc-8a53-e6468c4aaf20", "value": "6144:/tPgVYHCd5ECxaSbRjzJfVCQ+GXgMo6O0+QuswBNN:/tnHCd5ECxaS1xVCQ+lRh07uswB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316987, "uuid": "df440284-6db1-4937-8839-ac70761a1cd8", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316987, "uuid": "6a51341f-d3a5-49a7-abe1-3a0e1591d01e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316987, "uuid": "a24bb47b-7702-40c8-bdcf-3aea0eea5764", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2bfb60-ab85-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676282428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282428, "uuid": "84897717-e28f-4bd7-ab75-9de10b4deb35", "comment": "Malware payload (RedLineStealer)", "value": "85a7d125f19102f0e504443c721a850c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282428, "uuid": "b2cd1f0a-f6d7-4ba3-a4fb-dd59ce322f4c", "comment": "Malware payload (RedLineStealer)", "value": "b41e1a0228c495766f452ae25f5cf0ec032f4e5440b02beafc75af05b80a01b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282428, "uuid": "a8fa056c-7813-4621-9d17-946c1fe0e872", "comment": "Malware payload (RedLineStealer)", "value": "27ee948953770f22f6fde2977a7b1b174d9779a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282428, "uuid": "a0774ddd-979e-42e6-921d-cf8338a5aaf9", "comment": "Malware payload (RedLineStealer)", "value": "c406965cb445bfb46c952355addb8bc8215a45bcb267735d6466ad342b284d10ead049966b79d6276a0a1a7f9660bdd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282428, "uuid": "d4109056-2cb3-41ad-bc03-70dbd732b151", "value": "T10745F10373A0CA11DAF92A71E1EB842597B3FDA3B472D74E3B5C224D0793361DA11B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282428, "uuid": "d37327ac-e5b1-4eed-b54d-d54e97df8e5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282428, "uuid": "8dcdf527-c02b-4f60-8401-032bb6c3bcdf", "value": "24576:8TM5OGYJUGHLQidi/PH80ZLyIBgvm53cYZFyXNw:8Y5FYiGHsiU/BZl3nya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282428, "uuid": "f9df1a96-b581-41df-87f5-1060c57e53bb", "value": 1208864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282428, "uuid": "1ff907b4-2bac-4cdf-ba0f-c4688cc0611f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282428, "uuid": "f29baadf-dbc7-441e-bd42-06b2106b6fa7", "value": "85a7d125f19102f0e504443c721a850c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9f1f10-ab74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676275256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275256, "uuid": "29405387-f785-40c8-8c25-c0aefd9b2416", "comment": "Malware payload (Formbook)", "value": "971b8218ba2493718e7608f5f23a234a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275256, "uuid": "73c1f915-4d5d-4fcf-8df7-237f74c80f2f", "comment": "Malware payload (Formbook)", "value": "b4200046cce33757a5d9624c35cefcd43a2d64adfbc80607f7c26b59bff3034b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275256, "uuid": "31a4b0e5-5384-404d-ab24-6ba8c25bb202", "comment": "Malware payload (Formbook)", "value": "4796c47af6c340f3f049512b7be77c9794235774", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275256, "uuid": "8b414c27-45be-490f-afa9-edf5286271b4", "comment": "Malware payload (Formbook)", "value": "85b7fcdc1aa80b83291d62e9aa6cebd3936f7e0a1bdc6781f5c8dd3b1fd71c07f344f31b315ae1b1c7d9e0007bc3028e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275256, "uuid": "edf2e1ff-ce69-44f4-b164-4f25f5562aff", "value": "T1C244230F0E2E7D4C8FF847DE70C6EDC00516F9143AA66E3A9869B2526578315CD6B0BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275256, "uuid": "d7b0358b-7dc6-4116-a8c7-6278b087d498", "value": "6144:q/jUb7bnY9SkEYwOIczjMwshTpCkae18NtOMQa8Q:qrUb/YzEYwOj3MHhTae1g0MbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275256, "uuid": "ae4a562f-3183-4bdc-a350-fec986147808", "value": 269646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275256, "uuid": "c1f4c7d1-9033-4585-aa24-4f36f9a10e5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275256, "uuid": "36ea47a2-9d42-495a-a5a5-ea13f87cd7ab", "value": "PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03bb25b6-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272022, "uuid": "4a1e4e05-5c54-445b-8e2d-fdb07e1aead5", "comment": "Malware payload (Formbook)", "value": "fecd6f2a5e4a94cc09b721727a86295d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272022, "uuid": "c37047ea-a13a-43f6-b17c-0d86ad81cf79", "comment": "Malware payload (Formbook)", "value": "b4ae90babbf85fb137c173dbc6a8791c9b40a7d9b32ab70ef81284736c683710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272022, "uuid": "27850f81-e5ed-4077-82ec-01c8dc79b44c", "comment": "Malware payload (Formbook)", "value": "8d62a8780080340e42046dd40185da0f9207a9f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272022, "uuid": "e6878278-f513-46a5-a567-4362374ec52c", "comment": "Malware payload (Formbook)", "value": "d1d3ed6c9dfc71535caf2e31f0c980d743cf1a3579a1f3a41de5d596dc2841d1209d869446284d9805f44fe3a57ae6f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272022, "uuid": "1ecc416e-fa77-4f6f-bad1-6e6da54b5e4e", "value": "T1C104AE36D642C031F1B251B4F67D0B7B883D0E357255A4EAE3E21AE12EE45A5F42931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272022, "uuid": "a69da30d-cd56-4658-aa5a-a43a329cedeb", "value": "3072:gPEUkhyXt4Dg3h4IM2GH4j7evbUluEApIpZ7HYrqHbq5cPmmDU:tBuhFMDYj7ev4luXpIYrqHis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272022, "uuid": "f5f700f8-b2b3-44a7-a12f-10e1839372a2", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272022, "uuid": "7a32cc02-961a-4eca-97b7-9c58f51b0749", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272022, "uuid": "4114dd07-c67c-4d8e-acf0-dee08a8dccc7", "value": "b4ae90babbf85fb137c173dbc6a8791c9b40a7d9b32ab70ef81284736c683710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68e6f8a9-ab71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676273909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273909, "uuid": "c17c7305-5c04-48c7-80e9-02bc82d34fb9", "comment": "Malware payload (Amadey)", "value": "179fa0e337be1fb6f9d9149f278c6a8f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273909, "uuid": "48746ef2-6b0f-43fd-b264-c1e6e5fc9ae8", "comment": "Malware payload (Amadey)", "value": "b54f695ab656d79ccd86e01583a6aaff765285b4d499739cccfe7f371ef701e4", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273909, "uuid": "10bcd027-2c26-4885-97c4-fd25e12a5f3e", "comment": "Malware payload (Amadey)", "value": "195c60228bc97cc02a68a50b537f1d631cd712d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676273909, "uuid": "89f78412-8fcb-49d2-96ad-27326622f24f", "comment": "Malware payload (Amadey)", "value": "fc17e879883be84491ce906b4ec3c34a03f4698e460bc16d377229949678086ff2de686a69ac1b0e48d21880bbd58139", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273909, "uuid": "ecaad54a-ba83-4725-a972-46e277282784", "value": "T1E1F41207F7E89022E5B5937058F603C325367E619E78839B728FAC6E1C31AB0657572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273909, "uuid": "8a569e20-33cc-4247-90ea-15b465fa5603", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273909, "uuid": "46603ae1-5396-4f11-aa88-25744942b772", "value": "12288:CMrny90/iRzXDfk0X6wCMbTfJ1RlYE268eJz1dMi85qefi3Nzx:Fynnk0XwIjJ1kgJdMi8Ysi1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676273909, "uuid": "2af2fc45-a47f-4aa4-a442-5014ac6db0ee", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676273909, "uuid": "de90e212-34c7-4604-92f1-6e2a1dc1d35d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676273909, "uuid": "68af47bb-442b-46f3-a7b8-a0062ae83124", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dec5cd-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676299760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299760, "uuid": "171e214c-88c6-47a6-8a3b-4a3fd9e9edea", "comment": "Malware payload", "value": "5f90478d1b76bf11b949249d69a801e7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299760, "uuid": "c414abe4-a972-45b9-8dd2-39dd19b249b0", "comment": "Malware payload", "value": "b5920f6438479a8949baa8244dac079aaab3f54f25f2d59234d1163fff01d9da", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299760, "uuid": "a46aab99-89ce-47de-991d-eefd0e204475", "comment": "Malware payload", "value": "1d89fc258bf68f0676c39fa0735ed9a47f0a14e3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299760, "uuid": "9ecd42b2-ab7b-412c-a168-cebc3ffe7a5e", "comment": "Malware payload", "value": "f37c30b088c12724b20efab6dacfabe43e28f73929a394f9477b24d792891c5bf92d56c15b1123f4635ef074e0eb29ca", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299760, "uuid": "1424ce4d-db10-4368-a9c5-e019131c8e45", "value": "T1EF35E007D271AD2BE827C63CE84F14838212AC7AA955CA4E21C7731F5732BB16D7EE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299760, "uuid": "844d9974-1211-4c78-a01b-2c66833744fb", "value": "24576:7FeELFR5mvFe35FHoVXM3lpKE1xv9lTCnM:ZXeNcZOXSpKqxlRCnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299760, "uuid": "fe0e98a1-d490-4d60-9228-c9803b8e6e68", "value": 1106944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299760, "uuid": "4252c9f7-3640-4b9a-8b1d-a73a0ba737ff", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299760, "uuid": "4ee88ebf-f0a9-473c-b396-20bf345d35cd", "value": "Payment USD 8654.85.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166b154b-abc5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676309849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309849, "uuid": "5a3dcfe3-4fa0-4e7d-99f4-9ec0dbeee298", "comment": "Malware payload", "value": "8f17d1122364bed6963cc60a133286c2", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309849, "uuid": "efad756c-57e1-448e-a772-2a1d38eff87c", "comment": "Malware payload", "value": "b5e87aef1f5369ce633af754becec0d217496d4f6545a1223aaca0c411d8993a", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309849, "uuid": "a2680e70-804f-4f02-abc9-d7c86edef30d", "comment": "Malware payload", "value": "1fd9464315c071df193b0d5d94f518d844618a5e", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309849, "uuid": "c50dc616-a777-40fe-9494-b011889d7a78", "comment": "Malware payload", "value": "9151ed38d9981ac8dd12fd59a576c5e9be52dcfc909912b6e6580fa793f7bd2895b62b094b6feeea07ec342e6fcc5702", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309849, "uuid": "52b24628-72cc-4eeb-a7cb-ec7458f1e158", "value": "T13A035F44EB8044B3F21A0138B94789576265AC3BB541CE6A26D73A1FBB33F765E31F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309849, "uuid": "38e96ba0-38dc-4a7a-88d5-ce629f0560f6", "value": "384:WXXwBkNWZ3cJuUvmWnTG+W4AhyGcSX4WaI7/:oXwBkNWZ3cjvmWa+V24WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676309849, "uuid": "0ddb9e41-01a7-4e03-82f9-ea48d8ae22b8", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676309849, "uuid": "c0658a54-6103-4020-ab7a-8d5316eee3a4", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309849, "uuid": "325d9e07-2873-4808-9f12-e219b007ea9b", "value": "SecuriteInfo.com.Heur.15653.24633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87380295-ab55-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676261934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261934, "uuid": "62fe42f5-a0b4-4c22-b2c4-7b9bc4d2e050", "comment": "Malware payload (RedLineStealer)", "value": "dbdbd8c6fb064dc2948319f35c4db3a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261934, "uuid": "b2334d8b-e0f2-482e-8a6e-4526672f7c38", "comment": "Malware payload (RedLineStealer)", "value": "b64a96bcd5b7c97adae0bd01ac43e882930577b19b8b85a6cbba1ab664082c20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261934, "uuid": "caeab737-d706-450b-8a85-d883adb6cf69", "comment": "Malware payload (RedLineStealer)", "value": "4187f3d4c7aa8f9c46539ac3dd9ff4506f804724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676261934, "uuid": "471af056-bb4b-4566-8fc8-33019495c89d", "comment": "Malware payload (RedLineStealer)", "value": "fc9b33a87172b70ec17af923210665d1380c770622de8c86ab8ce8a14f4003d551c7f6f30d1584f0bdea614119aae56c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261934, "uuid": "f016216d-00e1-42a0-a2c0-08c360945ea0", "value": "T1BEF41217E2E99033E8B92B7018F602D31B32BD755A74439F63CB6D5A8C726A1753036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261934, "uuid": "ad0feda5-ff3a-40e8-92bd-9aaf68f0fa63", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261934, "uuid": "84981ad3-e71d-4804-829e-9ebeea7fa283", "value": "12288:WMrjy90chf/QTZPoIx/fhzyeJQut4ZXZ3QAMgxm0Tp2AhyTbpwPi:Vy1f/SZPbrnQuydRQdgXTp94TGPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676261934, "uuid": "ffd0cef6-e262-4e24-a9ac-086741feb5bd", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676261934, "uuid": "420a8970-f73d-4a4f-9b81-82dc788a4672", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676261934, "uuid": "8e0ed981-8135-47be-be2c-75d90a2560b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ef264c-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676301043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301043, "uuid": "c2fb6c9e-7c12-4966-8d1b-b6897ad279dc", "comment": "Malware payload (RedLineStealer)", "value": "7584be6252e12811b2115b80a7237348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301043, "uuid": "e948d0ca-76e4-407f-9c6c-0a57cb26c13f", "comment": "Malware payload (RedLineStealer)", "value": "b6827fc2c1beea50c7cff5cba9e607fcbfcda874a711c9b4a66ac665e1ffa69f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301043, "uuid": "8ac77afd-5d28-4546-a4d3-426f2effb694", "comment": "Malware payload (RedLineStealer)", "value": "7d15dd8b520ccc94a048cb0ed233abfca6112fa1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301043, "uuid": "e1811b5c-0f8c-4473-b6bb-48c30e8ea2c8", "comment": "Malware payload (RedLineStealer)", "value": "9dcb6c2d35d17cb658d8f086a023fee83d53876d5f7459fe58c8d48b3c1cbfa97a32d87629ed4f5e917ef4c4209242b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301043, "uuid": "8a5fd556-c4ee-497f-a9f7-1bab50eff0e9", "value": "T147F4120BF6E9C032D8749B711CF307D31E36BE644A38425AB78EAC4948716B1B6353A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301043, "uuid": "20db1b91-5575-42ba-bfda-0a5414f06ed3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301043, "uuid": "a6aff051-cc79-4b65-8bdd-df96396836d8", "value": "12288:yMr6y90Az0STlWmVt+9o+5rAZljpZdWPzKqhIzDQeJCF6OZ2dZgxMJUnt47YFzLN:wyX0yPVK5rAfjpZ07FhIViZ2dZO0E47G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301043, "uuid": "6d538bae-5b1d-4bac-af64-2fd3c99c902d", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301043, "uuid": "fbe1cef6-6429-48b2-84eb-55e879501309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301043, "uuid": "13395ba5-dd2f-4ba8-8461-19f2eca76c50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd9b4d9b-abe5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676323900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323900, "uuid": "94e6ebe7-1aa7-4dec-8752-dc3bfb266dea", "comment": "Malware payload", "value": "04b8f812baa7371b51a70202b2bb61cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323900, "uuid": "23caf81d-fd17-4a55-97a6-e27890eca603", "comment": "Malware payload", "value": "b70c3586d51a5d1b230051cc0a004ea1340f837066ecc6bc13bc88c11c88add0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323900, "uuid": "2f5bdd33-8d77-4112-b09a-067254f964fe", "comment": "Malware payload", "value": "8806b675560c8ef0feacbec2944fa764ea30ebc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323900, "uuid": "21706c06-e0c0-44ee-b28f-6a3a3cd1c208", "comment": "Malware payload", "value": "f71c0b3efc8dce43788a3add2793b839c08bf5131189ff48254a40e37cfbf4637b766832f080f5fd66a00ec01e497b70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323900, "uuid": "39a32f50-d6a6-4619-aed4-c53920452d25", "value": "T1EC04CF1372E0E472D57316319D69C2F17A7EF9220A78A58B37E8673F0E702D18A36356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323900, "uuid": "4744ccdd-b9d3-47d4-9971-8c65cad62d11", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323900, "uuid": "c5772af6-f72a-4144-9932-c9bd09439eca", "value": "3072:qKiijiRLBUYtSkfpDUjunLdyYBw3ZZ7PGZv8F8465stX:q/iuRCGSkfZUjuaZJ808xy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676323900, "uuid": "3f31d423-21e0-4e40-88a2-bd08e44aa022", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676323900, "uuid": "88c98682-bdf7-45af-bd9b-572f74d270b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323900, "uuid": "8377b1e1-8fbd-4c4f-a979-df37692a915d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f689fed-ab9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676293301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293301, "uuid": "f6227557-ee41-4a67-8cb4-54180735aac2", "comment": "Malware payload (GCleaner)", "value": "d98e21a22bbccbb29b6d9fe77c38e684", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293301, "uuid": "e18507fd-9713-4a78-9405-854acc941818", "comment": "Malware payload (GCleaner)", "value": "b72532614295b91b0ba31ae43b92792d692b21503bb66b9e6eaab81b8b5896c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293301, "uuid": "12d5a0c7-b32d-4cb9-940a-2443b2d889ce", "comment": "Malware payload (GCleaner)", "value": "9ca39bc4e98daec0becc84fcb0e2687ec4f4f9ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293301, "uuid": "e4df1a2b-96f4-4bca-9bf1-a1398ca37238", "comment": "Malware payload (GCleaner)", "value": "c4da301c2356662a02bd16287cafc495edc46c808782020d14c3f14b2065708c61676911fe81c3e093692dc7c6d82764", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293301, "uuid": "5be6c6b1-3c9d-4a6b-ba1e-06cc9349a1a1", "value": "T14BE5127C7105C9ADC680FEB4882AC8E71DE76DE3E890A56270DDBF3F52791858B1A107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293301, "uuid": "d178d606-13ef-41f7-8851-1a196bbfb47c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293301, "uuid": "a392a050-445e-4ee2-9185-db6a10889009", "value": "49152:rdHdHJdenp+fmvnruIeBWmR2qdg8kOF0qVVdh6spzo7UTV6gNi9bfhsLCgv2MR:JHQpXrulWGmG/vdhnbV7NM6v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676293301, "uuid": "c83261ae-c5a9-4e0a-8937-83225dabf893", "value": 3309572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676293301, "uuid": "75567c67-09b6-4fb6-85eb-3775e5c7b735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293301, "uuid": "aebf2111-e697-4cd6-afa2-fac8e90b8c81", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6ff984-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676300413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300413, "uuid": "83722339-9d75-4517-a382-5b5c47ec73ec", "comment": "Malware payload", "value": "b985671bebf3c3bed31b6fd7a95b5e97", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300413, "uuid": "b5ea14cb-0153-4393-a939-35e792e598a1", "comment": "Malware payload", "value": "b72d9494401d22ea84f4776ebab4d635cceaec8b97e82a3796373798521787d9", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300413, "uuid": "372aba3c-7ea7-4bff-94ff-8f1274e30da8", "comment": "Malware payload", "value": "221d918723cfb006c6e468f36280e9a690c35758", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300413, "uuid": "19e4ec7f-c616-47ee-9362-9c37cdcacebe", "comment": "Malware payload", "value": "363aa191bff12e7cb6c94e9c1485c1d2a39065de7db9b7858044beaad1ff16ee45bbaee091cb17a4e0dc399fb43967b6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300413, "uuid": "58abeebf-c1fd-4103-b81a-a37a83f67d94", "value": "T155812B74E64C8C93C47FC6925A2B7DB7427BB2429EC65D84119DECE604FEB028E3198D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300413, "uuid": "12070fb1-1a87-4d48-988a-9aa0aed7f2f4", "value": "96:OhYEzqmNf96FX9qOajDti7ysuQEpx4Dow46nbO9qBY2:y3qmaFX9qOqDtiD1EpeDow46qm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300413, "uuid": "faa33f0f-a550-47be-ac41-54ec38abb327", "value": 4079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300413, "uuid": "1f7fc732-4cb1-4426-9cbb-cee3dca63ede", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300413, "uuid": "a2028fb4-c923-4675-9a02-c22e856b35b1", "value": "SMGS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cd618b-abe0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676321689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321689, "uuid": "90e1806d-e84f-43ce-bfb4-7b55601ece65", "comment": "Malware payload", "value": "8bce88f7fe698c3dd7eaeb118d3f4cb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321689, "uuid": "634192e7-3ce9-40fb-b76a-ed7a880f81b7", "comment": "Malware payload", "value": "b745f12a34775db388dea566aba5c769bdacf443aa6d8268d1471aa3772e0870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321689, "uuid": "10c501ae-a14f-4938-9d09-4f94809e7912", "comment": "Malware payload", "value": "6191b9482dadc289b405b0232a3c2d70d5f7fa87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676321689, "uuid": "97d6e169-f2c6-4787-9b73-ca54c1d14a6b", "comment": "Malware payload", "value": "8d9f3aed4e5d0ad38896e93442c43555919057d76ef13238ead67298b9318b36f55832badad7bfd064e6b521b0116c13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321689, "uuid": "84330c3a-f3f7-4b3c-932d-6606369964b5", "value": "T12204C02332E0E471E4621730AD79C6B17A6EF821193D9A4B37E85B3F0E71ED18A75352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321689, "uuid": "c654ac51-3a1a-47a1-9284-3f6c9f91af14", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321689, "uuid": "d548f1e7-f955-487b-848e-95c62b897b6b", "value": "3072:eKgFdlfa3XDXw35O3KY8LoVQOh5fjoNjXu19uC62/9sTOkjO:eNFziHDXwpO63LoVQOLrohXk9iosTO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676321689, "uuid": "c536f3a8-2032-4df8-a840-1622891814c1", "value": 187392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676321689, "uuid": "3df76b3f-cbfa-4eca-b20f-029ac4255623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676321689, "uuid": "6233292c-0b15-4efc-ade6-678edfc2c06f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02eb4c82-ab9f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676293495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293495, "uuid": "cba3a98e-489e-452b-a087-7088310c7695", "comment": "Malware payload (Smoke Loader)", "value": "fd01e1fe2323ed242a7bf7f3b35e7810", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293495, "uuid": "a0bb6458-6d0a-4ee9-8c09-8e1a9bb620fc", "comment": "Malware payload (Smoke Loader)", "value": "b77629961b948cdbdbdeaf4784369e272580973ca0a2c835a6519c68497c0704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293495, "uuid": "7d79040a-d27f-4eea-8547-6840bc404b56", "comment": "Malware payload (Smoke Loader)", "value": "82de1a756cea7b11e828ed9bd90f5eb94c8c50a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293495, "uuid": "03d17267-83ca-4417-a2a9-199b4582b884", "comment": "Malware payload (Smoke Loader)", "value": "cb60e53bf39094f33d97c6f2923d334cbff902c608b44169a14e2207efbeee1f6830af78fc118712bb441ae1aa7c100f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293495, "uuid": "7eb584de-fd43-4a16-9368-d0e1a2e30bf6", "value": "T1AA14CF1372D0E432C57316399939C2F52A3EB9B1DEB9E5973748273E1EB02D09A36352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293495, "uuid": "440a04fa-5fb9-43c6-b064-a56302343ceb", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293495, "uuid": "de24ccda-211f-4540-a209-fa5b6ab7e6cf", "value": "3072:3pgkH/ODEERjBmzI5wAYCgU9VMILwcTLYloaXMoNyKc2P8v0/NG+J2LW3:3pnfsAISAYCgU9qILNLYxNyKDV/NB2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676293495, "uuid": "6012b36a-d6e4-4d3b-b0cd-ec75d32dcb00", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676293495, "uuid": "327ae832-1178-4c5c-8f4c-262a501598fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293495, "uuid": "b6a814a8-1e70-42f7-a8cb-669e6ca7787b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e418e083-ab91-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676287860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287860, "uuid": "fe69a1e7-8076-4492-a354-6f3fffcde66d", "comment": "Malware payload (GCleaner)", "value": "392be1c397fd6f598e8552b1a436fe7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287860, "uuid": "40d4218b-2d2d-4581-a5ef-3d095e114b46", "comment": "Malware payload (GCleaner)", "value": "b7fb4e928b7016af9b8e97df1d2747b4fafe1636389e9f79ca9326f0f8c1b347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287860, "uuid": "9768efa4-fc36-4db6-9edf-2460882b6777", "comment": "Malware payload (GCleaner)", "value": "27408b6380f073bed5d84c54d122079ea3fff05d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287860, "uuid": "ff2e9882-d715-41cf-ae43-ecc223ad2355", "comment": "Malware payload (GCleaner)", "value": "0b2deacbad5f038f7356dcf322f08582c3a66227ea752fc42a8a0ce67b81e921d798c57d7c581ca831bb4be36308fca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287860, "uuid": "1dbcd2f0-eda6-499f-b207-4d50dd9bd54c", "value": "T15EE512BC7159C9ADC280BEB4883AD8F75CDB6EE3E894902270DC7F3F527A1945A09117", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287860, "uuid": "33d53ec3-3a30-46b6-9a46-5575f070c415", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287860, "uuid": "556635b5-cb3a-4279-b3ff-f241fc0a0b5c", "value": "98304:JHogchV0H223uNhiafRCkC1b/7SN9v2MR:dtcG3uN8CRCkYDeLvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287860, "uuid": "96c7ff29-6ab0-49e5-934e-1063a705dd1f", "value": 3207882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287860, "uuid": "188649b4-804e-4281-b9d7-be73cca7245a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287860, "uuid": "4bf1fbbe-2764-4d4f-8a00-8cfb71e9c61b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5591038-abf4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676330275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330275, "uuid": "e6356e30-b46d-422f-88c0-f31f63bfa952", "comment": "Malware payload", "value": "fb3c769f6703ec0ad4e7b0591a375328", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330275, "uuid": "0a00edcb-5df4-4d45-a62a-05a9b06ccc4f", "comment": "Malware payload", "value": "b82d3332ed255dbf26633048f631ca42525acc315d1d9dd15882788677b3d23b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330275, "uuid": "573d6e96-9e55-4e89-b5a9-e605c23575f9", "comment": "Malware payload", "value": "104f3db47114a8c27659ef736376e9d4bbcfb674", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676330275, "uuid": "cf828900-4df2-4da1-ba28-dcd81d7f5088", "comment": "Malware payload", "value": "25ad861bd57f51ee385c4fcbe67da660c7a9ae19a95ea9257ebeb019944bfb48c65f9cd8bda3c6385bf7fa65a3694bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330275, "uuid": "0125210f-a741-4955-9a9a-5b87c8364be8", "value": "T15AF4120BB6DD9131E8B177B018F703E31A35BD624678826B524BAC5E28336E471367B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330275, "uuid": "9b95fa25-d097-47ec-9a9b-a1b5d75a8312", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330275, "uuid": "cdccacde-a9a1-43f1-814c-fb1b12e865e9", "value": "12288:lMrQy90lfKj55qJmkVJDawypRaYznCXiy3/tlWeJT5VcgPXaSGkYWFFfFtIkXt:VyM7uBRaYzWic3lH5YWXfFtIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676330275, "uuid": "dc0151f5-9fcc-4088-82f3-bf2758857b3d", "value": 737792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676330275, "uuid": "fcdf3110-f411-41ac-9aea-9814a1c303e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676330275, "uuid": "6d0075c6-48a5-4895-8b5f-f0c4d7b4dc1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c624f30-abab-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676298772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298772, "uuid": "5c8ed336-c586-4d7e-a668-053b2738c4f2", "comment": "Malware payload (RedLineStealer)", "value": "5415af759d35e091f98948299a580fd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298772, "uuid": "5c35ae64-361c-4235-a866-a804835f2578", "comment": "Malware payload (RedLineStealer)", "value": "b8457ce0f7fde3adbab5b5b02f2846e9caa9f8273ee4f6bb7131779177888591", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298772, "uuid": "7077d6a3-6417-4d0e-9f9c-68625e5329dd", "comment": "Malware payload (RedLineStealer)", "value": "5dca3b0cbcf94b84627273b05af7be922d88934a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298772, "uuid": "45579560-af88-4193-8a72-eacbc18e92b3", "comment": "Malware payload (RedLineStealer)", "value": "c31666e727949360b47914f61efb5d129df6553a8c6fb5d096eaf6182746ac688938ab046f16899277e9cfa26df0764f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298772, "uuid": "af8706b2-55a2-4dbf-988e-d3d5f48b4584", "value": "T13E54F1E27290D871D5721B318D68D2F12BAEF9F14B386A873B58172F0EB02D09976357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298772, "uuid": "e87ebbab-569e-4af7-a80b-05f1df71435d", "value": "096c57a489bc9be05d307c86ed0497dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298772, "uuid": "f1aa421b-41e0-41fa-9921-8877f5988b2a", "value": "6144:/OPArf3zYcguMeKSqUpBO9T5yOkGcz+GRSUbaCMkEMC6DZUCh24o:/kAwcguMBSXCBdkG+1GXr6du4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298772, "uuid": "e631afe7-9716-49b1-8536-4ac9a1077fbc", "value": 305152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298772, "uuid": "055421fc-cb25-416a-a0c6-7c7ad08deba3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298772, "uuid": "4f42cea1-6e0b-462b-a03c-eca545425666", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a2cdae-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676284666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284666, "uuid": "31d60e5e-3fc1-49ee-a8d1-e04e89966778", "comment": "Malware payload (AgentTesla)", "value": "ebfa651b54af9341c77cb8e35fd4dbd8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284666, "uuid": "854f06d6-7d7c-4813-9c7b-7991ed27401a", "comment": "Malware payload (AgentTesla)", "value": "b8da16c737e8f45792c9a10678b344689562a4e52be81e95acd81485eec2a37e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284666, "uuid": "e622681e-f1bc-4869-bb46-c1f38adf43e8", "comment": "Malware payload (AgentTesla)", "value": "cc26233bdba5e2ac7acc03bac701ac447559e884", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284666, "uuid": "ff2f5732-d085-4849-8cd2-d62da0990ecd", "comment": "Malware payload (AgentTesla)", "value": "2dba5449aef6ba7481f887d70c99294f494e28a6a27005621c1d0bfdab7877154c6151fd42b8b12cc6f905f46036f19b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284666, "uuid": "a66882b2-fcb9-4551-9e76-40a6b96328b1", "value": "T10CF422062D4DEB57C93D83B84D2284B093B27C742572F26B1DC73ADF20B5B650866B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284666, "uuid": "ad362c66-9dd4-4df5-acf8-7794234b112b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284666, "uuid": "3247ac1e-5b31-4f53-8b39-8cb95acb6fa6", "value": "12288:ah6q6EMh0NzFNwMTjSvzHucgHI7oJHzmFYC0ND571Vd8:aYXhyxc+OoJTmLQ57j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284666, "uuid": "3ef8cd34-3137-4fa1-b785-8ce76abb0b1c", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284666, "uuid": "1b6c3b36-d5f4-40d1-9deb-0c74c7a0f680", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284666, "uuid": "7efa70a6-1f18-4a42-94e9-4771022bf4bc", "value": "f023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f7c27c-ab41-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676253173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253173, "uuid": "a8598a66-c222-4ec3-84e9-c1be552ce204", "comment": "Malware payload (RedLineStealer)", "value": "f378237ff6ab667bb77334641c70e8de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253173, "uuid": "a29f66bd-87d1-4216-8f7a-cbc85a63b8ec", "comment": "Malware payload (RedLineStealer)", "value": "b8f34c3757c3bac6cd49cefa619b784134903a68f300e9bf83c316b217e45e4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253173, "uuid": "d58c2cb5-d5fd-44d0-a8ce-b921c5826d34", "comment": "Malware payload (RedLineStealer)", "value": "b60c0b776fcbbca30616f7972fe34a0add61267f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253173, "uuid": "996a48c5-ab7e-4117-8027-fd0c22c79aa9", "comment": "Malware payload (RedLineStealer)", "value": "88382e02d08dfb7d1bdedee62a53cd08f3ac1478071a4322633ef2b433748400d81a4cb1b92b2dcfd96447c39b5618d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253173, "uuid": "6ca9a30e-191d-491a-b059-60c2f07150bd", "value": "T1B7F4121BE3EC9472E9F5A77019F307D32A367DA06B39429F574A1C491C32670A23972B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253173, "uuid": "6ee3fecc-bc2a-4907-8e95-28a30c1db5b9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253173, "uuid": "fcf38eaf-afc4-4d9c-af46-093e06b24d48", "value": "12288:1Mrty90v+w+V+kaSKZ06qu8mDxlZYnteJ7GnTWjZV1bQa8PFqOecuxYv9g:YyE+/V+/SO0aZYuqTWt5PZlxMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676253173, "uuid": "7a60fd84-eed4-4b20-9ef8-467b90466dc3", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676253173, "uuid": "a665c029-008f-4b53-8843-b056d2d04414", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253173, "uuid": "d554e172-2244-4920-bc89-e3e7a842ec75", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c12ce7d-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676284652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284652, "uuid": "2f120334-0eb6-4807-89db-da0f635c5396", "comment": "Malware payload (Amadey)", "value": "8dbc029aab124b1f04a5061cab97409b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284652, "uuid": "555d50ab-8fe7-4f4b-98e4-19a1d9928c59", "comment": "Malware payload (Amadey)", "value": "ba4bf4ed8042f0090723fb89c5048754308c98bf518345083d99729b67c44b0c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284652, "uuid": "c6358fcd-95c2-4d17-a60f-3e9ed9ce1aae", "comment": "Malware payload (Amadey)", "value": "6719bb6f77c629d054fcbab9103ab6527fa87060", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284652, "uuid": "8e602abc-698f-455d-8b1b-87471670dcae", "comment": "Malware payload (Amadey)", "value": "a63d0c830e686df55a67fa072f4cbb791ddcf42741d78f1e4734509c676a5beb4d842bb565032fafb126f2960de61b7d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284652, "uuid": "6cc434d4-98a7-4b4b-aa79-8cc1a41c009a", "value": "T184F41247E6ED5132F8B1677019F703E31A36BD609B34829B234EAC690C72AF06275767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284652, "uuid": "807c4a19-629d-4f5b-95ee-40f8e3f953aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284652, "uuid": "5b617cda-74c9-4326-9da4-48c27cbffb36", "value": "12288:0Mr0y90RIsVG5ga7bocl/xQp2eJYrnVG8tCaR9bF7N4W:AyO1VGOa7bouZQtYbVG8tF/b7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284652, "uuid": "e25d8ba7-a269-49d1-b124-7f9e5b758e31", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284652, "uuid": "3ce4c0f4-c9b5-413d-b29c-8f66df325167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284652, "uuid": "f626f496-806f-4593-8977-e92980042e60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f53b7f3-ab73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676274618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274618, "uuid": "87686f3d-9ac9-4dda-9bd7-506ceb1a077c", "comment": "Malware payload (Smoke Loader)", "value": "99002accfc46f5a4cefb4284c912b715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274618, "uuid": "adf36b11-eeac-452e-acc6-69502427dea4", "comment": "Malware payload (Smoke Loader)", "value": "ba536e6bda4bc99a819c046a915834b43af65728966a63bcbd128d2d17ff9a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274618, "uuid": "2b82a46a-722a-47df-ab9c-613091f7ebeb", "comment": "Malware payload (Smoke Loader)", "value": "f74711a6fd664d107044d2abb624355ab816448a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274618, "uuid": "c1397546-652c-41e7-a3fb-04c2e1f34dc3", "comment": "Malware payload (Smoke Loader)", "value": "e7583641430e49b0870ccec776fc0c13df19b4e17ec678a16223dba9057dde3906517f186201a7b8084f8ea7620cb71b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274618, "uuid": "a6bfe5a0-d663-4b33-9eca-111f2d718379", "value": "T1D514BE1372D0E472C4631930AA39C2ED6B3EB8B24E79759B37981A3F4FB02D19672355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274618, "uuid": "3b213799-992e-4691-a039-ba0dde9ea1ba", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274618, "uuid": "809dad70-0a76-4ffb-bc41-62c514a50579", "value": "3072:3rkkNtPfeUKtlA+QHMAWjy3RHErDBneuBJpwJ1YDGZGk3vHJV:3r7NHKDA+QHMA1IDheOJpwJGDGIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676274618, "uuid": "d78c1c9f-84c4-471c-b5ef-b2a7ed6a255c", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676274618, "uuid": "1f624f76-0635-4a10-9b70-46d8a9d78f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274618, "uuid": "d8d830cf-2710-42d1-be34-8fccddc55953", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aae519e8-ab5d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Kangaroo)", "timestamp": 1676265430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265430, "uuid": "d9009c7b-37a9-4fab-ba19-10b177da7cc0", "comment": "Malware payload (Kangaroo)", "value": "3c0596d76cc0fb86b2a6abd5e7c442a9", "object_relation": "md5", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265430, "uuid": "482e489f-5759-420a-8996-d2ffa875ce8f", "comment": "Malware payload (Kangaroo)", "value": "ba7b2cbaae8cd1e0d12fea19971aee246d4e81ab51f1c83b60e9adc066d276c8", "object_relation": "sha256", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265430, "uuid": "c1c105a3-ea6f-408d-a63b-7cb784e353f7", "comment": "Malware payload (Kangaroo)", "value": "03935ffaff4c9f2408d42e00ac76b01506fe2e96", "object_relation": "sha1", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676265430, "uuid": "e91c4387-0a80-4e84-85d9-864ba9d57b43", "comment": "Malware payload (Kangaroo)", "value": "37f82d662e5d3831322cf05235b5f84dc763ae5c929df5cde6431dcaeceda853f64cc814c5f97491eacb9afab51010a9", "object_relation": "sha3-384", "Tag": [ { "name": "Kangaroo", "colour": "#076F52", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265430, "uuid": "06193169-f606-4cbd-b4fc-6d1f0c721384", "value": "T11B62D8471FB80D65FBF1DA7014FE780AC1777829AB38EACB05585C4419725E0E57C7A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265430, "uuid": "f0aa9e1b-76b8-4701-9366-78b41c270e7e", "value": "745d7f50636fb2b25f5ec7f180ef6ab7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265430, "uuid": "5b5bbd38-cdcd-41c7-9258-3b59cbac3950", "value": "384:1duTZHnVcaI2r4BCTXZhtam11fTgC01p1Xx99z9eWVhWn:1du9CaxEovcm/BCvX9Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676265430, "uuid": "606ae1ed-d668-4be5-a426-96cedab9c9e5", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676265430, "uuid": "a2203de8-dacf-4871-adb1-4b06a607ae2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676265430, "uuid": "27986639-b2fe-44e1-b749-a1178646ffdb", "value": "2023-02-12_3c0596d76cc0fb86b2a6abd5e7c442a9_destroyer_kangaroo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcedcd74-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676280922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280922, "uuid": "c21f4b74-fd54-4e95-b368-c174e3704534", "comment": "Malware payload (Loki)", "value": "e811ba615778cdce0ce22906862703ff", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280922, "uuid": "63674091-a586-4f2c-92cb-14e7052e7ae1", "comment": "Malware payload (Loki)", "value": "bac32ad4e656df1b774dddfe1d3097f3df6dd811718f217941d2085e7e2ada93", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280922, "uuid": "05fb1183-a2e0-4ba1-9739-bf9b119d35c0", "comment": "Malware payload (Loki)", "value": "748b9199e5de4026f615a91e1612602db5186c34", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280922, "uuid": "966281d0-6990-4696-8591-3a9e91beded0", "comment": "Malware payload (Loki)", "value": "b23154c75ef700e2c13c972af4e2c1ce6b3a6a49a62fdc3e27765cbc6735244f61ade6be12fb6db95c39edc4390ad1c6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280922, "uuid": "7456524b-88ee-4939-9911-d96cf0d5e5db", "value": "T11413E54AE79E02A8CF411277231B0A899AFDB73EB35155B1345C833433EDC2D46666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280922, "uuid": "40a867d7-b630-401d-996d-c8195cb4b73f", "value": "768:iFx0XaIsnPRIa4fwJMY68IdHdVUqY75JltRz27WojNcdKd:if0Xvx3EMYWHDUqMJl7udccd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280922, "uuid": "cadfdbf8-9685-400d-ac28-a182bbe28c94", "value": 41908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280922, "uuid": "93741406-c8cf-45c9-95ba-b73b4f6fadc1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280922, "uuid": "10155b8d-9600-4b60-befd-40bdcb023552", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.29449.30130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08433b8-aba2-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676295182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295182, "uuid": "ca00d9aa-e08e-4d60-8f83-cd70c8c0acc3", "comment": "Malware payload (AgentTesla)", "value": "828d66f472a33813699447f0888e275f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295182, "uuid": "962816eb-6118-4f0a-8a1e-9d83ab266e90", "comment": "Malware payload (AgentTesla)", "value": "bc8adaeabfbb712f8af4274072205059dea9d81f0e09016531d43ebcb52c5db7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295182, "uuid": "5e29dfab-bcd7-4cd7-a41d-370589b1cbec", "comment": "Malware payload (AgentTesla)", "value": "55cd9561289e4ddcf9f8c82ea2a1a70602cce710", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295182, "uuid": "29fd710f-ff24-42f0-a373-60f78b91999a", "comment": "Malware payload (AgentTesla)", "value": "9c1fd46f23bfed34c91e32942af9f061ebd77fcf023f590313dd086359c8cbbc58305111a4906ce83b1d5d46bca21ecf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295182, "uuid": "b790eec9-b341-42bd-9994-2c9ecbba4da8", "value": "T16F05D0237B74E877C45C47B824A35F00D2B1D65A7627A78A07B5902DBCF3BC09E16A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295182, "uuid": "8ee7a243-e17c-402b-8281-20d33ab5ec07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295182, "uuid": "359fef53-eebd-4337-aaff-613dadaa5314", "value": "12288:PftD84yMmwxSrioOKHOv0MJONTYFgO2v5Fs14AGpd51Ng:ntY4yMmwxS1O8TX1vDsgd51N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676295182, "uuid": "291856d4-9b6a-4702-96cf-dfcb1c65bdbb", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676295182, "uuid": "7d262a12-b6ad-4583-ae98-0cbcdbb955b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295182, "uuid": "3b787b72-7b77-40b8-a788-8e8a2038f2df", "value": "ACCOUNT_STATEMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5441c076-ab8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1676286330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286330, "uuid": "cf8ea668-2547-498b-a125-2e9952c9b156", "comment": "Malware payload (AveMariaRAT)", "value": "af9debe623afb659ca86811ca214520f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286330, "uuid": "86f4605b-4b80-4ca6-8b1a-19e428f81fb6", "comment": "Malware payload (AveMariaRAT)", "value": "bcf890c1ff2d59b5efe9cc9094d369c23ddee9975752365fa2bfd74cd0885c2b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286330, "uuid": "07aefea2-59c3-443e-a7bd-ccefc399bf63", "comment": "Malware payload (AveMariaRAT)", "value": "fa5d07f60bcdc8b6f1443b2bd378a4a6122ae78d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286330, "uuid": "c03eaf4a-2c13-4b3b-9f46-d184fc45d6a2", "comment": "Malware payload (AveMariaRAT)", "value": "767ee09a91998454c1fa27ea53756d78326b3716bf3bb4b8df23eaa7edb551d56b594e9469ae2c2ee3444862bcc4b6b4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286330, "uuid": "507895cf-d666-4ac3-ae11-ed5a87a0278c", "value": "T133051243EA4CBED1DA1502F84833D95053A7FD666070DE2A2AA33DB7A8736873427D47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286330, "uuid": "976b3b4e-f4c0-4c95-8e83-f49f79afab34", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286330, "uuid": "9c7903f7-765e-45c5-a675-b16c636b4322", "value": "12288:fh6q6EMwYC0ND571Vd8dHd+pu/aYoEXjr6kdAn1cGG0qpAnnLYPhsh3:fYXwQ57jCVSYBykdAn1cGG0qpeLYqh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676286330, "uuid": "9e470f84-ec76-4d25-a303-28a911988e6a", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676286330, "uuid": "e180507e-a643-488c-b0f1-ab0fb5d44a05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286330, "uuid": "3f64ff03-6aba-4828-8e73-7d170103c90d", "value": "ReminttanceInvoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3352487d-ab85-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676282409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282409, "uuid": "fad36073-769c-4afd-9732-64102e962802", "comment": "Malware payload (AsyncRAT)", "value": "ef1d5c12e7c82a596b745950ad7c6b2e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282409, "uuid": "9ca71f6c-e0d6-49fb-a681-ec194274633d", "comment": "Malware payload (AsyncRAT)", "value": "bd0857d908d046dba7e755ec6a2ec07c0662c0ad99544f4d8e9704fd6957bc80", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282409, "uuid": "c99d364f-6559-43b2-bd3c-0213bddc9d1c", "comment": "Malware payload (AsyncRAT)", "value": "7711ca0c12d2780e85dfd5711049ee8194cbc746", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282409, "uuid": "5e7e6230-a129-4dc0-ba24-2cf67603cf6e", "comment": "Malware payload (AsyncRAT)", "value": "aab2214c764fc1166a3b8b78507068f3f7fb5ee73ea3fb444d0deecc34697ac858e9b03e985f8e088637efb05f2a0dc8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282409, "uuid": "74207abd-47a0-424f-881a-14468762f2d4", "value": "T1C6C2CF0FBFCEA82AD8BF5B34A5F392551779D72150B69F2A4DD8A0C5AE1638114433F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282409, "uuid": "a4ca7c07-7e1d-494b-a5da-638d0393f943", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282409, "uuid": "e7865dde-6521-417f-b8cf-c3efb031cb4a", "value": "768:Fu8JIwoHiIMvQp4BHCYgyXQDZNvLnQIMbB5eC23UzVJ9O0:Fu8JIwvM41gyXQlINVJ9O0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282409, "uuid": "203047d3-e156-41a6-abb1-c255a3e07fe0", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282409, "uuid": "ec1600a0-e61f-4d86-b281-ffc2116f9aee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282409, "uuid": "b6bf542f-ec72-43aa-85dc-ce247d167328", "value": "Excel.bat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbad2034-abb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676305026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305026, "uuid": "c9db9e94-258b-40a0-8828-60d6975fa9ad", "comment": "Malware payload (GCleaner)", "value": "7d81d86241e1e906a60f3990a6f21706", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305026, "uuid": "72331a19-b3f9-4718-b55a-c595d806b267", "comment": "Malware payload (GCleaner)", "value": "bd15dea90485f8b872c1f12e0ab55923945a00b8cae0b1a4cd3099ef6d9574d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305026, "uuid": "17cc9eee-adaa-40f9-ad80-03d6a9852e6f", "comment": "Malware payload (GCleaner)", "value": "48ba327b8d65ff755909e11e7dba1cac85f52540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676305026, "uuid": "30de3696-e684-48ec-94f2-4cb1b45ef197", "comment": "Malware payload (GCleaner)", "value": "8d1f1f0784865680802b93c944f1139e4464ccb09a9cd55eaa4f0c1f1a7d4db3649c18a46ce8d07582a9051840555678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305026, "uuid": "3b3a4cc4-4642-498f-9bcf-0f3fea36f56b", "value": "T1C1E5123C7145C55DC280BEB88D3A95E75CD7ADE3E9A0A463B0D93F3F91BD2888A19103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305026, "uuid": "e433b55a-cfc1-492f-9f66-c93df07820b9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305026, "uuid": "e4d3a4af-6238-446f-acd9-4ed8507df0ca", "value": "49152:rdHhgmlf8sOlzSKUVfY6/m8G9lt2JIkXvtLCgv2MR:JHhFlf3OVSKURY6/m8+lt2JHZv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676305026, "uuid": "19d21ad6-d5c3-4ce7-a3f3-778372cb733b", "value": 3140320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676305026, "uuid": "a0766888-82aa-42e8-9a07-87222fb87905", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676305026, "uuid": "3fc862e1-0a51-41fb-8da2-370e49c94d7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7fb183c-ab5f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676266284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266284, "uuid": "572a06d1-ad5d-48bc-8a2f-5fd0f60f4f14", "comment": "Malware payload (GCleaner)", "value": "39746ca63063df253fa20ca1c84c5c58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266284, "uuid": "8a10ee36-b074-42d0-9cb0-fbaaf62bcd1c", "comment": "Malware payload (GCleaner)", "value": "bd34d5717a798f5a77af0fff8beb716c75f62be477a07125f321dcbbc1ec1e60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266284, "uuid": "57050cb1-c2ad-45d5-a63d-c62c31da0417", "comment": "Malware payload (GCleaner)", "value": "ba745bdc7a8cf152d805533c12c835e328860d41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676266284, "uuid": "a3655839-e6a3-44be-a9db-75356e30c3f8", "comment": "Malware payload (GCleaner)", "value": "1473b5ee6b688b516154453ca782ab769c15bec79523a64386f43a18180fe09457eb7252c08677ed9eb5f6796e4f9495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266284, "uuid": "d8bd9608-318d-45f2-8059-98ca8fa5145f", "value": "T1BAE5127C7105C86DC680FEB4D92AD8E75CDA2DE3E9A0A46331D97F3F51B92889B09107", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266284, "uuid": "0d630f34-d8d5-4b94-943b-3b19edb074ae", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266284, "uuid": "f03ddacb-f7b9-4db8-b16a-a2ebeae63e09", "value": "49152:rdHexHQ9QzA7fjVAfzr2aWGMBEJ83gSDkuY2h8lHcpOX5i1LPLCgv2MR:JHexHHKjSzr2aWGMB083gSDkxkAfc1Pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676266284, "uuid": "b6e593ce-d9b4-4c74-9e8e-18247bd30c2a", "value": 3142823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676266284, "uuid": "cc610391-b7b5-45cd-8e26-5426379689f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676266284, "uuid": "eee2ecb6-c965-4898-9973-813ac40e7d88", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "215aeb9f-abe4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676323181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323181, "uuid": "c5e77a2d-5689-4dcf-bc8e-93c569f4d85f", "comment": "Malware payload", "value": "a5c047951544ceac9031408b39a35107", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323181, "uuid": "0c3be08e-881d-48da-afe8-a649ebe79760", "comment": "Malware payload", "value": "bd4d88b6c641e6115d73323f28b7a9503984f3b94da8d5422be11db0baa10076", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323181, "uuid": "c86990ff-0d36-4348-a611-74fc21d66094", "comment": "Malware payload", "value": "0bb752b88b06b6a87ceecc2c8f50e81065e7dc81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323181, "uuid": "8b63d66a-82bc-412b-88d9-df95cb173f0a", "comment": "Malware payload", "value": "c29243d7ee944755f0f94fcacffaa5906704b0c96b88d6b98f5331b60d250c9715c9edbb550097262f8ccd998b4f105e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323181, "uuid": "2c377a89-58d0-48dd-8ed6-e739e66975db", "value": "T1C6E5127C7245C46DC2C0FEB4882A94F75CDA6EE3E9A4E42231D97F3F56B9288470A507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323181, "uuid": "a7bcc6cf-543e-4e62-96a2-f8212f092b1d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323181, "uuid": "efe20ebd-28fa-4be8-9945-a4093ec2d51c", "value": "49152:rdHZtv9xzVx3FaCYLiDpmWer+Q6Pq2piNDstP7aBoMen/A5v1BXxLCgv2MR:JHXFxBxYeD4nJkpQYFnyNvv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676323181, "uuid": "0231001a-f6da-4644-b4b3-d74498ac5e1c", "value": 3129544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676323181, "uuid": "c59241a8-9f17-4ecb-80a5-a27ebbe77a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323181, "uuid": "5fe7c776-6074-4a02-9d8c-6393c1a8b22f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ddb097-ab37-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676249238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249238, "uuid": "6daca993-102b-40d9-a685-7f4920a363a2", "comment": "Malware payload (GCleaner)", "value": "488c5b0c8a8cb4b7f65aacad042b2c2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249238, "uuid": "108159b1-b12c-4fb5-aaff-5eb172e34b7f", "comment": "Malware payload (GCleaner)", "value": "bd9feae6195f5343caed218f6bd1516d548f993d76aae5ef1d59c2167321ef46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249238, "uuid": "da6b9cb5-d285-4f64-8558-54373d86847b", "comment": "Malware payload (GCleaner)", "value": "63e1d7056a667272c396425f74454bdb77237a12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249238, "uuid": "2e688167-dfdd-4c69-911f-96acfd197c5e", "comment": "Malware payload (GCleaner)", "value": "14fbe9cb6033dd6681b73695b40fb66fd44f0f0f2a38223804c75f2f50343c230a005b77ee1429e1e1e90718ddb95107", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249238, "uuid": "eb4553b2-0e43-4a26-bc61-f310465faa58", "value": "T147F5123C7156C52DC680FEB88C3AE4E35CE76EE3A4A4A422B0DDBF3F62791845619507", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249238, "uuid": "9df94f54-0f2e-450a-a9f9-38c20fbfbfd9", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249238, "uuid": "3e58f009-31f7-4219-b904-e8f7d623c9be", "value": "98304:JHvc+kc9PT67zO5yhELt16pqz2GwmJc07UTOv2MR:dvicx67zwyuxcIzkR07UTOvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676249238, "uuid": "3609fa5c-1fb5-4035-85f7-f091b0592ca9", "value": 3441698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676249238, "uuid": "c87c5d2f-6588-466e-a7ae-aeb544bfbcf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249238, "uuid": "289ae205-d350-402f-b3a1-17e2bb607e27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc21382-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676301565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301565, "uuid": "9389a6aa-dbd9-47cb-bf0c-26a8c261a270", "comment": "Malware payload (Loki)", "value": "d98376cccec4e1ccefc38b09afd85dd3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301565, "uuid": "9cfd4922-21ca-4a8f-9273-889328b05f77", "comment": "Malware payload (Loki)", "value": "bdb82d81ffa02255456381ea067543a576124ea9f52e6c3251bace3c5ee49e9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301565, "uuid": "2f7f8022-2c22-4705-8ca0-9886cf82b9d7", "comment": "Malware payload (Loki)", "value": "c8946784d5b3d902fb319fd194567613708b69f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301565, "uuid": "4af1e08b-93e3-407e-b383-a47ff1c4a443", "comment": "Malware payload (Loki)", "value": "ccd4f681507da7815c9c771749fc6fc7491942d79cf1ea9f43845583281f7d6892d38c351ef10e0fd87a3d8ab2b4c1c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301565, "uuid": "f200ce36-2f0f-46a2-a8e9-e9062b33d00f", "value": "T129E4124729088723C47D83FC9C766EA8D7A6AD352973F1A66CC779DF21703A1081A74E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301565, "uuid": "c28e3e78-7d58-4079-acb2-65ed16eec39c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301565, "uuid": "24ddf3fe-e01c-4117-9cbb-f8a3a4706444", "value": "12288:Ch6q6EMAYC0ND571Vd8r4GZH7LP5qFDzq57YyXjE2Cus8t0WvcT8yvdEWQr:CYXgQ57jcbZH3PAFTyXjE2x7t0BTH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301565, "uuid": "a777ff22-9ab2-41b2-8690-02ce6b032648", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301565, "uuid": "22e1f439-06b7-4117-b8d1-519866a13861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301565, "uuid": "59af565d-67f3-41f4-875b-a8309118aaa3", "value": "d98376cccec4e1ccefc38b09afd85dd3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3db5901-ab8a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676284853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284853, "uuid": "06fd7715-fe52-4169-aa08-416787a6d0b6", "comment": "Malware payload", "value": "1b0e5582e9d9117e85278d852a7f7a5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284853, "uuid": "b8575da4-0b67-439c-930d-c968fd1b5262", "comment": "Malware payload", "value": "bdca414b0d32a88adfd9d44e54f9821b67239061a04e7e81168e29ee6f9649a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284853, "uuid": "28155fbc-9678-40a3-b0e1-8f4ce1caca7a", "comment": "Malware payload", "value": "f38efe11c71afed1e40f2aa227b0dc3801bb2a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676284853, "uuid": "42aaa95d-3938-47f7-bd56-c0fcc0edfd01", "comment": "Malware payload", "value": "ab3a0be5eb079ad08a6c3bc3375729358d41e88ea0fd76cba3e81ea34400f51e1235f11699bdd06c10e85dbf45041c96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284853, "uuid": "06054f4c-ad18-4a1d-8e59-74897313597d", "value": "T15EF30C99123547B4E417C4392BF95BC85B7C9E21404F8F98A6DE8B36BEA2F354D02EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284853, "uuid": "73a987e9-7905-4539-a0ce-cda43219f523", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284853, "uuid": "f3076f75-ddf2-4034-a06b-769fdba33a61", "value": "3072:btQpBKvij6fK7MM6Koo56oWyLQV4V+aGFYKziHq9nSbPOX:RQPKviufK7X6KoogoW14xGFBziHq9nSb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676284853, "uuid": "7e669fc1-9173-438f-adfa-d53aa041070c", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676284853, "uuid": "332b63fe-1e28-4c70-ac42-0abec8122309", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676284853, "uuid": "3f781e22-bdfc-4b14-b575-e8500f398c9a", "value": "GGLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf7964b-ab36-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676248415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248415, "uuid": "88fcad1c-a36c-44f2-8c06-009ef461b67c", "comment": "Malware payload (RedLineStealer)", "value": "137ff57edea11ba30b2f830b796f22dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248415, "uuid": "6da10e20-d076-4a02-abbb-f6967c720df8", "comment": "Malware payload (RedLineStealer)", "value": "be25926929b1aae0257d7f7614dd5ad637b8fd8e139c68f4d717e3dc9913e3cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248415, "uuid": "e16cdc44-d088-41e0-9333-dc47d5cd58b9", "comment": "Malware payload (RedLineStealer)", "value": "0a79e13b2b2be9fc02dd9b6f2d978291f2f5b460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248415, "uuid": "21b08557-ac99-40ff-bd39-128df1b70201", "comment": "Malware payload (RedLineStealer)", "value": "2131672c5fa787e1670466f4b59792fae8adff29f9c7d36f9f9cbd1540bb1ed5478c711f35bbecd17b3d377852a9b54a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248415, "uuid": "ab00ece2-e64e-4308-aac7-7cfc74b52bd2", "value": "T1FAF4120BBBE88062DDF1737059F603D31A317EA04638825B669F6D190C72AE1F67176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248415, "uuid": "721cb7d9-d5e1-4388-ba80-be51d89fe988", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248415, "uuid": "f3272666-68b5-4c3a-b6b2-d7001d035182", "value": "12288:6Mrcy90/7wQVEbzCkXWXcVCfQpXEeJsykK/f5+XinMvspLnIm4GAt82K:uyAVezsaGQvXjsExIzbM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676248415, "uuid": "36d8b54a-45e0-475d-a417-dee25b75b873", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676248415, "uuid": "928ff7de-30be-453c-9941-7c4e8e42bcd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248415, "uuid": "9b6881ce-a4f1-4eee-a2ff-8efe3c58e9e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "314d9d0a-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299586, "uuid": "477a805c-053e-4b6b-8501-98947eb69521", "comment": "Malware payload (SnakeKeylogger)", "value": "f5bdd9a85ef633d53b1d8c1b9e50a683", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299586, "uuid": "c130acca-2c8b-4b7a-a38f-ef8d44ffe65c", "comment": "Malware payload (SnakeKeylogger)", "value": "bedbc46bb0550879158a1ed1a754614695bfe4bb8a86518fe75a4a087b1f329e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299586, "uuid": "292cd2e0-6439-4170-8c77-a60574284628", "comment": "Malware payload (SnakeKeylogger)", "value": "d824788ce515a356144b8a56ed972769e0cd3092", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299586, "uuid": "5b7491f4-ce2c-4ebc-a656-6beb08e8069d", "comment": "Malware payload (SnakeKeylogger)", "value": "a706f05d338ede543986f3c239b7bbb19c6d80dd3847d3229aa436c585aaf5a30287b8a7f2ace400afc97dac772c33c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299586, "uuid": "6e09e43b-9168-4c67-a3fa-38fc4c6ec126", "value": "T1EE85F8243FEA902AF1B76F729EF075959F7BF5A236029B5B104403560D03B40ED92A7E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299586, "uuid": "7c9ddc5b-20ac-4c84-acf3-5519a2c4976a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299586, "uuid": "9d276e50-7384-42a3-a7eb-19f1bda7bf43", "value": "12288:vKGLziVgF8I+d8qayqBko2NkEXK4KIhHW2QOAexNt2jASMi4NuO7APC7mm2tMNTT:Np8I+d8riNkJE+b7OkqDdyh2OQwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299586, "uuid": "3c6ef033-f58b-46eb-aa3b-ce35294c7923", "value": 1783296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299586, "uuid": "eed1b697-ef32-4dd4-9cf6-aebda9363b38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299586, "uuid": "65ce305d-dd5f-4f33-83ef-8e754b20fcb7", "value": "09876435800987645678000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8a7e23-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676280604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280604, "uuid": "8c93bd6e-a84c-4b51-b727-1649d9ef5faa", "comment": "Malware payload (AgentTesla)", "value": "98fd54d675e42b1344be0edbf7dcda7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280604, "uuid": "b128501c-4354-4722-bf75-537da4608502", "comment": "Malware payload (AgentTesla)", "value": "bf3de2db09e325e210d9fad91b56916950fa2101ca7505e1671504d352f6ab2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280604, "uuid": "09e42b2a-79f7-4504-a099-b64416fbe522", "comment": "Malware payload (AgentTesla)", "value": "a6e2a97ae9c55a9e86f2f1668be9492e54b09afe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280604, "uuid": "e0cb7966-53c9-4dcd-8b72-897e0088b563", "comment": "Malware payload (AgentTesla)", "value": "9bb450b54eb5662283fc3e566afb9fdc1e212c286eef1dd8634ecf858bc330c692472bcdce56fe4bb3dbad6550c0fa1b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280604, "uuid": "17723478-fd69-44eb-9b78-38724b52da30", "value": "T1A315221B265D075AE51D64B580FB59340BF2AFC3A27386857F88728C4E113E7BE6039B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280604, "uuid": "a7418856-22d5-4075-ad02-c3ac636bf8c7", "value": "24576:yli9EfhoeQqs80D3PsGVIVr6iSQ7R7hnusIOBzePL:yliWmqs80DfsNVrHBhumBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280604, "uuid": "ce2fa453-86f1-4c2a-b53b-8ffd99c0d71c", "value": 926792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280604, "uuid": "7d3c16b2-f8a7-44f4-a59f-4bc6411af4f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280604, "uuid": "3956c912-dd4a-4a27-9c92-b3bdbe0912de", "value": "FedEx Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1222f3ba-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676280636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280636, "uuid": "ddc7163c-f81e-427b-b517-04f26cb75d4e", "comment": "Malware payload (Formbook)", "value": "1e80fde95cf12cf57b944322804111c7", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280636, "uuid": "d72f1c83-2612-4310-b737-c0e03aa0122c", "comment": "Malware payload (Formbook)", "value": "bfa0c11853ee9aa5f20df491c68ebbd73aecc22b0192f5e964656b84dfc5ecf0", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280636, "uuid": "ae61a08b-dd98-44b2-adcd-926271da0401", "comment": "Malware payload (Formbook)", "value": "f13928786ff917ba35ade9d03d1fec4699b6bb63", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280636, "uuid": "9fc656c6-df7e-427a-83f5-cf0099764de6", "comment": "Malware payload (Formbook)", "value": "b139e5306644ce56b14301fac1256ae68cfc70b9dcc1463d16ce0a560ee9198a2f98204149a2b7fe29ab054f1cb2a722", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280636, "uuid": "4abc3fc4-1592-4310-af11-4dab17f260a7", "value": "T1D5A5230136ED5B68E66D63B06875B140A3393F8B2D71D32D7DD931CD2932F868366A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280636, "uuid": "52fe1164-a0eb-442d-a936-04f9e20b333e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280636, "uuid": "ad46c627-920f-435c-a7c9-cbe47fe942e2", "value": "49152:J9soUPxeF6wVWi0Tz5/MgcQF5aJ0DoX441h:aZwVWi0B/MJQF59oXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280636, "uuid": "216c6ca5-d12d-4b87-87a1-09d8943b2bee", "value": 2150912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280636, "uuid": "bcbb0117-8aa9-4bda-999d-cf1cc54b99de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280636, "uuid": "46779ac5-62b0-4290-b686-68b3742201e0", "value": "DHL Notification_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abb0c81-ab67-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676269644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269644, "uuid": "dd9d4b32-5d10-4808-beeb-c835b9826c8a", "comment": "Malware payload (Amadey)", "value": "dd1479326663771f491b6f0564136a60", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269644, "uuid": "6ba570f8-c537-467f-8188-e35be09fa8c0", "comment": "Malware payload (Amadey)", "value": "c03925d1a1526ae0fff7a594044faf81b248a2229f3661df0135140334096acd", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269644, "uuid": "00289ef1-688a-4361-9602-269a44eaf816", "comment": "Malware payload (Amadey)", "value": "9579ab1046c96ec65a7f29a8943bba9ba2e0205b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676269644, "uuid": "0c5cd19b-fdfd-4642-8728-82dbe2c4d9aa", "comment": "Malware payload (Amadey)", "value": "6e2aec31cdf870969fd1b6399b9f287ce42c6a2da3bcbfa6a87c3bd987594ce5d32a15898432b2fe538ba92b90f5e728", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269644, "uuid": "c9bf58f9-da83-464a-8d10-a8dec800561d", "value": "T1EAF4120BEBE99163EAA153700DF307D319397D61AB34825B63CE6C1A2971AB0657133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269644, "uuid": "9ead6d45-67c2-4971-9bcf-64cd7b6d0306", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269644, "uuid": "56707781-492e-4061-bd60-d6772348c850", "value": "12288:UMrVy90fYPXoXUozLHCvV7q7uYuGQvWJUeJDJWEGnS5qezkZWTS:5yGNXRzLHMV7WFXQOenSY0kIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676269644, "uuid": "3c012c1f-3595-4926-9619-15d4b82af2b4", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676269644, "uuid": "0b5563e3-a08c-4369-a0c0-c06104bdd171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676269644, "uuid": "8c23f4db-a138-47bc-89b9-7eedec0843df", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72287c4e-ab52-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676260610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260610, "uuid": "b2e20fa7-c604-4d9d-96f7-71c81f5ae294", "comment": "Malware payload (RedLineStealer)", "value": "b0399927702ec2c955b6918592d2af5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260610, "uuid": "a135a47e-ea40-4be8-83fc-a0e0a81b234a", "comment": "Malware payload (RedLineStealer)", "value": "c11e1f5fcd647285ce116b8d4c53684b1766e56797f8e2ee64db3d9d21982303", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260610, "uuid": "08aaf8fa-2953-4f92-8e17-24e72d12b8ef", "comment": "Malware payload (RedLineStealer)", "value": "1be3a8f2fd2804d77ff03f23155357ba6ae090df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676260610, "uuid": "f0fd496b-0d09-4132-bae1-7cc154300b1f", "comment": "Malware payload (RedLineStealer)", "value": "e0437ff162a65653616ebd761af7bf51d02d0151293f5735621356e19bf24a0f28782689f8aad23ded0ea414cb133b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260610, "uuid": "c98c7fb4-3081-40d7-9769-febe26f46ec2", "value": "T1AFF4124BBADC9032F4B59B7018F602D30A767D219E74829B238F6E5D0C726B06679773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260610, "uuid": "7b0f8432-54df-458e-a258-0962e1ec78ac", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260610, "uuid": "031a7847-cbd0-4543-9519-286dcaa7bdc1", "value": "12288:lMrPy90tjmWl7LkLbUc6GrZM+veJV+rZHuiMgeBcTKN7H8:2yi3lALbKGNCVoHWgfTKN7c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676260610, "uuid": "ca1170ac-3b45-4898-ac0a-69c8b7497b68", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676260610, "uuid": "68af0ae6-d95c-4710-b7bd-83b415e01fef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676260610, "uuid": "72a96682-7760-4263-96e5-5cca18b0f73d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d998a48d-abb8-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676304593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304593, "uuid": "847a2e47-720d-447e-8261-8b97f62c63ea", "comment": "Malware payload (RedLineStealer)", "value": "3904abcf612a6662ad540173e812750f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304593, "uuid": "b2c0de50-bf8e-4c73-bce6-2ca98c768e65", "comment": "Malware payload (RedLineStealer)", "value": "c1f7164da1801b2e7b204bfbbc8c1b107db9e199b59d75373035bcbdab7f6585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304593, "uuid": "649c501a-f1e4-47a8-b7d9-52c8980843b4", "comment": "Malware payload (RedLineStealer)", "value": "539f0e8ec625c8d43b1ff56b3ac2f60979b5afd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304593, "uuid": "6f5270c1-ff9c-4cd7-96b5-78bbc78041bb", "comment": "Malware payload (RedLineStealer)", "value": "b1e5ea444c708479aed9e4a70d177565af917734517e1212ca70fdc809e324cf61254d656d8ac1dda0c8889f65eeb86e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304593, "uuid": "8c88753a-b46e-4d45-9882-91b54cfb5f61", "value": "T171F4120BA7E99063E974A7710CF353D30639BE709B38829B534E9D260C73566B632367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304593, "uuid": "cb565641-ab3e-4ff1-9449-0c21c60e08a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304593, "uuid": "d7e03b05-1e51-4b85-b971-9a76a81721d9", "value": "12288:RMr/y90wnbKwcM9VvasF9dSYu/Hz655MeJErzuHMzWyb5TzzoIZ4U:6yrnbKRM9VysHdm/OZ+CMSkvT/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676304593, "uuid": "5d5f509d-a244-452c-bde6-865551c7b716", "value": 747008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676304593, "uuid": "3bb41cd1-579f-418d-b7fe-17d9a64306ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304593, "uuid": "f35ae2a6-f879-4a43-bf7b-4798a2c96e5d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3839334f-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299597, "uuid": "9724b60f-d9ee-45ef-974b-eaa10126e71b", "comment": "Malware payload (SnakeKeylogger)", "value": "56e49a2131bc90c096ef4ca9052b120e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299597, "uuid": "c2d59b28-c060-49c8-b630-b8fab66cbe2a", "comment": "Malware payload (SnakeKeylogger)", "value": "c2b75ac0591a9d623520430e0c5adcf9ce5a812c77c43f9b1df080b628d48ad7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299597, "uuid": "ccdfada0-670e-46f3-84c5-3d637fc2bb90", "comment": "Malware payload (SnakeKeylogger)", "value": "55128ff26142e54a64efa41207bf4dc1eb83f5fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299597, "uuid": "ffac19d7-2291-48ca-9db1-a63917d507ba", "comment": "Malware payload (SnakeKeylogger)", "value": "1c044b4602578b44dfaf64c6b33b6fc61b6d1a883a4205cf0aebea8cef97589ce281b67408634692abf2a85a9bb3bcfd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299597, "uuid": "76612dad-1659-4711-9b61-5e9476227a4f", "value": "T167A49F873584859CCE6A15F36207454433E5DCFFC618E61AAFC933939EE5BA21823B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299597, "uuid": "224ea068-ea9e-4cb4-ad8c-c8144d2e8219", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299597, "uuid": "5105d96d-05e8-4911-84ce-7405b1fdfce5", "value": "12288:bFDutOc6duxKLopiOyUlx88WlqDHhBzGHJ6Ap/Hv6nnjqKoe:WtFnBa8AJP6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299597, "uuid": "988aa539-1245-4ce2-a0c6-88c4fe14af04", "value": 452096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299597, "uuid": "1d126458-f303-4505-8c46-573ff4aaedbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299597, "uuid": "756a7360-c6c3-4228-8033-f5b982675843", "value": "PO#214317.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f1b9b3-ab8e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676286408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286408, "uuid": "84d7141e-8e32-439b-8b21-85abe618e166", "comment": "Malware payload (Smoke Loader)", "value": "b02479a6c16c1571bf7b6bf934253d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286408, "uuid": "60103d61-3882-4f50-bbf8-aaacc3c9edd0", "comment": "Malware payload (Smoke Loader)", "value": "c2bb7de1b81b56aacaa92b4f0f37500d60ec637606c9eb72e1f25b69d0fce9dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286408, "uuid": "f8871e40-9224-40c9-91d2-ddb23c15e3ec", "comment": "Malware payload (Smoke Loader)", "value": "716af19d87a39199273b8612b0adabe66cb9ec2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676286408, "uuid": "4889e624-ffa9-4b32-ad28-d6d28a7c26e8", "comment": "Malware payload (Smoke Loader)", "value": "979dcff481bc5e5d1285fd2b2a2864de3368fefe1b00b15d08ec3e23a8525e5e2d6c5eebca0720a8978c4983686901c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286408, "uuid": "3a577ada-2be3-4657-8247-8fbd26314a79", "value": "T11814BE13F6D0E472D0635A385929C2F56A3EF8B14E38E59B37582B2E1EF02D19A73351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286408, "uuid": "7bd1a672-b3a2-4def-8992-75d27c481565", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286408, "uuid": "655eaf38-0264-4ad4-a31b-2ac052f00ed3", "value": "3072:vvcXtx/GPR8XlInzlvbUhJaIBemkW9DehDcPDfJJ9q4cQvxdbB03:vvAvt1IzlvQhJaoWSP7hbXrB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676286408, "uuid": "f32cdef0-7cb0-4b93-8e28-eb212ae88f7d", "value": 200704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676286408, "uuid": "c4c18856-6129-441d-ba98-7364df29320c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676286408, "uuid": "7f3f8e43-bf9a-4c48-8d8c-ecc892bafae4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952a5e65-abed-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676327241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327241, "uuid": "896a23c6-f5cf-4733-ac29-367868ea0a4e", "comment": "Malware payload", "value": "7faca5df40b94ada91cec384713212e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327241, "uuid": "16a424bf-885b-4e9c-a27c-cef71835827c", "comment": "Malware payload", "value": "c2efa6a35c63622b49a512eb32775aa94f77223627def85bcf3e507114ab4bad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327241, "uuid": "fe96e7a8-e11c-4065-81bc-d53d5d668b99", "comment": "Malware payload", "value": "2fcf99c8f9ceb5826efcd393226014a3da4126f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327241, "uuid": "a100310b-7706-4fa1-93c2-07c84257c28e", "comment": "Malware payload", "value": "f5efbe0a291614bc938c649be7bd5855b3a0f26aff7a599042880804a03015332788487ad5713f2105ca4e69a73939ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327241, "uuid": "fdecb465-83da-4964-9467-9eccd805b2f8", "value": "T163F4121FB7E89022E9F49B701DF603C326367E50663983AF938E6C590C329E4A135767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327241, "uuid": "1183eaa2-bb08-4079-b035-7521a6b4c2a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327241, "uuid": "e4519b58-9936-4cf3-b7f4-53e75a1949b0", "value": "12288:eMrpy905YdCGWzFhWsqmnnKaeJm9cxbctMW8lS:XyJdCGWz3nym9cxQtM9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676327241, "uuid": "2224a041-9969-4a69-8533-0a219ccbe1f6", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676327241, "uuid": "05090886-c00b-4b6c-a4f0-af6df93a7d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327241, "uuid": "eca547bc-cce5-4f7f-90ab-a98512718150", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72a8446-ab88-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676283919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283919, "uuid": "f5475ecf-754f-4820-a6af-b1b72be42492", "comment": "Malware payload (DCRat)", "value": "286cf0d432d0a61e5650f574a9ddd932", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283919, "uuid": "9ca1c0dc-72b1-4521-8afb-72340b1aa67f", "comment": "Malware payload (DCRat)", "value": "c2faf400b7fb5d379829f39739c2a3e2acffdabe362a96d8fbe28b3800bcbb56", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283919, "uuid": "734840da-44c5-40b3-8906-debb1407fc0f", "comment": "Malware payload (DCRat)", "value": "4ecb67f745276d37235e43a05108e73d5153a179", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283919, "uuid": "29d6e57a-d33b-4ae8-bd67-9190dfe81289", "comment": "Malware payload (DCRat)", "value": "0ddee2fefb17811a5471ebc4b74cdd17e8f898d7871cb70504e3c2e42aa62c6dea063490ea19ec34525a202abb0ac9b5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283919, "uuid": "bb27f700-3fda-4b83-84e0-6a27e6c4a9c6", "value": "T1B5F30D99523143B4E417C4382BF45BC95B7C9E22404F9F9CA69E9B36BEA2F354D02EC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283919, "uuid": "14b1b5c4-5b21-428b-926b-d5cee4658b4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283919, "uuid": "5f22b49b-180e-4392-bc42-6c5baf79c0e4", "value": "3072:DUYVRtgrk93FgBzyN1PNXsclKOXjxS4HCJDfUvAjbVwU:D3Wk93FgBzg1PNXLlpVS4HCJDc4jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676283919, "uuid": "84d5e3ed-4043-4fbc-8949-d897ff219464", "value": 162816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676283919, "uuid": "6f36490c-243d-477d-bb14-ce4944ad7649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283919, "uuid": "e637ac2c-f16a-49ab-a0cb-e7ae56037038", "value": "ThirstyLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34b0911-ab76-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676276289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276289, "uuid": "a91aa1da-bd12-47e2-b836-dcc029c9455c", "comment": "Malware payload (Amadey)", "value": "67074e93baad04f26c772b5cacc5647e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276289, "uuid": "27a34de0-1ce0-454e-a9ea-e29dc8f732af", "comment": "Malware payload (Amadey)", "value": "c35709026675a5d8ddf7b4f405f25c5b7c0b021a083f509483015af16a903705", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276289, "uuid": "ec616595-55a1-4f25-ac6f-6250b8677070", "comment": "Malware payload (Amadey)", "value": "b46eea19bcc4daea1e4df087089fb881b74df798", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276289, "uuid": "d6e3c6d0-ad29-4921-b67d-d11379f6ac01", "comment": "Malware payload (Amadey)", "value": "0cf7bfb4e204d901b32489fbde1f9beb4f9a6a208df72a2ec219c197bdad2ccd348ca998fcf7828022403b3afc85383d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276289, "uuid": "8c22bad9-7430-454e-8552-53d69e8f310d", "value": "T1FFF41247B6E89132E9F5673009F613D31A367D605A38829F278F6E580C722D4A23577F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276289, "uuid": "b3120d76-56a7-4e9d-a5fa-3af80bbf0420", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276289, "uuid": "9590fef1-d3d1-4629-84d1-719d7de89c54", "value": "12288:IMray90cRLBfQmJTOgkqct2NOUwr0ieJp8sX9spv+TPXvc1suElILY7l4Z:iyCWkoGKXbEEu8l4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276289, "uuid": "21692d2c-eba3-43cb-9cdb-913f290db56d", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276289, "uuid": "dfbfd8cb-2165-441d-a4bc-4f7c836e5374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276289, "uuid": "dcd74fc5-091e-465d-9972-c7011e93b602", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f18a11-ab50-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676259627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259627, "uuid": "b5b833fa-cfa3-44f0-833f-4aabb062b160", "comment": "Malware payload (Smoke Loader)", "value": "f6ff1805d054c2e10bb993166c9dae1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259627, "uuid": "d4d1cc91-5b93-4e5e-8269-e9438eeb57df", "comment": "Malware payload (Smoke Loader)", "value": "c3ee79b7f326fe41e0bb574a65808160795850f993f9961061415051e3cd35cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259627, "uuid": "213569c8-fc1c-42cf-8e3d-5eed5c3dcb67", "comment": "Malware payload (Smoke Loader)", "value": "b0bbd730e4b6282aa4d3f301ee29a3098d55b0ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676259627, "uuid": "31fbe9ed-5e3c-45ea-b89e-1ff87423be49", "comment": "Malware payload (Smoke Loader)", "value": "08f4dd27d26928a55721562da36f8c372c056f31169cb79ccaa33f9ad863195a309fa59679bdf1b3a91a47e0a6f523c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259627, "uuid": "a9d81fcd-f3ed-47a1-9d61-65b33a6b347b", "value": "T12A04D01675B2C073D1A78A345431E6E0692FBCB167A4C09B3348EBAF2D313D19A6D397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259627, "uuid": "c1ce041f-0b1c-4796-8ef3-d9ada904bf36", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259627, "uuid": "13ffe265-8cf1-4af8-9449-9f4d3c96c685", "value": "3072:Ms1uDV39aK35XkfR8aAdoKsoehdL1GFqewklPohFVNy9f:M1VPBk58aACKsVh5I0ew6PmFVg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676259627, "uuid": "3b3f2afe-4a4e-4577-b482-a29c153e0a97", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676259627, "uuid": "7bebc64a-afa5-471c-ad8b-eefd3cef1750", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676259627, "uuid": "a0cd1e5e-333a-40b6-8f20-e4c6cfee9dc9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40874f67-ab8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676285867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285867, "uuid": "33b0f372-ad42-43c1-83a6-e11b6658393c", "comment": "Malware payload (Smoke Loader)", "value": "5d704bd1407d15e32ecd87ae56891f38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285867, "uuid": "f99e3e52-a0d4-4ce6-883b-b895567deace", "comment": "Malware payload (Smoke Loader)", "value": "c40dd63e792aeda01ae4599279560b1e3fd5993592c2398414ab4f637b3c3e8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285867, "uuid": "268ae17a-8f0d-4a5e-9c36-bf5b694cca15", "comment": "Malware payload (Smoke Loader)", "value": "b750f279d245d1045d2cd672896f8545dfb0c10b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285867, "uuid": "db1d9790-babd-45a1-8460-2dc579ce375d", "comment": "Malware payload (Smoke Loader)", "value": "0c9752e8e23221ad2c03d3ca9d4f9f1ccb18c5b98120e6126850e2af7758dca051210ba7a0b34fd19efde1ad3c35b409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285867, "uuid": "f1925090-6726-412e-ba14-39aa1fee1e0b", "value": "T1DB14D02372F0D431C47216309E78C6B46B7EB9B12E786697775A272E0EB02D1D673352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285867, "uuid": "dcbdc119-f7c3-4352-9205-230c966a2e6f", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285867, "uuid": "7743dbac-b3d2-4a7c-9036-f02f4ab3359c", "value": "3072:MpgvJ2ZMYURpkUIGeUXL8CnZprpWvD+0UomkAsrdJ7Ppg2x0iekP6CB3WxV:MpsosjIhUXL8CnZpVwDZYkNdJ7px4Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285867, "uuid": "83a53c86-0429-44e1-85ec-10798b978c3a", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285867, "uuid": "69b5b4b0-5c39-43cd-9f87-a6663401bf21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285867, "uuid": "60cd8809-6117-460b-affc-916b2d8917d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c0fc13-ab64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676268166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268166, "uuid": "bcf840e0-9fe4-49cc-97cb-4b45b8e4f567", "comment": "Malware payload (Smoke Loader)", "value": "3c0f65fdef69235c5580b14703844b52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268166, "uuid": "9f7cfba5-7d8e-4e2b-be43-de55b057dd56", "comment": "Malware payload (Smoke Loader)", "value": "c44c89acaf6e9f5dc768f441673fb88423bf5c791c3cdf7d09dd3978d528104b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268166, "uuid": "188a068a-2c0f-44f4-8f2b-b218945b1151", "comment": "Malware payload (Smoke Loader)", "value": "2e1ded5e3544d55a1627f1c75df6f3b191865660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268166, "uuid": "b9f7c121-ca56-4771-9da6-72e6bf8a6b1e", "comment": "Malware payload (Smoke Loader)", "value": "3392832e2ed1028c23bd1598023413f138f1593ba14f67006d724555c1794e9c0e375805966b6f0525841e056246690e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268166, "uuid": "89c848f7-a954-4b24-9137-f13f206f240c", "value": "T17454F1123D6D807BD09B8575A535D6906A3F7C72BBA1858B33001AAEDE307C2873D7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268166, "uuid": "ca7e6501-b5b8-4242-a970-652d10800f3b", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268166, "uuid": "c5e0c5e4-df69-4995-b4ef-5b27adc17b85", "value": "6144:K2TBe0YLXYl9/rDSEehH0DdoxEhHCbbJh7BDb:8UpWGDdSEBEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676268166, "uuid": "d4c05ff3-0d71-425d-832a-44fd6dc7c505", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676268166, "uuid": "1ec200c0-2089-44cd-87d4-fc43448b21ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268166, "uuid": "bbd45083-ddc4-48f9-b00c-b5e047aea713", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b50fe5-ab63-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676267755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267755, "uuid": "0f6e9ef7-fad5-4855-9dd2-73c3cdf12bc6", "comment": "Malware payload (RedLineStealer)", "value": "b6d9fe1712d9625099b1ecd72c42acbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267755, "uuid": "dda43008-2319-4459-93a7-81f58cd91699", "comment": "Malware payload (RedLineStealer)", "value": "c45dd469f3b1847106f834383684260614865936e76afea8a9c7514268d9aa1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267755, "uuid": "72f9b350-3849-405b-8288-7cf3f040aca5", "comment": "Malware payload (RedLineStealer)", "value": "a6095536c39e8e007613cbcc4bee85cfbd58b5b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676267755, "uuid": "b90aab4a-0cda-4999-b856-72cccb629fba", "comment": "Malware payload (RedLineStealer)", "value": "8e7b741ff8129b07c7479c97f8ff04c7704901f62cec8e7b30914567764ac5d18c22101af51f75cd146de4aa084d899b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267755, "uuid": "ed38d748-d915-48a7-901a-af66779f8109", "value": "T1FEF41247EBF8A431D5B4277059F203D30A36BD615B34825A678FBC5A1C326B0B63639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267755, "uuid": "d2301afd-14fe-49c6-bb30-bc8150e2e832", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267755, "uuid": "cc634d35-4081-48d6-a3e0-6d3d931545ae", "value": "12288:vMrmy90jhGVM0iGtS0my+7d3BEHH2YeJcHOU80ZUt3v6n/g9Ec2/k:tyQIVMMtiJpBsycHx80it3vfrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676267755, "uuid": "f1f06f1c-69c9-4d67-9968-c56b4bff4b99", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676267755, "uuid": "a2772c50-52b8-4671-bad1-126d58cd9cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676267755, "uuid": "6406ccaa-3cb6-4ab2-b93e-2e5dfcc9aa2b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b891f309-ab8b-11ed-88f6-42010a9c006e", "comment": "Malware payload (CoinMiner)", "timestamp": 1676285210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285210, "uuid": "9cbdaa50-d937-4cfe-9aaf-ee3ebe673faa", "comment": "Malware payload (CoinMiner)", "value": "512fbc039f55ef4012b11cd15c54e2a0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285210, "uuid": "e94d12f8-b5a4-4f62-91e0-cc5a54c8c6a3", "comment": "Malware payload (CoinMiner)", "value": "c45f7a52901b74e468b972cf7deb31297a5b5ad52c43fd2f73be3bede5ffd269", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285210, "uuid": "ff438ea2-4d93-4e3c-ba63-1750358a80a3", "comment": "Malware payload (CoinMiner)", "value": "35b57a9e8020d2ce60655ef2b1952cac7cd75760", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285210, "uuid": "a63cbea3-a2ea-4c87-b40e-ad17b4f2af62", "comment": "Malware payload (CoinMiner)", "value": "fb371958416d45a356c0f70f218ac84719539443a2ad5959adf52eed8ffdd9e654b0c38505536a6077f8e1eec7d75af0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285210, "uuid": "b982f02d-cc0e-42fe-b4ba-041b2bb5812b", "value": "T16E062389F2F11C7BC0AA80F06440177356BAAD1B84BE9315B309F8FA1A71525FA3ED57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285210, "uuid": "17237245-4bb0-47ad-a252-21577cd3819c", "value": "df9a7bc1c6c6cd97d04c3762fdde6719", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285210, "uuid": "d9c3e3d8-9732-4262-8eb9-5e0f48345f3c", "value": "98304:npWUPNtIjcNVxL7Z4Av9O4G46xYTD2hd0e84ur:AWNtjxL7ZW4G0DQyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285210, "uuid": "276bcae9-47da-4a02-b93f-2a1ce2ee2004", "value": 3814912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285210, "uuid": "bdfd6780-e0fc-4aed-b59e-7d25fac3ec33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285210, "uuid": "1d1e2d22-78d0-4f7a-b3b3-8a52630ebd12", "value": "Rust.Cheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a554eae-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676276811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276811, "uuid": "971f8aac-c78d-4f41-87f0-d953ea32e114", "comment": "Malware payload (SnakeKeylogger)", "value": "ade84c53c7fd18453adcaefc322073f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276811, "uuid": "5e0b1b67-4a65-4a1a-9e98-57ca0d49f382", "comment": "Malware payload (SnakeKeylogger)", "value": "c64eedbbfb5e111089a3e0eab54f848da53dc1387b9c3a53653c534d198730fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276811, "uuid": "aacd2b3c-44d4-4110-9ba8-76fae04b5bdd", "comment": "Malware payload (SnakeKeylogger)", "value": "9b94edb521431e5baa3c8c95dfbb0bbd1c3d7225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276811, "uuid": "7f03b11e-eabf-45b3-b845-56dfb981b02a", "comment": "Malware payload (SnakeKeylogger)", "value": "e60920290e90ef9c4db47e532edcb8af26a753d12ebf90ffdcae05b73c8f174423d64971d6d7cfd0e8f7f341a944af08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276811, "uuid": "c870516e-8350-43a5-afcc-f23ff3fcca54", "value": "T1DC05BE85EAC04084DC3D6774253E8D25965BBEFAA8B8E14E6F8D723177F31E3183614A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276811, "uuid": "a0dd5d3f-b2fc-4015-9b54-0a4a6b2c1e06", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276811, "uuid": "bfb98c49-4608-46fb-9941-a5e955eb9323", "value": "24576:IYOhaSAi7rs4EHCMj9r0BcgwkCtrOsEhTNL:ZO97rs4EiMxwnKqJNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276811, "uuid": "9025ff2c-563f-4bff-946f-978b5070b272", "value": 824415, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276811, "uuid": "bfa3d154-504f-4640-9956-3ab42a72a2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276811, "uuid": "1a9cd49f-5046-4d4b-91c6-ee45c87746c0", "value": "shippingDoc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfb16f4-ab90-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676287284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287284, "uuid": "c1819a69-8251-4431-8d45-bb48745ed557", "comment": "Malware payload (Mirai)", "value": "fa2a7bae27a33c64a08eb63c92ca7e06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287284, "uuid": "dea9d422-043d-4b95-bbd7-37ec5175d53a", "comment": "Malware payload (Mirai)", "value": "c696b81732622d030f3a2e384013c8a012fab111f6b474bd1f8bfe704ac4f9b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287284, "uuid": "9983ef4c-3109-49a5-8445-016ec79b180f", "comment": "Malware payload (Mirai)", "value": "fbc26a128bde4ba8940a3661f65b0c9d084a0ed4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287284, "uuid": "7c8f2e67-4792-4265-a02b-25b7de0616f0", "comment": "Malware payload (Mirai)", "value": "c4b63790fa90a9db7907689f028cd4578632897fb273739cf772bca4b8d376f902cbf2166bd4a211fb1227cb0b7378e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287284, "uuid": "7b7bf234-1e7d-464a-af33-c84a92dfab2a", "value": "T16C334ADAB401ED3DF99BE2BEC0234909F63127551053073A77ABFD935D322A85E26E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287284, "uuid": "c7ac958f-c2fa-4919-88a8-1324fe511464", "value": "1536:ZsS8PtrKoG1BQ9Vses8Wsl1fLeAm5OrSJhBT45dB80l:mLPtrY3z8rlEXIraT47d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287284, "uuid": "2747189e-d214-4d90-80d0-14327617e33c", "value": 53428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287284, "uuid": "cd485fca-22ea-4067-95b9-289134459dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287284, "uuid": "78f265aa-1f0e-46c8-a809-adfeaf89fcd8", "value": "fa2a7bae27a33c64a08eb63c92ca7e06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241cd8ab-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1676300423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300423, "uuid": "d199f04a-f572-45e6-ba30-8e5f805d46da", "comment": "Malware payload (Rhadamanthys)", "value": "9717a36b7a9757aa6e482e413b636e34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300423, "uuid": "2ede8468-9314-4737-b529-a058f8213d67", "comment": "Malware payload (Rhadamanthys)", "value": "c7550cc0310b3d3a99b9cd02b33450a5735c2aa93cdd8a345b9a46d3fa1a9d61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300423, "uuid": "e757d731-d8de-4f13-b972-cabadbcb6b88", "comment": "Malware payload (Rhadamanthys)", "value": "22fd4bbd0641c95a9224fee39557ed6dc5579665", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300423, "uuid": "5b9a4214-dd25-4824-9101-852a63ec114e", "comment": "Malware payload (Rhadamanthys)", "value": "45734a08c1799419bedd79938c031be0953b93f7fc0691f2ccee43ece2fafc2e6e448f64346cbe373b3d26de6143e22e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300423, "uuid": "2e7fc3ac-0598-474b-8e68-facd05df2d50", "value": "T19275D06CDF4A0782E366C9B26691C5A0F051F21C71794CEFD1CA878BD03AF968465F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300423, "uuid": "e2d45692-1567-4126-be9f-2085bad4c0fd", "value": "396c902890b802c5ec6bae321a9a9c71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300423, "uuid": "d6e5341a-4aa9-4a3f-97af-533b50e34b3f", "value": "24576:r/5SpOTALRq6CoRranwHrPYoJlyzlkZMP/8Bs/5kp5CExDgq+LlTK4B2SkH2+JMG:rlAlqdoEwXlyIY4wL1lBaW+JMe7mKAI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300423, "uuid": "25f7c147-814b-43f8-be4a-c7689015eac6", "value": 1667600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300423, "uuid": "18adaeff-5e49-49a9-a305-78162ae1c728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300423, "uuid": "53519306-dd20-4fa5-a026-cebbe0f7ac7b", "value": "FedEx Receipt_AWB# 102233516763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c793e3-ab91-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676287891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287891, "uuid": "5bf40450-0d7b-411a-8aa1-9113c45807b2", "comment": "Malware payload (RemcosRAT)", "value": "9a41223b386389a4f3f78b5598bac55b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287891, "uuid": "3d1a752b-8b9c-47d6-9fdd-627167e6a841", "comment": "Malware payload (RemcosRAT)", "value": "c8092ae8e5c2fcb2f4ed5be1dac0723ef951a8b445c45aa68376d093fa3a5623", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287891, "uuid": "a9d68470-6b13-4e39-a984-db26baa3b2fa", "comment": "Malware payload (RemcosRAT)", "value": "4029fb38507d83e47588f9843d8afcf74003f9ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287891, "uuid": "f9dd31bc-1c03-4661-acbf-4f33adf03903", "comment": "Malware payload (RemcosRAT)", "value": "7a124716d1e01ecfe6c58768ab071c246f3d666fc61833e7ebcf4299150f8752adaa9599f44118a520969b9ed95e8707", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287891, "uuid": "93951cb2-7a6c-4846-be40-c825d1fd6762", "value": "T1ABF1F720E7DC8633DE6B8736AC7377C00774A35658D7CB5EACC8114A6C2A78546A3AB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287891, "uuid": "7f8a2d5b-9ff4-47c5-b7a9-88fa939c3011", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287891, "uuid": "f1d52e8b-1323-4170-aa66-7b39d978e45c", "value": "96:YpUIpb4xaVGEp7QLDsc9Vr/RZBzh4HbKlKetY8nXGkzZizNt:QUjwcESLgKV7TNh4HUKetY8nXrNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287891, "uuid": "2e90786b-356f-4fca-b0c2-94a3ee7ad0fb", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287891, "uuid": "b1fca804-d42c-4e44-a425-44763fb42461", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287891, "uuid": "f5f074d9-2c5d-4707-920d-23fe3748af98", "value": "INV2023021306070335CN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2717ab54-ab3b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676250606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250606, "uuid": "0b051a8c-9184-4f34-a1e0-9583038861be", "comment": "Malware payload (RedLineStealer)", "value": "6c55acf0ef3e42aac5717b375281b6c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250606, "uuid": "d296f8f6-9c0d-4d89-a0b9-1af37ff70e65", "comment": "Malware payload (RedLineStealer)", "value": "c89986258f85e6ab04dcd902e08967e26f2f5a13123aa0a88ac7ace321410bf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250606, "uuid": "083b6e6b-106a-4bd7-a637-de0aa8fa086f", "comment": "Malware payload (RedLineStealer)", "value": "263eac532cc9656be48599d9a3b68b5fe5ea76c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250606, "uuid": "f6053fb2-2ff0-4de4-8dd1-854f74972846", "comment": "Malware payload (RedLineStealer)", "value": "98139cec8e84d5da769a799046a74f4d64a7ec7268488f23efcbabc1f9a554768d79b2ed47e8d4e0d3305fb8d2a1361f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250606, "uuid": "7981901f-7d01-4e88-bf3b-569c568a023a", "value": "T1B2F41207B3EC9463E8B927700DF607D31E357E414A388697238FAD5A18762B4B638767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250606, "uuid": "f102b1f7-c844-4942-9807-f2b3bf4623e0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250606, "uuid": "a5cd5eba-19be-434d-9e51-65e811b66156", "value": "12288:6MrEy90Fv4nq8VDGok4nQqNSlIbvk4ebEveJuyZq1OBl/VPi:2yg4n3V3dimkbuKhVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676250606, "uuid": "244dad47-dc9b-4398-9760-0b5a655df1b2", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676250606, "uuid": "71b8c585-9683-4fde-8b53-f4f07bdb1c1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250606, "uuid": "799033a4-4646-48f7-8912-3efbae9d4ace", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b555339e-abf1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676329013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329013, "uuid": "051ddea8-ed6b-4a1c-9c5c-fa3623222dab", "comment": "Malware payload", "value": "a86af1c24a82f0081e61fb6b8d057fa7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329013, "uuid": "7434c7d9-8734-419f-b28e-cb8b93befb94", "comment": "Malware payload", "value": "c89f02c09cd226d2149c9fa8ac0314dff24bd2c4f9c438a86f1ea33e3738851e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329013, "uuid": "25e2e427-33e4-4c2a-9c57-7f863f70aa94", "comment": "Malware payload", "value": "84db22d09aafb0998fe52807e88d92392218f24d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329013, "uuid": "7bfbcffc-5c3f-423a-a5d1-c1eadd34f7cd", "comment": "Malware payload", "value": "ed72e68427467d418e32e9e279329b1696b226cb4ca8349fc4311f0944288ee654e78c2d12c26247366f004d627eec76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329013, "uuid": "3a9bcdbe-142b-42aa-9272-2b903fd1bd70", "value": "T101F4121BBBFDD022D971577018FA02C31A3B7D60923947EB678F6C9618722E26235367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329013, "uuid": "891054c2-6a3a-4dc8-8b70-9cc7169816c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329013, "uuid": "c92f9c2e-7d33-476b-b9e2-7fb4bc4e382f", "value": "12288:tMrNy90q0Fca9csfBLY1z9BOeJQ0XbxfunucYs3W80SA/0:IyacULeBlwHYu9p1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676329013, "uuid": "33bbbf50-be55-4472-b7b3-52fd8199bd6d", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676329013, "uuid": "06f8531d-8ff8-4d73-8db1-7a8ff20c930d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329013, "uuid": "64a26090-ba0e-4dda-bf08-48a701275aa5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3112a388-abaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676298297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298297, "uuid": "ddc9dc92-79d5-4243-b268-7d780988eebe", "comment": "Malware payload (AgentTesla)", "value": "9b05630af6a1f97dbcb38e5877f8031d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298297, "uuid": "9d051d3d-5c11-4b60-b256-d7da95027f0d", "comment": "Malware payload (AgentTesla)", "value": "c8e0dfc2f5671efee2e7a57ebcb04889730c9887e073ab93f7381a19200b4901", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298297, "uuid": "a20fb5b9-c5e6-4fb1-88c2-d06b65ba9c0d", "comment": "Malware payload (AgentTesla)", "value": "00b1b1a810ff638fad56c9a8a6aa7e70360756e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298297, "uuid": "f293c5b2-b6a7-4933-b2bc-7557c879f06a", "comment": "Malware payload (AgentTesla)", "value": "7a01c09f96612b5acf3aa31962d6a2d22a6e2ccfc69499c8ea94d9056ccd829abccff4a5fc89445aa8688924f854380a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298297, "uuid": "b2656332-c51d-4361-b6f4-bc4faefc135e", "value": "T172A41225FBFC6FEAF4FC47FB6C4A9844037A9231A519CF0D8CA464E95043F805651AAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298297, "uuid": "5e79b064-1087-47c7-8b85-15bf78357c44", "value": "12288:DZFlwtHCw0pVSMmr7lVy/cpqYWrKfOka/0yGUv0JAmW:DnuiwYKr72kWrKTaM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298297, "uuid": "50241be0-6a71-40e6-b3b3-eda6d6749f94", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298297, "uuid": "9d10c0eb-14a1-4409-9dc8-536fdcee511b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298297, "uuid": "1035eb41-a79f-4d2d-9732-e50df2c67dad", "value": "BTSL catalogue_2023_samples_list_revised.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1ce974-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676272039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272039, "uuid": "e0731485-f61f-43c2-805f-14eb116b6555", "comment": "Malware payload (GuLoader)", "value": "87570e3e60d466d073216460459220b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272039, "uuid": "2f9246e6-0d26-4104-90c3-b336f575587f", "comment": "Malware payload (GuLoader)", "value": "c91e9569ec550b0898e3fbd82915936d44dc269120ba5ef6113ba290a7ebd943", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272039, "uuid": "3b04138b-781b-4889-bccf-8352bb837b37", "comment": "Malware payload (GuLoader)", "value": "fd7c145be721ede9b0912571a87f8b6f1b68f204", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272039, "uuid": "a7dfeade-bf71-4cfe-a089-3ab77b9a1775", "comment": "Malware payload (GuLoader)", "value": "7546f4d417fded6428c8904fbb065103996353bcd511979911a5643fc483c07f45867eaf5ec49643de7d7a20d544211f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272039, "uuid": "403d470a-8562-4822-bf3c-052a81967df7", "value": "T18F84111577E4E81BD03A1E390CE6CA75833A9D412D2A57573BA03FEB3C3A5C29C2525B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272039, "uuid": "3dada02b-321d-49be-9705-15093eaa0344", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272039, "uuid": "1065dd20-0801-411a-828f-c385c493b123", "value": "6144:fC2+8+wtGyOm6KLAvrQItGkaZWhEEVIkTEENcNxMMDy0Q4Y3Shif:fGk+sChEUIkZNMxMH0Q42x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272039, "uuid": "ac4333e6-9c6a-4793-8c92-a409878bc27d", "value": 388542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272039, "uuid": "dceaf699-7a43-49f2-b1ba-7f56acb2b29e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272039, "uuid": "5def392e-df54-473c-8eaa-dacd79a49df7", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf848271-ab74-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676275370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275370, "uuid": "101a80b7-54f7-4e05-ba28-c5d3b913eeb8", "comment": "Malware payload (RemcosRAT)", "value": "928f6afbdf939fd8af9b930e747980fe", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275370, "uuid": "cac2eef6-1b7b-4628-be3a-a18b9ab7f12a", "comment": "Malware payload (RemcosRAT)", "value": "ca8756917a31c222cedc54ee8a1e0bfda702c0b4e633e2920bacad5f5a613d2a", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275370, "uuid": "3a001e05-0317-447b-a951-b54446402dc0", "comment": "Malware payload (RemcosRAT)", "value": "f649eefa7ecf5da24c409ebc17da25d2b9a7b4cf", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275370, "uuid": "de6e3031-5062-4397-b255-b1bf3468f5ce", "comment": "Malware payload (RemcosRAT)", "value": "6e8a73462b6d3b10f5516032ab5ef46fc982e06a4b57ed8f8f066b839e2f69494556161c72afca45021772a1a5d52b71", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275370, "uuid": "0087860b-155d-45e5-83d3-be0559757171", "value": "T188B423432DF328AC05F1C6BF0F62D2D489029552778E26286A94C77366BE618F7D6C37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275370, "uuid": "21a84cec-41b0-4539-aeab-75e3f3e279d1", "value": "12288:7t1oytF1WfPkRZNAbgfmrg1glBLd7Qa4d9IMN9Ypo7q/2w+l:oHkjNa8mrlP2a48MN9Yb4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275370, "uuid": "c6c3c403-2fa1-4e79-a74e-737a584f2746", "value": 497032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275370, "uuid": "b4353766-53dc-4bbb-a326-6880d4c25adf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275370, "uuid": "821d4eb2-0644-466b-8908-06d642d240ee", "value": "SOA#SEAHORSE2022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e388f90c-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676280557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280557, "uuid": "68418995-4101-4253-9b64-0a6223f87130", "comment": "Malware payload (AgentTesla)", "value": "1e6fd32828112b1066afccd4cbf2415c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280557, "uuid": "091aa1f2-ae4a-4247-b963-4e271ef3ec25", "comment": "Malware payload (AgentTesla)", "value": "cabc78e64293721adffb17e17e420bba3b3e1d04b6a43c40f650f8a5cb0b5c4f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280557, "uuid": "a21be0d8-149f-4ade-acc7-9fa8b2214813", "comment": "Malware payload (AgentTesla)", "value": "6a6090b95b80e68b269edf0399eb468469cf06d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280557, "uuid": "c4fd2473-85bd-45aa-9374-d5f3b56ef7a0", "comment": "Malware payload (AgentTesla)", "value": "7c4080bd0aaf0d1d7328ddbadafb7a7f5b6fd4110ffe72fc4bc05192bc94c94469b39bbc38899b6d36b20878f56b90bc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280557, "uuid": "b4a017c8-5cce-4925-adbe-e58f6896a651", "value": "T117F41242B64E4700C8A929F5C0D70535A3F5ABC31A73C6C63F5C279A4A423D3AF9676B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280557, "uuid": "22f499c9-bf89-4ae6-8f6e-c342cd0f86ef", "value": "12288:TRZ+BJUHa7Ilh2sjt0rTosZtRYfXiXFNG+Nx2vZbsHBA/rb7EV6a28J7EbRgMh1:T3UWQTDROXiXFNG+Nwv08/EK8J2jh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280557, "uuid": "f824bd39-4dfd-4f40-b265-620df5c17e13", "value": 737864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280557, "uuid": "9912cced-ecf3-468d-9121-f6c3fdc35161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280557, "uuid": "1ae4edd5-0215-4dfb-b95e-9519f80cfdd8", "value": "e-dekont-20230213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5cd2d4a-ab71-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676274065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274065, "uuid": "6a6396de-6e01-4299-9b98-211ced62a47f", "comment": "Malware payload (Amadey)", "value": "a77a8e99bd4bedad91e4c6d55bd843ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274065, "uuid": "336d7d3f-e392-4bd8-a880-836c46712d32", "comment": "Malware payload (Amadey)", "value": "cacb2f6c318a41d6007579c54ef435f0ec25aebcff63c9dee7cc0fddb5056021", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274065, "uuid": "37edc2be-93b3-44f2-86d5-3feed193ae62", "comment": "Malware payload (Amadey)", "value": "1a6459bed077ae88cbe10e75f4f7834c15d929d8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274065, "uuid": "8b5911c4-1465-47da-aa75-d547c3919f54", "comment": "Malware payload (Amadey)", "value": "9a5279eca0e1df247fc602c029afad53bc9351e916408a85100bb3e16185ec13fe4b330f29ef84bc142c83263d55f61b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274065, "uuid": "238fb8b1-eb58-4470-a6dc-a8f79aee807c", "value": "T1CEF4120BA3DCD533E5B153305AF207C30635BD645BB8C267238E6C8D2A72AB4657A763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274065, "uuid": "107ad622-62af-4e8c-81b3-61a1feb26775", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274065, "uuid": "4cfdfa91-e501-4238-b9af-3d20279da0bc", "value": "12288:vMrHy905mVQOr2lTlamJEaqUZg6A5dcSxxCeJeY9ZbAj5qeFBUDV5X:syBQzTlamGYg1dcSxdZZ8jYWBM5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676274065, "uuid": "fe9970c2-be84-4e5a-967f-d5721823be94", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676274065, "uuid": "fa6c84f4-640d-41ea-8db6-d211a9f33f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274065, "uuid": "3839eaba-3d72-4d18-9190-093694a2dd0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13454a78-abb9-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676304689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304689, "uuid": "ba017277-6d47-4914-ae3c-3753309596a5", "comment": "Malware payload (GuLoader)", "value": "063ae96f1551f59bba014e68fa5b7ece", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304689, "uuid": "3a66ec07-e3b9-41f5-8cff-c11068580c23", "comment": "Malware payload (GuLoader)", "value": "cae28fa8527ef65bcb4381a45e2261b7242ba5e0d7923619403b512e88fcf346", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304689, "uuid": "c6d62ba1-e81f-4a95-b736-66ff385e6adf", "comment": "Malware payload (GuLoader)", "value": "74a3ec2d7cfe15fdbf29e93a2a2f68993df7e534", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676304689, "uuid": "2ee28766-7c96-4fcd-8894-01d5d91a32c8", "comment": "Malware payload (GuLoader)", "value": "2958dfc9f03f0e8ea795761cc8cb03755793390d0bb970f8fbff0db944964280db6b439457c63ac92bba185cdab186e9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304689, "uuid": "c8515772-291a-4ce1-a210-9abcbe763f2a", "value": "T1A96423248293DB234DD61CF185621D4E4F04D9EBAAA5F4621C7C3E301BABCE855E7E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304689, "uuid": "73c29d7b-cfc1-4772-a04f-af28299a3e77", "value": "6144:9d+waHL4fxum24iUZUMUtHWCJ3LCkwMGQt9Ap9YdFZC8uxM1Kni:9d/MZ4VZlUEC1LbGQwPYdFZtuxM1Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676304689, "uuid": "fe400b8f-7f8d-4137-8131-71ab05998578", "value": 326643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676304689, "uuid": "128e5167-9e1b-4dee-82b0-a99775bd0530", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676304689, "uuid": "10205cb0-8c7b-4ad9-a559-365b1a64275d", "value": "Ziraat Bankasi Swift Mesaji.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a544be-abd1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676315053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315053, "uuid": "cef0b132-7c7f-4aa2-aa40-27bb3c666167", "comment": "Malware payload (Amadey)", "value": "4853c6e5d157deffb961f69504f445a8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315053, "uuid": "26ce866c-5a77-426e-85e2-3e79b401dea7", "comment": "Malware payload (Amadey)", "value": "cb3bd26c3e2579df1a634a1311599f70f2b7d947972332fddf54a6e860cb76f6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315053, "uuid": "2a84a2f6-1348-4710-ba8f-7e5b004c4c21", "comment": "Malware payload (Amadey)", "value": "7be90b14fe682636082bf92a1309d6932370dfbe", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315053, "uuid": "6b5850be-2b01-48cf-b102-f5d3b4ad68fe", "comment": "Malware payload (Amadey)", "value": "8967838395970b2b54533901224de091e6067f65c2c60558e70b40baef55a951f46cd24db25e57be71a26d04a04a4852", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315053, "uuid": "f50b2bf6-351b-4f27-8203-0479602e4516", "value": "T1FBF41207AAEC5152E9B467705CF647D30A36BD644F38836B279E7C2A18727A0B631337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315053, "uuid": "dc9a6870-00ec-446c-bfc7-4ea66b002b5f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315053, "uuid": "8742e17e-9e5b-45a3-b240-c18705a52256", "value": "12288:7MrXy90dxUe7as68aDETmEl9tCIA1paBUUp7teJu+q8QD/n7gtOXLvb3QMDnC5Ng:gy4HPaDve/CSawCub8QDEqvbJPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676315053, "uuid": "48c2bcb8-cb78-48be-8bf9-9ca0fbcd6719", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676315053, "uuid": "d78eabc4-3000-4da4-b592-7b57a365ba8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315053, "uuid": "c590011b-2544-4e1d-a6ab-a00ec8562cd9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51e4700-ab5b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676264696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264696, "uuid": "1b99f434-3478-430f-ae7b-20333b986348", "comment": "Malware payload (Smoke Loader)", "value": "5fa4234cd1a3775dee68312ae1b20a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264696, "uuid": "4074ade6-1bfa-45c2-b790-b0cdefd2ca23", "comment": "Malware payload (Smoke Loader)", "value": "cba649489c6cf87e9bd4be090c6b87d2abd20fc2b24d9b1ddb53c8256c761a7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264696, "uuid": "2008536d-2142-4d45-bc48-b06dbea79d8a", "comment": "Malware payload (Smoke Loader)", "value": "d66d05065470bb1edf71f271bc712609fd20ed4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264696, "uuid": "2acd105a-4291-408d-b0fd-7183387f84d2", "comment": "Malware payload (Smoke Loader)", "value": "48d0da160983d64dc5a6e2b950c6a1b1439e5bc00042cf6f91c91572de951e3880a925e729f3d0f6175a30449d307769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264696, "uuid": "98074735-6af4-478b-a0d9-1a44bc146011", "value": "T10B04CF05B9A1F0B2D5B782745A21E6939A2FBC71A3B0C54B33441EAF6E213D15FA8707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264696, "uuid": "b81966b8-09e0-40b4-ae25-8db05a3534b9", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264696, "uuid": "b7af5af2-59c5-418c-a4e9-a022c8097c60", "value": "3072:xHu47/35XbPiuxPmopSnqgFb48u/WkNMd9Xo0:xL/Bbun7e8uJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676264696, "uuid": "5473de47-ddda-4a85-b73b-9b7fb9b96d8d", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676264696, "uuid": "40fa1a6a-7995-467d-b79f-5f97a14892b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264696, "uuid": "18857411-251d-4c6c-a11c-1907de464694", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487ca690-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676300484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300484, "uuid": "8e95bdec-0794-45f4-8735-d157369d07b0", "comment": "Malware payload (Formbook)", "value": "b95ec05e5039e9d85a18eca4985f50f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300484, "uuid": "1518e278-4f89-47ee-823e-b0307761f724", "comment": "Malware payload (Formbook)", "value": "cc2ffcb49e5ff1b4f1be2c0c8f5bef3cf51caeef5fcd8be8a6367174b7dd8063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300484, "uuid": "e32c089d-171a-4de2-b7ac-0e6a169c14c8", "comment": "Malware payload (Formbook)", "value": "50c4dd7c8b27213e7d74f59d16ba3c0e7c0fbe5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300484, "uuid": "613dd4a5-08c2-49d7-8e35-b3fd953da96c", "comment": "Malware payload (Formbook)", "value": "eca059bc134ae80e0338e06d4fc35724a8494b6a7f9672002ca2777a9a084f58d4202aa81c9e6c23c0e0331be4aafa41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300484, "uuid": "d198c361-6903-4089-87bb-c5d6b23f6c5e", "value": "T1B844222432B4D46BECB32A721C3FD72556D5261424B6FB4F1300AB9BB475B81E42FB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300484, "uuid": "aa46b6b0-a9d4-4d71-afd6-0693491aaff7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300484, "uuid": "6531b4d3-e447-4b48-b437-fded8f103d0f", "value": "6144:/Ya6paAZMh/mnoevZmAt/VxJqpO7Mae2i6Nmn4LnyNfhBHXovJsYo2Z1:/YbaAZMFmn9xmAtNXqM7Mae2TjnylH3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300484, "uuid": "f2f10cfc-ab62-43a4-89b2-0795501f99d9", "value": 277400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300484, "uuid": "3462a64e-08dd-4000-9fa6-6068130d3995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300484, "uuid": "134b874e-7f6f-4af3-9929-9d830464ce61", "value": "odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee76d8b-ab77-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676276416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276416, "uuid": "884adfdb-a044-4b86-a9d7-102fa80680ac", "comment": "Malware payload (AgentTesla)", "value": "9674dbcb45c85b0f3af8c31e9618361d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276416, "uuid": "b0051965-c675-44d1-803e-5ee04f8eea39", "comment": "Malware payload (AgentTesla)", "value": "cd66386d06681fd22f7bf0d3a49727f71f0636846f67993e33455807fe04ec2d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276416, "uuid": "4f0077e9-8c4e-4df0-8c1f-7d34caae675f", "comment": "Malware payload (AgentTesla)", "value": "d28aca0432ea1c0ad181a78fa94d599ab6cb395a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276416, "uuid": "c10fdb59-5a20-43be-a506-dfe6975dc180", "comment": "Malware payload (AgentTesla)", "value": "9c3aa596bbc927244a6cc1171441338dc153b110b238048eb35638420133eae4103ec3d1dfce78287ab0c435ee67450e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276416, "uuid": "3adb254c-2fde-4005-9637-d8d3433043d3", "value": "T144C4236DA2F0A560B02ACA038E6C2BC39E701399F7371C93E579D4070775A9578F637A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276416, "uuid": "c069e468-6edd-40ce-92ce-9ccd04f62100", "value": "12288:iKIm/FO4cK9Tfb+K/7+mzVXpp9l69+U7wyb6KO/fc4Ryh+odSk:iKI8zcAnayTF3U7wUYHNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276416, "uuid": "663c1743-d9d8-4ac5-beab-858962d1eb05", "value": 568492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276416, "uuid": "e2aa50db-8ebe-466e-b9f3-a7453a20856d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276416, "uuid": "906d3fe7-ef0e-4dca-a19a-e1b3decf2727", "value": "INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbfbd86-aba3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676295282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295282, "uuid": "e7767dd4-3250-4d64-8a24-04540351ac0a", "comment": "Malware payload (Amadey)", "value": "d00e598318a1390717d87600a76483fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295282, "uuid": "21363b55-ff1e-4aed-ac34-79548b9d2c1a", "comment": "Malware payload (Amadey)", "value": "cd6a1f1a4c1a1312c64ce46c57167a5c47dbe24332fa13c819507ee4baa1948d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295282, "uuid": "48a20798-6f02-415c-a7ae-8bdc455d2245", "comment": "Malware payload (Amadey)", "value": "db38206e537cc4e300106f6256b6f2b7b589a4e5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295282, "uuid": "42acd383-30cb-48cc-94f1-6f360cb7642a", "comment": "Malware payload (Amadey)", "value": "bf1807814a3ee6ed5799243b33109fbc0d51913394e0367f8b4cf2502c647ab998d9c85d0b98778c8a84e4ba759fc8fc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295282, "uuid": "16dc081f-e5e7-472c-b06b-290c158a15f2", "value": "T1EBF4120FF7D89122D8B567704AB303D31A3A7D506B38C297338EAD1D28626F4A535B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295282, "uuid": "b50fe683-05ea-4c3f-9a17-729220c5b152", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295282, "uuid": "0b7f99fa-fa99-4c64-a827-f85227720992", "value": "12288:qMrTy90HN5VIbJzamf+V8LY/PuieJJOzmneY3psdKlNRlaQAcMnaS:ByCNkl5e/+QmneY3q+Rhmn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676295282, "uuid": "f09eb8b4-2508-434c-adfc-55f00e1283dd", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676295282, "uuid": "ca659dba-a5bb-4218-9a18-8e99945f0d99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295282, "uuid": "397028e9-5a4b-412a-a5bf-af4e75b40f37", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "774c214e-abb5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676303139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303139, "uuid": "a3ccee45-d0b5-4c6f-bdc6-b6d5e9844338", "comment": "Malware payload (GCleaner)", "value": "071342f9e26df8abe18bd597d311724b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303139, "uuid": "01d840ae-3c3c-4dfc-85ae-01ccff4eb6c5", "comment": "Malware payload (GCleaner)", "value": "cd6fea1533aa3e4556a33e61ed06f2e57450dc6ff98a8f8163a3fc5e23bf3a07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303139, "uuid": "ca24bac8-ddc7-4855-ac1c-9d611fa0ff0f", "comment": "Malware payload (GCleaner)", "value": "9ef42933adebb7181b0bde4006b3b25fc416a282", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676303139, "uuid": "77c145e8-5fd4-46b2-b3df-20ec8b37477c", "comment": "Malware payload (GCleaner)", "value": "0cdcb24b8e3269e2b87bad06643e273ddc76de121fedec01ea923c551a25852cb4f2c7ebe626e4a3ace60e3135157b8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303139, "uuid": "dbfc383f-0931-43ea-91d3-49b71ab35669", "value": "T17CE5127C7205849DC280BDB4CC3AD8E35CD66EE7D9E0A562B0DD7F3F52792498A0A50B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303139, "uuid": "fa074e3b-427b-4748-8cf7-958560d75763", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303139, "uuid": "6f4dcfcb-ae32-40e0-be0b-ae45c0da1416", "value": "49152:rdHXY5ZreQRTO3eMI0KzNO26ZhCZDRLYkNkKdf7lxbwDXjKm6KDCCbkGBKizLCgt:JHUR6uMdKCqZRNkKxvwjjbcI/3v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676303139, "uuid": "56b33ccd-ab82-42c4-9b14-94fca1a1037e", "value": 3319420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676303139, "uuid": "3d4104de-1fc3-413e-b4d3-4cf4750f8bcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676303139, "uuid": "e2f3b0c6-554d-4b74-92a5-5779d9795482", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be46b508-ab7f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1676280065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280065, "uuid": "466e8650-1df4-46be-8dd2-fbecc3381179", "comment": "Malware payload (RecordBreaker)", "value": "8d6d2cde513c324c52f408151229efd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280065, "uuid": "9ba6788a-149e-4f13-bbcc-6110e961cf05", "comment": "Malware payload (RecordBreaker)", "value": "ce59d2ac679c36ad5169712ed75dd21494e552f8ec9334d8fb4f74f4d83ce190", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280065, "uuid": "ac401276-72f1-4b44-b734-bd5c8f647859", "comment": "Malware payload (RecordBreaker)", "value": "36700c13db56a594f007f432e07d256d0c44ca4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280065, "uuid": "9d24e5df-e9a8-4938-8173-f1855b9f860a", "comment": "Malware payload (RecordBreaker)", "value": "08ccb63d041462a51885affe78502a6a7c6e66e7611c58d39d142cbe524c8789abd6c42ac44153f6654b7d6154bf68b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280065, "uuid": "59055615-7dd0-4baf-aea8-ebddb228f5e9", "value": "T1A775CF292324403DFCF228F4FD5A2BD54EF351931771559FDAE8A3028829C6DDEE960A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280065, "uuid": "9941515a-1cf2-4b3a-b4e1-34bb4015ea65", "value": "396c902890b802c5ec6bae321a9a9c71", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280065, "uuid": "d561d56e-ee70-418b-9be2-a6f9a3e8f49d", "value": "24576:HKy1QXROJQwBBkHj7Q3sj91DaTINdX2/wbi4JJtY7jZL+V78a:HmcJsHsUboINdmX4s5L+58a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280065, "uuid": "764f8043-31c4-4cea-b80c-bafc8c981783", "value": 1565240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280065, "uuid": "eac70ebc-6d09-41c0-ac97-02b7041737be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280065, "uuid": "22c7d612-5ef3-43f3-a375-aba85be63803", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a33cf40-aba9-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676297802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297802, "uuid": "adfc10ab-9529-4f8d-9554-322451f4c30c", "comment": "Malware payload (RedLineStealer)", "value": "8e112f905872b4ed4e37b67c7869326b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297802, "uuid": "0ffeda4f-d2c8-4d1a-9ce7-7dae8d8eecda", "comment": "Malware payload (RedLineStealer)", "value": "ce6db8ad25371c6a2ec86af83d658ed382401aea4dca602e49576d2bcd2e8918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297802, "uuid": "6f466cf0-c976-41ee-873a-f91d64bc5b8d", "comment": "Malware payload (RedLineStealer)", "value": "e93cc94f8c4547176bdec18e8f056905db58e93d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676297802, "uuid": "29395cd4-d5c3-40f7-ae77-7e0d40d5c56d", "comment": "Malware payload (RedLineStealer)", "value": "ae93ad674081324a9a1059557467d0bf6bad2012911808400021ee2060b15d8829262c74a45318a9550a59cbd0a76a50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297802, "uuid": "f2afc4bc-fea7-4fd1-bd78-80473d957fc8", "value": "T130F4124BE7E98163E4B853705DF703D31B367D610A3882A7378F6D560C32AA9A53076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297802, "uuid": "689e8a59-064f-47fe-ace5-cccc45f2ffbb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297802, "uuid": "384b3d43-a506-439c-a29d-5f10fdde5df0", "value": "12288:GMrcy90kmc95P3V1pGZ+Q4e7t0LsaeJ7GGWcOqzNUntLzIX3u:iyFmK5tDoVyDkNiXq3u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676297802, "uuid": "cf8dd79c-32cf-4f82-ab17-b7e6bc055571", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676297802, "uuid": "26614dce-15f2-4436-80d2-78b1f73a79b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676297802, "uuid": "a7d3a81a-f665-4f77-b305-33b600901d2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a698392-abac-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676299333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299333, "uuid": "dfffb0f3-1e98-4963-8ea6-6da3bcfd4748", "comment": "Malware payload (DCRat)", "value": "a91fcb3d082178ef662efa929573458a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299333, "uuid": "102d6e4c-22be-4dda-a8be-e67f1927a896", "comment": "Malware payload (DCRat)", "value": "ceb12c810554c6988f7a88335613971616ef832dfd7e9027ae3bdf76f0974ee4", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299333, "uuid": "1d928442-c766-4e78-9742-9d60f522c183", "comment": "Malware payload (DCRat)", "value": "f009343efccfb6fb00684ff425d57680957edd55", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299333, "uuid": "3007102e-5075-4a11-93e6-09885ec81d74", "comment": "Malware payload (DCRat)", "value": "b94730e79cdbe7f53f47577141127d27c90ae55711fd5b32fee8be7c6d0e1162cfa9bbabc78396f693ad15d53be73ffa", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299333, "uuid": "2cadcff5-8769-422f-8aa7-9b67d970893f", "value": "T105535B002788C965E2AD4AF8BCF2950146B5D5772102CB5E7CC804DBABAFFC646537EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299333, "uuid": "2647cee9-9353-48e5-8832-8237bd0ad0b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299333, "uuid": "cdabce39-ed03-4265-b161-334418c6c105", "value": "1536:HhYBLTM3Ufc4c7VGeeiMl8GbbXwagzDGZZVclN:HhYBLTM3UfcVVfeFmGbbXOezY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299333, "uuid": "e18f3bad-23a0-4660-96aa-36bc03892c3a", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299333, "uuid": "943e1774-2670-4ea2-9320-56d6810bb7f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299333, "uuid": "6e6d02ad-0d31-4a03-a8f0-32fc409d2474", "value": "bJBm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa3aaad-ab7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676279128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279128, "uuid": "83659917-ed84-4b68-9499-2a37d0390d3c", "comment": "Malware payload (Amadey)", "value": "67b29e0f974f742b7f4e097c501be300", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279128, "uuid": "39019b07-12eb-4a21-b0ad-c959a2db83e6", "comment": "Malware payload (Amadey)", "value": "cec2854970bc62a993be79ec24bf499d8b207d75375a31c9785711e6b55be7cf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279128, "uuid": "2fc40633-2d08-47f1-8ef2-ce26fc3239f6", "comment": "Malware payload (Amadey)", "value": "961a77fdffd02fca22a82d466df3ef770043c14f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279128, "uuid": "13390e5d-b8c5-4bf1-82d5-391792f0958e", "comment": "Malware payload (Amadey)", "value": "cea1bcf6451d5c6fe6304ffab741d70ce869721a867f11c48b717c1f6798a5439139f7bba70d78e5befb7c37ffca0499", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279128, "uuid": "29a252bb-b53a-49ed-8b66-1ff8110f8432", "value": "T112F4121BB7E89032F8F497701DF602C31239BE606674D22B628D7D944C716A9B63877B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279128, "uuid": "bc682197-afc9-4592-8f59-fd2b3ec3a340", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279128, "uuid": "7150304d-35c5-4b2b-8c83-950b8e8cc245", "value": "12288:xMrNy90s4RfaRZmt6XUcNFzdD8WeJET3FuxUTLXucFhGeT5j6l3:syD84U4EcNLDCET3U2v9S3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676279128, "uuid": "e04c07ef-e653-4e0b-b632-26ffb141d6fd", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676279128, "uuid": "669012e2-15fe-49c0-9fff-3e5af9b43514", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279128, "uuid": "cbef0a2f-677e-45d3-851e-fbcb48b752c0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3415ce-abc8-11ed-88f6-42010a9c006e", "comment": "Malware payload (Heodo)", "timestamp": 1676311519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311519, "uuid": "4244b1ef-0e79-40f6-bf9c-af38d320a643", "comment": "Malware payload (Heodo)", "value": "aff28dab7b14bbe5479a550767970bd6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311519, "uuid": "d0aee1a0-0fe2-4767-98aa-b551608dd2af", "comment": "Malware payload (Heodo)", "value": "cefab4701668dde528767b7db159a854e548371bab974b1b8be57ba6aaaf379e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311519, "uuid": "c08c79d8-0b1b-4408-9a4f-cec2954e5958", "comment": "Malware payload (Heodo)", "value": "c7645e2a493ae07d4c03f25fce294ecb32ab5078", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676311519, "uuid": "070f89d0-592a-4379-854e-21e8163118f4", "comment": "Malware payload (Heodo)", "value": "e445bbbe0d42e24efb5032248e30e1c6dfd2f6b6333998645eda0b0be1f31fcf1f9b79078b8f37c40c533ead670d7404", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311519, "uuid": "1fdc2fa4-e4a6-469a-b695-f8a285da60c8", "value": "T15C845B26FB451CFDD42AD03486464A6269327CCA0731BEFF22D461362F7AAE06E3D745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311519, "uuid": "d0ba53a5-c54a-4fbe-a8ab-35cd1eb1cd5a", "value": "8c7b8a24a346512928a131f66113fcaf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311519, "uuid": "029dbf8d-f7f1-4de4-8bf3-829fa3f1091c", "value": "6144:S7Ior9RNpdMgu/rBrzMfezZXjN4dzTSbxvaqmB+n1:xbFgSZzN0M1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676311519, "uuid": "6d3802b2-b4c6-43bc-82cd-7fea0ed9ffdf", "value": 371085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676311519, "uuid": "130ddc33-a79b-4f95-adc3-7e6dc1f20caa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676311519, "uuid": "06a0f48e-4978-4d67-97e4-ec83fcc7688f", "value": "cefab4701668dde528767b7db159a854e548371bab974b1b8be57ba6aaaf379e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02c333e8-ab73-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676274597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274597, "uuid": "8c2df065-b8be-41e7-bab0-a13c8c133043", "comment": "Malware payload (Amadey)", "value": "ca9e751728128b826d88a8d278e376e0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274597, "uuid": "15b713e4-8638-4ed8-8ae2-93cc7a70e041", "comment": "Malware payload (Amadey)", "value": "cf0db604185c611f175e25a9c495ca5c6fe3f970142c08837cc70275560a51f2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274597, "uuid": "d79f8da6-0b8d-4a14-9e6b-5036583e92c5", "comment": "Malware payload (Amadey)", "value": "c27e878508d38f043ac6512f53b3c65003afc74a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676274597, "uuid": "7754c1c1-9914-4429-8f88-d7a21d7fe41f", "comment": "Malware payload (Amadey)", "value": "e9d224ffc35a844fc654713275f8271dedd0ea58154738d2d441ca1ee065c9ce6283d0c87d90b1d7dd2be6ea8ae8abc4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274597, "uuid": "99d4fd7d-7f7f-4cc9-8a5e-e3ba41d0dc96", "value": "T1A3F4120BF7E98032F9B4677069F253C30936BE616738835B678E5D5908326E06532BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274597, "uuid": "767f12cb-59b0-4cf0-85d9-027787d19bff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274597, "uuid": "0040d063-50db-45a1-b2c9-b8d5fac134e9", "value": "12288:5MrVy908dxi0l102f7YkJ6HWzHyXgvlAveJbP15A1uynfS5W9/JsQDPLZBux:Yyndxi0l1XzJGwtHb6pb/fDPtgx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676274597, "uuid": "03740f83-66c2-4ece-9bd3-c15690839107", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676274597, "uuid": "8b59dcaf-781e-4e7e-bc1e-cb3f2988bf83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676274597, "uuid": "c2cf43dc-6d95-474d-8166-132143748af7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a15430-abf1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676329037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329037, "uuid": "f53a9e21-57c5-4ec9-9de0-7af0f3bbbc98", "comment": "Malware payload", "value": "80f9ccb2188e8fe8d8add22f4a2214d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329037, "uuid": "f395d2ef-acd2-43fe-ae1b-03d8dc60dd46", "comment": "Malware payload", "value": "d001876dc21a9d8c5d116d1dd29d87c8de4654afb74a2dfbc361a99cd4c855ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329037, "uuid": "b762cdcd-e775-4354-8020-2dc0bb250be9", "comment": "Malware payload", "value": "994922fcf284ccd4f6bce9da29d0b501be590cad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329037, "uuid": "55d1bdfa-b9d2-4014-89f0-aa1e97be0d64", "comment": "Malware payload", "value": "808e77074229eb2f281c059526441ef88218c207787d619dcc759d62785648eb8be9e3a9185446b8a4aa917dd2dffc76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329037, "uuid": "622a49b1-9be1-4ae8-9580-ff361bddf936", "value": "T12D04C02332D0D872C462C6309D7AC6B17ABEF8214E74A98B77D45B3F0E702D19A76356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329037, "uuid": "311e1de5-9f51-421e-8cd5-cf99cd3a63e9", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329037, "uuid": "55d469b1-bfa2-47a1-859a-9a8397e95d9a", "value": "3072:DK7w/AyWmDpxYsmntNlUpi+wW6AWuqoC9H1TpHyud5bK1E:DGwYyp1xYssHUEbW6GqoO1Vfd5bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676329037, "uuid": "3ffddbc9-edc8-4684-92dc-a3e31d6c12be", "value": 186880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676329037, "uuid": "76751ba9-0fad-4208-917a-37a05c387118", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329037, "uuid": "4bc409a2-775a-4f16-9b25-f1a7518c23e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89261958-ab7d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676279117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279117, "uuid": "7e9507c5-98bd-428b-86f3-bce181efa466", "comment": "Malware payload (DCRat)", "value": "7322ac3c8fbc9e12209ee5ff98fe9cf9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279117, "uuid": "a778bb41-10ea-4af9-8881-b49169c7091e", "comment": "Malware payload (DCRat)", "value": "d01fca0d6090c1afa65be5428fa78ade03a18eef6d1c44807762eb6341f8d805", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279117, "uuid": "5c1c0cab-ec1f-40a7-89fc-9b74ab9597eb", "comment": "Malware payload (DCRat)", "value": "eec26462327b5b31387f597758b27fbe5c6ec4bd", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279117, "uuid": "0d4c06c5-937a-4c06-9560-3391192e3d6a", "comment": "Malware payload (DCRat)", "value": "89ec00f52adfb95029765f2f776a7a7c7067dc09d5470c2055f910e35f886ff9b327c93422fc813e129fe1dc77f54c50", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279117, "uuid": "84362831-549e-47f7-8fbe-3e5955a3c6f9", "value": "T1B795D0013AF6C863F05A0E7460283DCC3A3CE4479BD9419FB972A96853D66B7F9D8D21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279117, "uuid": "dfd786c3-752f-4c99-a307-14bac1d1de99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279117, "uuid": "4e03c098-c246-450f-896e-8e7f5545905c", "value": "49152:QpsjM8DoQpGaNOFKqQQwQWTPLR/IKXcQY5UsoGl:GsXMMGdCTPLRRcPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676279117, "uuid": "04a19fab-b1a9-44d3-954e-33beb2f2a2c8", "value": 1901056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676279117, "uuid": "58cc468f-761c-48ec-869e-22ff6b9ed37f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279117, "uuid": "343db974-5bc3-4d71-9786-b201ca3a36fe", "value": "7322ac3c8fbc9e12209ee5ff98fe9cf9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06592771-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676272026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272026, "uuid": "2ff2ea59-f2b8-46ef-a8f5-672809cc261c", "comment": "Malware payload", "value": "d82b21fb9596ede9813a5142e1042b48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272026, "uuid": "14f025f8-ec70-40b7-8c84-fd19cb16ff31", "comment": "Malware payload", "value": "d08d1496721ed6e1549eec13a84d070d5929ef8df4cddac2301674fbb1de5b3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272026, "uuid": "b86105ec-675c-4fe3-bd35-5afdc2e491d1", "comment": "Malware payload", "value": "1b05f09d3f8a65ae438a25c15ba258e89326ad86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272026, "uuid": "0320f300-ca91-4fa0-9f30-80b72591effc", "comment": "Malware payload", "value": "67ff87c6e86112f40ba90b361b13f91f085f799d67c0d982cabd8264109d48f55e279795de339e01af9221fbcc07b310", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272026, "uuid": "4bed0ce7-5e6f-4e0c-b809-e0d69b391aae", "value": "T177933C116C934032F6622430247D7372E2BDEE141869AA877A58F9EAADF54C3C73CB57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272026, "uuid": "f73e61a7-6c08-40e6-97bb-ac02ecb7f531", "value": "768:H41XsJUn0KEDvBB2NQAed56ZTpfQvWfABwBz6FiD:H41XSUpOBZAed5MovuABi9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272026, "uuid": "0038dbc0-63b0-44dc-9cc2-812f09fcae19", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272026, "uuid": "701b38a1-cfd0-46a5-a4e1-e2796abbfa18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272026, "uuid": "a7c1412a-529e-486a-8465-0d71fe3a1678", "value": "d08d1496721ed6e1549eec13a84d070d5929ef8df4cddac2301674fbb1de5b3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c260d9b0-ab85-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676282649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282649, "uuid": "13bceb2c-0540-4d44-9094-a932c4ef0980", "comment": "Malware payload (RedLineStealer)", "value": "52210758549d1fcb7691a612eb338e24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282649, "uuid": "de23ad79-2219-4bb1-961f-0d04246b16cf", "comment": "Malware payload (RedLineStealer)", "value": "d18316240b4d19c2aea407593e8d429fe7fa6ac2d5991291e237edf69d0b9e10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282649, "uuid": "6a384533-15ff-472b-9a72-a824ea59b10b", "comment": "Malware payload (RedLineStealer)", "value": "99b7fafe27bf8d96a5ef8137d5170cdd269aa1b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282649, "uuid": "78725662-acb1-4c3b-9ddc-d2cc8e4ca60e", "comment": "Malware payload (RedLineStealer)", "value": "26c6ad5b82b2565f985d586454560cc64e76b64d38fb093c4250a7b350c397013c1e5623a083e81ed172cd0f1d73da49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282649, "uuid": "c62f1c0c-3aa6-45e1-be56-cd24fcb10d38", "value": "T18BF4124BA7F94033E9F567B055F202D3193ABD219B389347234A6C5E1CB1AE0A2357B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282649, "uuid": "c7789cab-3734-4269-bb37-d1bc1c872dd1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282649, "uuid": "997ed26c-3766-491d-a005-0a4cfe78861c", "value": "12288:mMrty90SV9n+9PQOKS1jrppaNNR6eJzCnLcKI/48FCaReXM003:by9+rjxrpazCnLcKI/48FFcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282649, "uuid": "bdb2aca4-793d-4890-98bb-a9caa48fbae1", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282649, "uuid": "98977f0f-838c-4bdf-83ec-80ec29e54705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282649, "uuid": "1d58c400-fa09-49c2-a1bd-86b40af82b7c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0c2ed1-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676277033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277033, "uuid": "cd622b8e-9f04-475b-9e3d-c3630edb05c1", "comment": "Malware payload (RedLineStealer)", "value": "a7af73b9e45a60351058f9ca3927d63b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277033, "uuid": "15da3db5-b70c-45f0-94f7-731a4ad4ffad", "comment": "Malware payload (RedLineStealer)", "value": "d18ab230389f3443dc1eb30bf0ad8a542492548f6278a5ccb3e103abbd2876c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277033, "uuid": "61ef54a3-3bd6-4a2e-80b6-c0110f8cc1ce", "comment": "Malware payload (RedLineStealer)", "value": "2cbfc8670374bbe542f7cf09e69690045a528293", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277033, "uuid": "69fcb08f-894c-457a-86be-56c71a3094bd", "comment": "Malware payload (RedLineStealer)", "value": "555f6798701a86b46686ffd02ad1c0574fd54b08cbbadf428a3b75f85e637002799950d71caee17f1e1a403b5d0a2adf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277033, "uuid": "f76fda15-e32b-4a25-a482-20d9531ae22b", "value": "T1E964F10373D0E472C0B256306D28C5A46E7EB8B25E38A56B375827FF4EB06D1DA76315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277033, "uuid": "62389f72-20b1-462c-9107-80707ea6814d", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277033, "uuid": "9e588cc3-4ac0-4aa9-a5ac-defd9f6f980b", "value": "6144:6zfDe9xKU6zwhCMJ/NIJ1pkhYakpCNyEayAGxkW3ctO:8fD/rwhCM1uJ1pkFkptyLHcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277033, "uuid": "2dbd7377-fa2d-40c5-a06f-6ede44cbd848", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277033, "uuid": "c1d21304-f3de-4faf-9afa-4aa0e64e1e16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277033, "uuid": "aa0757f7-b335-4f39-8d72-9af4a8ea6d0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d46445-abc4-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676309410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309410, "uuid": "64549ffb-a188-4c36-bb54-29750739c979", "comment": "Malware payload (GCleaner)", "value": "897dfd08d74f9722c8bb3fb2cd1ab74d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309410, "uuid": "498d6b8b-a448-49aa-81df-751bd651ce2b", "comment": "Malware payload (GCleaner)", "value": "d22be2d5d83e54c9984c25d8e58fa943ddfc06dc26281742f800585dcca26901", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309410, "uuid": "e65724d4-000d-4dcb-af14-695d30d62479", "comment": "Malware payload (GCleaner)", "value": "cdb392b2314d50ed52a1f00f9a9839a95739606c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309410, "uuid": "f9ae51bb-15dd-46a8-82a2-9e006314ce43", "comment": "Malware payload (GCleaner)", "value": "2aa53a4caee0f9d4844af745808d303a4ace6fe4cf577f3ca9a9e5af028d9cb25caa4774f45225c8ab3dd323629c6f59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309410, "uuid": "f0a55774-d4b3-4e50-86b9-bf88141dac73", "value": "T1E1E5127D3509C86DC280FEB4993698E74CDA6DE3E8E4A52270CD7F3F567D2498A19203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309410, "uuid": "6096a095-27e4-406f-a859-e896a6b9acfd", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309410, "uuid": "1e122808-25d9-40c9-955d-934c98a7ca95", "value": "49152:rdH7ZSkJ/pbwkzCjtZlLZ2zFZk67h+NN/gZxkh75lM03CFKkh0v/41+1RLCgv2MR:JHNfhsvhZ7QLth4N/gq7XjkKkhCxzv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676309410, "uuid": "0d19313f-d065-405c-bbc4-8c9f5287782d", "value": 3136395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676309410, "uuid": "32ff3ae2-819a-4165-8224-f9826aecaa15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309410, "uuid": "fb97fa53-42c6-45ed-b3a9-045714636cd6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4aec03-abb3-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1676302393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302393, "uuid": "dc516147-e07d-448c-96ae-0bc2485bf1c4", "comment": "Malware payload (TeamBot)", "value": "fd466943736431592f5d3100cc5ef176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302393, "uuid": "f1462c26-3e79-434f-9d02-c764b6935e40", "comment": "Malware payload (TeamBot)", "value": "d254183803aaa2a5ab7118f423809013bf0e5fc1766bb37beaea2ce1e0acfa61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302393, "uuid": "8bdc1976-0d58-4d33-b4d6-cb476e10f2b3", "comment": "Malware payload (TeamBot)", "value": "ed2f661153cd32ba1fe2a3a46be0c2c8904f38c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676302393, "uuid": "258dda89-e040-4355-ad8c-a89e732cd10a", "comment": "Malware payload (TeamBot)", "value": "00f0344c2d68bb4887db3ce92dd70b456ef7cbeb2d3a15a261297f71d85c6e4a0715b4ac74156d1c54f524282b6584e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302393, "uuid": "0bcf60ee-81ec-460b-8172-b386d66eafe3", "value": "T12F14D02332A0D471D56617737C68C2F52B6EB9B10E78A68B37542F2F0E702D1A636397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302393, "uuid": "6eba43c3-c17b-4633-9178-9abf434dc948", "value": "096c57a489bc9be05d307c86ed0497dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302393, "uuid": "70697a58-3925-47d1-99bc-ed0bc18fcc4d", "value": "3072:M6BNw/Msja1bk2KiLl8KtbS2E95mxlbzy3i:MOWMz1vKiLlO2b//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676302393, "uuid": "f948c49b-40c9-4e6a-82c5-fbde020e6f01", "value": 197632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676302393, "uuid": "0908db52-e6a0-430d-b29f-b212fcd1d943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676302393, "uuid": "4163af32-94d6-4ca3-9212-e438eff405d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d26e1f-abc1-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676308289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308289, "uuid": "698a45ad-f1c6-4374-b669-61d207b7caa6", "comment": "Malware payload (GuLoader)", "value": "a210b4034786023b5bc6e85ed58ed561", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308289, "uuid": "2a45123f-18e2-4cf0-ada5-712c49f8b9cc", "comment": "Malware payload (GuLoader)", "value": "d34b2d1ff5fd4c266c909d1436dc4d66cb9db91abe844ae21887a364d7f5bd08", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308289, "uuid": "271cb1bf-5773-41ab-a3dc-b3a3eb98ffdb", "comment": "Malware payload (GuLoader)", "value": "60475303381370795af516166089251227a24588", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676308289, "uuid": "5b17dc3f-932a-4f1f-9afe-6e408980c793", "comment": "Malware payload (GuLoader)", "value": "1acf22ec8d457709d59604470ce1c9331527f9dc4a4ac3891b26e2544073549bcf258da2dc97387ce5040e441d4c7179", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308289, "uuid": "788b3b9b-ed01-461c-b0c9-99a17a75e345", "value": "T17A6423288293DB234DC61CF585621D4E4F04D9EBAAB5F4621C7C3E301BAB8E455E7E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308289, "uuid": "127e6a79-70ca-4b83-8e69-30a5f475f10f", "value": "6144:xd+waHL4fxum24iUZUMUtHWCJ3LCkwMGQt9Ap9YdFZC8uxM1KnW:xd/MZ4VZlUEC1LbGQwPYdFZtuxM1KW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676308289, "uuid": "9a74ef6a-cffe-44dc-ba6e-aae260f0a1e9", "value": 326629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676308289, "uuid": "437ec841-f173-403c-b7bc-866bae5d6329", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676308289, "uuid": "6c58c676-133c-40ac-b580-a0a7ce74aed8", "value": "Wire Payment02132023.r19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986a4ae9-abec-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676326817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326817, "uuid": "e19a5963-cdd1-4bf0-a658-08f382c9a330", "comment": "Malware payload", "value": "f3261c9f44f50ba3cb62c1d658687ee9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326817, "uuid": "cff52cfd-4a6f-444d-bfa3-57584998f723", "comment": "Malware payload", "value": "d377103acf1c971d6575f088649a9389393f84cd22de9c3b35b7c840121932c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326817, "uuid": "0af740b3-0768-4281-9ae0-73d9b42a6fd4", "comment": "Malware payload", "value": "9670e8cd9551d7f7edb6211e04bb0d17f2e56a11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676326817, "uuid": "ad5a0633-0e22-46cb-acf6-d85f76eb12e0", "comment": "Malware payload", "value": "ad92ba6a99a8788aa6fcaa88febd7f13fcd48befe4147fc5a90f58233ed9312d74763d1bf6c9f6105f72185bed1fef00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326817, "uuid": "525c2546-3979-4cd1-b762-56e3be4e0a74", "value": "T132F41217B6E89432D9B47B702DF742C32A3B7D604B35474B634E6D9B1C72AA062313A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326817, "uuid": "2ed82ec8-d635-4017-a59b-6525e17842c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326817, "uuid": "36e4f7d0-a6a1-419e-916d-14f2ab1a6265", "value": "12288:eMr1y90wJaHTIuv6T4m97VHeJQx2cNf9c9tW8zP1PQn:TypaHTf6cm9+Qx2u29t9rA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676326817, "uuid": "ff797f14-8b96-48d7-adb8-f9139bd4a3f5", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676326817, "uuid": "5dd30b5a-9c33-47eb-92a4-cf1be377d701", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676326817, "uuid": "a1ae4921-8fb5-421a-ac0d-2d72bfb07e83", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9f5e56-abd1-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676315045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315045, "uuid": "e648d2b7-566a-4eab-b89c-d43f2ed325c1", "comment": "Malware payload (RedLineStealer)", "value": "6d51357646585b816a5f6d44296b039a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315045, "uuid": "9aaba6d9-9b19-4360-b271-d47af88462ed", "comment": "Malware payload (RedLineStealer)", "value": "d390ce5696a407f776ab1f9c23637455bf0884745861c786d3b05eb30910fddf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315045, "uuid": "e51d5450-99be-4df4-bcbd-e43a58a50cc4", "comment": "Malware payload (RedLineStealer)", "value": "9477ee6d32f763e9d93336c0db9e55632d625c5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676315045, "uuid": "4cf20eb8-65b5-458b-a149-611899a28b64", "comment": "Malware payload (RedLineStealer)", "value": "88772df790f364919f102eb0c42081f74c1286ca0a6affcb4d7f9cb3c3e12d0791bf1e9eabc9e99e9ce6ad8ebbbd3033", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315045, "uuid": "0bf698c2-a62e-4327-b795-d0e06f6f698b", "value": "T14F54F11333E0A831C16655319D6AC6BE66BEF9210E3895873BD05A3F4E703D2CA7631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315045, "uuid": "dc3c35a8-7f2b-4e84-9090-bd28d191e5fe", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315045, "uuid": "c67ea35e-faa7-4c1c-a697-d8cf10935325", "value": "6144:N1Pg13mV4X7DP1iGHYuslanzFGimZ994DQKoCCHxR3UbEQON:N144V4X7cG0lanzFXmfP5VHfEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676315045, "uuid": "1e2641fb-65f9-4676-b49d-2af2f27ef219", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676315045, "uuid": "7891e906-dd9c-495c-924e-6b24e8e34ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676315045, "uuid": "0c59fb59-018b-4aa9-afe9-50a6740744da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a63bfe-ab4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676257294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257294, "uuid": "deee0dcb-d6e1-4e6a-8cc1-0a0adb772657", "comment": "Malware payload (RedLineStealer)", "value": "c59c59a05f1ddc2fcd21957adb7595a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257294, "uuid": "521ad45d-5c8d-40e2-8138-e33625dd689d", "comment": "Malware payload (RedLineStealer)", "value": "d495b1b300467a9a7f664ff41d83327b6eafa6b0d5dc72d4ec158dc0353a997e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257294, "uuid": "1271dfe5-b449-4753-82da-374fe4c47aff", "comment": "Malware payload (RedLineStealer)", "value": "84752a4d55d4611b9c1a2d896172018a1248d0e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257294, "uuid": "13378b47-34b2-4fde-953e-6494d06f96a3", "comment": "Malware payload (RedLineStealer)", "value": "2c2cd0aab5297e801462196e4dbaa4b3782d2e3ad85576e025519b0b1b6387d535e50a9c10848299fc4f17a807ba68d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257294, "uuid": "5bd90e14-183e-4d72-863f-ad40acbc74a5", "value": "T172F4121BBAED4523E9B2A77058F603C31736BD204B78825B378E6C590D326B1B675363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257294, "uuid": "8fff5baf-7e5c-42c7-a557-ce0b9768a190", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257294, "uuid": "76f9c142-f0c2-4f5d-bc3b-36cac0fbcbf8", "value": "12288:4Mrby90zPtxCS6JjpNMiVBjaIlU4+2NgNAjeJW5Tjcx51YAsftaeqxOboNPNu:zyayJjpOIBjaIlUSNgNWc7iASta1xo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676257294, "uuid": "ccf7519a-08b2-418e-ae63-23f0ce1328c0", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676257294, "uuid": "f3e9a337-7257-4f10-b3c3-eed788747b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257294, "uuid": "b6c82635-74f9-4f05-b69e-2afae6ebe4d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2351d719-abbe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676306864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306864, "uuid": "64c8e3af-1d7b-403d-8d28-4a090858bb16", "comment": "Malware payload (Smoke Loader)", "value": "d33935713f49623932db6b3a1aef44ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306864, "uuid": "d7d8d05f-4660-469f-85e2-9a88c1aea4a8", "comment": "Malware payload (Smoke Loader)", "value": "d5007c6ee5d4b18a54eadb54235c7bebdfc94c73aa8755a1e26a5dd72fda4aa4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306864, "uuid": "f085ed07-27b2-4a2f-b5fc-479e4f6d9e96", "comment": "Malware payload (Smoke Loader)", "value": "979f4d5a0d5f9aa65b2130c5ed80cb47f53c7296", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306864, "uuid": "7682552f-c587-4973-badc-a33f6723bef6", "comment": "Malware payload (Smoke Loader)", "value": "f053a46f4549292a9880885050e4a6b63b538f37c8ca32a1a2502bf727bb55cb8d48a156418faf7f220ec342acddba2f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306864, "uuid": "4a813dab-c038-44cf-a2ed-572ead6cc1ce", "value": "T15214CF2332D0A831C57612315C69C6B47A7EFA214A7DAA9B37D81B3F4EB01D19E36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306864, "uuid": "e75a9882-01a2-46b8-81d0-6314596fbb5c", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306864, "uuid": "96d8a191-4e17-40fe-a01e-228d8500d279", "value": "3072:25mzWKYmkRCEHlvmUfkomhffX+0quREPahNtI5nt6L6WKRwqWx:25uWHjCEHRmUfEPHqiEPm49XRwqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676306864, "uuid": "41c2ad15-d093-4049-945b-cd565a4528f0", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676306864, "uuid": "4420714f-98b4-411c-92c0-bc2251abfa68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306864, "uuid": "b6592144-91f5-4dd5-8beb-85512579de21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077f7591-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676272028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272028, "uuid": "8aae9c3f-5ad6-48db-a9a2-ff185c49f65a", "comment": "Malware payload", "value": "e3ed45c220f72f72f84ec17399e24571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272028, "uuid": "07eb80a6-7bbf-48b2-9677-d9481260c828", "comment": "Malware payload", "value": "d527f67e28f5b4bfde76d57ef0798ae3b3a0addc9025f012bffb8006e0ed4e92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272028, "uuid": "75254505-6f2f-4dfa-92b5-5a26052a3c37", "comment": "Malware payload", "value": "8440ecc76e5a2bfa3a031977e8dae5d8470f6e8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272028, "uuid": "8db4240c-7728-4518-9297-5b5e7f8b3fb2", "comment": "Malware payload", "value": "2ac86ca539e118f11c1596632cf9ecd4857106584d7ea477fe1ad3c65617e7bdb02ee345dcd48ceb2632d08259c88487", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272028, "uuid": "35704baa-b517-40df-a109-805a5ff84131", "value": "T18225BF40B3528932C4AB3531D91BA63451EDBCA88B205AE732A87E9F75317F27D3521F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272028, "uuid": "fd3c7df2-2526-4709-aba9-6cfa12fa3582", "value": "24576:dMiOQGCEYxJgo1NBbt1VH9McG6XH4qvIReK1odddGdBnyEj6kKZnBF:g1qNK7jyRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272028, "uuid": "f0fe7349-4221-4cc7-9fad-f55ab8ccb4ff", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272028, "uuid": "9978c57e-c564-4905-a156-900bf4fd0fee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272028, "uuid": "272cae67-573d-477e-8db5-52254c773785", "value": "d527f67e28f5b4bfde76d57ef0798ae3b3a0addc9025f012bffb8006e0ed4e92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2bc4053-abbc-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676306245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306245, "uuid": "301fc6a3-d16e-4015-a20b-9cb95ad17bf0", "comment": "Malware payload (RedLineStealer)", "value": "e432aa759adea46907955e41422d0e53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306245, "uuid": "0ca87d0b-bc34-44f3-bba4-6ff619e98e75", "comment": "Malware payload (RedLineStealer)", "value": "d5638a442b5612f381713866a09c3630d66a3eb9ebb3966eb4f64b2f8ee99073", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306245, "uuid": "5f7fac76-6a1c-4533-a17e-71490dde82f9", "comment": "Malware payload (RedLineStealer)", "value": "c3288fb341b05e7d951f0634c6e7f45a87621fb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676306245, "uuid": "afcfc4bd-4e96-416b-a242-263a8f77ec35", "comment": "Malware payload (RedLineStealer)", "value": "f97429927fa7a506d576f578440aef465c6f744a5d3935838a7faf2809c2a079a1192f8085a40e9e543e55306d867920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306245, "uuid": "1564eaa7-6c8e-44ce-b202-ddef73f284b9", "value": "T12BF41207B6EC9122E8B547705DF702C31B367DA05B3882A7638F6D690C726A4B236767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306245, "uuid": "21107205-d52b-4e06-84b7-238fb7b16db3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306245, "uuid": "e0743dd9-72ae-4e8a-8a63-d827681ff85a", "value": "12288:HMrxy90qJ5hCiDkAdxWimWEni56M6eJGjbtS1bw0q8BU5vCXl4xfoh:iybXAm4imdnisWIJSq5FlSlv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676306245, "uuid": "eccf5b09-30c4-4846-a403-674e4d57ca5a", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676306245, "uuid": "6eef9162-ce2d-4901-be19-45b7b51b9d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676306245, "uuid": "225d2dbb-bf1d-47e1-8606-b03123b1f591", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f49883-abd5-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676316727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316727, "uuid": "31b6032d-bea8-4e18-bd2d-bdd1280af391", "comment": "Malware payload (GCleaner)", "value": "eeae06fd1bf4581cc65c8348d9a3d702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316727, "uuid": "8de96822-8981-4b3d-a661-984b820a0851", "comment": "Malware payload (GCleaner)", "value": "d66cdab94fb0231de6ddd6201c606115b2fa8174cc9f25816aabcb3347acc398", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316727, "uuid": "4ef2a3ec-f610-4dc7-9134-8aed932f7923", "comment": "Malware payload (GCleaner)", "value": "1c00733dbeae30efde5a4b25cd54106d47a79516", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316727, "uuid": "18bba267-89ac-4e86-a247-c6ea36386d93", "comment": "Malware payload (GCleaner)", "value": "498785973058d3d412b066c672a53b89546e3b907d2ec750b76b872d10dda16a6cf489c0fc09b5b74f33c2eddb95c21b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316727, "uuid": "68487b1a-3d12-4c26-8568-b83d6a7724d5", "value": "T188E5127C7219C9ADD680BD748836A8E75CEB6DE3E9A4A02230DD7F3F517D2C8460A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316727, "uuid": "23d5de5b-6d83-462e-8d5d-11eea233f89a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316727, "uuid": "8650d056-b0bd-406c-8c17-277ff7ea8dd6", "value": "49152:rdHCizbDh42bSN+ITY2KU5N0SNCtXcFtSTc5E7iCsPJSLpyRLCgv2MR:JHCeXh4nI2KQSRXcFQTcvZx009v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316727, "uuid": "39bb663c-166e-4658-9b9c-0f12d9f11c09", "value": 3148819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316727, "uuid": "9c450cab-33ee-4556-a423-c00138b5cec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316727, "uuid": "da31ab89-b69a-4137-a9d9-97b6c0bc5fe1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2f78d6-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676251448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251448, "uuid": "ae266641-3172-4093-82f1-95feced61013", "comment": "Malware payload (Mirai)", "value": "70e3fdebcb458b4e889351c6a5ba40dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251448, "uuid": "85b12daa-fe32-40d0-8226-f8903bb507c9", "comment": "Malware payload (Mirai)", "value": "d71b93c48e54fcb8bb3289fdb484c5cbb327dd61255230a338700e984cabf4c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251448, "uuid": "2d929612-80d4-48cf-94c4-5be4243736ec", "comment": "Malware payload (Mirai)", "value": "a1c3a55979ec70e392841d8f027be353e8c5fa24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251448, "uuid": "01817c2e-abb4-421e-ac3f-8e9e5e2c1372", "comment": "Malware payload (Mirai)", "value": "12c8b293f37a0428f146563014cf92386da3f971a27cd39d14c943960f1803766bb8278fdbd934f0bb9a9eb5ce899f3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251448, "uuid": "757e77d3-8845-4168-90e3-7ae5f687d096", "value": "T1DCC36B395C752E16C1C5A57F06B74371B1E2278E36E8C92E7EB20D4EEF68720201767A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251448, "uuid": "0824ebdd-9e7a-4481-b5d7-ff6ad7addc1d", "value": "1536:oAgh47lyGpcnKZxASev5MnOiVRBoKRO80zxuCakLZ13bUMXEr/dJfDS3e6:oAge73eRyxsZ0kLr3A/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251448, "uuid": "241631b3-5bb3-478a-a89e-3d85120702f8", "value": 118424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251448, "uuid": "c30f0a70-2947-4d77-b53f-c2eafc9ef278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251448, "uuid": "0afdb76c-5225-49df-93ff-01fb4856ba2c", "value": "70e3fdebcb458b4e889351c6a5ba40dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7380a9e6-ab5a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676264049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264049, "uuid": "22f360b5-5816-4b37-8ced-fe13fb1212f1", "comment": "Malware payload (Amadey)", "value": "bd60d3500dd8a237f1a263c0469e4771", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264049, "uuid": "23326290-1513-4067-ad0b-0f6d58756768", "comment": "Malware payload (Amadey)", "value": "d7e73672b1ed16d2d5f4184ed285ba1bd4915c243d2140bdccfd314be25e8a47", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264049, "uuid": "b755e7a7-0a52-4c2d-afae-901c1d783495", "comment": "Malware payload (Amadey)", "value": "ff932ea509c367ceae4c41370569aa4b162c3b1c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264049, "uuid": "131ad8a0-4301-4ef1-b70e-6339d0f98ba4", "comment": "Malware payload (Amadey)", "value": "e8bbd0a91b87e409f83869feda24843acd771ce0b2468fd85ad69e7808a82d95833676c7b0c16f9a3da15ceaa35d0dbc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264049, "uuid": "0dd16e5a-6799-42a7-b102-d6a8e4737cee", "value": "T1B5F41207FBE9D532E8B4673048F213C31635BD615E38425B238B6D592C32AB1E63676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264049, "uuid": "60a67e36-7265-4949-ac95-40432d1759bd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264049, "uuid": "d288124a-66d6-41a4-8ede-3801e934c430", "value": "12288:yMrMy90Eh6B4ekcuwRAfV4MENqRY2eJ09RUUzMgnWZTJkTujM9J9:+ybhe4zcuw8VQqRA09iUogkTSH9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676264049, "uuid": "c86b7e54-1dc9-4ac4-888f-d6375682418b", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676264049, "uuid": "2fe542ac-8351-41be-a6ab-b704e3bc6e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264049, "uuid": "ea8525b7-fc58-41d6-9de9-5cd6d135b0e1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1100925-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676280580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280580, "uuid": "cf3e587f-3120-4085-882c-7e6cafa6b6b1", "comment": "Malware payload (GuLoader)", "value": "06cc21baa5cd382adbad6f106948c86d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280580, "uuid": "b64f181f-f00c-454f-ad52-c1c471af6eaa", "comment": "Malware payload (GuLoader)", "value": "d7e93b6d68d60891ed36118fc4988d938bb16e22c95cd211f0127cf378b793bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280580, "uuid": "f92393d0-68ef-4195-a3fc-d39bbf68d4f0", "comment": "Malware payload (GuLoader)", "value": "99e25839dcb2b9048eef4c59f61d2c6bdfe48740", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280580, "uuid": "ebd9c6e6-e390-47fd-b409-339391c47195", "comment": "Malware payload (GuLoader)", "value": "4b504f5e121f588ae01a741c332b6b1eb9d8313586bdab36b87660116c1855fdb0516237db2c19f6da4992c7a72c0e9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280580, "uuid": "12c4f85c-0752-43cd-876c-daed3b7162b7", "value": "T146841258B7F4F127D1694E340EE2E73AA27A7E916D0486077BA13F9B38760938C1614F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280580, "uuid": "f1a4fa7a-c61f-4435-97dd-8af565f891bf", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280580, "uuid": "3dfb5c36-330e-45a1-967d-393651d27403", "value": "6144:fC2+8+wto1tZNdrO7OisOKEENcNxMMDy0Q4Y3ShiH:f4ZHuslNMxMH0Q42R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280580, "uuid": "c1d20e1e-4ac7-4d3d-a6d9-6637180c58ab", "value": 394868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280580, "uuid": "d8556947-ce1f-4cfe-80c2-fbf466488932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280580, "uuid": "ce75d661-c00a-4f24-a684-43ca98d5e9b4", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d4f0331-ab75-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676275608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275608, "uuid": "e18d021e-f9cd-40f6-8eb1-ed503f72d2b2", "comment": "Malware payload (AgentTesla)", "value": "0772fe1df7bbf98bd849b8ea025d6aea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275608, "uuid": "8bd57540-b483-49e0-86ed-47a14846e1cd", "comment": "Malware payload (AgentTesla)", "value": "d81720d1a15508ed513442ea7d6b026b2452e957714a74adf3d535becbb74843", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275608, "uuid": "9132b9e9-6de8-41ff-ae81-eaa2c14f4a19", "comment": "Malware payload (AgentTesla)", "value": "30bdfe75cd9702d0be79483154d3d2e6da1e63b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275608, "uuid": "9934b90b-1354-44f1-adcc-4395486d382a", "comment": "Malware payload (AgentTesla)", "value": "8b694db9dde1f94818ec5788d4422f4488556bef08697c0b98656f81c63cb2a15ab301d22eb63c8fd9e5fd7f8d51832c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275608, "uuid": "7152e0bd-ac20-4116-868a-5e5e3831ae23", "value": "T1CD45F16F7EDA3F62D67D06389D529D4823F0894B2035E74A7ECC00A95BDAB4C8F41396", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275608, "uuid": "56c5faf0-c12e-4053-b74d-f12b81729dc4", "value": "12288:uKFQmymXknLaxx0tKKgaciSrgvRsHLFVIx+9rUw:uKbfYr9vYE+ZUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275608, "uuid": "c5013f7d-d297-4d4a-a974-c5a76177865e", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275608, "uuid": "d8e7af0f-8910-487c-ab02-9a76939aa6e2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275608, "uuid": "c2c2a433-1058-4e64-8f39-3507a9f36113", "value": "ORDER_118802.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd804599-ab82-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676281380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281380, "uuid": "5d21874b-2afc-4ce0-af16-99a01366e7b5", "comment": "Malware payload (RedLineStealer)", "value": "74ea26791f099eeecf9b179ac3f9f2e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281380, "uuid": "d79b838c-327a-4099-90b0-25d5a673031e", "comment": "Malware payload (RedLineStealer)", "value": "d8c03eddd2c947563cd8ac2ad9ab904d44a011f26e327dcded5a6154814285de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281380, "uuid": "def814d9-16a1-46b7-8c91-6cc4cf934746", "comment": "Malware payload (RedLineStealer)", "value": "a738d2536e6e95ec3166d79fd96cf042e1f47182", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281380, "uuid": "c98d6842-2d79-4e51-a941-b6f4f4a45588", "comment": "Malware payload (RedLineStealer)", "value": "4ae5e0204076ebd768d5331a392bf0ce2a2f799c1904cb85d01c6708ddf3b5e5d4707bedae907dcdaea1843f51761731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281380, "uuid": "8f2ad19c-d4ba-45fe-bd64-61a90c75487d", "value": "T1A5F41247F6E880A3E475977059FA02C31A3BBD6066788357134BAC2E18736B4763637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281380, "uuid": "a3f173e8-27c9-46df-be0f-d5809fb01b8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281380, "uuid": "dfb5671b-5542-4cd6-8c61-71f498874704", "value": "12288:7MrUy90LrFirlUQmYXXaIsxZpk9v88xv2IPlY8BLRn87OiNit5KtQWbuHxp:vyfrVHaISZ2N88xv2IdYqSwt5KQRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281380, "uuid": "59882251-41f0-43b5-a5ff-f2e4ff592750", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281380, "uuid": "1d95366b-b74a-485f-98f8-f871cd82e0fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281380, "uuid": "3fb757fa-8b7e-4b88-b234-3017db03a5e3", "value": "74ea26791f099eeecf9b179ac3f9f2e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aac21b2-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676299628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299628, "uuid": "821d9be1-29de-4313-ae87-6971f5b2a023", "comment": "Malware payload (SnakeKeylogger)", "value": "577b76e34468689f1b77e062eebf31ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299628, "uuid": "2b98b8cd-2957-4607-8f72-09ea7fd5544d", "comment": "Malware payload (SnakeKeylogger)", "value": "da0416690a0f0bdc34e5215285d224ba895141f1da78f6512465bd11d8ed4892", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299628, "uuid": "1e16ac55-4226-4c2e-8907-9733df86f9a9", "comment": "Malware payload (SnakeKeylogger)", "value": "4c8e3741834277217417ad4b8ba8a5586db0b9de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299628, "uuid": "648a5e8d-61b8-4d54-b3c8-8c6337c7bdf7", "comment": "Malware payload (SnakeKeylogger)", "value": "710d0845f8641c8a45c206d2f53831464ee11a3a14de6328c52b6d164e8f52b1217fa4c1e59b1379a14390c047de7c67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299628, "uuid": "d4f6711d-c9d1-4dbb-b826-18a5742680a7", "value": "T187E4F1403A9E6F18D47E5BF82475A080A3357E0639B6D22D7DCA71DE0E32B568316F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299628, "uuid": "706cea6a-bee6-42ad-ad35-eca820126ba5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299628, "uuid": "8006cd5e-32b2-4eca-8024-8c56c5ee318a", "value": "12288:S9f6qZh6q6/TKPzG7IToZYNBU9Fawul87lqRcEIi87H02x9:S9f3Y/TKPzG7aoxFawTliSj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299628, "uuid": "f7dd5428-8830-4c46-a510-4cd6a2894d43", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299628, "uuid": "88d60b5e-292a-4d98-a02e-14fe146126c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299628, "uuid": "2d8d4e42-d6c6-4a93-ad7a-3ddc2e268b2e", "value": "LPO13022023-001 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a7fa63-ab37-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676248852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248852, "uuid": "bfcf5f30-9b24-42f4-b8c9-5856c2d123c6", "comment": "Malware payload (Amadey)", "value": "64441c9bba2ba74ebb61bd65a8bf1510", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248852, "uuid": "acac0137-0efc-4558-81d4-4d6eb8307908", "comment": "Malware payload (Amadey)", "value": "da20ac26edfad2f1e9b0229977c919b105e6034410bcacb2eb9d44d77f0bac7a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248852, "uuid": "824b0297-56fe-4d28-83e6-e4643a1ee559", "comment": "Malware payload (Amadey)", "value": "993cbd53e630916387b0d69bd028f7a13df7c6da", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676248852, "uuid": "6b4a0fdf-25e3-4d0c-93fb-8e6abd7465c3", "comment": "Malware payload (Amadey)", "value": "e52fa4fa3a50b9a0e2c4328d443c74ae3dc730e9eec5773aa22812a23894636d141f4af2261eb6a9f52ad91b8d45848c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248852, "uuid": "bc25ca5d-23f0-4459-8297-8ce4784be1ca", "value": "T1C1F41207FAE98032E4B8277019F602C329357D615AB5869B238F7D1919336F0EA3577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248852, "uuid": "fc220477-bf30-40b8-8482-125d9e94bd2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248852, "uuid": "7b220337-b953-4644-a726-c6d8c4c0b202", "value": "12288:8MrFIy90hKEdE4Ph0qLdnrFccBnj/X6CeJPNXcCmU3lxOE8h/OKd:uy/43Ldr6ej/6ylUx8hmKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676248852, "uuid": "fe2bdb5f-7534-4a62-815a-058589553e36", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676248852, "uuid": "b612c7ee-3b7b-4a46-8017-e547c274bc52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676248852, "uuid": "c9d237b4-253a-4d71-af33-ba9925d488a2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642ce135-ab74-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676275190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275190, "uuid": "e73e549e-681a-457f-9cb5-b2b82feb01b3", "comment": "Malware payload (Formbook)", "value": "73009e08ab4d8b11bb8bdf6948e038f4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275190, "uuid": "a18269dd-7ec9-433c-aec5-d5acead03e26", "comment": "Malware payload (Formbook)", "value": "da20ddb8f9c542e7c11d119c6fb745f2619caa7b5cd29efa1d0a42de994d873c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275190, "uuid": "13bc578a-9a13-4626-80f8-e09218e41ee4", "comment": "Malware payload (Formbook)", "value": "c43c7773bef5a02a1f16c8718f440252b5c060d9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676275190, "uuid": "b8110931-3c43-4c3b-86f9-014f8218eea0", "comment": "Malware payload (Formbook)", "value": "9b7dbaffcdb09022fb6c51103d131cc75435a65e97017c74f693da513c271eb3dd42981a9a288854eccd5edd86639cfb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275190, "uuid": "4ebbd9a0-4a20-4db0-8f80-c04874a0b4d0", "value": "T1BE44230F0E2E7D4C8FF847DE70C6EDC00516F9142AA6693A9869B25265B8215CD6B0BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275190, "uuid": "1be3b9ca-4620-4a5b-b034-0924346cd117", "value": "6144:g/jUb7bnY9SkEYwOIczjMwshTpCkae18NtOMQa8a:grUb/YzEYwOj3MHhTae1g0MbJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676275190, "uuid": "0740f38c-7d13-4ea4-8d0d-d1c5a5630a57", "value": 269650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676275190, "uuid": "ff21fdcf-de2c-4fa8-b5a1-33a4a2ce9f50", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676275190, "uuid": "034fc9c6-595e-4938-ad85-7b820c7fc631", "value": "ATTACHED INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c914db6e-abe5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676323892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323892, "uuid": "e246f695-4d96-445b-ba02-de722cb1515c", "comment": "Malware payload", "value": "2512dd9e7116d161827f7bedbeb3ce54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323892, "uuid": "5f97a68b-f930-41ed-94e1-68d48145b0e5", "comment": "Malware payload", "value": "da27d1b279bdb548f73e1dd1421795ceb53a0fd7d3ef8ec226c0a284538eb9d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323892, "uuid": "3c50bf9c-6bbd-419f-9a96-7527870e370a", "comment": "Malware payload", "value": "9e97ded4cc58fcf2d5b3667544de420eb2315170", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676323892, "uuid": "5a3bbc95-4972-4d37-b38e-e9b95c90abee", "comment": "Malware payload", "value": "ab469a6ff8f86e8e575c1e12362e19e73d14bd79217641e96f6d6df6a32374f8d7398f0d60ddb53a5a8c645f858f09e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323892, "uuid": "12d2c458-5366-4e7b-b037-0d1b8fbf7f81", "value": "T1BB54E02232E09872D45212319DA9C6B23A7BB9715F78958B37DC6B3F0F712D1C636364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323892, "uuid": "cf06fc31-e911-4530-b098-1b552f2a84c4", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323892, "uuid": "14ab5f2f-0da7-4c8d-89e8-edf8fcaeb1bb", "value": "6144:/aO3/a7XDY6fmd56ZX1h2/dIwqTdeuBLXFL:/a0IDY6fga1ycLXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676323892, "uuid": "29f22588-aff7-49b6-9021-ff7481da9489", "value": 295424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676323892, "uuid": "80484e16-1d6d-4c97-97cb-c45a2085df2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676323892, "uuid": "4f1ece8d-2092-463c-b798-a5a2990c0a4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c641e7c7-ab4a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676257316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257316, "uuid": "30804233-c2ba-4b11-bdb6-c688c2a6fc5e", "comment": "Malware payload (Smoke Loader)", "value": "0a969fd5f7ad0c969bad344903262c9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257316, "uuid": "6c1c2860-5ad9-4204-8357-da57192d1afe", "comment": "Malware payload (Smoke Loader)", "value": "da6f01a6cd7cc6189a9a4a2585e9341891c37382d074f49c9999b1c0fc010cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257316, "uuid": "e4fe25e3-2326-4c5f-aeeb-777d640a1483", "comment": "Malware payload (Smoke Loader)", "value": "c4d0cb0352f9efae7636480eed80322da2dab728", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676257316, "uuid": "fd790f7c-1bf1-4420-b476-a113fc3141dc", "comment": "Malware payload (Smoke Loader)", "value": "ed1cc4fdcc3e8050ffe6f0c472ec73190836928dee57d27d2833c4a9b4a41d40f9e453842269b769993facc8f91ac2ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257316, "uuid": "d644b954-1296-4a01-ac41-60e02457b7dc", "value": "T1A504D01279E1D077D0BB85745921CAE07A3FBC73ABA1884B33142A9F2E236D19669347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257316, "uuid": "bfc0434d-55bf-4f8c-a56b-6583d75fe58c", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257316, "uuid": "2e7973c8-dca6-4077-8b28-35b49d35357b", "value": "1536:CHGd1cxd+jwNkkmb35XOXyNnvJ+Bf6DWEPme+RQChn3CM+12IcFX+WhlapvxpdBG:CHsc5A35XN+1EPIZCM+1Xc0gYxx94XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676257316, "uuid": "f7f6bf22-9cfc-4585-93e2-b78d3724618f", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676257316, "uuid": "feae0227-d2c1-429d-a2cc-bc2a6a46a12c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676257316, "uuid": "0d23fb1f-d786-4865-87dc-c6b33f2675bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd654e0-abaa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676298612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298612, "uuid": "6ceba92e-117d-4e91-b6cd-625e58fcdde5", "comment": "Malware payload (RedLineStealer)", "value": "d3145a2091c1bbaadd7e960cf284aa46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298612, "uuid": "59e75acc-2f41-4ce6-b0ad-b098edb85b86", "comment": "Malware payload (RedLineStealer)", "value": "dacbacf9dec1d0009348e99fbffa4c0b352651d6e682e426ec9b668532b6cdf5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298612, "uuid": "d0ae6aa2-b731-4743-aaec-892a09273485", "comment": "Malware payload (RedLineStealer)", "value": "5519589f9c496cbec28ff77377b7ea849a0e10dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676298612, "uuid": "8aacd83e-0bd3-4019-abd4-46c29115b2ef", "comment": "Malware payload (RedLineStealer)", "value": "0735b74ebda0bdfd5803dbdc8aa88068f9d96af6d5d581fd08e4a6e780746ebfe34722b096fec1064e02b84241230d1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298612, "uuid": "c27e330c-6d26-4fb9-b1f5-24070333e3cb", "value": "T1DFF4120BE6D89032E4B457B05DF606D70E3B3D625B38819B368B6D991872AF1723437B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298612, "uuid": "fd962e88-e24e-4732-89bd-e3e3f2999bf5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298612, "uuid": "a2531d60-c1fc-4b24-9c61-f1a0d562385e", "value": "12288:tMrSy90NyFKpJXLvd9mnxYGHb60cDqeJxJqWQ6XKOzwUVtDjtySTjfw9:LyLFKpJbvd9mm0WxcWQ6Jw2DjtykfU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676298612, "uuid": "8b9bb316-8a01-4bab-b903-7d46f73c1cad", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676298612, "uuid": "40c0302c-b3c9-455b-81af-17b7c780acff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676298612, "uuid": "0e6e6858-053e-4103-a77c-79d3875fdeb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8c1ec1-ab77-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676276605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276605, "uuid": "4f59f299-5930-4475-b352-1f255a945aab", "comment": "Malware payload", "value": "1a4367b65ba26290743e7d6578df4d7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276605, "uuid": "f02b0593-7e78-4961-aeae-cfee9d9c9a75", "comment": "Malware payload", "value": "db176ec8ad6ecd788b5e61d96061427602518c433df20a326b67a8f18dc1e136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276605, "uuid": "b08aa87f-350e-44b7-97d5-9aa62223dd90", "comment": "Malware payload", "value": "a9f64f444df94b5e034170dff12065d93963cf63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276605, "uuid": "0af517f8-a736-48fc-8421-10e1cb361f46", "comment": "Malware payload", "value": "7a8bee892289fef8a7f6e459c40f3914301915a232b80db93c1a6926f8f503718957ae459cb1e04e64caf227e5897990", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276605, "uuid": "f213cdb5-3070-43e6-be8c-cff2b73ec628", "value": "T1C6F41247A6EC5032ECB5A7711DF743C306373E609A3892AB668E7D190C322A4B675727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276605, "uuid": "42686803-c493-49be-b892-d0d6609c9963", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276605, "uuid": "cfb40c63-512b-44f9-890f-89776c31a12c", "value": "12288:IMray90cRLBfQmi0ZCodOecpHMppdSeJ8Fgg3kQ7TrXScvL4MOkLo0asw:iyC50ZCowpm323kUvP4MOCof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276605, "uuid": "94bb1e2f-bd16-42d4-a302-a5402c8e854a", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276605, "uuid": "a24debf4-e9a4-48f6-82d9-adb97f796b2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276605, "uuid": "492a3ea1-d0d0-4ebb-abb0-c62218aa8e60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc78f736-ab6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1676272815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272815, "uuid": "b568bcee-3955-46e4-b74d-10fa7d987751", "comment": "Malware payload (DCRat)", "value": "5c85e5ca96bf6acf5a826de35c5e3f53", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272815, "uuid": "3fad46e2-a521-40d4-af86-b053b8e27c26", "comment": "Malware payload (DCRat)", "value": "dbf3b5a8edd99c33f86f18c28c6dc8934d2887bd8e4c036daf86aa4429394466", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272815, "uuid": "7e9b2fb6-e7a9-4769-ad4a-0f9859772378", "comment": "Malware payload (DCRat)", "value": "49be4a001e9a686a6465d4ca6afbd636e3ec5907", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272815, "uuid": "993bd86f-fafa-4ab2-9643-c5c84da451ef", "comment": "Malware payload (DCRat)", "value": "45f4f4b6b349af59e0aaa51fbdf609dcff1a77544921200049b23b8a8988eaf5b3c882e0828227c90dcef276adf899ca", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272815, "uuid": "83455995-3d70-4ad2-9c9e-7c20cd352d5d", "value": "T1D0657C01BE40CA11F0191633C3FF465847B4AD112AA6E71B7EB937AD5522393BE1CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272815, "uuid": "5734fd12-34d6-42f1-a07e-4169ed0c903e", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272815, "uuid": "c1455384-5a89-44f9-9d70-a7b72cb64bdb", "value": "24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272815, "uuid": "a59da3be-3021-42a4-92a7-33a8c8b52d85", "value": 1410793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272815, "uuid": "8d8c3601-17cb-4dd2-b7c6-af9b408824cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272815, "uuid": "6e29ea49-4095-4144-8e41-ddbd6e23c49b", "value": "5c85e5ca96bf6acf5a826de35c5e3f53.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170f17c4-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676251438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251438, "uuid": "5734d763-eba9-4a0e-926b-c77c26d4cfb7", "comment": "Malware payload (Mirai)", "value": "819c9047cb19b5997608405a34b89b5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251438, "uuid": "6b2e7de8-591e-4e46-b706-70da004bf2fe", "comment": "Malware payload (Mirai)", "value": "dd2a8ffc082bde36d44cdf6aca9e0d56dac42f10b2ceb996a4f249e7f6589dad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251438, "uuid": "f0ca5e66-ba9e-4897-a42b-6005c736229c", "comment": "Malware payload (Mirai)", "value": "1f5b6f9a36a2d8cf95ecfa9946b47c0674941b7a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251438, "uuid": "2f2b8b8d-a675-41eb-a4ae-633b569479bd", "comment": "Malware payload (Mirai)", "value": "6cc09dd5f2133c0e4d757d77ae14cddd1b30031e6622a0a6a8caef239aa5889bfe4d0db87d765fa8882a95669a7e82ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251438, "uuid": "fddac8ab-29d1-4040-baa7-2771501c35fe", "value": "T140E2D079E898DCA9D6EA8DF068B6F2415FC90BCB37729F110ACA23509447672B543C85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251438, "uuid": "7385d25b-a59d-4e0a-90ed-26be597f0a0e", "value": "768:+a4K67R7S90eLY78ORcCDkXHew9geSAaoHTLDMGS4uVcqgw0RNWXJ2:+aP0YQ5DkXTAAtHS4u+qgw0bWXJ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251438, "uuid": "f9f14f33-60b4-45dd-a5cd-e27f00291651", "value": 32788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251438, "uuid": "4e80e46f-29e7-4e36-ab60-ab8e4f303099", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251438, "uuid": "7151360b-2370-4b14-bcf2-b827230dc212", "value": "819c9047cb19b5997608405a34b89b5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097de207-ab84-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676281910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281910, "uuid": "aa90cb54-0541-4a25-a9b4-54a8c81dc536", "comment": "Malware payload (Formbook)", "value": "fa28bfe4ee1dd72996774f1e8e06524b", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281910, "uuid": "5eca95c2-58ff-4393-8143-f237370e24e1", "comment": "Malware payload (Formbook)", "value": "de8d23702e0e2dd07e0df01ba775077ff7a6918cb53dbb65680aea65054fd9a4", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281910, "uuid": "f1e3704b-9c51-41c1-bcc0-daef93ae6e48", "comment": "Malware payload (Formbook)", "value": "7e75558da2478c68311fb29c331078316b5955a7", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281910, "uuid": "6cebbe78-2298-4048-964b-d93d9a4ca1e6", "comment": "Malware payload (Formbook)", "value": "8e218300fd9c2dc3461797ae9aa785b7b109cb8399062b89c8395aecd427b8665ef765cd1ef42fd914a548494b17f2b3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281910, "uuid": "57b6b9d1-4887-4b04-93a8-5fe4d5ae046f", "value": "T1AD9533B8EF65007D98438C5B50EE22E417E2BF9BC3AB94D4D5C032272C65C998CA9D79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281910, "uuid": "941a169c-355d-4b96-af79-b9d8ba4e0f18", "value": "49152:Wyk3BjXUOQ0ErV39MtzQV/rWWNKG8sbCDMJ73Dhi:WVRjkkSetz4WOKjsbCDS73U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281910, "uuid": "e69048ab-119d-4938-bcac-acce6aade336", "value": 2029546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281910, "uuid": "424b5b50-90bf-4bee-b828-109a9de75048", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281910, "uuid": "4678013b-88e2-4a00-8dd1-9f303a5fbf2a", "value": "DHL Notification_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad933b2a-abc5-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676310102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310102, "uuid": "826fb05e-24ec-4490-bd62-fb182ce23db7", "comment": "Malware payload (AgentTesla)", "value": "32819bbb515cfabe248785e63544b76d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310102, "uuid": "b532c5cd-2852-405d-ae85-7cf0557d5608", "comment": "Malware payload (AgentTesla)", "value": "df323385db95674bb79c30fa9ed60dec13d5644c8ef6ffb054a449887e8da5ad", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310102, "uuid": "f5e3b3a4-fb33-4b04-98b8-b52d4665c484", "comment": "Malware payload (AgentTesla)", "value": "06d075ca1f03698193be74a7013928e0fa5be13e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676310102, "uuid": "f73fc46c-d264-4c71-9bc3-7a1d9c4bfa9f", "comment": "Malware payload (AgentTesla)", "value": "f2aba4e6d400756c16bc378c0ee3a37da53de0da13d250e32825cfdb00e9beaab354c40161c16edfc7bcd75d3626cf18", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676310102, "uuid": "fca1720e-ecf1-4d2c-a537-80b2fa6a3d4b", "value": "T19AE42358EC1D0E15DDE22EE822520229F13496D6076149DB32A52EFFD0AF983DFBD136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676310102, "uuid": "70013f73-97e7-4225-9359-27601f58b918", "value": "12288:4obYi22KStLkTosZtPOfXUXKLG+SZjvUbsHkw/tS7If0aV+R7AV51OKDW/UqR:5hPBATDPAXUXKLG+Slvx/MIp+R41OKa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676310102, "uuid": "1fc699cb-0a74-4806-a41a-1f2343a9f8c7", "value": 687357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676310102, "uuid": "40c7054d-24d4-4840-8ef0-762ef16faac1", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676310102, "uuid": "d2379cb3-eb23-44d8-90df-7beef901c8f7", "value": "Scan-1_230213_133209_1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248f9e6b-ab42-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676253608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253608, "uuid": "896c1bca-521e-4edb-9d4e-fe04870388d0", "comment": "Malware payload (Smoke Loader)", "value": "3f94fa3600339c20d612693d374687df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253608, "uuid": "a76b9c61-5713-451b-ab7f-fb9dbb31eea3", "comment": "Malware payload (Smoke Loader)", "value": "df3f24620f8ed519ce5ffbf4b260a15c455ca4f23fc788896e62692e2345d923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253608, "uuid": "c55a84c3-e894-473a-a2f1-b7faa592148f", "comment": "Malware payload (Smoke Loader)", "value": "179104bd95a0e9b558728bd2cbae9dcd2a2d142e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253608, "uuid": "493924e6-ea21-4865-8964-410883e759e3", "comment": "Malware payload (Smoke Loader)", "value": "752aa7802acd924e59f30b4a5186161af54d9b3f3cfc8845e2a310d8b8b04cb5503239187265ec7db675ae75dfc51722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253608, "uuid": "d048b7fa-1e4b-40b2-8497-cd45cb6795bb", "value": "T14D04DF1175B1D073E06EC6B098E1CAA0DA7FBC226664C09B337417AF6E313D19AB9357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253608, "uuid": "a8f00a06-482a-4182-95a7-b93d1d2642f7", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253608, "uuid": "dbe993da-b717-4ee7-b2c3-a31765794028", "value": "3072:x32vfWaR35X0G6cCHBfDdUmOLHwAb34XJjidXl:x2W6B0bZnOLQAIdK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676253608, "uuid": "b7e358a2-e489-49dc-aa7d-54603c2e53f7", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676253608, "uuid": "f5fb4c5d-e38f-4cd9-8bf5-164a76daee7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253608, "uuid": "55e04426-3b27-4e89-a444-4dd9f5cd873e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d308de-abf3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676329878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329878, "uuid": "0d5f628f-f486-4e91-b56d-67a78b51027b", "comment": "Malware payload", "value": "b06f070a91c83dca57dc346a0fc0aed3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329878, "uuid": "1636b6ac-8d39-4096-bcdb-8c3cc53d0044", "comment": "Malware payload", "value": "dfd64c49a09e7f26984832c12d18a1f0f46360817af1ed74027e403822ae4d66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329878, "uuid": "9d628878-b2c2-4f9c-94bb-157199ffd267", "comment": "Malware payload", "value": "80c1ddb8e55182d8e531fd69395e6579d36803e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329878, "uuid": "b68d61da-e567-425e-ba38-4baabc2e22ff", "comment": "Malware payload", "value": "c1b9668f6259a9ec8f460fe437e2158c86dad086e4d108feeaca31b1d350b6353bdeb33309e357b90124824895fd978a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329878, "uuid": "86e055b4-4090-41fb-8e40-9c60f0761d73", "value": "T13D44F02332D0D831D86326319D6ADAF4767EF8215A39998B3BE46B3F0F712C18A75351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329878, "uuid": "393d7bf2-69f5-4e32-bf1c-27496bd29709", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329878, "uuid": "5b9108a0-f60c-4ad0-a36f-97c0712b3d64", "value": "6144:brOtYWMwV9SYnR8cTBZc3K4leE6BgDI/mp0Er9cB:bruj7V9vnRW3c5/60oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676329878, "uuid": "4e43083f-1eb9-45eb-a16f-0df031d56512", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676329878, "uuid": "dbdee329-f994-4b43-9afb-4fb87ca5db1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329878, "uuid": "e9ed90aa-de90-4538-a131-02e8e5a44622", "value": "b06f070a91c83dca57dc346a0fc0aed3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4fb0c7-abb1-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676301562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301562, "uuid": "c5928ec2-d960-4620-81da-d504b238f31f", "comment": "Malware payload (Loki)", "value": "751483faf20881f8567d76d6c823bf1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301562, "uuid": "d3018225-8548-4e5b-8eac-549dcea70176", "comment": "Malware payload (Loki)", "value": "e0012a37abf360a40a1908969dd4b34f9abd45d074be84161da714327eb3e2a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301562, "uuid": "edf0fb69-23a3-4172-84fc-8083cc683346", "comment": "Malware payload (Loki)", "value": "1a08b7173000f37fa4efd6fb2a6d12a91cb8a990", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301562, "uuid": "567f129d-7682-41f4-aded-565ecfb21892", "comment": "Malware payload (Loki)", "value": "d8f4cbc3c51ac3a3a8cd6aaaa3784f76b861d985a93c7dc1c3585ff793554d7a9cf44ebcb3798484bd8acca6802059e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301562, "uuid": "52dc44b0-9922-4dc6-a9c5-588c987a20eb", "value": "T1D2E4124A3D699317C938C7F819768578D3B6BC716C72D2622D837ACF1430BA1848BB5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301562, "uuid": "decc33ea-82cb-40c7-b13a-1d9ae853b760", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301562, "uuid": "a263c1cc-55fa-4d4f-96ee-94895230bb42", "value": "12288:uh6q6EMSsVfz6JbCEsksggVKDIcx2xsaG/ikYC0ND571Vd8:uYXSsVfzcU908cxIs5icQ57j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301562, "uuid": "6f34d8d5-0465-447a-95fb-41d0e3fc5018", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301562, "uuid": "55a61a39-b74e-4dc7-9ae9-cf5f63d61923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301562, "uuid": "6c9216a6-75c7-4378-9bf3-5fbef34996b2", "value": "751483faf20881f8567d76d6c823bf1c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5b1ea40-ab7c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676278736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278736, "uuid": "81ee8428-b5f6-42c2-ab9d-ed2a5381d383", "comment": "Malware payload (RedLineStealer)", "value": "7272bd316529c7b192cefa5416f0aca1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278736, "uuid": "92be4a02-9f6c-49f7-bbe1-d3adddc9872d", "comment": "Malware payload (RedLineStealer)", "value": "e06c3c6930e39d2f0ff35e1ad9031d44a6c5b70c40376ca5e161743538bf6f22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278736, "uuid": "a371ab29-aa54-4a5c-8566-a4e2b82951f8", "comment": "Malware payload (RedLineStealer)", "value": "5a974c238a1a099ca48d2b40c8a9d2528bfd578b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676278736, "uuid": "2929aad4-da40-4231-976a-83d90098d34a", "comment": "Malware payload (RedLineStealer)", "value": "4c7ef3946dcdc21efaebba35c317961bfc0c8f5ae0266adee07a6aa82b36d1fed3f57b93bf5e8f230c74be6a410763f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278736, "uuid": "79cf267c-b9c7-42ca-834b-a8614259d185", "value": "T18EF4120BB6E85522E4B5A37019F703D316393E205A7883AB228D7E2D0C717F9717676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278736, "uuid": "a4d875c3-1b7c-48d9-bfe9-6fba4e739564", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278736, "uuid": "6692cae7-32fd-4125-ad7e-cbe335b460bb", "value": "12288:bMr/y90uDza1updxB2JwQ03GgeJJReIih1vVfgTPXqc4wU0WQP:Aydpq0EWI0o7fpWQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676278736, "uuid": "3995f3aa-72c3-43a9-9fbc-00c79a298fc1", "value": 745984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676278736, "uuid": "69deb0fe-e02d-4e2e-95f4-af10b6365b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676278736, "uuid": "e5372f5d-fe06-4cf0-9ac1-a83b3636d193", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a706620-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676272033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272033, "uuid": "d5b2b42e-6953-4aac-b464-e8b22914ccfc", "comment": "Malware payload (RemcosRAT)", "value": "ede7e64306072bcaa307e50c0587ebe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272033, "uuid": "adfec7e5-0544-418d-9699-21df6e7b41b4", "comment": "Malware payload (RemcosRAT)", "value": "e0bf2af1713abe4f3c276ff977a8405ad655b4cf43def74cea14b06540d5ca00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272033, "uuid": "7c599424-374d-4f70-88fc-2b859ffd0dd4", "comment": "Malware payload (RemcosRAT)", "value": "1f6630f51b308b0fd0010426f38ce04a465f2804", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272033, "uuid": "3863da16-b2c5-4f9c-bb21-f9c657af924b", "comment": "Malware payload (RemcosRAT)", "value": "571e252d9e2203f7e1c21c58cd752005df90267d9a59b134a3d0b45ae8d9ef5550a6c39bf4c5ce9f976f34e471de6157", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272033, "uuid": "039f0ad3-d987-4605-a642-f0fc9e154c1e", "value": "T10EB42359F711C9A3D5D383325D7B0760AFA6FC0511B9868B270C5EA8BB323E1941EF82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272033, "uuid": "aa061327-3a52-4b67-b5c7-8a9b1f58f067", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272033, "uuid": "60bfb08a-e42f-4d73-986f-c1154b2bf5a6", "value": "12288:3Yw9TYcmHs207r39OuFpG0Wzl7OE8g6S2i4daf7pzE55iAO:3Yw9TDJp77DBW57OEOR/UTpzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272033, "uuid": "90272c40-21a9-45b9-b3ff-02b3d0569170", "value": 516498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272033, "uuid": "844dd92d-2d40-4353-91c4-f1a0e10d1722", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272033, "uuid": "b9660c99-6fdf-4360-b772-0692e6458a8e", "value": "doc20230211009999850000100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bf5dd1-abd5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676316778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316778, "uuid": "cd8cc387-8fb5-4698-bbac-e8d257319432", "comment": "Malware payload", "value": "4b1757825e731799c72a46dd38e73fbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316778, "uuid": "3bc5e111-98ea-4c12-a4a0-6b06171c620b", "comment": "Malware payload", "value": "e0d89e688f446d7a2eef546cdbded18d6bd28b6476123451f34f9a885d126c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316778, "uuid": "9c47e0cf-ffaa-48ea-afa0-90befa0096da", "comment": "Malware payload", "value": "4e63d4421e4f52df68ccd07894672488d79a2de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316778, "uuid": "46d94be9-2d02-43fc-b1d6-f00ff73de33d", "comment": "Malware payload", "value": "40084e3fcd6110cfd28f8e271071875a530fa62b74c47718e750c8a726fd1fbb4fccaa4164ccabecf373271cdcef6e47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316778, "uuid": "be0950f1-7de0-4900-a34c-6350183417b5", "value": "T13FB5221527C79A3AF5624A34C178C5F18C37BC6424F9A0031EB1FE8E3EB4D866A79761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316778, "uuid": "f028e150-4282-4fd5-abea-78e4b69767ef", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316778, "uuid": "80cea917-8eaa-413f-80a7-9ee07e41a210", "value": "49152:ZtGuB95441oeTBUAUTaPYQc2lJBxmCz4If0aJz8CIdc0MGpuS5M:zr4413tU5WVc2/BGuXaCIdc0nNM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316778, "uuid": "f6d24f34-9ce5-4a3a-a4af-48a93184ba50", "value": 2332680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316778, "uuid": "69523f20-3ef6-4dd6-a53c-036f8970d05f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316778, "uuid": "f668b999-0d4a-44eb-adcd-fb482a267be2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f49de08-abc0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676307743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307743, "uuid": "05da2278-0d95-4b7b-87e7-6a8047cf0dca", "comment": "Malware payload (RedLineStealer)", "value": "adddcd7cd201c0dbaf9cf28e2f41c7d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307743, "uuid": "b252d7bb-7edd-4526-8864-72bdd2cd5956", "comment": "Malware payload (RedLineStealer)", "value": "e101c41dd5aa67b70dc9852979346e29c42fcfe32d1f6ae1b6c2d69a2e634ac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307743, "uuid": "00cf3f7b-abee-4168-9c3a-f13df6588c84", "comment": "Malware payload (RedLineStealer)", "value": "a6c818d29e8af128eacad9e2642b886a82e09fc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676307743, "uuid": "43e563a2-ad3e-4f84-a77a-4f5c76eeb553", "comment": "Malware payload (RedLineStealer)", "value": "c8508048c14907f09834dcca159327de07f47a8d11907db78dbed8573b1982a615232323b92e9ac53acb04e93d2575e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307743, "uuid": "2d2f0836-f1f8-41b4-83c5-5a8f1cd39b99", "value": "T18454F11333A5E831D46716319D6DC6A17A7EB8234A39E94B3BE40B3F0EB02D1C676365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307743, "uuid": "e2a79a4a-bde9-408b-a22f-aeec8dfdc4ef", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307743, "uuid": "d540f25f-1138-4f9c-9a4f-595e20ab6f7e", "value": "6144:ACU4j08L+ri1XXg+Tz8IfIufc7yYQpcJbR7QwtUvqP7:AC3L+rMgDIfIIc7yfebPGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676307743, "uuid": "a533f05b-9810-4d7c-a7a0-ee5086e67b29", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676307743, "uuid": "ba71b26a-6289-4f53-943e-2b8f40939d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676307743, "uuid": "97784012-efee-49a6-a0be-a2d5ca05f953", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2e7184-ab9a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676291390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291390, "uuid": "b4136b90-7019-4991-8ae4-c6271e6f4451", "comment": "Malware payload (Amadey)", "value": "cd4128c60d863b10fc3809e16b62de9c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291390, "uuid": "6fde307d-3cd2-4bf9-9d2c-b7b42f43b76f", "comment": "Malware payload (Amadey)", "value": "e16bb6a9b4e4bc6f014bf78018d247aed7fe00492d08f4100ee1d2b818eb0c24", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291390, "uuid": "145f6f25-feaa-45fe-8bc1-d90658ea3573", "comment": "Malware payload (Amadey)", "value": "6c35e41a92ccbef990f9d407266384f209e175aa", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676291390, "uuid": "0a356a51-e534-486f-a74a-68f20d17a9ec", "comment": "Malware payload (Amadey)", "value": "afab07e65385f1b72596a93e544ef89081dca71e8d67e69d04b8928daf2c381acd3a48b8b6e1895954bc1fa2e0e21706", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291390, "uuid": "dcc9480e-bc53-4696-8989-c8577e27846a", "value": "T16EF41207A7E8D476D4B45B705CF303C31D7ABE516A3493AB268EAC292C316E4623177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291390, "uuid": "4b7946b0-2182-4a70-9754-a396ecabb976", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291390, "uuid": "def51678-b3b7-4c8e-93dd-85d30a51d562", "value": "12288:IMrpy90r72XhDssznAYS/hooV3xVk0FHeJL7NZGqk0v6rro4LRkoapztwIf:hy9hY6nAvoe3x+5XGN0GU4Fhwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676291390, "uuid": "31e484aa-621e-4504-acbb-cc64bc62c43b", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676291390, "uuid": "60dd6576-0c0e-4c1f-8753-8ceeb912627f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676291390, "uuid": "8d8851ce-bf69-4289-b157-8df6f79c17ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb05ca6-ab78-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676276815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276815, "uuid": "19a3bdd0-f09c-4c2e-859c-41ea77b819d6", "comment": "Malware payload (Amadey)", "value": "0d72b77d839566f9efa59c89b00e0bbf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276815, "uuid": "699d2fc1-bb6b-4277-89a8-67ef0c5ba568", "comment": "Malware payload (Amadey)", "value": "e1a1ed032fc65dbeda2333166180911307bd36d64f977ee8320c9dcb6155a4ee", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276815, "uuid": "df779208-f452-4fd3-bf5c-ffd9b4a6cf77", "comment": "Malware payload (Amadey)", "value": "8504819974241b2a6500114926bae74239ac5ad7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676276815, "uuid": "e222fd22-88bc-4717-8938-869b08ebab67", "comment": "Malware payload (Amadey)", "value": "c42390693084e0608df8a62de5490da109f7d9a04ab276a5d174beabc8a54aca0bbf49027295fa96c9cf0692f3041a5f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276815, "uuid": "7a12d1fd-1bf0-4370-91e2-cb2853c71b86", "value": "T184F41207A6EC9032F8B5E7701AF743D315373E90963493AB268AAD191C325E4B676337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276815, "uuid": "e737cc47-6056-4175-92d6-1b82956ed7f9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276815, "uuid": "c3056185-a30a-4db2-933a-786c0298e048", "value": "12288:vMrJy90b6w7F3z0ZCodOecpHMppdSeJ8Fgg3kQ7TrXScvL4MOkLo0asw:qyoJV0ZCowpm323kUvP4MOCof", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676276815, "uuid": "441c3b60-a8c7-4ab5-b91e-4e911fcb8525", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676276815, "uuid": "85453171-002a-4ad0-acb3-1e3cb0200547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676276815, "uuid": "6fffa8c4-31fc-45e4-bcf0-67df72af7618", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d919790-ab82-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1676281058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281058, "uuid": "1e376061-4edf-4107-864e-52ccfea9d6ae", "comment": "Malware payload (SnakeKeylogger)", "value": "cbeae0e460b97172ca86996d7ae1bc80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281058, "uuid": "61f3643c-3519-447a-9b1e-ef9a6eb7eb8e", "comment": "Malware payload (SnakeKeylogger)", "value": "e1cfaf8c115404150c4bae0e2210c47862cdc5f12b0e2054bd5afd4ce6569737", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281058, "uuid": "6770c2e6-e4b3-452f-8068-4282aae435c5", "comment": "Malware payload (SnakeKeylogger)", "value": "1b058625d59261022a56e062d14da9c2ded0d61b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676281058, "uuid": "777196c8-2631-4cad-a3df-bdb6d7b01abd", "comment": "Malware payload (SnakeKeylogger)", "value": "56c7e362b84c2a753c17f72fde9d020993d08a33f727c23c0d73cb03dfb309d6d6f3d1d17c19579220df08dc4f19e3c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281058, "uuid": "51d9b667-3c16-4934-9f81-34b6994ab4e2", "value": "T13BF412593828CB67C62CC3FC5A226878D7717CB42C72E2B61D8776DF2635721441AB8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281058, "uuid": "4fc93216-772b-4dc6-8b19-37f1ecefd68b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281058, "uuid": "4c158d9b-2e13-41b0-afa7-616bb5630f5e", "value": "12288:Ih6q6EMXYC0ND571Vd8DKEZpS07qgGY23SWcbuTPVqCCIsdqP1UHo:IYXdQ57jMKI69SDKpqCNP1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676281058, "uuid": "9c9f1785-6c94-4842-a677-e2585813eebd", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676281058, "uuid": "8c306c3f-4c10-44ae-9084-e75522535391", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676281058, "uuid": "13ebddd9-3581-4ed2-996a-80c26af3c883", "value": "cbeae0e460b97172ca86996d7ae1bc80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb4a6a8-abd4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676316627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316627, "uuid": "457829c4-95f7-4dd0-9674-320726b67e09", "comment": "Malware payload", "value": "8673b15d687242f9058d6c9e9e1b028e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316627, "uuid": "5bb7bab8-774d-4848-84a2-69b6d03a98a6", "comment": "Malware payload", "value": "e1d3f825eb26376ff57ca2b7f1df4f51ae6fa28b85d037d893689832d35370ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316627, "uuid": "2b688059-862b-4aad-b0d4-29b28a39c300", "comment": "Malware payload", "value": "06e004eb2ce5f28d4396e70d3229829c8733bdef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316627, "uuid": "ce442fb4-f787-40e4-b0b2-91b305485b48", "comment": "Malware payload", "value": "c2bd8faa1648c14299ebcdf1f58313ca4d1d7bddcf5323833bc3fb4798d5e43cdfc3fb5c43deb1ac683f20b0254c05ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316627, "uuid": "925624db-d419-41c6-a830-9ab498685a9b", "value": "T16A04CF2232E0BA71E52216315DA9C2B237FEF9225A34A55B37E86B3F0F702D1D536351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316627, "uuid": "28ef3175-2b3b-496d-b44e-df9aecccc80b", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316627, "uuid": "76245131-20ab-4a32-b439-00ade66a6359", "value": "3072:ToVeeWePbk/Ak6jTGznSyZJgmNI3IwX3ZWTXdwb+YvwJWrU:TmefMYAk6uznn64AZWzdwbvvwJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316627, "uuid": "74dbcb05-2e95-47f0-9340-726ccc195576", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316627, "uuid": "860452c2-a409-4508-bfcf-0c126766c22b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316627, "uuid": "df965da8-8721-4bde-b528-334d53201f0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53960e5-abf2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676329416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329416, "uuid": "c29ddc5d-cf7f-47bc-ab37-cbb60779bf25", "comment": "Malware payload", "value": "edf4d9accde61fd13e91b54fba48489e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329416, "uuid": "617598d6-d26a-449a-a5f4-9e83037d6f01", "comment": "Malware payload", "value": "e2522e802b03b3c482634b136e1e3058518f5092539c82c8e81c6fd0e84f0491", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329416, "uuid": "9694042f-7567-46cb-9618-8974adbbee4f", "comment": "Malware payload", "value": "7b95a3fa27d3fbd385459d5cddb5d2f4fc75bae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676329416, "uuid": "7ae5e4d3-d515-4bb1-8052-36438c2dc33a", "comment": "Malware payload", "value": "f473eb40e9c6166146a1c6823ab65315be19b95a461b49b1699a54f429b9e6c024144cf2426748af1837c70ec392a7ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329416, "uuid": "e90cff88-440f-4a4c-9705-a7b895f37eab", "value": "T19BF41207B6EC8021E9B5277069FA02C32E36FE905B74479B534E7D6A0C325B5B23476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329416, "uuid": "b13dabcf-768e-4ba7-a4e1-f2e9187d9a03", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329416, "uuid": "2c145f7d-c43b-4986-85af-1c15d13e667d", "value": "12288:nMrjy90bwmfntONEOlc39jYQeJrGcf2lDU5RLc3oW8sY:IyLmWRlU9jqslDGu3o9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676329416, "uuid": "dc0d5d86-852e-4bd1-8d65-e49b721d6d21", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676329416, "uuid": "82fb0f2e-3cea-4c37-907f-721fa26f3d5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676329416, "uuid": "5529e3f3-ab80-48fa-a882-03df40fad44c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1947acd1-abc5-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676309853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309853, "uuid": "09dc81ca-4a1f-4b75-bade-def63feea861", "comment": "Malware payload", "value": "ed94bfa29b0cc3600464990a7e943e07", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309853, "uuid": "cda99bb8-447d-47a6-9a94-f073cd14c589", "comment": "Malware payload", "value": "e279027f187c46cea658ba5e08bf88068a053b1966c8bce4dfe04a819247d844", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309853, "uuid": "c494de6b-f10f-429e-be0c-4180746a3702", "comment": "Malware payload", "value": "ed0f8ff2571487c6d96fd5363be283138ebb80fe", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676309853, "uuid": "90fa8fe7-8bd8-48a2-9ee8-1009364c9a24", "comment": "Malware payload", "value": "6c47a8f54cf8abe2e41d2610717954835b3f6a9d4be1e0de4217f576ff3d146a73b0691d390f15deeb6ffb22ab4f1d16", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309853, "uuid": "028d523d-6218-4eee-9051-2a0ceb28d9db", "value": "T1CD035F44EB8044B3F21A0138B94789576265AC3BB541CE6A26D73A1FBB33F765E31F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309853, "uuid": "a2ae3403-c76e-4c8b-8314-66027176aff2", "value": "384:kXXwBkNWZ3cJuUvmWnTG+W4AhyGcSX4WaI7/:WXwBkNWZ3cjvmWa+V24WJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676309853, "uuid": "f55c1cf7-5b18-43ab-80af-c651db959764", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676309853, "uuid": "08821c54-8fb1-49b8-8aa3-2073f180ab14", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676309853, "uuid": "4abb5f27-3500-42a6-90f8-86efc8d4fbb0", "value": "SecuriteInfo.com.Heur.12144.3171", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23685b83-ab3f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676252318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252318, "uuid": "d8bd35b9-9ca9-442f-b847-2bab996be2f1", "comment": "Malware payload (RedLineStealer)", "value": "6d9b418ec2128d4972430f1737930eb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252318, "uuid": "a399f403-95bd-44c2-992c-148ee20d1649", "comment": "Malware payload (RedLineStealer)", "value": "e27ee77b131ea3e93abd8f6502a0ff5db7c15dbd3bf7a40c6d4e3e0cd4ad4f4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252318, "uuid": "8b02c569-917b-4b66-a007-ebf482c59beb", "comment": "Malware payload (RedLineStealer)", "value": "6cd5678f24be72f8ceed9314980a90a986bc6670", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676252318, "uuid": "6bdaee1f-d4c8-4bf8-bce5-8dda448d9ed5", "comment": "Malware payload (RedLineStealer)", "value": "ee6849e95301758a4dc664e0efa922f09238bb5f9ed96bb48621014eb5041fb4e20bb158ec3ebcfa47cf087a73aea353", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252318, "uuid": "4d4f9e1a-e87e-4bad-83ed-761294a4e631", "value": "T1EB54F11174F1C0A6E06B85356521DAE4973FBC60A6A0C04B73677BEF6E303C1AA7935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252318, "uuid": "6af469fa-c743-4d8b-b9ac-76dc9cb872fc", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252318, "uuid": "cb4bb3c4-4e04-46b9-ab39-52c5b45d7419", "value": "3072:BeVYN1h35XVzXXXgXTl53DMplIjHAx5ybpT6SPCzE/oTBehtgbR3dgD+iEsE11o3:B9hBVEzDM8j3bYHI/oTBxbdALi1kICT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676252318, "uuid": "ef3bc267-62d9-4c8b-a8d7-cd62c372b3fe", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676252318, "uuid": "ebdd53b8-cb6e-446c-aa85-61bb6492c604", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676252318, "uuid": "f2af67b7-05c1-41ef-875d-3f1d651c0ab1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59bf2a4-abac-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676299405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299405, "uuid": "8ac589ca-1761-48b3-a7f8-730b6a569823", "comment": "Malware payload", "value": "8ac6e2c8bf9c9f486108d1b06f89f036", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299405, "uuid": "36edcc58-9446-4ba6-b1cb-374b05223693", "comment": "Malware payload", "value": "e2da4331a8325ffdd19b28cc191dda193396e8ec6755cf1ac9acfb9ba3ad73f8", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299405, "uuid": "ec5cfaa8-a555-41cd-a837-21cb971a6aea", "comment": "Malware payload", "value": "6514a6c63d71d9037d1bb1973a28bfc14e87124e", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299405, "uuid": "df76b9bc-c4f9-415a-a5f9-96b5997f85a5", "comment": "Malware payload", "value": "2599b20d653fef079a0107fa245fe4af24580b31159d39be86e0243ba4970d52e8b73640bf0ff1713428e40195ac3d59", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299405, "uuid": "8d2d2f8e-6df3-4076-95f7-29cf011a02b1", "value": "T16C23917CB621CC8D9DB3AA3BFCA82715D1489E57FDC9B2E4085540863FB346AB1047E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299405, "uuid": "d9ba504f-bf68-465b-a0f3-1fc125dc86de", "value": "384:frPsjcAqyu+qjWQlleITsyDhagetyuXcLqk0M:frPUu+qjWQlAVdXcLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299405, "uuid": "309ff292-6d36-482e-a4ef-4082ca9f5ea1", "value": 46328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299405, "uuid": "7aee989b-4894-4db0-b1ea-c67701e4cdd3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299405, "uuid": "ab9acd98-88eb-40a7-bdcd-ea02357e8697", "value": "Remmitance copy.shtml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b480bb1e-ab87-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676283485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283485, "uuid": "8b8f81b4-8529-489d-a117-ed9e396e073d", "comment": "Malware payload", "value": "e94edcc54bcf0d65e97bf2d950214e76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283485, "uuid": "3aeb1a66-8ff0-4a97-a6c6-e525fcc556cd", "comment": "Malware payload", "value": "e34e04a5ec0fe131236803262834901c0dc254b8583024050507e683a9b32932", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283485, "uuid": "63feaced-fd23-48fe-b81e-9c3c04934589", "comment": "Malware payload", "value": "fa98138d7c67987405830b35884b44e0a4d11b36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676283485, "uuid": "9857331c-60b4-470a-9a38-f73f5a1992a2", "comment": "Malware payload", "value": "a8d31eebc5474068383ce3e5c3a3164270b22460ab24a6a09b2e4c58ba077b51ed046a9a4d975659e7fc36882d557afa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283485, "uuid": "02c61e20-c09a-47b5-9059-ba9a6264d94f", "value": "T131752387B79F14F0ED37A0304ACD962EC229F7245107DBB2A928572DD726293703A7D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283485, "uuid": "cb56eb86-1da9-43ab-8009-e6462a4f53ad", "value": "1f2702872592229d2f4cb1162cfbc55b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283485, "uuid": "24dcdefe-03c0-4ba4-89f9-6b5eb97fe806", "value": "24576:KPZL2KEqk/cGGIz6csKyizjHkv86C1DY3R3aTDNw223y/z5XIV2QPtPo+qNBru+O:p2Kas6qFHkEU3RqTDzxVXvyonNNugC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676283485, "uuid": "f95d54b2-6448-434d-a2f4-733fe0299ae2", "value": 1572431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676283485, "uuid": "407444fc-baaf-48f4-857a-0fd43c75b29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676283485, "uuid": "cc43be7f-cd96-4785-a234-99b97a5f714a", "value": "cnsware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b907988-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272035, "uuid": "57fb04e0-9622-44c3-a1ba-31d0dc0bcc8c", "comment": "Malware payload (AgentTesla)", "value": "b659c411f54083b2bd8641d30cfc97a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272035, "uuid": "e4ffb08f-795a-4cab-88a0-dab61b0a756d", "comment": "Malware payload (AgentTesla)", "value": "e3e0d1e4f6b405bb5d060f919f7575d1c16812d7ffb19973acd34afb4bb827e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272035, "uuid": "39938be6-f016-4e52-bd42-ec47734b6ab8", "comment": "Malware payload (AgentTesla)", "value": "35f9c01ec0fe74875ce984e769b12187066ffc19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272035, "uuid": "464472af-f81d-452d-899e-18e6ec381c84", "comment": "Malware payload (AgentTesla)", "value": "e5cef7170e2da77b218d1cc9cb2f68d34879de430042549745cf98e1b62611ab554d0427e72f20aeeaac284ff1c351f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272035, "uuid": "b090b2e4-1c76-4ebc-9aa6-f5bface34a8b", "value": "T18215F12D6C748625C92DC3BD81D2A536E37E3EF3B564E6080EC270DB0CB9F96815994B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272035, "uuid": "e0247963-5ce2-4a1c-934d-64ec81e3aea8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272035, "uuid": "b22dc0ad-2330-4f01-aeeb-aadbdee2ab33", "value": "24576:m1ADwqG/BQrJvGgEBsup3bppFi/atlkiiQlQX:FtErppFiC77nK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272035, "uuid": "f69d76cd-5aec-4014-9d39-edf2a5132803", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272035, "uuid": "d4a5fffe-0c86-4a91-9302-e6928e9f783d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272035, "uuid": "21113bcb-2d0e-46f0-adc8-c78ac6f48a08", "value": "e3e0d1e4f6b405bb5d060f919f7575d1c16812d7ffb19973acd34afb4bb827e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412d0387-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676251509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251509, "uuid": "7c64d472-7667-49b9-8eed-89aacd6623a1", "comment": "Malware payload (Mirai)", "value": "32638f3cf3b4c21cef3947f1f2bafc25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251509, "uuid": "119b41d8-8b13-4def-81ee-9e065997d7d8", "comment": "Malware payload (Mirai)", "value": "e438eb46178917814aef33647e7f6b12f3810c0f0f60066f210a5b824500abb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251509, "uuid": "0dbd34f3-2a08-4126-b0e4-f8da678206f5", "comment": "Malware payload (Mirai)", "value": "7f4168e63e7dd6b36a09afcd3e78bc076ce59073", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251509, "uuid": "267dc300-05ed-4e29-82af-0ebe5e3699f2", "comment": "Malware payload (Mirai)", "value": "d45d78955d3c4250fddd391f9b466af246a74dbca27f8da9ce0e5931caecb863cd6eec77177b89812120454f5fb1a17a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251509, "uuid": "3293c9f6-bb7c-436e-a92c-4c8383c01779", "value": "T11DB36D94A8029E3CF497CAB686374B0D643192580FA30F17F6A6FCDB6C731699F46A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251509, "uuid": "26ada94a-b2d8-4bd0-9b94-fee864b5ad5a", "value": "1536:iXjtf/iB1UXStrs+ox2xC7ApLR7byTLhSRDMW2CWS8h6hlAuMxJJpFu/EJuxH27:MiB1cStrs+ox2xCMRKBSRDMW2xcqrbFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251509, "uuid": "158aa437-c178-4171-9188-3083e880d76c", "value": 116456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251509, "uuid": "c2aee683-a0cb-4ce1-93e2-8ab6feb7c353", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251509, "uuid": "2250eb6d-08df-4a7e-af5a-90c5ddec1fde", "value": "32638f3cf3b4c21cef3947f1f2bafc25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240ec931-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Vjw0rm)", "timestamp": 1676300852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300852, "uuid": "ba337662-c1ca-4054-83d9-8b70d605c733", "comment": "Malware payload (Vjw0rm)", "value": "31402979093a6fa8d82437f4c00fdc1e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300852, "uuid": "bbebc2ff-c94a-4d1f-bb4e-75e4a8add95d", "comment": "Malware payload (Vjw0rm)", "value": "e43cd083a5db05eb390580af3cc8bcf29561d080e07dfbcc66c2388b8b16c454", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300852, "uuid": "041872d4-98a5-457f-8678-1b613bc42ee2", "comment": "Malware payload (Vjw0rm)", "value": "3677af496413e8f925d10e05845a949ad71484a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300852, "uuid": "784c53dd-86f9-4c27-9ac4-950dd84834aa", "comment": "Malware payload (Vjw0rm)", "value": "85376d83646d80220c8cc17069d322a30f9568353b3458b4678418fa1dbd8e60e3f50d2f0089fa873ef3576136c48bfe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300852, "uuid": "54dbedc8-2c9c-4ebc-bcea-731726721881", "value": "T1D4F534B0B76CF12B6F740F4EB2DA0D8D5DE23A0B8DD271A8114E9F2B15399D9188D4E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300852, "uuid": "214d04f5-a988-4236-9794-b81b1ae64242", "value": "3072:vkbNExKp0pfpkVU5fzTyb+NuDj/yefrgd84HHM2PQOTWV/g8Ub34mOF3tgsfp9ka:vkbyHHRyV/g8U8mLsEdVARKNNKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300852, "uuid": "144b03c4-8da1-46b7-b0f3-6a3b77b5054e", "value": 3479075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300852, "uuid": "6a1b0caa-30c2-4022-a487-e924346eb3c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300852, "uuid": "b3b4a522-c192-41a4-ba55-a27f7f691509", "value": "RFQ_Order No 43456767.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320fb9ab-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (NetWire)", "timestamp": 1676300446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300446, "uuid": "282dd12e-6d1b-451d-b01a-a80eeccabe3c", "comment": "Malware payload (NetWire)", "value": "729cc4092956ba9a933a6066526df3fe", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300446, "uuid": "74bde7f3-6b05-48be-9864-0a653b29120d", "comment": "Malware payload (NetWire)", "value": "e4c9593c659bac746a293cc94552481a1089372820685f8807f03b8682a0c485", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300446, "uuid": "859c2bc1-b4bd-41fc-be44-2ef4a82d1dfe", "comment": "Malware payload (NetWire)", "value": "bb17e4520e65cf45def4ff881cc50b6771c83924", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300446, "uuid": "820ddee2-ef84-423f-83f0-b92790b398a9", "comment": "Malware payload (NetWire)", "value": "5ed17e493ecf31f8de952ee2f7b3becee48d98bcaafc86d3a584902904badef317bbe56acb681791a6f51197757d17ba", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300446, "uuid": "a6e78cf3-610d-42d9-b01c-7ec34c867bcb", "value": "T1E1E1C711F3A88332DDA74731ACF653C207B893507987CF5E6CC9619B9D1728246B3AA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300446, "uuid": "659125d3-874d-4515-8589-a99f04921dd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300446, "uuid": "7776d787-6849-4a08-a3b1-90603c3fcad5", "value": "96:NBKkYCOAn1fkOKppNPm+SmLjtcROCRZBzlH+BxztpsJ2lkSVtdWZzNt:/wCOKf601mLJ2OCTNxCttpqSVGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300446, "uuid": "823ab762-e490-4a8d-9ea7-895d6553d75c", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300446, "uuid": "b04b46ba-4115-4fb1-afc0-e859b32bc88c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300446, "uuid": "2df1e299-94da-4fcc-8a8b-41cbf417802b", "value": "from-iso_DHL.EXE1__.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70687ba6-abcc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676313006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313006, "uuid": "d9946cbc-b063-49f2-bb62-a28f4175038e", "comment": "Malware payload", "value": "8245d1de7c175e07a25231a57e426cd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313006, "uuid": "5310fd98-0f33-4711-a2e8-dd8744a4ff2b", "comment": "Malware payload", "value": "e52807731640ff9c0ae01b6f343ddf5efcc295ab8514a5a3c710b7638d21b34d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313006, "uuid": "bd201311-a12d-4cff-86a5-855d322e6e2d", "comment": "Malware payload", "value": "5963669721447fadcdba749738b0dfff2481808d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676313006, "uuid": "b9ed1342-036c-4841-9dae-d128c8125e87", "comment": "Malware payload", "value": "7a6ee964a4db5d0b6e4abea085bb6b4f2bf658289db1db8724d517ab154e21bd53a90d3226b98c27352d3e9be55d9ed7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313006, "uuid": "3b5e4f27-6e93-40e2-8219-19765429eef4", "value": "T189F3D03236E0C0B2C8AA65305C74C5722AFFB9625675C88B7F541B3E4F706C16B793A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313006, "uuid": "4389fc60-6f10-4c3c-ae73-7920da8a9003", "value": "89db4fb132eb4013d16b8ca757203146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313006, "uuid": "1608e0d6-7c13-4d3c-8a52-95320fd5298d", "value": "3072:KoSvn1eVPZSMimTR9EGSh24TObnwRNXfB0g:KpvERSMi6p024iwRBp0g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676313006, "uuid": "01643d99-6df5-4ba6-861f-505634e46d10", "value": 158200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676313006, "uuid": "16ba7d91-ee04-4324-9364-377af6208192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676313006, "uuid": "93cbceeb-a8bb-44d7-85af-2b766b67f15a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a068cf1-ab3d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676251470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251470, "uuid": "b173a2cb-a5a0-46a7-b8f0-defe83219ddf", "comment": "Malware payload (Mirai)", "value": "13b678106078d0e57e56b035036da41b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251470, "uuid": "a7dc508d-f4f0-4d0e-b50b-ef945ce4223d", "comment": "Malware payload (Mirai)", "value": "e52b8bb595b0f69c4845d0a48b0733323e798012a4ed3a46d5975417bb187cab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251470, "uuid": "e9087651-6220-4541-9339-2c39438e7a96", "comment": "Malware payload (Mirai)", "value": "5c267e279bfd0d21873ec67e436355e34e8369a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676251470, "uuid": "958f4804-6ea0-4b6c-97df-699025679cbb", "comment": "Malware payload (Mirai)", "value": "d8373548da1ec6f7a56d0a4727d12e5acef5c7599a4f3b3e0fb01748acc317d8598572ff7ec3cd6c74287ffe571ea7a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251470, "uuid": "9e339bb0-540b-493d-af68-a4927a6a072d", "value": "T1EEF2E15EF5285E88C9B61E79424807E0DC48E4C2260BDF497A52CD9B6A1A21FF11E4BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251470, "uuid": "71dea4d7-935f-45be-924c-9ef3602e9e3b", "value": "768:SWEeFz+A+PDLDkKj+QmB8XajbM7gmaW3NWMe:lFP+DCTOX2bM7gQ3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676251470, "uuid": "b4e390d8-4485-428d-a865-ef85d2e65b06", "value": 36680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676251470, "uuid": "159a8f8a-4f88-4215-9dc4-ce095061e21f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676251470, "uuid": "ed06912f-e2b5-4070-88ec-5931cd899400", "value": "13b678106078d0e57e56b035036da41b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f4b018-aba4-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676295726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295726, "uuid": "76b442da-b377-473f-a1fb-71ee5b9c8999", "comment": "Malware payload (Amadey)", "value": "ad5104ef745adcdef94ae911cb2c9e26", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295726, "uuid": "8f9d5d2d-f58b-4a8a-a2ff-53684eb4e75f", "comment": "Malware payload (Amadey)", "value": "e54704b46237f9d86072a37ddfdb6bf800ee10a75f7254b4abaa740a3306888b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295726, "uuid": "e826ea3b-e958-4e2b-bc5e-3bc7ab35c73b", "comment": "Malware payload (Amadey)", "value": "3e5191699901375be4364abe3d241c4e3f863865", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676295726, "uuid": "0133705b-dad9-4ef0-9252-946cc26b0fc6", "comment": "Malware payload (Amadey)", "value": "e5751f6ce7eea629f68332661e82982b2ef90b3248184d60bdbd9e55b6ed966a3aac905d35a33c67b7939172a13396ee", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295726, "uuid": "00122028-ff4f-4cbb-ae6b-dad6bc55ec08", "value": "T16AF4120BA7EC8022E9B527700DF603D3173ABD555B78C297678EAD5A0C721A0A335B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295726, "uuid": "5764d86d-7733-4f58-b254-87d6c324cfed", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295726, "uuid": "67e02159-2e49-49c2-b022-570d953d1d6c", "value": "12288:rMrjy90WQTxx2HgYcN5GDGUv9zWJjOAxC1hH6HeJzpTX73DncSVjKlNRlIRAPCqy:oyaxQRcN5GDjv9zujVxwHTzpv3Xj+RQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676295726, "uuid": "1b5b768c-d64e-4fd4-8540-eaee1fe10902", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676295726, "uuid": "50c1bf01-d66a-40bc-9909-fd1670b04a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676295726, "uuid": "764d5b0d-29e3-4f8f-87ab-0f88f1db0ef0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28954bc6-aba6-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676296565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296565, "uuid": "883cbad3-b87a-47f8-8ecb-d7cc6ce59065", "comment": "Malware payload (Amadey)", "value": "de2b64c5a273ef83010b6f5874a4cf52", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296565, "uuid": "42bec2cf-1806-452d-a458-83c69efd4fed", "comment": "Malware payload (Amadey)", "value": "e58813475b479ef6460846a2a88e6c6d266dffb8bd4bb025a4cd5aa93ee690ae", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296565, "uuid": "1716068a-98a5-42f9-90e7-881e0d052b60", "comment": "Malware payload (Amadey)", "value": "0b60de4ad90b2e57d6dcdf62afc0eb3318b8fe68", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676296565, "uuid": "45b91c9b-b892-4832-ac94-efe2dfc8167a", "comment": "Malware payload (Amadey)", "value": "f59766bf858219d183967afaa9cbf052d320b20a10aa5405645cc2ad914ca5db9cf0ed99896e2d813eb025d5e3eebbdc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296565, "uuid": "59c766aa-7a7e-4a1a-848a-42b5161b1c85", "value": "T1D6F4120BA7E9C132E8B017B055F303D31A3ABEA1CB79C29B274B6D5D1CB26659134367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296565, "uuid": "5a78d583-7b6c-4423-98f5-910d47b2331f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296565, "uuid": "c533f2a9-266b-4244-918f-72c24c45bb22", "value": "12288:eMrOy90bj3imtI5uT6z/DsoxMmreGhiH7NjeJN9Wz3ZOJz1+24B6jBxLbXqcjRo/:wyyjSGZQsCrjhiHyNgzsGB6jBxLbqURu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676296565, "uuid": "10744afe-c135-4915-b8e8-7c82311b86da", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676296565, "uuid": "08202a54-9219-43ff-bfb8-c29bc19bab88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676296565, "uuid": "662a889b-c642-43a1-a41e-4726ddd386ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6502ab0-ab6e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1676272831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272831, "uuid": "840cd308-7093-408c-8c4c-fde33ca21129", "comment": "Malware payload (RemcosRAT)", "value": "ab1a1ce9db279aa701d1a43105794ddd", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272831, "uuid": "6ba0e5cd-1320-442a-8238-804dc3366864", "comment": "Malware payload (RemcosRAT)", "value": "e5f7fd07e990c70c150b230caa0fb375bc951da4426fc8ad929c587e5649e15b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272831, "uuid": "247f6575-be7c-4040-87da-54f0f04f674c", "comment": "Malware payload (RemcosRAT)", "value": "a6837bdfa50eeff1bcf59c550664bc372b9fb489", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272831, "uuid": "c786af46-6066-409e-bd90-b0e84e271fc5", "comment": "Malware payload (RemcosRAT)", "value": "4344a55f5c5e50f13cea23b74827318b62431b37b3a6d241a35035d2576377459bf7f61cd844abd5e4d4ad39429f11ef", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272831, "uuid": "b85694a0-e26c-4511-9d9c-0b21d8837c44", "value": "T149C3BF60FA6E3619490B1766EE435E4480FE443FA06A35F9FDE5438E210269CC37FB99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272831, "uuid": "cea793f1-4741-4b2b-81f8-82773d3b9060", "value": "3072:yilwwTdpAZmpV4sapqazHVM9HSE1ju+FyCDK6QrBRI:yilnpAZWajVXCBQrrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272831, "uuid": "5c089cc8-cd90-47e9-aec5-c90874fa86b6", "value": 129916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272831, "uuid": "20d7a8be-1746-4d38-8ca9-df1f7ad300e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272831, "uuid": "a0389f50-1643-4b7d-9b0c-07c7c2f177f5", "value": "Remittance Advice 10022023986468.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7541d2b-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676280591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280591, "uuid": "034a8c48-0fb1-48e0-a5c9-e7d43a06fb72", "comment": "Malware payload (AgentTesla)", "value": "cee0d55e1a621875cf94f0ada51082ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280591, "uuid": "bfa4c550-e640-4546-bac7-6ac8c2e3c205", "comment": "Malware payload (AgentTesla)", "value": "e5fa8652ebe8a92e3bc8e1100140973bf8ebe9a006e3518de51b99d99c3d1a43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280591, "uuid": "ad171648-a624-4cfb-a293-26890864984e", "comment": "Malware payload (AgentTesla)", "value": "d4c88b349d97c0046749491fd472438b6e29628d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280591, "uuid": "58f2a806-9a7d-4ef6-a6d3-6a1b6418e257", "comment": "Malware payload (AgentTesla)", "value": "a10c0b6d9473ccd192696585ccb5e63a76b95ecbce5a4127130fcee1b1ee526e30750a4e75e3154a68b797e0795c5520", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280591, "uuid": "fa1719b9-a10c-4355-bdc5-f4db8dec17c7", "value": "T139F401403AAE5F54D57E5BF42879B090533A7E9A2971D31C7CC630CE1E32B968362B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280591, "uuid": "8e5cad74-6d4a-4ccd-9849-52e8dca39db1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280591, "uuid": "1fbf2719-f2f7-4e7a-8dc3-a2954132301b", "value": "12288:B9vXgZh6q6/TKPzG7bT/r9Uz/TrBisVqENvT6xB+2eN7RnJGBU:B9v0Y/TKPzG7nxUPrrzOIH8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280591, "uuid": "091e27a0-9173-46d3-b357-ff9fcf77fe0d", "value": 758784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280591, "uuid": "ad27a930-51fe-49e6-8a30-2987ecdf631e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280591, "uuid": "36ca877e-2877-4455-84b3-f6c73fb87fa9", "value": "FedEx Shipping Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d138879-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676272064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272064, "uuid": "d2325bc6-3637-4daf-8e03-324d22b16c81", "comment": "Malware payload (AgentTesla)", "value": "2c375c8b4b2368fc018271d48f59acd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272064, "uuid": "91dba6cb-319f-430e-9be1-e2d7af45ef5f", "comment": "Malware payload (AgentTesla)", "value": "e6193bd382f7c7b88cf15fd2f68a187acceecd0cb1e5f82beba77efbb52f0619", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272064, "uuid": "fd8cce97-1ae4-4874-91a7-e0328fb62081", "comment": "Malware payload (AgentTesla)", "value": "aec9dcef9f15452c63c4376485f3d8b87d48b424", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272064, "uuid": "25d86d12-f92f-4bb3-870a-4efa5cdbd219", "comment": "Malware payload (AgentTesla)", "value": "7520ab4e2c227f16fb90c27bc5ef006a517544e0747da87d6774dcc9477fd55260bab3cf816a28deff4bcf19564a98c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272064, "uuid": "8d4542c3-a2c8-4fac-af2d-e169ad1a4cba", "value": "T1D5151280628AC2B4CCD21FB9C5724CBE65F1E1B982C0865CEDC65A3AFE73350735A479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272064, "uuid": "bca84374-0899-446f-8e54-87cde6157ab1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272064, "uuid": "a5d7857a-d83a-4441-bb56-4c2a050adc69", "value": "24576:VKQPSDX21ppE1q2DCqvBof8ESAlUrueDT:V42DpEfpvyUrue/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272064, "uuid": "f668e0cb-7989-45b3-a15a-f4ad2c0bbd9d", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272064, "uuid": "07721ea8-7582-4c3b-8125-bc628ff2a3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272064, "uuid": "6dfa7e53-4b77-429e-8eed-20c822fedfd5", "value": "Request for Quotation - OC 3967.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3e78b19-ab6c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676271995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271995, "uuid": "230248ff-19c4-4ec0-9436-e41d3c985817", "comment": "Malware payload (Formbook)", "value": "74d4c55aec897f408948b8a5609bffdd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271995, "uuid": "1710dbac-60d3-43ac-8c4f-c38189dd386a", "comment": "Malware payload (Formbook)", "value": "e62a8dd12a0fe7876f858f80bfc1e9658f52f4594d7194ecc6dd656cd715b9d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271995, "uuid": "ccb9011f-f7fc-45b1-8e3e-02d74fff236b", "comment": "Malware payload (Formbook)", "value": "7fa4f6619edac4852b0eec9d017c5d68218d3c3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676271995, "uuid": "915ff20a-0695-456e-95cd-5a3fe109dc9c", "comment": "Malware payload (Formbook)", "value": "9802c838b060fe4942332255965958b44d73f08ab80cfa08a278dace274cd0e63d53c6901b761c54d6593756b1e8c3f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271995, "uuid": "2fee17b1-4e0e-4975-9419-273d263bb22e", "value": "T124F48E62B6E1DD33D12F36B99C1B6364AD353F202D29B9876AE83E0C8F355847835253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271995, "uuid": "0fe7986d-0f6d-4107-adc3-df183b787d70", "value": "80608c1845a68879e7ae0f4d4c316124", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271995, "uuid": "f5776230-188f-4abe-b98f-80e6028b1ad1", "value": "12288:4ElN2Z2/NeCH8l5Hcy+Kl6ZZw773v8kOAAlD+JuvoMAEulyZZI9:F6YoCc0y+KlGwn35vAl5lAEuoLI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676271995, "uuid": "d8bd7853-6981-4812-a2a8-321a5133ef57", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676271995, "uuid": "166cc695-7e9c-4981-a93b-660d422e5dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676271995, "uuid": "aefc6837-bb3a-4793-a81e-cd23038cd1fe", "value": "0094352783923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f72256-ab33-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676247375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247375, "uuid": "21e01409-19c3-4cb5-a67c-04d38937aef0", "comment": "Malware payload (GCleaner)", "value": "9cde0c540ba4697ac3ea12f8a710ec6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247375, "uuid": "2a4275cd-ddea-41d0-a0f8-3020d1858b95", "comment": "Malware payload (GCleaner)", "value": "e6c53dc2a38873f6e8545384fdac4ecc62495ea832c7bcab240fb2afb7ba274b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247375, "uuid": "5c2802e1-62ec-4685-b32b-f271b828fa7e", "comment": "Malware payload (GCleaner)", "value": "cb22aee278172d17e7abdf909fe6170034d539ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676247375, "uuid": "1696d3aa-c5bd-410b-a0ef-cef094841705", "comment": "Malware payload (GCleaner)", "value": "f705e2d4fac8b78039afa93981c70531729b4716c9c7e3a7aa8d0feb8de65543798113904bafd101fb6b543097c02b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247375, "uuid": "39b80242-a814-4ca7-bab9-877da86614a7", "value": "T153F5227C7148C8ADD180FEB48C3AE4E75CD66EE3D9E4A062B0D97F3F91791894A1A143", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247375, "uuid": "aea883d2-bb26-489d-91c9-aa9ca8c78caf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247375, "uuid": "8519834b-fbc3-477d-9326-4817383115da", "value": "98304:JHu16ViSJZRZniv1EHegk9DG3BLwfZu0xkv2MR:du/S3RVg14egkxuBLCZuTvjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676247375, "uuid": "9710627e-246a-4384-97e4-16d8a27fbe82", "value": 3616063, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676247375, "uuid": "47496ddf-0cd9-4b1a-ac15-51a1b7a0699d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676247375, "uuid": "210314d5-b00c-4422-aaad-d6fd85c7b9dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626a90b9-abd7-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1676317707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317707, "uuid": "9b6db893-a1ee-46e1-96db-42ef0f2ed3ac", "comment": "Malware payload (RedLineStealer)", "value": "049fdd801f54de1182383432feb86c88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317707, "uuid": "8db46011-a8a8-40ea-978e-6de892f99db8", "comment": "Malware payload (RedLineStealer)", "value": "e75467700035bed5d7171b042ef8abe7469879006e18ad85e5bba9bce0351de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317707, "uuid": "c4486cbd-5b5a-4fca-8193-93b36223f981", "comment": "Malware payload (RedLineStealer)", "value": "63f6393e620e36d4682369d1423e7305710b26fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676317707, "uuid": "64beb6f0-044c-4a7f-af1b-3a1601ba8679", "comment": "Malware payload (RedLineStealer)", "value": "33f42d40768723115d4d3f5eb357aa269977ce906af87f7bbc39a60152f4de3200b1ae2308d197e39e86152521257b20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317707, "uuid": "1b2829cc-d43e-48eb-8c55-e66666163fb8", "value": "T1DEF42207B7ED80B2D8B1977149F243D32931BE605738835B238FBD1918726A1763A76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317707, "uuid": "56f891d5-5272-4c8a-9492-e9f3125d04bf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317707, "uuid": "7ad66a93-a1b7-4b3e-a5fa-6d321406f4a0", "value": "12288:AMrNy90Wrz8oVGoJwwXyaEUukLwBI11meJj4+rXNM6GnYaOM0WnsbQaROR9:9yTz5VJaCEUrwm1JjzXNewMzsaR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676317707, "uuid": "b691d9a9-632f-4000-aa83-e13281c5b98c", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676317707, "uuid": "7b444e71-3646-4961-8146-6c239d404914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676317707, "uuid": "49247ef6-c30e-4830-aee9-8830c417319a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f77e7a69-ab91-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676287892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287892, "uuid": "4dc4af88-1700-46f8-8398-7087892dc9cb", "comment": "Malware payload (AgentTesla)", "value": "68df9ff9f6117aeeb2a0d926d66e475f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287892, "uuid": "f8f6608f-0b27-4a23-9d49-6ce7256bc062", "comment": "Malware payload (AgentTesla)", "value": "e78091d4b4baa5e310c6722561ca24a05735b0bdc31f61ae10d9a8f5cf1d753e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287892, "uuid": "159df78b-42b8-46cf-8ca1-970fbd57146c", "comment": "Malware payload (AgentTesla)", "value": "ae71b1672f6325c01d3da67f828d73aeeb9982e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676287892, "uuid": "ff8f1010-c169-41b7-ae5b-fb130d9fd34d", "comment": "Malware payload (AgentTesla)", "value": "75ce3de37b7eb8fa0432de252af503825e1215560c89bd75f19e8e2c7696dbe56158ff1232236a56e01587a24b227ccf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287892, "uuid": "ee5eb062-1f96-4060-90dc-f5ec6c528a48", "value": "T11A958F2439EE501EB173AF6A9EE474DBDAAFF6633706A4592050038B4B13E41DDC253E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287892, "uuid": "ef7b15ce-3f40-4b7c-94e1-76c992b648fc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287892, "uuid": "66373d99-9b1b-4826-a910-caabe841e4ea", "value": "24576:53teJM/pHw+TmbDHZWxdbDHZWxCWR0JDLtJc:NkJM/pHw+eD8D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676287892, "uuid": "dc22a9cb-bdea-48c7-9a48-ad052089de9e", "value": 2004992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676287892, "uuid": "1dd012b6-c0bf-47d3-860e-9efe8f5f7d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676287892, "uuid": "d67a5f96-6cb0-49bf-985d-a9f0628775e1", "value": "130223.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "accbb729-ab9e-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1676293351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293351, "uuid": "64f0f965-5197-4313-8b9c-25a003d5d8ef", "comment": "Malware payload (ManusCrypt)", "value": "81e46e7f0df354331bd883b30169c52e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293351, "uuid": "fe726cdf-34de-49ff-a65b-764611f8d0d1", "comment": "Malware payload (ManusCrypt)", "value": "e7bded553dd053da75e9c1247a24b16344028de8c8100324b8f6852daf5078c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293351, "uuid": "d63c780a-a0eb-4b04-813d-6ccf5705d8a7", "comment": "Malware payload (ManusCrypt)", "value": "a3b7640ec0d359a9145f3522c739677b49f21d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676293351, "uuid": "ce5bd662-3dc1-4392-b598-c1aaf313e60a", "comment": "Malware payload (ManusCrypt)", "value": "082f1c8ecc8f89bee73632fb6ac8310602c9de0045d401979ebced039b9b741044820401d233d249c024c37a310fa797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293351, "uuid": "048c7d80-b23b-4247-8803-2e46ae43de81", "value": "T15714BE1372D0E4B2D42256319929C2B4EB3EF8B14F78697B77481B3F0EB02E1A676351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293351, "uuid": "7d344329-3d79-48b9-a7e1-dba5673e8b7b", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293351, "uuid": "94541e69-37d1-45bf-8b60-fc65d1ea8616", "value": "3072:Qpgixt4Py+RxygIkS7+PjT6DX9pFaUOHJa1WDJ+oxxd9xYezYBaNRQz3+3B:QpxX4pIT7+PjT6z9Rq+8xd7YeMBWQCB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676293351, "uuid": "287bd933-6700-43dc-8664-091b7ebf6abd", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676293351, "uuid": "da2cb502-f98d-4bfb-8465-2389b6f7e490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676293351, "uuid": "cd905b3d-3d47-4bf9-a26a-8cdaba726cfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91cab61f-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676299748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299748, "uuid": "d579dabe-ea4d-4ee0-8632-fa20b512a196", "comment": "Malware payload", "value": "0f30d4513865e75cb8544ad7306868b0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299748, "uuid": "b9b92fec-7524-43a9-9bc7-f01c3fc81ba1", "comment": "Malware payload", "value": "e8116c1cd3c13ef3df3e65970c68bbbf78984b7b977d9e0dd71172f7d501095c", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299748, "uuid": "42fe3cea-ce8b-4e59-b393-5e72e6d87386", "comment": "Malware payload", "value": "70fa8b8c07efc1852a6012e9daa1028287665efb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299748, "uuid": "0b727f3c-52ec-4b4c-b0e9-4ae17ee0039e", "comment": "Malware payload", "value": "52d5ebec9b3f2826d0d498f4995c7d05978d5225a6bfc375fffe315f0bdf9f8ceb163262f85650aad9467b9134236442", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299748, "uuid": "809443b9-93c4-4470-bf27-abf34b3fa432", "value": "T19D35F107E57AED2BDC12C53CAC9F24828212AC79B918CA0D31C3772E9636BF1593ED55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299748, "uuid": "1770a07f-4eff-4cad-8459-81622b9c3a86", "value": "24576:/FeZGMdJiIFe3wMdmMdVCmFNlfDqnXGb23RUwCV:dT9cuwiVCmrlfoMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299748, "uuid": "0617edb6-93d5-4bdb-8959-62ad9e483f6c", "value": 1068032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299748, "uuid": "89cbf5f6-0876-4063-9bc0-c0c6e0cdd1fc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299748, "uuid": "d99188f6-bb4b-46ba-8657-18b1f77688cb", "value": "DHL Original Documents.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cab1b33-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272037, "uuid": "c519b55b-3f76-477d-b27d-83c1f2b3ffda", "comment": "Malware payload (Formbook)", "value": "b851f841b33b2911c454b6126716e71d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272037, "uuid": "1a994090-11e9-4776-8813-63f4496457c4", "comment": "Malware payload (Formbook)", "value": "e8120ddaa86fc56ab083a38b22ca366809e5d1196f3c10175bc745e3dfd15750", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272037, "uuid": "7d3f60d7-8403-48c0-9ad6-bbfbd2c94931", "comment": "Malware payload (Formbook)", "value": "7628ab856d509adfcd7e8fc4212c71571faf9e2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272037, "uuid": "a8829b8d-f539-4dbb-847f-243318fb124d", "comment": "Malware payload (Formbook)", "value": "d2ab0ea21ad8a129cd5486a7f822bdd0d734cc7e530564d4f3a40ee635274b04825fa4832dd77bd9714b45345d469d48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272037, "uuid": "424edc86-4adc-4997-a766-c316aa4e5ef7", "value": "T10204AE32D641C031E2B251B5F6BD1B7B883E0A353255A1E6E3E216E16EB49A5F03D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272037, "uuid": "035629cf-9326-4100-814a-c5c18c437fa2", "value": "3072:m81ZkcOYX2iR3h7+gMJOTKjgtCZoEilKag3Tx+Cf9:NRNhig1TKjgtCaPST4CF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272037, "uuid": "78195ca1-333f-4452-9e82-7e9defadc2c3", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272037, "uuid": "5bbb10a6-fe8f-475f-a568-ceba5fcff409", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272037, "uuid": "a7466eba-7bb1-4d95-8532-e9cb534877d8", "value": "e8120ddaa86fc56ab083a38b22ca366809e5d1196f3c10175bc745e3dfd15750", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e767755-ab3b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676250592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250592, "uuid": "a243b7b0-195d-4a11-b3ca-b38182d681c7", "comment": "Malware payload", "value": "82819205bf4650fcbba966996c03d06a", "object_relation": "md5", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250592, "uuid": "b7ef842b-c656-4c78-a84c-e91082301f81", "comment": "Malware payload", "value": "e86f3ef518d1675ec73dc97496aff28a7cf86af14794b22bcf5edc1b1d19cfb5", "object_relation": "sha256", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250592, "uuid": "8d2a49be-5cf0-405b-a9ab-1d9adf53c7fa", "comment": "Malware payload", "value": "5a522dd802fddc361a96090c3ca9c96b018f7a8c", "object_relation": "sha1", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676250592, "uuid": "7baefc32-1959-4cc9-a38b-341bba9a859d", "comment": "Malware payload", "value": "8adc0c1c161cc6de8c5aae48d4dca407ac3adb7c041d7d1e30a34bf54c29f3044f23611285afb243800fba2fb2674b71", "object_relation": "sha3-384", "Tag": [ { "name": "BlackCap-Grabber", "colour": "#84CE0D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250592, "uuid": "b1a68464-54eb-414c-88fe-cee55348d154", "value": "T1F11733A523588DE7D8D5313F8C5FC83D51AAED121758D8CF81A8732A2E336859937FA0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250592, "uuid": "2f524821-605e-4dbc-9d69-d4a07f3eacc2", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250592, "uuid": "27a5222d-60d8-477d-900a-5d3a6ac542d7", "value": "393216:KbxAlndYXAnAu0ptGT6K4/m3pFFqyoBgsSHCJzQQEK4rY2i7X:KSldYXAnA9ptGWK4Ky1zJUQEpU97X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676250592, "uuid": "5b0292dd-6d08-4e57-93f9-294ab3a95659", "value": 20191852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676250592, "uuid": "b659a3b7-81ea-4268-a68d-93ee83771bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676250592, "uuid": "6cbe0f87-979e-417c-abf1-a33cc4a0a0b2", "value": "demon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf0c937-ab7a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676277939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277939, "uuid": "e9331b0c-3187-464a-b52c-11acc875df72", "comment": "Malware payload (Amadey)", "value": "3fc7f0f33b79e2585eba68180ac4d955", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277939, "uuid": "990e625e-a415-48f9-ade4-df2edb78ec3e", "comment": "Malware payload (Amadey)", "value": "e92c62378282a0123570be8bc0658a4f2e7318ebc254249af7381372e57ab643", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277939, "uuid": "cf60191c-f0d8-464c-af6e-d591ec7d6a6f", "comment": "Malware payload (Amadey)", "value": "3d1f982302e90d1c14737c6a2c5547b0d2cf4f5d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676277939, "uuid": "0033fec8-dee4-4d85-8735-8155bcad684d", "comment": "Malware payload (Amadey)", "value": "ef8f78559e27c2754f6e699dc9dd33048b0ac62a89648512a66dc1c2e24e43ce371035edc63facf0e0ebdb9f7a0fd2c8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277939, "uuid": "10f19c21-da50-43de-86d6-c07e9d82f2a6", "value": "T18BF41247B6E89532D8F0677099F303D317383EA16738839A278E7D4D1C32AA5A275727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277939, "uuid": "7474e27a-ec7f-4538-8189-ae7ba05bc544", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277939, "uuid": "9a5e9b8a-dfd3-496d-9b9a-1a439513a11d", "value": "12288:hMrsy90iRF1fvPWFWoFLr5YTuieJMHxyUZTpXbcqp8TFO:tylRF1fvPWEyYTEsVV6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676277939, "uuid": "fae4f5a8-9c4e-4339-93bb-504e03bb4285", "value": 746496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676277939, "uuid": "47a50835-4825-4201-ad51-2baba46f869f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676277939, "uuid": "d3f49c1f-605c-4f59-93ef-8d6540b88dcd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0ceaeb2-abaf-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676300632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300632, "uuid": "3694a5b2-8ac2-4132-99ec-cdf9df2b866e", "comment": "Malware payload (AgentTesla)", "value": "9034993f93ee8a874386bcde4b0206a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300632, "uuid": "6683938b-2c25-498c-8d56-eabeab4dbef6", "comment": "Malware payload (AgentTesla)", "value": "e92d947e5ba510e9dff65b5e87e56e08df8c70e1bd9a05ea7ed08a860b957295", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300632, "uuid": "8ac0aa57-746b-49a7-934b-7f6d0b82bf94", "comment": "Malware payload (AgentTesla)", "value": "64cc95844eb7e1b367d9e0f3821e0b10b81ae4a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676300632, "uuid": "6cbe2bc6-f227-4b6b-bb27-568c57b0f320", "comment": "Malware payload (AgentTesla)", "value": "abd431e144fc127240c0a96f67f50d26d8151a589da55e575c0f200ee1269e7a20fa2dd4724ac09e602cd3921f86b5f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300632, "uuid": "59d7f134-42a9-4884-86b3-fc50474f3e86", "value": "T191A44AE121ACC3D7D0F29D712F9A867075F139ACE4D4520C60F99B2E93D23A415DCAEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300632, "uuid": "efa01b3d-7427-4e6f-a1a4-7edecb7f7570", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300632, "uuid": "4cd6dcd5-eb38-4cca-9fd2-e8f8dc44c684", "value": "6144:GYa62DaNJTCoOn9JlEPKpOp4EviFeYvegZS1bjotnvPnxKqqL6+TEKMTBwT:GY8aHTbaJePKpOp4zBvgvoNoTLxiwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676300632, "uuid": "4b9813af-440d-4ee6-8687-3565624dc526", "value": 477180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676300632, "uuid": "041deba2-7aa9-47cd-9b17-414429c8f30b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676300632, "uuid": "1ffcfd5a-c350-4dfb-a1c7-2dc8be879367", "value": "hesaphareketi-02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e50079-abed-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676327395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327395, "uuid": "f63ff17d-d2db-4543-a89b-b17d4bb35cbe", "comment": "Malware payload", "value": "e70b578e92748def527de53c69df4b25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327395, "uuid": "7d17ce64-66c1-482d-a961-d6acf15a00b2", "comment": "Malware payload", "value": "ea0a69fb6f1d0394dc98405912e438f7206f9996d0d2ef3c00a9fb6fe5846919", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327395, "uuid": "1c09b0f5-0bc9-473b-a70c-8072477c77f6", "comment": "Malware payload", "value": "b53b5ad6d683250069a8416c46870b96f9c8bd3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676327395, "uuid": "02adf983-928e-4ea4-9fe5-5fbe18edfe37", "comment": "Malware payload", "value": "fdb66b45d646adcbaeb9c8b2a2274568e474bfebad622565bd41c2beabd15c86049940fc03c78addba469f2711629e58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327395, "uuid": "bb57a59b-a0f3-41fc-9a2f-fb0431b8b015", "value": "T1AD44E02372E0D872D5222631AEB5C2F5377FF91209699A4B33E85B3F0E306D18A75356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327395, "uuid": "b28f0f15-93bb-41b5-ae47-009f83dd2047", "value": "69c74347ca5e302f400568065e2bcfba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327395, "uuid": "ddaddc59-31d5-4e38-9292-13b3b64415c4", "value": "6144:g0FSl9wV9AfbmVFDWg6HcK21S7sL57WtWYCgN:g088V9ADmVFCg+Z2M7ySpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676327395, "uuid": "882bacc2-2369-49d9-989c-9c70b32cc3ce", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676327395, "uuid": "e7e4416f-ca0e-47e2-af9b-4ca0135a5ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676327395, "uuid": "b28ec535-c8bf-4d4a-9f9b-5fe281eaf85d", "value": "e70b578e92748def527de53c69df4b25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4f8013-ab81-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676280653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280653, "uuid": "6aa947e1-680f-4d3d-bd84-8794ae8e701c", "comment": "Malware payload (GuLoader)", "value": "6600de691eacbf5da122528f64d40b3a", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280653, "uuid": "0c1f7368-bf1b-445b-b017-9601e850b2a4", "comment": "Malware payload (GuLoader)", "value": "ea12e877f81661094649620e721c19b28af4628d02a2f035eddee81c212befca", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280653, "uuid": "35f80470-1aa1-4276-8d3d-25b3dc81a9c7", "comment": "Malware payload (GuLoader)", "value": "26f9ca15055a6d57cb02087c2c12ee2960fc9cd8", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280653, "uuid": "2f5b5225-cbc3-43f0-aa65-3b8582ad3c54", "comment": "Malware payload (GuLoader)", "value": "7e689a7bf105779a5ffa8bc3f1f454ee034a3014f50ac3149c02ec345373d833338aa4e2ab8020b1e4cf372a170c5541", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280653, "uuid": "7e44357d-d037-445b-be00-58fc18a55645", "value": "T17F138D61D9C614169E0B3F7EBC872F85987E4876A432A0787DE807CD0E06DADC37E216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280653, "uuid": "ece2ea94-4590-4b38-bdc0-d8cd456e191d", "value": "768:/JZzlIfmOJb1m1qCq3nYpC5k5eIafwOxGvGz+9W4lxyVsD4PRt2djFN6F:RUfmOJb0snYqkMevG6c4lhNV6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280653, "uuid": "2505b108-4a46-44de-a161-f1d48db86ea5", "value": 43079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280653, "uuid": "8b52b7ea-ee9b-4d22-a9ef-2ab761740791", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280653, "uuid": "5f0eb809-6195-49d3-932f-a20e6b9a4aee", "value": "TBC - 880393659090.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a696aa38-ab39-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676249961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249961, "uuid": "f80c5c28-550a-4b53-ad3a-e942c3eec2b3", "comment": "Malware payload", "value": "700fb9c7891703382b020ea6a0893459", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "veil", "colour": "#80A310", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249961, "uuid": "d4a00daf-cb80-475c-962a-7549e07fb784", "comment": "Malware payload", "value": "ea3cefbec5559525250299d7cae97e85c8afa12a3c47b1123d6f2473ef6dacc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "veil", "colour": "#80A310", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249961, "uuid": "64a2b344-ea8f-4c38-b925-cf5f8ec7b7bb", "comment": "Malware payload", "value": "0881ac6033f2cff5dedc18f07900ab6b81479ecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "veil", "colour": "#80A310", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249961, "uuid": "ccde56fc-840f-458e-973a-e3b341224c48", "comment": "Malware payload", "value": "3f256730e11e9a18c4bedfb269445a4dd4bd6b8a1de11808ec18b8cb4be025714f9772ccb7e2d283bad4df76f63ca93a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "veil", "colour": "#80A310", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249961, "uuid": "0ce4c93d-97eb-463b-a69f-a5ca381fc9cc", "value": "T14D26335BC0A9EE74DA5382F128F6B2BFE4824B7D65F24809EB6C30147252E61D70DE17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249961, "uuid": "0d749e7c-cfd5-420b-9f92-6c299a54ab80", "value": "05a03ed18d2e75f8c4f1c5bcf287ac56", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249961, "uuid": "76578dc6-0870-4e74-bdc9-63ca3fe95c1b", "value": "98304:/YVHQcsibw8SPLeTtSQo5Z8DERxrfExYzznLQlyl735r2gY3q:wVwcXMHLKy6txILQlyF35r2gYa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676249961, "uuid": "260f1073-2552-46da-859e-14647cd1246a", "value": 4772844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676249961, "uuid": "c8cde59d-54ee-4817-91b6-3d6c6344a61c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249961, "uuid": "24c3ef42-8fc5-416c-bb3f-a7f73beef5b1", "value": "veil.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f536610-ab8d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676285973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285973, "uuid": "a307508d-84a8-4a79-8fc5-27235b6c1355", "comment": "Malware payload (Smoke Loader)", "value": "792018486680014dbde50ad58dd925f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285973, "uuid": "ee852a59-dc2c-4d32-b62b-aecf8da1af90", "comment": "Malware payload (Smoke Loader)", "value": "ea90e9a64e47feec4e20a41bc22ea2aca6fb0d16eb133d8ac6265d9d71981425", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285973, "uuid": "2bcd8c24-4d39-4bcc-a33b-14ecabd423bf", "comment": "Malware payload (Smoke Loader)", "value": "ab781343e5b3ece458f6950accd1d5bf42b5172e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676285973, "uuid": "5f9ff11e-c49e-4712-ac0e-0317eab98dca", "comment": "Malware payload (Smoke Loader)", "value": "1a0c26387cc3be8fcf492f6647fe6e6a929ee5b17a7314478717ef3e1cbecfe1dd89bc965505bec6b535d973c41c8fa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285973, "uuid": "5b19599f-46c7-4e9a-8092-f44f8aad4c7d", "value": "T15F14BF237290E472C57246337E7982B46A3EF8B15A78B66B77541F3E0E702D19A72313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285973, "uuid": "a386376b-6258-4c6a-be7e-c8bb5abf2f0c", "value": "209f9c826abdd7bbdb83ab4abd6db0b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285973, "uuid": "a3b4479e-1d3f-4467-818b-cce74f7854f6", "value": "3072:RvcUKbth3RgdwaI+5Gew8hhx3A6Pve6bTE6Mqd10VWG+f9iIbx/5nzzlC13eK13N:RvrGE9IeGew8hhxAQbH0+9iYVNZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676285973, "uuid": "60141330-04b1-4172-a664-93ab50657db9", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676285973, "uuid": "994b5884-2e6a-40b6-996a-afb70a5a54ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676285973, "uuid": "f5e5abf3-86a8-472a-a0fb-1b8ad1873895", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0411737c-ab42-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676253554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253554, "uuid": "d51e2e9a-bf98-4098-b449-a0f43bdf2626", "comment": "Malware payload (Smoke Loader)", "value": "ce38d567786aedda25213ed2450dfe14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253554, "uuid": "85e3991f-03b3-4e43-9801-3c78cb0a53da", "comment": "Malware payload (Smoke Loader)", "value": "eb15ab6f0386e1a37aef949ee2ce0d5482fe3f7f318dfd45403660499dd4b3e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253554, "uuid": "58844f23-9765-4159-a88a-1819c8a249a4", "comment": "Malware payload (Smoke Loader)", "value": "30d1e8ad13bf8df7f2735399789522a18a9a908f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676253554, "uuid": "45ff0ff7-88cc-4ea5-a715-992c6953ee9d", "comment": "Malware payload (Smoke Loader)", "value": "2b51c0aad714e08ffd63d21f46aecc7a242044c6726db3eef49514ade61dfc44fc4ee9c9420c45110fa07e5744dab938", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253554, "uuid": "b6ef8650-f096-4f94-a356-2c47ba811c9d", "value": "T14104D01175E1C072E15781752530F6906A3F7CF1E7A8E4973F582AAE6E302D2DB6530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253554, "uuid": "9015c345-81d5-40fe-abdd-ffe4ee4503b7", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253554, "uuid": "0197f24b-2efb-4760-89f4-a9224608c676", "value": "3072:AYNZ0S35XsyibNmc+h8wUZipI13FW4NXvAgoX:APSBobNXwUZ4SThu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676253554, "uuid": "7687b487-a765-4691-a844-f7352a98429f", "value": 184832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676253554, "uuid": "dc96be38-ca30-4072-85ca-de9b4fc72889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676253554, "uuid": "b034d740-5244-473c-a6d9-da9586a61456", "value": "ce38d567786aedda25213ed2450dfe14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1017287-abd3-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676316228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316228, "uuid": "7c15c33a-feba-48e8-9562-ac21079e3fe3", "comment": "Malware payload (Amadey)", "value": "423ec7fe49fe4758e57afdd58418b2c3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316228, "uuid": "b0514ec1-316f-4f62-8231-90a05e2c9f07", "comment": "Malware payload (Amadey)", "value": "eb472b1cdb3c53a4c0b07fbf921ed5acd6203c1d4b56c800b9e3e866a2cfaac5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316228, "uuid": "581828e8-a269-42cb-adf7-81d1ef263f52", "comment": "Malware payload (Amadey)", "value": "85c2b3e7c9cbaee5cff8df55607ebbfa82a4b8cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316228, "uuid": "70d2c4ab-9747-4d54-bb32-6a757da4454e", "comment": "Malware payload (Amadey)", "value": "28694398a7280af6f4571cddd6277c10b9db6a7a45ddb2b38d9f08a308611fc559a7ff519b242332afb2b526a61bcf80", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316228, "uuid": "b676eac3-6bfa-404a-95e0-fa43ea6bd9ab", "value": "T1E0F4120BA7EC9172E87457B028F613E31A317E615A3843AB624F6C494C33AB5727537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316228, "uuid": "9c87bb39-f87c-4381-a1e8-457f4488593c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316228, "uuid": "7b3c9ebe-aec8-43f4-9288-ec93a8bcb71d", "value": "12288:UMrSy90mJkXVC9Xt+KLwLOxyGH9PeJPsd0tfFy4/oRgMZ3Ql02q+B/fc4n3:myP6VCRxLCIWPsdetywoKMZcR/kW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316228, "uuid": "d3047e6f-cdc2-40fc-a853-9e944dfbe7f2", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316228, "uuid": "b0b1701b-5422-449e-8dde-814132be2175", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316228, "uuid": "a007fcd3-69b5-4258-96c2-bc40870fdd84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930ced40-abad-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1676299750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299750, "uuid": "3500a188-49c2-4bdb-a39b-4eda0fa64a73", "comment": "Malware payload (Loki)", "value": "b53d29992533520b827228516f021f49", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299750, "uuid": "0356f7f9-5ec9-428a-bf18-cdc0f09f00a2", "comment": "Malware payload (Loki)", "value": "ebc6d9bdba2acb425f9ce0245b8b23c2b37f3ea7810dc3b8908d98e28dd27c01", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299750, "uuid": "794d864f-3665-4de7-bec3-da37f549e1e0", "comment": "Malware payload (Loki)", "value": "9c2cfb272d01d95de2b38cc673253dd5dcc77af6", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676299750, "uuid": "47ed3371-ba70-4a4b-a424-71d61242c154", "comment": "Malware payload (Loki)", "value": "7414b396e493ba9ef568925433015b1992baac8f4fd18647d253875e27ebd8c6f426bb4fac3fb72d72044bcc38f7ecee", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299750, "uuid": "56447f42-d194-4bf2-9200-54f5da047910", "value": "T1CA433D2EE70F0915DF5597BB035A4E4A45FCB22DB38140B539AC97343BADC2E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299750, "uuid": "bb508845-c928-4f8f-8f64-5bff0ef36161", "value": "1536:ASupF0AorqfeDA47gooo0FBkdJZ3LN2X+PpPfAWLUXUiliPsk3ByRhVWECGmyR:aEAorqfeDA47goo9BSTLN2XmPwXUigPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676299750, "uuid": "80631b35-dd40-4efe-a052-c750614c3c1b", "value": 56245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676299750, "uuid": "6a3df6df-8ddb-4af8-9e5a-014a2a698a21", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676299750, "uuid": "398c9300-76d7-43c8-8914-1d3b3d820eb2", "value": "IN-007.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390feaf2-ab43-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676254072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254072, "uuid": "41b304d1-6add-4bfb-8613-e03fa1542431", "comment": "Malware payload (Smoke Loader)", "value": "f5ad238dcb26458e74e5a4a5368ef20e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254072, "uuid": "573f5b73-277d-4d3d-bf16-72869d57a6eb", "comment": "Malware payload (Smoke Loader)", "value": "ec41706892fae7e46bc01072c9bd80aa0329ae826a45119a514493b04bfb2a3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254072, "uuid": "7953b0ac-df4f-4bf3-a83b-bf74f1d8550d", "comment": "Malware payload (Smoke Loader)", "value": "636f629fe013fe03d02568e40dad81c60f0a5417", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676254072, "uuid": "a08c494d-9f72-4243-8146-c8b73540e7f4", "comment": "Malware payload (Smoke Loader)", "value": "c56306a7f635fc0a66554f18160f185c536cb874cfc49f4c42eb6c3c0f63ae3b793d31eecca75c1545fe4bec701aa877", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254072, "uuid": "bd2d1bc6-b2c7-412e-8254-5bd1280b0368", "value": "T11C04CF1279A1DC62E59785746421F6E06A3F7C716BB481AB33C43BEF0D3C2C09A6A357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254072, "uuid": "eed8568e-4d9e-4e61-a71b-d2f60011ed3a", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254072, "uuid": "e6900447-60a6-4250-ae79-c0780e369673", "value": "3072:HZ1A8fP635XhqxqDIZN1zj4RRfPvMwuhZx:HX9P6BEYaTzER1HMwu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676254072, "uuid": "100e3f4f-b4cf-4ca0-b1c4-52dfe182996d", "value": 183808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676254072, "uuid": "0bb64836-18b0-4a3b-9d19-015a108375c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676254072, "uuid": "e4e0daf8-2e8b-480d-834c-71b975d3f465", "value": "f5ad238dcb26458e74e5a4a5368ef20e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa18cdef-ab39-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676249967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249967, "uuid": "4d52021a-1e06-468c-a8f7-f04a5ac9e2e5", "comment": "Malware payload (Smoke Loader)", "value": "75f05af46235ce799131539b97e53df5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249967, "uuid": "cbc5925a-6a33-48f8-91da-21af82b3ba1d", "comment": "Malware payload (Smoke Loader)", "value": "edd350ebaba96f03d9d4e8e965e9cf9152f548cc3ea2adb2a7e36ac2243374ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249967, "uuid": "623da40e-da6c-445c-9dc2-d7a5d7ec6efe", "comment": "Malware payload (Smoke Loader)", "value": "806fbbf51381220a861a127490b21ef7c555b685", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676249967, "uuid": "ce92d8df-0649-4f87-bb2d-d0777528dac3", "comment": "Malware payload (Smoke Loader)", "value": "74cd85fd680ea420fad1226ab10e107c009615f98990c725361ac4fbe12240d2d45b958c60f2280e9e31a8c5ab720245", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249967, "uuid": "f68722d1-1c44-4adf-89e9-531e8873560e", "value": "T11F04DFE17DE0C072E3978574A421D690692FBCB2A3A5C4DB3344D69F4DB12E18BBB352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249967, "uuid": "a6f6d8c2-ef1f-4246-9102-7dfb7abc8998", "value": "1ec118ddc3b50693168adb7f3df7b684", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249967, "uuid": "cbc833eb-066f-42f5-aa7a-316a030510cf", "value": "3072:eCKZ/X55HTQBBL2bqu8T9YbrLDVlIT4kj9DK6Puj:wtTUTkDucHgEc9W4uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676249967, "uuid": "1beb8917-15ee-4d4b-b358-6bc28e4d4e23", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676249967, "uuid": "8359ab4b-f38c-48a0-99a1-fb091431d4fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676249967, "uuid": "260e2103-c19a-4b34-929b-8aff039bd272", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6eae14-abca-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1676312031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312031, "uuid": "68c78060-075c-4be1-a3be-33549ce9bdeb", "comment": "Malware payload (Amadey)", "value": "21f0d4b3fc097ab3c38273d20faf0523", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312031, "uuid": "6d58d8f8-2d5c-4cc4-9eca-61ccadc6dbcd", "comment": "Malware payload (Amadey)", "value": "ee0b6164a896e4aee2ad1d45efebc5d28f91afb1a4cb329f01808e1763609e93", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312031, "uuid": "12f9e374-a752-48cb-a514-d23c44fb67c8", "comment": "Malware payload (Amadey)", "value": "12e928e051f62c5469fd144a88e061df7231f8d6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312031, "uuid": "8c187300-ea34-4c89-a743-bc209bf7b85f", "comment": "Malware payload (Amadey)", "value": "97d41a15b887fc82bd83df5563f5df7e7ede86140e4771d250efaa8e413e98fd57f6754bf39f3228cebf72e6c3343891", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312031, "uuid": "22b6d5bd-87f0-4622-ac62-67bdb0dc7cd2", "value": "T1D5F4134BA5DC5132E8B4677059F206DB1F31FE505638C267278EBD6A19722A0B73132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312031, "uuid": "06f3415e-3001-4e10-8449-0c16c99a5117", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312031, "uuid": "040733c8-c50a-4bfd-8c3f-445c88b795c7", "value": "12288:NMrxy90L0EnqsZ5sjfyViS++2wC8eJGQSMUbznlTlLiFA9knz7W:cytzssmivVwE/SMUbzyF9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676312031, "uuid": "bd830815-24bb-4aec-8a20-3b1d0c22a935", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676312031, "uuid": "a23609f6-ef53-4a4e-8ac2-5c86b98ce00d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312031, "uuid": "3b033235-54d6-4490-a359-5062cbfe342f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1239e9a7-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1676272046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272046, "uuid": "16f55e01-4503-40a4-9c78-7578dbb26314", "comment": "Malware payload (GuLoader)", "value": "c5e8b753010d23d3e7ecbe690afc21b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272046, "uuid": "ef65cfd4-6c6d-4bb7-978e-756843ec1564", "comment": "Malware payload (GuLoader)", "value": "ee70402abd31ad9b8ef47279c85910da7189743e022d23e2ad6efe7ab76dea0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272046, "uuid": "26518d50-d857-4be4-852f-df4ea9ae0d46", "comment": "Malware payload (GuLoader)", "value": "e18babdffcc54b2bfe1029b97b16796c575f8e19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272046, "uuid": "545e6959-73a2-4d5c-9034-56d4bb010d90", "comment": "Malware payload (GuLoader)", "value": "49e60b162127ccb1f932b7c13d63802187308740505b9d1c26291d1523aa5717bf4f41dece33009700fb0ae7d6dc0c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272046, "uuid": "495ad8e6-1d0e-42c8-a096-4b30eb06a7a5", "value": "T140D401A8FF10E80BDA560F380D55D1645A30BE803854D663B7E27FAF3F7A2D2B925146", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272046, "uuid": "1bfa969f-ca81-4b83-8846-11b3662c3263", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272046, "uuid": "3ac29648-7a03-47d5-8597-255f136735b5", "value": "12288:5bif/mHZzu6uhuQgRN6Zuj90Z2upnDuAes/qaLJNOofYDME1yI+oRwkEA/:Fif/mHZzutuQgHt90TnDuAX/JjrYDTvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272046, "uuid": "4d9cfb19-bf27-47ef-a433-5cf3a7db2ef0", "value": 643784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272046, "uuid": "d69389f3-72b1-4ebe-9ff0-50d3b2dc1fe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272046, "uuid": "a7fdd247-ceaf-4463-88f9-c259b4f8438e", "value": "JUSTIFICANTE DE PAGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfdfc298-abcb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1676312737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312737, "uuid": "491083e0-8bc1-4530-b5aa-90dcb2af1cf8", "comment": "Malware payload (Mirai)", "value": "5149b20d2d7484d52bb2ce6a7ff7cec4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312737, "uuid": "fe4ea780-5707-4b8d-90e0-9cef920ec528", "comment": "Malware payload (Mirai)", "value": "ee8f17b957cfedeb2f41d2e7bfe68b13271f5d2a0753eefc425cfc31913054f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312737, "uuid": "870c72d3-a43a-424d-aca3-75e16960248b", "comment": "Malware payload (Mirai)", "value": "d28eb075c98df14ceac61f71aed8e434d834dfa1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676312737, "uuid": "36efb317-4e5a-4ec5-9d81-467dac246312", "comment": "Malware payload (Mirai)", "value": "cc394fbe5741446a21ce65bfaeead8301969ad37923b42fc1a7a8710b118d1cd8ed8afe9b2500da3a12f216aa242c1a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312737, "uuid": "86b84ece-4291-4940-a949-df8fea2a0f58", "value": "T19873AEB2C4652DA0C2684138A5E6AD381B13F50196732EF04E168BE2650FEECF55E7F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312737, "uuid": "ec9e62c9-30bb-4988-8c16-025bf8afb3bf", "value": "1536:E/jnwcbjpmywJaFwtO/WlP1Y1VOCjFhA6y5gn0iG0NIxCS18f:ErnwmpBwJCJu5i1QCbLn0iGkIx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676312737, "uuid": "a929c651-a68c-4f89-9178-60bde1ed076c", "value": 74804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676312737, "uuid": "24f41b8c-2ad1-466d-b259-cd2b0a398543", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676312737, "uuid": "6b3c1e9e-0ead-49a7-ad82-e59ab290861d", "value": "5149b20d2d7484d52bb2ce6a7ff7cec4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2266a2-ab5c-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676264840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264840, "uuid": "9049c184-edd8-47f6-b37f-8d29dd80110f", "comment": "Malware payload (njrat)", "value": "5221a481d0fc7292eeaaee207f1711f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264840, "uuid": "b6146fe9-bba7-4c3f-94a6-d1b38c250d2c", "comment": "Malware payload (njrat)", "value": "eed339357478dcbe1598136250942503ce5b269787956ae30c18f398e503b770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264840, "uuid": "c28201ff-6165-40dc-ac35-0fb0f8b2911e", "comment": "Malware payload (njrat)", "value": "9ae6e1f1dbf07bdf9e2ace85d38ab768e97fabba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676264840, "uuid": "f329de3d-93fe-4e67-a8ea-9f6d0d3c6abb", "comment": "Malware payload (njrat)", "value": "788c56742f25653adffa03f888778d10fe65abbfceaa88a7c22b323cf52063341154e6454992fa5c194fa363f5c0541c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264840, "uuid": "5773cb6b-7223-49b3-bda8-c055d9c73479", "value": "T1D6B21A4F3FA98866C57C177486A5965003B0A1870423EE2FCCC554CBAFB3AD92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264840, "uuid": "ab09aa55-4f05-484a-b9e6-eceff73653d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264840, "uuid": "ee6fdb14-f881-46bd-b19c-b569908cd1cc", "value": "384:zcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZgv:I30py6vhxaRpcnuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676264840, "uuid": "35347e90-f39e-4eb6-87ff-b9af618c9c09", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676264840, "uuid": "31df62d3-9bd2-455e-9df4-e32711a46016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676264840, "uuid": "7b8ee894-ad26-4283-b091-0e56916bb2e4", "value": "bJBp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e72969-ab80-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1676280553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280553, "uuid": "6bd53594-1cf8-4d83-bee7-23f38db6fffe", "comment": "Malware payload (AgentTesla)", "value": "8f735146f8caf19ac19530e8d53e5723", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280553, "uuid": "b46953af-3275-4abe-a66d-74859980a02c", "comment": "Malware payload (AgentTesla)", "value": "eef81aa34f56adfef9816a5c91883b920da81ef467c75d3d26accee5eabe5f52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280553, "uuid": "a30aabd0-7908-45d0-8131-a04fde780cdc", "comment": "Malware payload (AgentTesla)", "value": "cd7046a3662f1d2fc746d054e360fac306d8012e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676280553, "uuid": "2071ac0c-8621-4d81-b309-6389f7e480df", "comment": "Malware payload (AgentTesla)", "value": "98f8fb19deab8ca23f7fc76113e4f63ba2c24a922344550ee06b1a9b57c9f316a07d74b940f13615bb3b994fece4b5a9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280553, "uuid": "36aa0e7b-36ce-4c05-8a0f-5c4cd39c6ac4", "value": "T1D7F41242265E1350C16866B580EF543997F1EFC32AB3D2C73F1CB29D5A427A3AF41B98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280553, "uuid": "5c72a251-e4e8-4f2f-86a5-b051a1ba4901", "value": "12288:YKD2BJUHaPD+V2Z/0498Y06daYdShuXaGEre9WzEN6o+wbPdC3aQbnN15EQzaCNs:hgR9j0xaXOre9mEN6o+wbPdCBbnb5EC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676280553, "uuid": "17964e20-f827-4c0c-b604-d562cc370478", "value": 735304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676280553, "uuid": "05d2b0f0-1920-4386-b42a-551aa7f5ff32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676280553, "uuid": "3ed945e8-9b4d-461c-add7-1cf29b453ac9", "value": "dekont-20230213.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee9beb3a-ab85-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pony)", "timestamp": 1676282724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282724, "uuid": "d95e5d28-bdd0-4283-952e-bcc4186c8afb", "comment": "Malware payload (Pony)", "value": "70f548c9858f69fc54f3a907d11b76e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282724, "uuid": "7dc177b0-5a0d-4ebe-9303-1878c3cd23d6", "comment": "Malware payload (Pony)", "value": "ef11640a48d75d3004ee987099adca738e43b7298a0b52913f4f9cc878422116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282724, "uuid": "4a70a48b-a161-41ce-976d-91c5f05c0a79", "comment": "Malware payload (Pony)", "value": "74537424367b1b920a599fe635ff07d615ab67a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282724, "uuid": "60e989dd-7e6e-4477-95d0-2e2a1f183020", "comment": "Malware payload (Pony)", "value": "075354e9115cecf875aba7bd967d5d661f2ae8756feb7490eed71044483fc6047237e00b28bfa1d58de0bf6f7489f991", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282724, "uuid": "d4416b30-4380-4faa-a8b0-d02cb667f81f", "value": "T1437412D7D608AD76C2052C3D8F978D19B3F2D93D062A63AB004AF8EEF47D381AE44521", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282724, "uuid": "84d92268-1d97-460d-8aad-5be81862d797", "value": "7a43f7969acd9b42ea476b177ea7c29d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282724, "uuid": "8589a70a-24ea-461b-8396-cdbe08f5f1bb", "value": "6144:3RJWqrsqoOvxYEwulXuWKZO6nWPJoriWL5Wqb2TZpvD4Te0HzBO0:nWI9oOvOEvhJ6uJAYq6TZpL4i0H9O0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282724, "uuid": "b8d0f004-1229-44e0-9d82-a80df96f5fd6", "value": 347648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282724, "uuid": "d63f9827-6fcd-4e4a-8b9a-ced66829441b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282724, "uuid": "6d6a5ed8-15d0-4945-a603-346d952c2278", "value": "70f548c9858f69fc54f3a907d11b76e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b2d685-ab95-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1676289559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289559, "uuid": "9a80c50e-f962-4432-91ca-87d8aa4d538a", "comment": "Malware payload (AsyncRAT)", "value": "745d5609cd535a78dea1f9521b6ebf76", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289559, "uuid": "a91529fb-a956-41b7-81a0-3975c857ea40", "comment": "Malware payload (AsyncRAT)", "value": "ef69f3e6161a2dbecefb9b991023e062877415ad1c1be084e6d331a91a74e596", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289559, "uuid": "da68925a-2f83-4593-b79b-309a8702d88f", "comment": "Malware payload (AsyncRAT)", "value": "0b9b2cd65488477f90a79b73d22820bfc32318aa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676289559, "uuid": "fe3526f6-6252-4cb6-8228-bd3514cc8607", "comment": "Malware payload (AsyncRAT)", "value": "0c2c9b2304b19229da6b8a3a9bb7b183c17b86d1945154e036a8de58d8d6198999504be8ba30be02c6015f3403f571e2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289559, "uuid": "f4368e6c-bdc9-463f-be35-3c141514854c", "value": "T1ABA5D04172893C1AF5F8CE7D890ED52CE15976822F5930C277E0D84A3E77AD0E4D2153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289559, "uuid": "e08d6720-0d62-45b8-9a46-cc64519a4098", "value": "768:BIdCM3EJ5SkOTczv/T6vo6WVjxqSd9X6W6Hm+IOt2c7ZGYgnH:BIV3EJQ4v/T6KFD9qeu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676289559, "uuid": "7487a133-0712-4b67-a1db-70448b94ae36", "value": 2097152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676289559, "uuid": "cb3700a6-ac2a-487c-9b69-cc4ee15155bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676289559, "uuid": "fd829fca-de3f-446e-befe-4c2a9ba9e4f2", "value": "20230209_{Host}_AP_SOA_Report_List_xlsm.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c6d8b7-ab64-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1676268420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268420, "uuid": "a12b9db9-0271-4f40-b882-f4e81a228b15", "comment": "Malware payload (Smoke Loader)", "value": "d8e280d91764b5416dc043602c8a449a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268420, "uuid": "08e54883-21c5-45c1-beb5-ec33c960fb63", "comment": "Malware payload (Smoke Loader)", "value": "ef70b577f2a4120a990902f3e7452fe56c6811331f1fdb950f279cc3dfd42bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268420, "uuid": "138c796c-42e5-4df6-983a-ad1787965fa8", "comment": "Malware payload (Smoke Loader)", "value": "1862ac00a871088636fccbefc3bd0379e3368e45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676268420, "uuid": "9f4fd301-cafb-44ed-a27e-e7984aceefdc", "comment": "Malware payload (Smoke Loader)", "value": "45b9fefe41920c84669462a0d1e3eb2cf471cc835f38219e08d146ad7e3e1c3df4637cf552f43449492241a91c574f76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268420, "uuid": "f4821fa3-f49a-465d-a264-160274d2a0fc", "value": "T15D14CE2372D0E472C032D630A939C2F52B2EF8B15E79A55B77942B3F1EB06D19636352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268420, "uuid": "02878e00-f238-4747-b7cb-4a4696a28c87", "value": "a47515f9ebd7f251f383b85609098a78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268420, "uuid": "5ac519ea-9f57-46f4-83f8-49f512247b7b", "value": "3072:bzfQ8JrCUWtK1PHpy83q4lqly3ON3gHw3HWHGUQ3Wq:bzf/JEKtHpy83M9d3CBdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676268420, "uuid": "bbedf920-ba4b-47d6-8295-1da0ca211adf", "value": 201216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676268420, "uuid": "ed76ba2b-44ef-4a59-a126-7b3b966aed61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676268420, "uuid": "fbe4f86e-f988-46e2-a91f-42a2f97dc380", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc254ad-ab7e-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1676279417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279417, "uuid": "407532f9-6530-400c-b69f-ce8ca3768874", "comment": "Malware payload (njrat)", "value": "13154c46f4fb277f2ccfd52f15aae463", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279417, "uuid": "17132668-0592-46f9-a017-82052d7fde5f", "comment": "Malware payload (njrat)", "value": "ef911d330bab5251bf508ab875f70f659a1ad3bab3a6cdc44da71dcb2da38136", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279417, "uuid": "b94c3568-5a23-4ee2-9807-48cbb460eacc", "comment": "Malware payload (njrat)", "value": "ac00e8b25c90d1c0a5da106e8d8d02749c198073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676279417, "uuid": "c9ab4f3d-5892-40c8-9295-bc67f0f5225e", "comment": "Malware payload (njrat)", "value": "a9777a3591e875d0e449260e1f7087231a9c26a995c4d2a7212e7e9befefd17b197c416193c3a8f38cd75b51cd8c9674", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279417, "uuid": "a06ad496-4cd9-480a-b691-2b1f4295a897", "value": "T120032A4D7FE18168D5FD067B05B2D412077AE04B6E23D90E8EE2649A37636C58F50EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279417, "uuid": "8e4cf29a-e8f6-41f5-88f8-de5c562306c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279417, "uuid": "3fecc150-4669-4758-9812-f00506356015", "value": "384:ybejKicgMjn5xL5oyUi8Wn1ejvfP4YicpKrAF+rMRTyN/0L+EcoinblneHQM3epd:We2f5DUi8Aejv41cQrM+rMRa8Nu5jt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676279417, "uuid": "c0053f59-afb1-45f0-a9ab-dd58cff81070", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676279417, "uuid": "b1e19442-b648-4605-bae5-8555d514187a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676279417, "uuid": "e8b4747f-d594-4713-b866-c393dd51b888", "value": "13154c46f4fb277f2ccfd52f15aae463.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1e34cc4-abb0-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676301144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301144, "uuid": "d6eac7eb-a7e4-4790-8eb3-9bd9501b5c02", "comment": "Malware payload (Formbook)", "value": "5e6920e180a742ffa7a56865e59ff7c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301144, "uuid": "4f71b472-87f5-44e3-a8dc-dd431c6b3838", "comment": "Malware payload (Formbook)", "value": "efd586fdc04eae13911a3f2638cb478edb6c952716e3279d854c4d855a9a70c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301144, "uuid": "33d69484-35e6-499b-9b3f-b9d4fa4368cb", "comment": "Malware payload (Formbook)", "value": "8bdb0e5a726c52fc4b476a060c7646b678bfc7a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676301144, "uuid": "aec74da7-2ac1-4672-a0d1-de51d93118fb", "comment": "Malware payload (Formbook)", "value": "d4727bb2092eda8a9887366befdce855f587b39ce698847af262d80df91a00569d2f9e2d574364e8f0832b86458d0f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301144, "uuid": "86867bcf-9594-41c9-bd2e-e3cd7785789d", "value": "T17005224E2C1C9B77E43DC3F45E2665B8E370AC6429B2E1662D9379CF36743A2045278B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301144, "uuid": "3455b8a1-313e-442f-8345-78e814488681", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301144, "uuid": "8063be74-7b75-4722-a3a9-9138c8f54c49", "value": "12288:6h6q6EMiYC0ND571Vd8NremF8FirV81vawjOuuNII1c407JNvkMQiDXZnGne/:6YXSQ57j4emqp18vNBc48DkMbJGn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676301144, "uuid": "e5b773e3-a805-49ff-9688-23c31c141568", "value": 799232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676301144, "uuid": "723f08d9-e91b-4fae-80d6-7ceb2f1bd6d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676301144, "uuid": "3148976f-e65c-4c5e-b4a9-5ff0df65208f", "value": "5e6920e180a742ffa7a56865e59ff7c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71797c16-abd3-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1676316014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316014, "uuid": "a1691e88-b1de-4aa0-8962-c10ec03f1c3f", "comment": "Malware payload", "value": "4ebf576ccd688e32e71122d7f8be2d8f", "object_relation": "md5", "Tag": [ { "name": "89-32-41-231", "colour": "#F84F73", "exportable": true, "hide_tag": false }, { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316014, "uuid": "434d6230-a5b4-4d1a-842d-90b1dc691cd6", "comment": "Malware payload", "value": "f015cf03b22191ac595069ce9195f85ddd24664c6b1f4454c849479b9da97a67", "object_relation": "sha256", "Tag": [ { "name": "89-32-41-231", "colour": "#F84F73", "exportable": true, "hide_tag": false }, { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316014, "uuid": "9ef84626-982f-4c28-b455-2cb979b1e12a", "comment": "Malware payload", "value": "f6d033e35351f189ad29fde4821d80891c4be484", "object_relation": "sha1", "Tag": [ { "name": "89-32-41-231", "colour": "#F84F73", "exportable": true, "hide_tag": false }, { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676316014, "uuid": "f8d555b6-6837-4ff0-a22b-f7f572ac3383", "comment": "Malware payload", "value": "2c44b9665b566850470b194078c45356c6a7fbbb915cbdb5a6d7129af659d5efbc349e50eb32fc5bc243e0ae97398d23", "object_relation": "sha3-384", "Tag": [ { "name": "89-32-41-231", "colour": "#F84F73", "exportable": true, "hide_tag": false }, { "name": "crashreportcdn-dot-com", "colour": "#7FBA6B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "SpacePearl", "colour": "#0ADA3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316014, "uuid": "960f582b-ad6e-4674-b94d-42b4c8d9304e", "value": "T157072324F8663661FC4EC1F40AB00EF803E46DB6122F57C422B9746FA727E6DDA64935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316014, "uuid": "a54ac8dc-b4c6-4e3a-957e-0800236e8738", "value": "393216:mm0x5JtryZx3bobCw8eoDr/4U3oDJ3x4Owp:6HtOPo2Heo/y747", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676316014, "uuid": "f84036e9-0c61-465c-962e-8b599ce1c8af", "value": 17331618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676316014, "uuid": "874ec044-4a8c-4748-9b3e-92e50718fa62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676316014, "uuid": "b5b631c5-4458-4f0e-a658-deccfc336b76", "value": "MsSgrmLpac.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6dd3e8b-ab85-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1676282603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282603, "uuid": "e8765eeb-e71c-4b8b-9ac6-509e4b06c031", "comment": "Malware payload (GCleaner)", "value": "32692cba9b51e7333758201a625b55de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282603, "uuid": "321b0b6b-da5d-4ccf-96b9-a1d8d837f8c7", "comment": "Malware payload (GCleaner)", "value": "f09f4dd86be517c48ab02290b004e6bc24025c7234264fcd6f4de22fb0efb605", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282603, "uuid": "43ac16db-0028-4f41-b3ac-b3a3a681f987", "comment": "Malware payload (GCleaner)", "value": "38643d43e310f036aa914d66ce5c140d4125565d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676282603, "uuid": "4e3677a6-b5b3-480d-aa96-257b7b540aef", "comment": "Malware payload (GCleaner)", "value": "c8edbba0f895528ed17b5eccbcad1828ab8941495cca4b5c35a89feb2157bf70dd72be5c1fe36302af3064fd3b9c603a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282603, "uuid": "a5b28593-9dcb-40b1-a47f-50d89b83b484", "value": "T1F7F5127DB111C8ACD2D0FEB4C92A98E71CD7AED7D994A16270DD7F3F91392849A0A103", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282603, "uuid": "80c834fa-e9b7-4bab-91c9-9d2e5185cb0f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282603, "uuid": "0e3fd7a6-6689-4d62-b658-373a88c4ed12", "value": "98304:JHQHm11lJmEmtsPSK5prTYyKL8mLqXowFD5xv2MR:dbxPH51TYjL8AqXowF/vjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676282603, "uuid": "5ef3e43d-17a8-4d84-8e73-7bee37759759", "value": 3325859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676282603, "uuid": "6ca6caa8-96de-4aea-baa1-03de2b2bf9f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1676282603, "uuid": "f48708a5-6b72-40d4-9816-706550beabd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa1a96e-ab6d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1676272042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272042, "uuid": "14b38298-d16b-4399-b924-2cb084a801e5", "comment": "Malware payload (Formbook)", "value": "d926a90d5e176eaa4d0b7dd98cf45dd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272042, "uuid": "83f73659-3039-4748-9aa2-35cb8d810003", "comment": "Malware payload (Formbook)", "value": "f0a5c2339933c5547d78a0e2015cff25fadc7fe2d56f8822202f874c1a8b979e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272042, "uuid": "f008ed6f-72e9-46cf-8654-7fb382c981f9", "comment": "Malware payload (Formbook)", "value": "ca8bc9fe7f737a4a8f5813aae5b1c011c7421c84", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1676272042, "uuid": "888bd3e5-54b3-4258-b5d9-e2c7b6b0f8ca", "comment": "Malware payload (Formbook)", "value": "b817b762160ed763d4593d4f9888fc51f42c9e2c66574f2826e511edb3eb6720dccf3182c2878b724e0ff60420e8eaa2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272042, "uuid": "8f329a6e-313b-49d2-9424-cf5c483c4b92", "value": "T16F04AE32D642C031F2B212B5B6BD0B7B493E0E357295A5EAE3E116E16EB0495F13931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1676272042, "uuid": "c6608721-89db-4b77-a6bb-362b831ff6d4", "value": "3072:GytHk412ERXjg305CEqYwamyFM3d1aaTqI4+EZkz+SFY+bcIPVL0:dru0MEqnamyFM3d1acqIKLSFY+zVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1676272042, "uuid": "6c8004f7-785d-42b6-982e-90c0ee21cc0a", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1676272042, "uuid": "80b0da7e-3934-4d3c-850b-ff19e128994f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, {