{ "Event": { "published": true, "date": "2021-08-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-08-20", "timestamp": 1629504182, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d6f29084-d3a1-432b-8eee-4d044bd84cd8", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded00413-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629471848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471848, "uuid": "bbf9ce63-059d-464e-b742-12d52c47bba0", "comment": "Malware payload (AgentTesla)", "value": "39e893c4b18b74ae5b4e8b8d39a92b64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471848, "uuid": "bbc1b022-8d1f-454d-9ae4-9d7d13215e71", "comment": "Malware payload (AgentTesla)", "value": "01e74d3bf9e9b967220cb45019259e83b4bb4f425ed5ddd1a3c1b05267a4950b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471848, "uuid": "f0e4ea86-9069-4376-a1b6-5e8548c5c884", "comment": "Malware payload (AgentTesla)", "value": "d0a32de20f023f04bae7bc5629654fea59404c4a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471848, "uuid": "cf8f98e2-2af2-4fae-be9a-cde5acedb8aa", "comment": "Malware payload (AgentTesla)", "value": "6abc4451ee746221bc64291eb0840af8060a5657a05f52dfe7f5a0d7b88826ef12a46c9be3ee6253774a5028c5738376", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471848, "uuid": "dda2b40d-efe8-40fe-b355-71a9ab7f1885", "value": "T16A25273D19B91637C1B5D375EBE49423F158985FB404EE6AACDE07A7030AA8734C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471848, "uuid": "215b19bd-12fc-434e-af28-c93c9842fecb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471848, "uuid": "7e1b1651-afed-4b2f-bd15-023693a55fcc", "value": "24576:hSiZzPqTX6svzimKNpNs685M+WU93Mn8:pZzOLvlKNg64Mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471848, "uuid": "6446fff2-cab9-4c8f-bc69-ce683fe09873", "value": 1024512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471848, "uuid": "fd0e4629-5192-4cd3-9ddc-d05fe02f4f97", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471848, "uuid": "47818d0d-afdd-4200-b009-0308de541e1b", "value": "39e893c4b18b74ae5b4e8b8d39a92b64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d9a29f8-01c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629471927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471927, "uuid": "768de40a-44c8-4bda-8994-e68b15fcbbaa", "comment": "Malware payload (CoinMiner)", "value": "daebb5fe27c6b6ec749ccc2809b58c8a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471927, "uuid": "968d182b-7843-436f-9fb7-7edd36e55837", "comment": "Malware payload (CoinMiner)", "value": "02509150940d9d652f1f65aef43231c2bd30e5ff2816f02ecc3f93a63e11954e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471927, "uuid": "04d027f0-7dfa-4945-81ae-7352faaa8f3e", "comment": "Malware payload (CoinMiner)", "value": "698ff87bb1b4987f7137bbed104b03bf5df6964b", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471927, "uuid": "9999eeeb-6e82-45e4-bf86-182249aeb938", "comment": "Malware payload (CoinMiner)", "value": "5ae0c1f2d5d8acb6e8a5076cbac077679cea9f423a14e7f88c3f47574121e1b6cbc1970a13f352ed36775fc42bdc55e7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471927, "uuid": "867d3810-c055-4b7d-81f3-a497cf4ad5ac", "value": "T156247A821BDBA663F8458E75C3F026CFC8706362FA2AC59F105F876D7BBA606C11594C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471927, "uuid": "bc5f4bcf-1a3b-4ac0-8ba2-9926f47a663a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471927, "uuid": "b9714b8d-c36a-449d-b5ec-80fed2d142bc", "value": "3072:jiW6IrKfV4yIDWs7sPGcbrgoMFwoaq6vXJxhvTMyZ92HpQdj5zV7O99bSDyXD:+lIOdFZ/+ErawoLyz4Yy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471927, "uuid": "b53531ba-c76b-4091-823c-52d77dc8eacb", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471927, "uuid": "f6c6df7f-27a9-4e77-9bca-3c9c6b49b11a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471927, "uuid": "2e3cefcb-105e-430c-b112-3619f5aa8d7e", "value": "daebb5fe27c6b6ec749ccc2809b58c8a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09f3ddc0-01d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629477075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477075, "uuid": "9ae6c346-c034-4edf-8b4b-d6b90f4da3c5", "comment": "Malware payload (Mirai)", "value": "2e1d3fa70d399c298a1b7e40d8061b34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477075, "uuid": "0ed19a3d-2aad-49f7-87a7-41c25b6599d2", "comment": "Malware payload (Mirai)", "value": "037c2e6e03d9c0aeaf5c9c2597e666b39f42d7cd56aa61db9849c960c758cbe0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477075, "uuid": "068cfddf-a73c-4aa0-a6e8-94eef30cd6d4", "comment": "Malware payload (Mirai)", "value": "cd071ea3108cedc555ef5dc9edb1600466862034", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477075, "uuid": "1533d893-fff7-4a44-af64-24a677c306e1", "comment": "Malware payload (Mirai)", "value": "3461ca7fbac81bf1ab14141ed7449861b7c26d6458b6a7115726be9bf0bf2ea972c0140ead174607215a05adfd4c984e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477075, "uuid": "04e50c3b-ee38-41f4-a49b-2b7ddcaad3ad", "value": "T1E1639C29E49699E0C0824A34A0E5DE761F63A4C492672DF6EAC081F55847DFCFA05FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477075, "uuid": "06e7b542-518c-4c13-8656-473da5b4ffc6", "value": "1536:naOI6W/50wtC4hwffh6j/N6DRx4tUPqHDHCU9:n0Z/50JpnxyFHDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477075, "uuid": "e7d3ce42-a642-488f-83fb-c20e2e36caa2", "value": 71136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477075, "uuid": "6d95cbd1-c42b-4cc5-93a4-d184fe7bddeb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477075, "uuid": "c938ab14-c0e0-4823-b3d4-69c5d6788536", "value": "2e1d3fa70d399c298a1b7e40d8061b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2615dc74-01c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629471968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471968, "uuid": "1655917b-a47b-4e6c-92f0-c04640c4bd34", "comment": "Malware payload", "value": "0ede6eb3469ccbe97c5cc2a4fc1114a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471968, "uuid": "715a20b7-15f6-4f16-9306-888ede611ddb", "comment": "Malware payload", "value": "03c72ba4210bb7b27c38735b169a5af85166aa2bb84ddeb7c47a421f1f716e48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471968, "uuid": "721f7e35-49db-4d1b-83c3-954ad9293a92", "comment": "Malware payload", "value": "731ea81e54002fedabb2a55afb43262bebf6010a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471968, "uuid": "1c59dc9e-f49c-4e4f-affe-a674e6b12393", "comment": "Malware payload", "value": "d92af70d2ccf683ae61d5cbded1e58803f39444f3bc06be541a9795169570331c7570f130d78edf74beadbdd885eb378", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471968, "uuid": "2626f8bd-89f5-4b34-8523-c869bd7c3a4d", "value": "T17C05179DB25072DEC857C977CA782C74FEA0A4A6430BEA43E45312ED990D99BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471968, "uuid": "2322ca08-baed-4a48-9252-ef9a5301131f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471968, "uuid": "18254207-b13a-41cd-b2a7-8e503769e987", "value": "12288:15JED8HD5a2ByrojzM8fegu5y9/oVshlQnhJdTTP+Er6mG4gjvP/LWyQBC6DyLjJ:1waIRuzM8fegDeshsvdv+0hPgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471968, "uuid": "91626f78-9212-4c05-bf26-50f2f566d23c", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471968, "uuid": "248bcd7f-8af7-4ed2-92fd-2ed516a8eb99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471968, "uuid": "cae29e36-9b63-484d-9e00-be0ffe36e62c", "value": "0ede6eb3469ccbe97c5cc2a4fc1114a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d202860-01f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629489562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489562, "uuid": "19cfd1ff-866d-414b-a47e-31b8a00efbb7", "comment": "Malware payload", "value": "e469d954208648089041e21f6d882702", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489562, "uuid": "c5b64adb-60e5-4c9e-afe7-eaed5e798900", "comment": "Malware payload", "value": "03dd5030cf9419d5f328b6ddf8bce820199c0aad46caf85c68aeb1645133972d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489562, "uuid": "19670700-dc1b-48c8-9847-35e753def3d2", "comment": "Malware payload", "value": "454bf06e9f471a7590187c7806231cb957fec5e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489562, "uuid": "241fe374-8f21-4612-9c32-3a2cad01136d", "comment": "Malware payload", "value": "4b264135efdd727c53b55e31f1a1cf1aab9011aeabd57a1f72f02a4ae239384f3b48307285841380889f46247f347ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489562, "uuid": "dc961e36-3887-4a61-8ef9-5bf9a8ef29e5", "value": "T12CD5BF31EE6DBE52F9D2863086A0978451202F3776935E47B64C6B05FF317836DAE20B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489562, "uuid": "02e9d33e-7639-4976-86de-d36c92ddc798", "value": "70153b8ea63b325481cd2648c33fe10e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489562, "uuid": "f999add8-c04e-41ca-889d-96a0f986d16d", "value": "24576:pZKlRgOIfgOIcVylQpgst89780uEOjxWfmP/UDMS08Ckn3U:pZMW5/pVP5tI7nfmP/SA8Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629489562, "uuid": "6a238081-bde3-4510-960c-2d1ba7ef40c6", "value": 2842624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629489562, "uuid": "6b2a3eb6-7b07-41c7-bc4c-a5aad2da9ff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489562, "uuid": "17466f1f-749f-477f-8bd1-2e7161ce0fc6", "value": "image.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc13f029-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629471844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471844, "uuid": "aab51068-1f55-48e8-b3d3-a60115a9da2a", "comment": "Malware payload (CryptBot)", "value": "32f240e4a349b540e4ef9ec90ba7a6cf", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471844, "uuid": "1de1ad98-caab-4ceb-aabc-106704849e63", "comment": "Malware payload (CryptBot)", "value": "0437b84beb437820567ae02427845d6214db65d389bff346a5dd83e28b5878a8", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471844, "uuid": "04a26db3-36c1-4f81-9180-67737dc771fb", "comment": "Malware payload (CryptBot)", "value": "ccb49d1a05e2f9b767059942f4f116caa9de8de0", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471844, "uuid": "ce4a6c65-3d3c-4448-8b57-2187b5256d03", "comment": "Malware payload (CryptBot)", "value": "34bde7787133fb64df850289e57249c5561f229540b0050818592a7707615c2fc1dbe23683efa4a63003201dae9673fe", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471844, "uuid": "0feac32b-6f4b-4ac8-ad62-9ac88216660d", "value": "T1C9B4121539F1C333D0B550348575C2D42638B9A2A968C0973FB7EA6E1E312D19B36F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471844, "uuid": "3b696450-fbde-4421-81ad-3bc84042bfa5", "value": "ca5ba0dfe6e58a229ea3afad859dcc2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471844, "uuid": "a60a9756-3a68-4b69-a0e9-e9cd1d625fcc", "value": "12288:b90Xyb0fwQwjJjMrI66PJNiR3L38rrGf3wd3Jj62f1CfKzthkLZL:bLb0oQwq066R03LfH61CSzt2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471844, "uuid": "0cbd0921-b6f4-4d2f-9c4b-0eaec96a2022", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471844, "uuid": "ad024720-1320-4c9a-a5ea-d9ea693628f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471844, "uuid": "53a81e00-c1a5-4ce7-93ec-b9dae1f16eb8", "value": "32f240e4a349b540e4ef9ec90ba7a6cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd00813d-015a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DCRat)", "timestamp": 1629424977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424977, "uuid": "0b5efd77-6d26-477a-9654-b5142f8a48af", "comment": "Malware payload (DCRat)", "value": "cb7eb1adf0a8dfe4dd7f13840f612514", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424977, "uuid": "fb14b811-b6c3-4954-89c1-f2cf4945221a", "comment": "Malware payload (DCRat)", "value": "0446e34ae6ce7f9cca130d58f9dcf0485e2d4ec5010eefbec4c826918c72e3ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424977, "uuid": "b42b33a4-c317-463d-b72d-a2ec94c54230", "comment": "Malware payload (DCRat)", "value": "15111c3b8f323535b86e81d2963a19029cbf40b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424977, "uuid": "98257c13-5d14-4101-a9ae-64e8f0b7a298", "comment": "Malware payload (DCRat)", "value": "39c2aba7cd45ac9f9662d439beec4a7e9690d66648050f98e9fef83dc06158a1baf2a52f115319b728e3d8f0da8b9f20", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424977, "uuid": "41d309fb-ad61-43a8-985b-c05bac28733d", "value": "T1973517027A4ADD02D0A9163BC9DF443447ACEE417B66DB2A7E9F376D21123A71D0E1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424977, "uuid": "8c3e00ce-640e-4f4c-b01f-b65abca9b871", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424977, "uuid": "1ac69e64-eb81-4c53-812b-708474d31c2a", "value": "12288:qlJMy8mJMcg/izkcwyAQubRUjq+81o7/NOauaspKtbg2Kgkqn4:qdLZg/8w1bRIqFoKpeMvgk+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424977, "uuid": "fe894375-118a-4e47-b8dc-355396fbd70f", "value": 1120256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424977, "uuid": "c630acea-6b43-4f37-ac38-5af4d4b226ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424977, "uuid": "51aec36c-3d17-4910-8ca7-1ea80975eef8", "value": "cb7eb1adf0a8dfe4dd7f13840f612514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79ecb241-01dc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629480699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480699, "uuid": "7ea75537-1c7e-4aae-8e58-b379aee0e1e5", "comment": "Malware payload (NanoCore)", "value": "2e22233d4c5993e18158513a8a5eb905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480699, "uuid": "3adc46e4-9ed1-4cd0-b1cf-c79beb1a5cd6", "comment": "Malware payload (NanoCore)", "value": "05313016547f4333a754bc06925283b5db426b462815be01c170b7ff27dc2bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480699, "uuid": "6a868cdb-9e7f-48a7-ad6d-0ad22f301360", "comment": "Malware payload (NanoCore)", "value": "291479f6475818c6e6b3241f43d2459be9d1f424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480699, "uuid": "59175007-5743-434f-bd99-0fa639329a93", "comment": "Malware payload (NanoCore)", "value": "c1e7e14750223a2c6f140e0814701e5c86ee32a26c4c4475ae6dd0f70fd9190433f8c0351279fcd6a3feb7470132edc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480699, "uuid": "2b97b2ce-9347-4814-a488-b7e3ec9f8ef4", "value": "T199B4CF1179818072C7733C3147B5D6B14D6DAC302D609A9FA7D83A396F34682EA36B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480699, "uuid": "dc4276e7-2493-40d6-b92e-abf79698cbcc", "value": "7e10d8f3c6a91a68257beb0c2e7d22cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480699, "uuid": "1844d1b0-dcfb-42d6-adf1-957cd0b5c78d", "value": "12288:SUBJ+tZYaWvuEiz1QIVgHQI/aD87/KuJgWdHZ2er694:oEiz1IHQI/aD87/KuJgcZ2ere4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629480699, "uuid": "6e562c15-6170-4dfc-a92d-aac6638941be", "value": 518091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629480699, "uuid": "24ad30e6-7da6-4676-a3e9-c0e908e64ee3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480699, "uuid": "e20ebfbd-660e-4b9e-bdfa-1333130a6b55", "value": "2e22233d4c5993e18158513a8a5eb905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8011dee-0163-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629428807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428807, "uuid": "bcb5cd58-7420-4d33-b7fe-ae6ec2e72cb1", "comment": "Malware payload (Glupteba)", "value": "79433be33e2c5789b8c212efd3e2882e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428807, "uuid": "da2ff620-0711-4e55-9e51-a2994fa10bd7", "comment": "Malware payload (Glupteba)", "value": "07a3740166cef528ebddd4f594c555f7a07cee5260fb85d2840dded9ebbbd652", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428807, "uuid": "15c4ae10-8feb-4e0d-a149-5aa10bc155d4", "comment": "Malware payload (Glupteba)", "value": "b6c44ade39f3c9579f1d76c7efe0e5298fdbb19b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428807, "uuid": "ad39ae8c-50e7-4d80-a324-42e73bf5ae0e", "comment": "Malware payload (Glupteba)", "value": "3028c10277a1f1a2b81f6e819792af13d1117fe3bd2c4dadbbf3d0e8806806bb88eac04367c6c2c616d021fdb3eed3d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428807, "uuid": "a3dc5566-2ee4-41df-be7c-1ba19a8a423e", "value": "T10A263301B0E21937C238953771852DBA3832F9CA1925A727AE5F1A0B7F13346D939E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428807, "uuid": "39b7cfad-c057-496c-b3d2-d687ec08e0ad", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428807, "uuid": "4e081718-cb19-4e4f-b964-06efc514dd03", "value": "98304:SvH5Ty4vqUb9LW+RTyqdkIS4yC9ynU1kei0YwOtitAGb/:SvHJvdhC+FJy+YirytGDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629428807, "uuid": "23509f5e-9f29-4eef-a70e-c2f178fe7a49", "value": 4558888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629428807, "uuid": "e9b79c17-ae65-4c48-a39b-22f9e00ef03a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428807, "uuid": "d6e63c4f-9ff7-4a4f-818e-e03a2815ae42", "value": "79433be33e2c5789b8c212efd3e2882e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c7af27-01c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629469231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469231, "uuid": "f5fad5dd-9dc2-4722-9ef9-9951a889c3e0", "comment": "Malware payload (AgentTesla)", "value": "a08e7adebdedfc9946c31a60e2053b1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469231, "uuid": "afadb232-3ec5-4b76-aa4e-78ee5007c077", "comment": "Malware payload (AgentTesla)", "value": "0892c5324bdb3086194c4ad7f02cca6f81125895790da7643671e2f6c5a17697", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469231, "uuid": "e3cec1c7-7f11-4005-8598-f2e414a9e329", "comment": "Malware payload (AgentTesla)", "value": "d029961c3645aedf7f73b0ccb412f4c34c8afba0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469231, "uuid": "f60c57c5-91ab-48d6-a669-31dbf26aec6d", "comment": "Malware payload (AgentTesla)", "value": "fbe7d6d06eb922561ab5130b894aa7f49316b0b443b8e34a16c33b00133dd141fb310c22a501e0a7e902b4a96d979a01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469231, "uuid": "966dc34b-a20e-4a4e-b7be-e4f157e03f64", "value": "T1DAA4F1043A54B6DFC91BCE7AC8622C50A6306477670BD3975C5329EE5A4E7CACF422E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469231, "uuid": "b7d31f79-9e6f-45c4-868b-0d9e99cfb086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469231, "uuid": "5a31330f-e37e-487a-993b-0f3d7906189e", "value": "6144:2GUIIgVzoBQSMlkdpM7acW+5iu0hXhtWtkaAWkOrCMuLdPTft192GKOsUzkx9IG7:KQRSVfbTuKFopAWDepR92nOxo9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629469231, "uuid": "59fc738c-dbd4-40c2-9813-347f09e8482a", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629469231, "uuid": "41f9e8d7-02f7-499d-b7ba-d75687824c96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469231, "uuid": "5f7db8b7-deb4-4f13-9dc1-be7f707cdb57", "value": "EST P.D JKT - MASS - LAV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21de280-0203-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629497516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629497516, "uuid": "7a44fcfd-fac7-4c52-85f2-7123bd88de53", "comment": "Malware payload (RedLineStealer)", "value": "35370892bea49137ac3c08f8998bb9ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629497516, "uuid": "ac74636a-a355-4884-bfab-718a3c19d713", "comment": "Malware payload (RedLineStealer)", "value": "08a036509308480dee2d3221cca7ddc40681bf9a5cba1f83a4dd227936c32f2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629497516, "uuid": "1a987e16-13f4-421f-a6f4-e2f7f215b6b4", "comment": "Malware payload (RedLineStealer)", "value": "5d1f0813913bc139750d2fa9bf4822197c2b3eea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629497516, "uuid": "ceeddc84-67fe-44a4-9636-f4fcc585d3c8", "comment": "Malware payload (RedLineStealer)", "value": "a8edb5fef7f392134bed8b6292cb9e423e80f084848498b431da755568d73a8b6b060b846d5660017694bd031f540f9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629497516, "uuid": "d7d6a444-84ed-42f8-8014-b06a8d0e6f5e", "value": "T1AD05BE323A02ABA1D63E8976E45B00440F703D2351B6E367B8C573DE496A7F1BD158EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629497516, "uuid": "527ee9c5-a0fc-422f-8ab0-48ab3f3600b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629497516, "uuid": "d167a23b-0439-42d3-b1ff-90e182ae7b1c", "value": "12288:OSd5cUyhfuu0cwBRSBMAzD98PZ88Y6fB0CpMDZ56yjPSx/aLXJtQQQQQR9CX0di:OSYTduHcw7gM08PzVGfqx/IXK95di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629497516, "uuid": "20fc47a2-5ed1-420a-8aca-d894a514c026", "value": 829560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629497516, "uuid": "e5011acf-fd37-40ef-89b5-83378f7a813c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629497516, "uuid": "ba7be89e-b128-4aa4-91fe-41cde7b8fddb", "value": "08A036509308480DEE2D3221CCA7DDC40681BF9A5CBA1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351c990e-01c6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629471134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471134, "uuid": "40c97a25-d671-4968-9558-f020cd573abc", "comment": "Malware payload (AgentTesla)", "value": "b9bd0acb00b80b8a387135b780bfa3fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471134, "uuid": "28dd1f80-ba23-4b8e-985a-d0ddf6e726d4", "comment": "Malware payload (AgentTesla)", "value": "09af713942642f8e11ed05bbb8a864d8573bb82be9b9ec96947673c093bee23c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471134, "uuid": "1962d2c9-f0a3-4431-aad4-fd03ad46f51e", "comment": "Malware payload (AgentTesla)", "value": "da599006705e97ea79cb078a802a27d458602626", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471134, "uuid": "911d2015-94a7-4fe3-8ae7-920dda572e79", "comment": "Malware payload (AgentTesla)", "value": "89d644574a3f131f97623a9a9172483d8b90ce2ed1d7bd6d9bcc88dca53502dcbdc91cf90c9fbe85f72391713cd81e36", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471134, "uuid": "18361bc2-916d-4968-b523-0f495b1432d5", "value": "T13225273C19B91637C1B5D375EBE49523F158985FB404EE69ACDE03A7031AA8738C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471134, "uuid": "25c06b11-ebd7-4c51-a556-2496f35dde98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471134, "uuid": "f33c2ba6-35c2-455f-bf02-d14df4768230", "value": "12288:qU2UfZi970MqZhMMDtWOZTem3IZZ9UZS8pQJZtZXOcdY5XoRwlWTBufWWATt0Aaz:qU2UfZ2qZrVZLC64RDWXzre37oBtKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471134, "uuid": "5759342d-f3f8-4a2f-943a-0ca567ee2e58", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471134, "uuid": "0835f1ef-279e-4d30-8b7a-234187c0edfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471134, "uuid": "537fec26-ff9d-4bbd-9c54-cec1c8106015", "value": "CL_PL_BL_GSINBKK2106741877_DRAFT_PDF.EXE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12ba08b9-01db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629480096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480096, "uuid": "a80548a1-76b1-4304-92ec-043b7b9176ab", "comment": "Malware payload (Mirai)", "value": "e32f29a8a0cff57484122ab8a0b87f1f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480096, "uuid": "ed9a074d-20f1-4464-9baf-2b79e39c219c", "comment": "Malware payload (Mirai)", "value": "09f64f6d7b56a4ade434bbaad0799286c40f94796304489e20886a8cd8363958", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480096, "uuid": "e17dd1ad-fd19-4124-89ef-47cb3c640a04", "comment": "Malware payload (Mirai)", "value": "35eb51805608a59d393ffc131c03f3996562f88c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480096, "uuid": "0f49c051-0696-4e8e-bf96-724be1afcc63", "comment": "Malware payload (Mirai)", "value": "2cd8dd12f81e31c384a23595c88db2c604c76d08dae4e467dd4d1d431de3bd13d0f5cc441a66f756621c4f74af316f37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480096, "uuid": "cb629570-2bbb-4465-9996-ec9549b1b06b", "value": "T1483302A28B612855C70DA9FEDD9E80D6622CBC61ADC8573ADE3BFC0D1EC6317406F106", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480096, "uuid": "45d8be51-addf-4cd8-9e35-8482544ea059", "value": "1536:v18EDlNAQwFmNKAY95P4z/F3kdgmMOFpMsQs/Cv5P:SEpNAtF0Y95gDFugmMOn2V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629480096, "uuid": "4d53bab3-7baa-4d75-bf24-6865b0d42b39", "value": 53624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629480096, "uuid": "2d495de6-bb5c-4d2b-bde6-ed59aa6a80c3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480096, "uuid": "0d55188b-e3fb-4946-85e3-8346ed8615b4", "value": "e32f29a8a0cff57484122ab8a0b87f1f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58c8eb9-0210-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629503159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629503159, "uuid": "00ff8596-f3c8-4b08-bf5d-95db41b48733", "comment": "Malware payload", "value": "c853f7362ae13e08fdd038b762951fcd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629503159, "uuid": "8aa79ffa-e05a-468d-9fb2-e98728ed6dd2", "comment": "Malware payload", "value": "0a1e7526110ce24293ad63218291487041aa01e536c0525436101792cd232229", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629503159, "uuid": "e969f610-9213-4ec3-b961-86cb482365a6", "comment": "Malware payload", "value": "3a7bb98cda0002e924a64d2188a3c5755e1eaffe", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629503159, "uuid": "1cd7e8cd-0e3a-432a-88ae-fdbb2a3933a7", "comment": "Malware payload", "value": "ac55a0f4cca1ebc6ce593f2375fddf7b65242f523aa2c22f4344a54f7ea4ca9b13bc021d6748f0a5d54fe6db026b540f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629503159, "uuid": "6f5d5ff1-ecf2-476b-8896-fac1fa5315d4", "value": "T15E730991FA8D58F161B398E4274B60CAA86D85371400CCD5BCDDA97CAFA8D7D0225EFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629503159, "uuid": "5ce66872-f107-49bd-9d85-8d3a96ed2dfd", "value": "1536:sfWMOcNNqtaBORk+cr9mmMaKXPzVp+y364C6MIy3PfPh:sOMyRjK1KXPzVpzwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629503159, "uuid": "f448487b-d60a-41d8-b457-f440498b2026", "value": 79447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629503159, "uuid": "f6580ca2-4358-4005-8935-22d5d15ab683", "value": "text/x-php", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629503159, "uuid": "c3fa8898-8e5d-489e-b85d-d1b039157862", "value": "bookmark.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925869b7-01c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629470432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470432, "uuid": "cac70a1a-0d6c-4b37-b4be-790577393d39", "comment": "Malware payload (RedLineStealer)", "value": "b376e4858ece14f0459fc8f24e72bed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470432, "uuid": "5d728d5c-6a70-480d-acc7-34632c938228", "comment": "Malware payload (RedLineStealer)", "value": "0a823cbd6a32a10c927253fa40466c8a3177e487ee7895a8a2e244a9b4c415fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470432, "uuid": "2a5df6ed-23f8-4315-8b1a-d5b1f248c120", "comment": "Malware payload (RedLineStealer)", "value": "c9e9321fc4d550ef75ca83deb1cdbd2d235c9fd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470432, "uuid": "756b6cd7-12f9-4aef-aafd-a3202360c408", "comment": "Malware payload (RedLineStealer)", "value": "fb70e9fc601228d8d49a38c4c7b8a75aa20c22a1d7327f7596043114d612fe246ab06bd0225190f060fe80c6b532743a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470432, "uuid": "7d12e889-1ec8-430b-ade9-edd852345f85", "value": "T1352633C198CBAC56EF3FA77305201F1546B5AA00FB6E36DE23500E5EFE24B11885A5F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470432, "uuid": "91ab6e4a-b38d-4c25-a18c-297d28ffc7dd", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470432, "uuid": "a6047e1f-76a6-474c-925c-3d1cfcb11aa1", "value": "98304:ywv9xHwVwoNa0X3Hcj/4l1zNn0QJmnVNYKH7ghdOChc:ywXHiwgH/nPmnVQ7hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629470432, "uuid": "cc79f69f-9c49-4327-abb6-38d59c540b99", "value": 4500431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629470432, "uuid": "1e86b094-090e-415e-9895-c0eccb82dbbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470432, "uuid": "bd0f68a6-df20-4a1c-a37b-0d7d41067ee2", "value": "B376E4858ECE14F0459FC8F24E72BED8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386903ae-01a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629458684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458684, "uuid": "a965f3ee-c2ce-4cdf-bca8-9f30a7b80720", "comment": "Malware payload (AgentTesla)", "value": "c5bd88480dc7dc03c3cb6db29c4b0104", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458684, "uuid": "07726c4d-e9f4-423c-8b2a-ae7c52603da2", "comment": "Malware payload (AgentTesla)", "value": "0a833ec06fac34128dee3a5ef9bda802aac68af3d7fa53169ce2a7159a79ca52", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458684, "uuid": "fe08788a-9aec-420f-8961-a1c55056fb82", "comment": "Malware payload (AgentTesla)", "value": "1b1c9ef96d373e819fff001197898041f782f1c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458684, "uuid": "771d9be8-d9d9-46cf-a05e-ba407661a1dd", "comment": "Malware payload (AgentTesla)", "value": "28efb805eec8eac29cc44eab6f57e6c37a4e8dbd01c74ef14521b92ed0a433a18fa96115bcc1de5d721eda7888d99e73", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458684, "uuid": "e53e4f0f-3947-44d8-bbcd-0f800626f3dd", "value": "T1A0A423DAB0D3B8FC330AF36CE70F49788B3A7D6C188605C3E015A099273AE593756654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458684, "uuid": "21dd9d02-7f37-4f2b-8565-53b501a1b203", "value": "12288:zIz/KQbL8NBLiy7Z4/ntFkm00HwttVIxqQljlnLMgN2ExG:dQbL8bZWMP8oVWq6nLMr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629458684, "uuid": "9a4e42a1-6b7a-4d0a-ade1-330bec58a7f6", "value": 466756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629458684, "uuid": "5d3ea4e7-35a1-45d1-9195-f44240f2505f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458684, "uuid": "1c6ffe4a-0ada-467a-a47c-394c38a9cea7", "value": "bank slip.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d018d2-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629471885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471885, "uuid": "bcc740f8-265b-40f7-a77f-3cf742aabf4b", "comment": "Malware payload (Formbook)", "value": "d659960132af324d2dbdaef622bb05a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471885, "uuid": "a45b0ae3-bf1c-47ce-8d46-54d967d940eb", "comment": "Malware payload (Formbook)", "value": "0aa68b819455d1810d114c502d6a221d0da9320d506c31b9e83b7a488f46a954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471885, "uuid": "da7e9a7d-0ae3-4e37-a8d5-3bff0aa67285", "comment": "Malware payload (Formbook)", "value": "27b9debff9fef20bb9ac3a2c6efff6d66b023bab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471885, "uuid": "86d347ee-d0a0-4ef9-a655-3dbaa871b317", "comment": "Malware payload (Formbook)", "value": "93148594f604e70622cedae141bc6f5ab76619a37fa1b6d1f72883b3e2a56a95501c77e73cd2c5753c88a82fb5350610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471885, "uuid": "4bd525f0-dbb2-4cca-ba66-378c8080e02d", "value": "T12825283D19B91637D1B5D375EBE48423F158985FB404EE6AACDE03A7031AA8734C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471885, "uuid": "51b034e2-213a-4a06-bc27-0718b9a9aa17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471885, "uuid": "28a555b5-7fed-4a3e-9516-1d224ceabf76", "value": "12288:DNZi9708VGxIjEfh3hIA3ULh00E9MbzcYpwzyOlXyg+knoJKu:DNZNh3hh3T9MbzTqzRBygOJKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471885, "uuid": "e0fd4a18-e2db-474f-bbbe-95371fffa851", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471885, "uuid": "43237698-1ec1-42b0-8133-bb3400b5fe06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471885, "uuid": "486a3704-11e5-4589-a281-13faa9ee1919", "value": "d659960132af324d2dbdaef622bb05a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc4cbbc-0183-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629442537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442537, "uuid": "106a1f98-8721-4d9b-88c5-9021e43c6bdf", "comment": "Malware payload (NanoCore)", "value": "025079c343931f6b9327d097676bd2e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442537, "uuid": "cff0dab5-6f56-4ac1-bc90-6a14c841d485", "comment": "Malware payload (NanoCore)", "value": "0ad4f1d30893f1e1a9cd576cea5ce0ac536ab9b361c7bda325d42fe52f306531", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442537, "uuid": "3c74d2de-1b6c-4b4e-b0d5-0001cf211fc9", "comment": "Malware payload (NanoCore)", "value": "752d05636d41be31c9917366756c6fdd89c83e44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442537, "uuid": "7e05533d-a6dd-4d28-80aa-1c461ae12d02", "comment": "Malware payload (NanoCore)", "value": "6ed600cba51dd722b5889393dfed9365441a7e8161a91ea416e797afc45df887c1e2c2d7c5bf644af94dbf60314edf2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442537, "uuid": "8e9b5ccd-efbc-4d5a-892d-302e5cca3877", "value": "T1D745492439FA5019B173EFA58BE478EADA6FBB733B07A45D109113860723A81DDC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442537, "uuid": "f6c415f2-644f-400b-9b94-8944bf02ed93", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442537, "uuid": "4ca6f6ec-67ef-4b0e-bbe4-20f294976fc4", "value": "24576:ART3bs0XvLqO5G1ZyrxRgvTdyfLobcjY4LFgv:N0/MyEsfUbH4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629442537, "uuid": "222d807b-745c-4c7e-a17f-ab6d29ac5eed", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629442537, "uuid": "ad054732-1de7-4401-b895-685ed9088805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442537, "uuid": "87244ffe-0bce-413c-a3cb-50aaa06999b1", "value": "Remittance Form Payu.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f2db1f-01c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629469258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469258, "uuid": "4260c17e-60d8-4353-9839-e52710239521", "comment": "Malware payload (RedLineStealer)", "value": "da64052d0668ffd45460f0808b8289f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469258, "uuid": "89a5e896-59b2-498e-b112-25b49c5986f1", "comment": "Malware payload (RedLineStealer)", "value": "0c1fc2b2d57ed0e1a22e06c0a700996b36646d4a27278117fda266949aeb86ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469258, "uuid": "13282562-0f4a-4986-8215-ae5df055a4c3", "comment": "Malware payload (RedLineStealer)", "value": "96ebdecb0127a033c5beb937b6890f49d6ed1028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469258, "uuid": "ae6199f5-ff9e-420a-ad66-3eea9f5c32e3", "comment": "Malware payload (RedLineStealer)", "value": "026cdbb8486aa107e9e171ff81917f56a6757fd8d2203c31c91d0bcf35d4753a4bf3cb38eb309627318401ab24f82624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469258, "uuid": "1915f657-1933-484d-bb4f-732f0a793897", "value": "T19844E11079B0C1B3C453D67039DECAE06A3ABD216BB4510F3F9B266F2E71281D61AF56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469258, "uuid": "b31adef0-3440-45bb-9c6d-848b8b0fc18d", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469258, "uuid": "2cda0068-3821-4d5d-81d7-323ab0f8857e", "value": "3072:2BP0x+oqB1Y5Syvc/PgxAArZ6CV3BofCwxCvmW/bcDE40wBSRjDzJ/gxzgFnLmx:N+oQA6+AAFf6ymWDs6DzCRgFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629469258, "uuid": "608394d1-0063-4f0e-b718-8d160b7062b0", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629469258, "uuid": "776647a7-0cc3-44f1-8476-46240ad48d08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469258, "uuid": "7a061903-932a-4880-acd6-2d4b5da71d7f", "value": "0c1fc2b2d57ed0e1a22e06c0a700996b36646d4a27278.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bc2be3-01d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629477335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477335, "uuid": "8c70a02b-f73e-4224-9cb6-8929737b5211", "comment": "Malware payload (Mirai)", "value": "1769bbc53a4a241490299044c1a0224c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477335, "uuid": "0c9530fc-20d9-4268-905f-ddfe69c63153", "comment": "Malware payload (Mirai)", "value": "0c49667b312927dc895a052dfa947fc66269db6be8582c59a0de942cfac4d213", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477335, "uuid": "d55fc052-abe3-4318-af01-a105561e0154", "comment": "Malware payload (Mirai)", "value": "02f3655896ff0d12740a4b4229cd8876a59e8b04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477335, "uuid": "a16b6c05-7557-4c63-861d-83c8175cb88b", "comment": "Malware payload (Mirai)", "value": "47078451844ba790ad2329253cde426d2edeb9e41f52570fee3490a8678149d2c76ee49667d265ffc40e3abab3712d75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477335, "uuid": "ba5f23fd-d9ce-4c3b-b17e-b6f355bfce7f", "value": "T13943D595B883892AC5D413BBBA6E11CD332477E9E2CF7223D8105B647BCA51F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477335, "uuid": "a891530a-cb33-40ed-838c-b781714d5473", "value": "1536:1r+ko34/nu29aZOAQ6abRNZ71+nkZ1j8rgPvIyi1Wrz0nn:Pnu29+Ox6SN5Ok7Irg3fiErA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477335, "uuid": "e3e20385-326b-42a1-9e7c-6a38601e4eb9", "value": 55316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477335, "uuid": "ed2bc18b-65db-403a-9dee-a9f970486b2a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477335, "uuid": "202ade54-98c1-4af4-a729-334ec2131c6f", "value": "1769bbc53a4a241490299044c1a0224c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e405e8e0-017a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629438786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438786, "uuid": "86f6d523-bd21-4f77-9a87-2ba8a2633e71", "comment": "Malware payload", "value": "b15acf48f1e4f48861dfa3fbfc275e67", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438786, "uuid": "eff3c3ba-a176-416a-bd17-7342a80c56b2", "comment": "Malware payload", "value": "0d802bfbce5b21e8dcbf37c79cf24699671d082a820a9b0a948433560bdc9a16", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438786, "uuid": "fe777269-e7fc-423f-9134-017ef79517f3", "comment": "Malware payload", "value": "1b8e86593aa6b16a1296bedbf143399af40c193e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438786, "uuid": "f527063f-eb46-4585-a583-5808a1bf97a7", "comment": "Malware payload", "value": "5f33ee4efe86dd3de07c8cd920e46ab3aaad94c928f2b0d15b35fc5909866ba5a22ffb7215bfe21e640d328eb7e7a5ea", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438786, "uuid": "1f61e222-76f3-4cc5-a5a7-15c430cea51d", "value": "T13402957863740503FE47C5E1E47AFE2201E2F2AF99DB165033EEF5B10B5A75A1616805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438786, "uuid": "688f8d69-91ad-4d73-a109-712ad4fd4aa9", "value": "96:TCJ1bgBTvc/CL+ZoE8k8gRHaCbFlYmzoIyalX6:G3b47caLc95oHalX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438786, "uuid": "c82bbe55-c4c2-4e40-a576-a16157c4e782", "value": 8859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438786, "uuid": "f58133fc-9bdf-46bf-805c-f1d415ce4d31", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438786, "uuid": "8358a405-b2e7-4aba-bfa6-86c96fe54ef5", "value": "165343202107011536010.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a04ad9c-0179-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629438179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438179, "uuid": "46a98a34-bad1-47fc-834b-6ed6beeeba70", "comment": "Malware payload (AgentTesla)", "value": "04be2382458dc42e75f440d1bde7065b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438179, "uuid": "971e208c-1543-45b8-a790-dce0852ed43e", "comment": "Malware payload (AgentTesla)", "value": "0e0bc4b35abdcb24d188d891bb687510462292d5e813ea24e08a1e902c6a8fa1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438179, "uuid": "63fdf8c0-b42e-431d-9c74-9bcf82999506", "comment": "Malware payload (AgentTesla)", "value": "71440eba3406f7d4cfeda18db51aae8bd0ca7390", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438179, "uuid": "d814e2b7-aed7-4267-a26f-826531853ee3", "comment": "Malware payload (AgentTesla)", "value": "1f4d289b398a902886700c9474476bd196376741e673347906f3a718996d5134ed914e479248cd7cc614b4fb3fe1d638", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438179, "uuid": "75cabfc6-faf6-4fb9-af49-20c05122ba45", "value": "T129A423DAB0D3B8FC330AF36CE70F49788B3A7D6C188605C3E015A099273AE693756654", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438179, "uuid": "58234cab-ddfc-4bb6-b3a6-74b65bb9bcaa", "value": "12288:gIz/KQbL8NBLiy7Z4/ntFkm00HwttVIxqQljlnLMgN2ExG:4QbL8bZWMP8oVWq6nLMr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438179, "uuid": "597cd53f-d176-4da0-9065-801c5d6fbb94", "value": 466761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438179, "uuid": "41516828-7699-4e4b-9205-95cea11c12c1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438179, "uuid": "d7c52076-845f-4aa3-b60e-9301326f91ec", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ce344d-01cc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629474031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629474031, "uuid": "79ae57bf-c974-4e55-838d-5900ae8bb689", "comment": "Malware payload (AZORult)", "value": "caf24d1c2944cc10b27a8216aa8a4d4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629474031, "uuid": "1936730a-b1be-4015-9419-73abe241eada", "comment": "Malware payload (AZORult)", "value": "0e544a7cb8a7edee3f842a7721245bf15bf8be3084cb13ded019ba79ac206bd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629474031, "uuid": "7eb657b3-fabb-4f94-af85-5ec6023fbd73", "comment": "Malware payload (AZORult)", "value": "9b21214d94043fa9b36a9842df82ab69775b3fb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629474031, "uuid": "f3126a40-d742-4c77-a7be-c9a83ab90964", "comment": "Malware payload (AZORult)", "value": "c1fdd28813bb7ad976de105b70fa36ef0576a0a162948d0792335e8ddd97bd4195b04773890c8b524a76e2962f7e3ec1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629474031, "uuid": "88ce64ea-d9b9-4ccd-9b79-62d551b0ac03", "value": "T125C1B617EBE54B37ED6B0B325D73A31122B8FB1589438BAD3484520FBD172990A62F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629474031, "uuid": "a7d00753-010c-4e4f-9491-2afcf2b9e9a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629474031, "uuid": "5572a89e-6c7d-423d-9783-4acb416cec6d", "value": "96:iaVX4LoN9c5t5GgNb6jXZtJNomdESOzNt:moqn1Ojp5FM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629474031, "uuid": "670f5763-af4a-48d4-8d38-98d0d3cd58f3", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629474031, "uuid": "6057d819-a42e-41c8-8dc2-6f4e229c133f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629474031, "uuid": "1714421e-f8a5-4a17-b167-915f9cdc03b7", "value": "caf24d1c2944cc10b27a8216aa8a4d4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d09abfc-014e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629419769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419769, "uuid": "e1a563f3-f29a-4764-9cb0-d795b8f55b53", "comment": "Malware payload (BitRAT)", "value": "7628b845f2eeefb6de01fa861e0ecf96", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419769, "uuid": "f5fa8585-b7ff-422e-a847-35c7e9f4639f", "comment": "Malware payload (BitRAT)", "value": "0eaeab189b978e9babdb4324c22d4bb708e3b33c0016f52e37aa66efae4a310e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419769, "uuid": "da1e2f6c-65bf-4016-bd63-f55c89936816", "comment": "Malware payload (BitRAT)", "value": "40f952c73c8f6ca829b3084bd925484539f0f09f", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419769, "uuid": "16f96494-87f7-4a9d-a270-3432ea14cb88", "comment": "Malware payload (BitRAT)", "value": "bc869a1d28ea80c6fd3f39e7a6053a116d06da2a488908a4ec716d60a4b15d3b83f7766c0f8db73e2fe2819629ebd72f", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419769, "uuid": "f99a9a41-bc46-4f05-97cb-fc613e71044d", "value": "T18A3623377261014AE4E1DD3B8637BE9576F11B664A837CBC55EEEDC32210CE9B202993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419769, "uuid": "4ad8e433-0daa-42dc-b4a5-3601849fb64f", "value": "1e7ccdf1a5f221a9b775e84d43ca8b13", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419769, "uuid": "5ffd2213-0afb-4e97-8080-d9d0f8a59db3", "value": "98304:FoytWevCVP03k+sX8V5mixXivhtZncFRtivop8NUImQcxGCihTRUbt/3f:KytWVKau5hqNcFLic2YGCi30tX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629419769, "uuid": "dc9e411f-78aa-45f9-96f5-18a03cd21026", "value": 5224960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629419769, "uuid": "3cc46f63-0cfb-4396-afa7-2b8433f5d942", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419769, "uuid": "651978a2-a55c-47fb-ba58-f63f610d6ec8", "value": "7628B845F2EEEFB6DE01FA861E0ECF96.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13facf22-0188-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629444450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444450, "uuid": "7525810b-07ff-4f40-963c-182f59a8d734", "comment": "Malware payload (Mirai)", "value": "94020793825ba1a98c384960a0250574", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444450, "uuid": "d28c5716-262c-4362-b784-d808f764a6bb", "comment": "Malware payload (Mirai)", "value": "0edeef94da1e62f72365faeb049abc8a840090f8852a2424a49f6cd516a383b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444450, "uuid": "cb37f5f2-dff4-4ee8-88ba-c1c6ea262266", "comment": "Malware payload (Mirai)", "value": "e5b44bb3f5a3b0fcb795d15c021214ec04ae9251", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444450, "uuid": "ee190b99-26bd-4c9f-a866-5fb7c8641cb8", "comment": "Malware payload (Mirai)", "value": "21d7112495c38895bcc564b0798e5716481a1624d92e514f406f5d15d13ccd4df7f0d1dba23a6eebce6ae43cf7729d0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444450, "uuid": "f440c00d-4ac2-4704-818e-7dfa4e96c11c", "value": "T14353F8827C81AA15C7C05777FE5F018E3319A798E0EA73438C191BA17ACED1F0D6B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444450, "uuid": "e1de2b82-b9a1-4422-8efe-f6457672ed62", "value": "768:R3nEczUZzYHTg13Je1t0zYRx0v6zJpbLA57MQHiLwCVy/Jx+5H8hG1rmCd/574yB:ZEFZyTg61tsYJLA54JeZWnxCBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444450, "uuid": "b1034f3e-f317-47d8-94b3-050329231011", "value": 63948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444450, "uuid": "ca0116cf-fb84-4c9f-9a9c-2abdb89f5ef3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444450, "uuid": "02a7e448-44ba-4c97-bd8c-bfb002b15f66", "value": "94020793825ba1a98c384960a0250574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f01512e6-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424633, "uuid": "79b51a2a-fb63-4404-a166-6739a3edacbe", "comment": "Malware payload (Mirai)", "value": "4624ce9b5be83a5dc44a56db4020f9a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424633, "uuid": "a399f983-69f2-4469-8fd8-538d985d4ae4", "comment": "Malware payload (Mirai)", "value": "0fbaad44c26cf880e41b5c085759d03bd06393e1f34551b585134c2b3d8e6108", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424633, "uuid": "dcd2601c-bcf8-45db-96d5-3ecb81650f5c", "comment": "Malware payload (Mirai)", "value": "51dccf2e6012648636fe62faf180e4c68f7629c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424633, "uuid": "555a529b-6442-4a65-bb31-96488a281f24", "comment": "Malware payload (Mirai)", "value": "f032b196c111ddad51ae619b15236dfaf93215e9cfff82af41922ff0b70ceec414f1d0411f609c7c9ffe83a006bc7f5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424633, "uuid": "32135571-d8e5-488d-8169-b4af3a19eeec", "value": "T13933F1F2E352A768EAB11C35E32DC1C0560A4E9DD3AC31932805CF615C879C3E5B9C9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424633, "uuid": "39a41f79-ac9f-4f6d-b5e9-154caecd4513", "value": "1536:RY3AmUi3ML4EkwjIQV5WW+Pj6L9FtLV2xour/:O753lWI+5P+P+LLtR2Fz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424633, "uuid": "332b9bf7-ee2c-4c7c-9105-77df6cba4b9e", "value": 53400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424633, "uuid": "c2ce23fe-d66d-40d0-8558-7dd5285f8f0d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424633, "uuid": "2ee3bec2-e1d4-4804-a4e3-7e95cd802e97", "value": "4624ce9b5be83a5dc44a56db4020f9a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfa0f22-0189-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629444866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444866, "uuid": "044f38ff-c7b2-441f-a14a-a967b574ab4a", "comment": "Malware payload (Formbook)", "value": "1362afc47bf20f7ec54d811d6225a10c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444866, "uuid": "10a5575c-b8c7-41eb-b6d7-eac7c5cea66a", "comment": "Malware payload (Formbook)", "value": "1073eafcf05e8cf0a63d6f207722200da69f4987eb362cf25e4a3293b8f3fadd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444866, "uuid": "6e8a039f-5426-4ba6-85ea-720631fe43b2", "comment": "Malware payload (Formbook)", "value": "b4f955e78b7aa7b51b5f3eedfcd54813d473c35e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444866, "uuid": "a2dc9747-ccd3-422e-bfdf-eefb729edfad", "comment": "Malware payload (Formbook)", "value": "0bcdd2a1d8b3cfde1161e163f975279cb93b567610138ec5cfc0a070f8c076c6674f61974cdcb3c7e704ef79b953ccce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444866, "uuid": "80ff4391-5abd-430f-98df-3611d0073472", "value": "T1DCF402657640BB8FC12FCF36E8514C00ABF0E5679707E7872C9221DC5A8E6AACF17196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444866, "uuid": "e5d4a77f-b136-43ae-98d9-7eb10b9d10ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444866, "uuid": "760540b5-d720-4f1f-8b74-ef42de4ed3af", "value": "12288:ywrkLwEgO6TYFrdleTML/gYci25DI34NuDDuHtk7/gYdOoHxNSxDZTAVSyvIvdRB:y0p5TWBl+fYcl5Dx8uHW7/gmXiLyQvdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444866, "uuid": "0c37c51e-9bd2-45eb-be89-44ad6df93422", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444866, "uuid": "28fed199-fa83-47ff-a9e6-bad469602637", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444866, "uuid": "0693490b-1d1e-48a8-a52a-7a8087b0b6fd", "value": "1362afc47bf20f7ec54d811d6225a10c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f895649b-017a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629438820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438820, "uuid": "4c774af0-990d-406c-be4b-71844f2d9800", "comment": "Malware payload (Loki)", "value": "e02986b72dbaf1d6c1f0cff31b9c2871", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438820, "uuid": "ecc54efe-b959-4d0f-b267-534c66c01880", "comment": "Malware payload (Loki)", "value": "1116e964bd456817f7932952db5bf638afda87bda0e62ea4919038620c237c85", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438820, "uuid": "b141399a-1a12-4b16-869c-c395d7bc17b5", "comment": "Malware payload (Loki)", "value": "dad00e62ae69b49122c234ec851b33c83870e0ee", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438820, "uuid": "ca8eeb39-5e9c-4747-b332-bd48c6b4d3f9", "comment": "Malware payload (Loki)", "value": "27849b5e8b8ef85eb889b720fdf09f8424010c3df63a2662d035947cebbc00b52a502bbc1c795bde533d5dfb3d334422", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438820, "uuid": "745cff75-daa0-4f30-a9a9-1da1b992d4e3", "value": "T1EF4513A29F701A6BEB7B8C7C04628068FA5B8E21F0C6D6B2D34F7F9A55F9C247710154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438820, "uuid": "ce4c33e8-39aa-496b-9226-758750a38c44", "value": "24576:jaVQ+ra5fKa9N/EQ1BAXSeVwbVaca5rTOPPZLcjc+HCehjizW:jay2Ciav/EHSlV5ETgLcjc+HCeFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438820, "uuid": "e9dce80d-4749-4d78-a3a0-74becd7aa48c", "value": 1248552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438820, "uuid": "6131ec49-2b07-42eb-be98-c97c37efb92b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438820, "uuid": "cb8e3bb8-f1a9-45e3-ba38-a93afc434ae5", "value": "MV MICRONESIAN PRID.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf3b73d-0179-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629437996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629437996, "uuid": "436ae868-feb1-451a-89c2-ac52daace6c8", "comment": "Malware payload (AgentTesla)", "value": "e15f79ddba43982febd10b47e9390a3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629437996, "uuid": "e7fa944b-a400-4644-985b-28150c238ef4", "comment": "Malware payload (AgentTesla)", "value": "136e2ea3ed8e58a7c7c73d814c82348eda517eebde4ec8d2aa52dfa711e7e13b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629437996, "uuid": "4be94acd-4922-47e6-82f7-2973fa15c3b5", "comment": "Malware payload (AgentTesla)", "value": "a1556cfbe67a8638fe831521f5caea6c8dc4b003", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629437996, "uuid": "7c1f297c-33f8-44e9-abfe-249e1d124d07", "comment": "Malware payload (AgentTesla)", "value": "6fb3560d35aa5e138798d6d3cf70864fdc4417c7d529c2831bc710c2c613a63405bb5b8140f7df86ea10a6fd9a7c5c32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629437996, "uuid": "3e85ea91-ac8c-4296-826f-bcc8896b6083", "value": "T1F734EAE4684F0872D6098C5E6494B145AE78FEE334C6987223AFD434DF5ABF29EC4583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629437996, "uuid": "fbb99e48-98d1-4009-b642-454b511fcb2e", "value": "1536:D/fz8/UprQHuEZ32oVo8w/pNInxu93duu7dzFz76mAg5eeVhMDw5wfL0:0sHy67dzFtr5RDAw5wfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629437996, "uuid": "a8bb06de-4775-470b-b4e5-8e330934682c", "value": 232366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629437996, "uuid": "863e5e40-41d9-4ff1-ae1b-0e100856cb6e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629437996, "uuid": "62e0dfc9-939b-4162-849f-3e08bcb6e3ac", "value": "DHL- AWB DOCUMENTS.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97d910f-01c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629470148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470148, "uuid": "e0ae0d4f-a9fd-4ac8-bcc8-08b021abaae3", "comment": "Malware payload (RaccoonStealer)", "value": "13f338ea42822f9491959d70467f6c82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470148, "uuid": "d880058d-65eb-4982-b32e-d39effa2a466", "comment": "Malware payload (RaccoonStealer)", "value": "142483644d21d3bbdde166a2848e7819f91197a51ffdb64567168ec11dd0b321", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470148, "uuid": "d40cad99-bb19-4f57-a8c5-5456599645fe", "comment": "Malware payload (RaccoonStealer)", "value": "8ee57373035423cc605f51a155cca8c3ed6b1b65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470148, "uuid": "ab8116c1-d656-469f-ac5b-2552fdacfecd", "comment": "Malware payload (RaccoonStealer)", "value": "108c068dd5cf21ad2c21449989decaaa55f6731dc9efb545c65755f2c540053acf34b95e7e90238ad2fdfa4cc68be0ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470148, "uuid": "5c8a22f2-3b22-4926-adb2-c3008335259a", "value": "T12BE3BF1075F0C473C0511531C8A1CAE0667AFDE16FA486473EAF276D1EF12D09A2BF66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470148, "uuid": "8bcb6a2b-b063-4f08-aba8-97a991534add", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470148, "uuid": "9c9d82f1-f81f-4e62-a9d4-b9b471a853a9", "value": "1536:cmpFlb0RmTtADvh+5Cj/LJwNTNQa0X3IzoZRJoAdPkfS0lDglzABFnLFBMK48o:ti85KzuNL0HuoZRJoA970lDGzgFnLmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629470148, "uuid": "bb6e00d1-6d1c-4146-a59a-2bbef860d0cc", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629470148, "uuid": "6e46b869-595e-402f-8048-94b6d1d49120", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470148, "uuid": "f505a592-3799-44b6-8272-40550a9b0a73", "value": "13f338ea42822f9491959d70467f6c82.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb7e62d-0178-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629437591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629437591, "uuid": "04dae17d-0573-4d88-83cc-5eeaa1c1724a", "comment": "Malware payload (RemcosRAT)", "value": "a54bcc7cc9b6d45f6b15435fab9907d1", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629437591, "uuid": "5347fa0a-ead1-4a50-b189-6507fe280d36", "comment": "Malware payload (RemcosRAT)", "value": "1515309774c0204e7d6df87af7770393fae8cf4c84add380d46fae51a9f3ceaa", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629437591, "uuid": "10692318-3d2e-4dc2-aab3-39b40dfce15e", "comment": "Malware payload (RemcosRAT)", "value": "5e9d336fe367140bef309a08ee5999de43384e42", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629437591, "uuid": "f43e1ffb-0483-4f82-98a8-0a0983d86a50", "comment": "Malware payload (RemcosRAT)", "value": "0bfd4ff0965da5e998784b6b491333d7046360c68b38cc38c655d98dd61a39d222b582c6d2f7326e3683b736b1643674", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629437591, "uuid": "418a3cd1-2388-47a7-a755-2b4b1f9e82b7", "value": "T136053337A1B0122F9C62B2B1D6ABAFE446FD61CE6E50D8277F467A14ED01CFE0591C12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629437591, "uuid": "ec742b35-86ad-4aa4-8c20-18b3a5001f0c", "value": "24576:s4s/anPOe5iYyfcJSEmZZHIAiofjgM3sfL:5sgmeZJSEmZijcsfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629437591, "uuid": "da96a4a3-6332-46ea-bc2e-5cc7063bf002", "value": 873923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629437591, "uuid": "ba241f7d-cb39-4e69-ba43-93c51e47b284", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629437591, "uuid": "52eb838b-f060-48e5-90f5-87107b11ba22", "value": "BANK DETAILS_pdf_____________________________.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63f37c2-014b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629418603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629418603, "uuid": "4fcfdb7d-31c5-4199-92f0-277df9bece3d", "comment": "Malware payload (RedLineStealer)", "value": "64aea6529d08c8255d97f9ac5fad3840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629418603, "uuid": "3b7fe8f4-1677-4778-9810-3679efd5e330", "comment": "Malware payload (RedLineStealer)", "value": "1633c6faf596675fa576e9fbb1acf05bb4a2a7c153f6330039b922d651564773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629418603, "uuid": "d7991e8b-ba26-4221-89bb-274f25a5403f", "comment": "Malware payload (RedLineStealer)", "value": "6011472abdac6dc712e816f2083bf7d6fb55a1ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629418603, "uuid": "de7a1574-6f27-4dd2-8694-61511ac39969", "comment": "Malware payload (RedLineStealer)", "value": "1e6a90fa2ecbae54b0730b3df03fcec8f59b8bec138bd430081e15d0a06444b2fad7554ef7a863a6e4a7afa89db60d7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629418603, "uuid": "129667ea-68b0-412c-a45f-75190a524814", "value": "T1ED44E1127CB4C073C457413148D5CAE5967AFD01ABA5904B3E9B3A5F1EF32918A2BF2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629418603, "uuid": "b23dcb43-306d-452b-97e5-521178f49864", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629418603, "uuid": "3ddbe300-7dff-468f-8364-8b6bcea59b54", "value": "6144:Ea/3M5IjiUWywogWmvbDOVxi5wfNIgFnL:T/QIeUWlo3Wix4wfFZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629418603, "uuid": "de0eb2b3-0dc1-418c-8a6d-9d2eca87f89d", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629418603, "uuid": "09651610-5a8f-491c-b9b7-4a9773c826d0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629418603, "uuid": "b745ba70-09c5-4241-877d-66f0d32f3616", "value": "64aea6529d08c8255d97f9ac5fad3840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4655b5b1-0181-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629441528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441528, "uuid": "04170cfa-73c7-45a5-a682-26871578204e", "comment": "Malware payload", "value": "52682085d0af41d8420319a1501314ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441528, "uuid": "755824db-2d6a-4048-adf8-a0c6e0e86283", "comment": "Malware payload", "value": "163457532b889ed7c972276532ebba74ec87c9f261afd8c317f6ddf33b49ec84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441528, "uuid": "fbf0ac3e-cd94-41b1-9de2-cbd1de60fbef", "comment": "Malware payload", "value": "3a4a928858f50acc5d3feb2c7544abf55346749b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441528, "uuid": "1b32fc95-a3d6-462e-9890-962a61dfad7e", "comment": "Malware payload", "value": "dbc80615e9ffe3df51d1c7a488300145f3b282b0a3343d324428b6a16d438927bab27c3547e6e5608dfa1e141298f526", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441528, "uuid": "404c53fa-5d7d-421a-99e7-e6a4351981ea", "value": "T125E5E057A86520F8C1EEC271C625A123B9703C99073837D72F9062F51BB6FE86A7D364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441528, "uuid": "f0ab3a07-e43c-46bd-be9d-e9de0947901c", "value": "49152:tvGIuxrb/TkvO90dL3BmAFd4A64nsfJ1XU59mMJETIR1iVhYOxbJBKqKhmYYMNn6:tvGfXB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441528, "uuid": "95182a7b-eb79-4246-9e1e-76bed67b51c3", "value": 3305515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441528, "uuid": "4cd747de-4ee6-4008-a243-3a6fc787ed71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441528, "uuid": "673b42fc-a89f-41da-b6ae-2a4c74d8c563", "value": "52682085d0af41d8420319a1501314ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7e90561-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629471891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471891, "uuid": "71f9e8d5-d5c8-48c9-b40b-7b53d3d16515", "comment": "Malware payload (SnakeKeylogger)", "value": "41959b740bb57fd1b6ea8b4af1b6e24f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471891, "uuid": "53862ac5-765c-40f2-836e-5fa4baccc20b", "comment": "Malware payload (SnakeKeylogger)", "value": "16b163153461d9b752ae96aa43450d3092e701d22e867d3ad5941b2b72bdbb18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471891, "uuid": "221ba815-f9e2-42f6-abdf-380b5c4c10ec", "comment": "Malware payload (SnakeKeylogger)", "value": "13171f34fd020d2ee4c8e3e6d9854827459fa2d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471891, "uuid": "cd555f63-7551-4a39-8662-5f0f0b70593b", "comment": "Malware payload (SnakeKeylogger)", "value": "39e745ef6a8115658a72a68b062a4ca704831098052997e0284e00c411578a1510147d7191d10edeb4a53529a28cc2fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471891, "uuid": "0bd69046-bb49-4ae8-becb-5558e25848bd", "value": "T17415163C19B91637D1B5D375EBE49423F258985FB400EE69ACDE03A7031AA8734C726E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471891, "uuid": "b74dc181-00c6-47a7-8ff6-973ac0f24450", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471891, "uuid": "aee43679-b446-449c-9b8c-4ac504d99a66", "value": "12288:qpG0iZi970m+e3W2pYmNGyF0nWQDHjRU13RCeibTSG:qpGrZ2TYmcYSdU18eib", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471891, "uuid": "2d3db31c-ff20-4f1c-81ac-58e8578d65b6", "value": 951296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471891, "uuid": "738542ab-a1ca-4f8c-b5d0-0b73015be61f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471891, "uuid": "2e285012-d6f6-4ad6-9865-df8f6e62d2a9", "value": "41959b740bb57fd1b6ea8b4af1b6e24f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a07e222-01a8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629458204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458204, "uuid": "a28335f9-ecaa-41d9-8ef9-d20674c3f8f8", "comment": "Malware payload (AgentTesla)", "value": "670b8c8c901b263b9d799df9f8e414c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458204, "uuid": "b3e7d9a5-137b-4795-8e28-2302335aa6b0", "comment": "Malware payload (AgentTesla)", "value": "173b362dbdb8d7ff3d5e9ab57be06bf28da8758a44ac656b57eb47c2d73b8790", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458204, "uuid": "998474b1-f439-4e4b-8b07-296cf631c8af", "comment": "Malware payload (AgentTesla)", "value": "54eb0e7f550efe930472868d7a8f30e27cdeb15c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458204, "uuid": "ad53344b-fa78-4ec6-abc3-7ddf3b214d49", "comment": "Malware payload (AgentTesla)", "value": "fc329deb24f9bb8dc587a0d70a47eba0818e42f0d4a6e1d9b4325cbc8f30dd9793fa449c763a3ab7b7f845e3aa013ec1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458204, "uuid": "4ce7506f-d936-4a43-8bdd-c276c74b5bd0", "value": "T188E4E0E2B740ADCDD82FAA71C8B75C1143786836D2CBD30F1487B6E54EAE361890759B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458204, "uuid": "87290365-34e8-4cfe-8b2a-0556f3bde11e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458204, "uuid": "a5992eb1-3e19-46b9-a8db-c89b6d00d5a0", "value": "12288:I+DwT3orJiQbbLh5OLYpKFE8LKD5wrPzVzE0yPcXhsK+f0oPLYmCCNjB:fcLordrh5OLYpKF4OLzGPaSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629458204, "uuid": "089d8dc5-e656-4737-aaa7-73aeddddbfb2", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629458204, "uuid": "78f335ac-c684-481a-817b-a4ea948b69a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458204, "uuid": "2e32397c-f25c-4d59-bd5c-98872890e966", "value": "LINE UP BERTH-05 AUGUST 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b15a03-0158-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424028, "uuid": "a3798c47-079e-4839-8166-5f147ff6e295", "comment": "Malware payload (Mirai)", "value": "b646cac7719c286c46532f42e0818e42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424028, "uuid": "ebe1f8a1-b006-4a79-89af-ce17105b0688", "comment": "Malware payload (Mirai)", "value": "1788deb3c4616c63ba46a0ae116c8dee925b61a406bbe730df881d1ef8fdb465", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424028, "uuid": "0fc6fd97-f78c-4631-8053-de6af1b2f344", "comment": "Malware payload (Mirai)", "value": "fced644fd3b05045929754f3673d4825fb46e04e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424028, "uuid": "022230e4-0662-4218-9f8b-9f4340d5eacb", "comment": "Malware payload (Mirai)", "value": "8cba5eba6a608307b47c37a065f502608a275176da2e3ab22232aea5c6360e271292704f35598d0ffe64fc078eb5d2ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424028, "uuid": "54766e9a-a3ec-4536-b2d4-f192266c8757", "value": "T13F637CBDE1795E44D25108787D108939C723F40BA6E62EB2DE86864FE85BEDCF114BB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424028, "uuid": "cb1bcfa9-4773-4323-93f7-d1afd442091d", "value": "1536:p/3FDRTDak6EXIsYMlJ849TP8vNvfs3+Xgqa6CFBC/C:pfFFHF6EU4dP8Zf+SS6cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424028, "uuid": "a71b1243-684d-4012-8e61-33ad94781fa1", "value": 67904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424028, "uuid": "9774480d-b998-4965-af2a-6d8d085e813b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424028, "uuid": "6e47b8dd-dd84-42b2-8961-2ba53df52ee1", "value": "b646cac7719c286c46532f42e0818e42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d0f832b-0158-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629424037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424037, "uuid": "ad43405d-c373-4630-a841-f7bb08e7fab8", "comment": "Malware payload (Gafgyt)", "value": "cde98d5b382eb450b713437988044333", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424037, "uuid": "274e6530-6393-439a-a873-e03868674c1c", "comment": "Malware payload (Gafgyt)", "value": "19348f58be880468456227935dd09f43e2f3b7c5b5476ea4e788152a63c65990", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424037, "uuid": "a13c4dab-73e0-468f-96cc-d4d31ac5b174", "comment": "Malware payload (Gafgyt)", "value": "344f7ee1e3e2b9e0560cee6801844115c38cac0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424037, "uuid": "cd51609d-2a39-444d-8e1b-1e169078097a", "comment": "Malware payload (Gafgyt)", "value": "a9623db24ec0b8053ffdd930933c372bcf51da9932ecb0548cfff6003a5b622f9e06a08065dcc201e90cf28e99d556d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424037, "uuid": "ca002917-07d5-4842-b634-4c14b1d65623", "value": "T1B0C34AA5A780E1B2D15300B2258BDF164033F6FB4A9AEA66E7583DF0CF585C6B161F4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424037, "uuid": "32189f64-b98e-4d83-899a-0310afb3aa02", "value": "3072:d3sgSgU8UgU2Tk/LZmJWvhZh9AnkkG5hEWuWGinI0/zJfNQQ2u:4gRzRTKLZmujNkG5h1yinI0/zJfNQQ2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424037, "uuid": "4e31e3e3-99ce-4df9-9ff9-593a39297daa", "value": 120432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424037, "uuid": "bf1cfc87-c0ac-4e1f-a4cd-ad885aaecc44", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424037, "uuid": "6ab11bc6-2695-4111-808f-20e157f53658", "value": "cde98d5b382eb450b713437988044333", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663b0697-0171-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629434709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434709, "uuid": "2e01537c-db73-4412-b5c6-4a5cde769ef5", "comment": "Malware payload (Mirai)", "value": "f5dd951f7a371b88b8f0136c93c38b07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434709, "uuid": "dd48a04b-1209-4ef6-821d-b75d434f2524", "comment": "Malware payload (Mirai)", "value": "196b0ae75d19df4105794073316bb080130c7b1b501d86690adfbe273e8f0986", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434709, "uuid": "7223920b-a056-4a13-8658-32c1118f6086", "comment": "Malware payload (Mirai)", "value": "7d1cda449c3e43860c4a58e17a52de7dbb473333", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434709, "uuid": "616c90e0-70e2-4b2b-80a0-877b7bceb6b0", "comment": "Malware payload (Mirai)", "value": "6dc290d709e134972be3febd03ebd8a649cf9cd9b956f105b61a16b0593150f800a65c0ae99ee53b663af0df9c3a950f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434709, "uuid": "9dbc1db5-b1fa-4f76-840f-6719b2db894c", "value": "T10003E12289016BF5D2D93DFB58F756C1F7D10A8826B3E2D232EE85118827A97E711CDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434709, "uuid": "4bc57167-7002-42b0-acc8-c7d75335f54c", "value": "768:LKiqaufaHs5P5X1ktLn+cx9qMyvXf+A8vuJqN7m4uVcqgw02NWX9:2/5P5X1kT1UX2AtqN7m4u+qgw06WX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629434709, "uuid": "369086e5-bc9e-4402-899f-38ff12506b08", "value": 37844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629434709, "uuid": "1c6b4a38-700f-4024-976c-786d268d9f73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434709, "uuid": "540375a6-6947-4934-a564-8026f8b5ec78", "value": "f5dd951f7a371b88b8f0136c93c38b07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8e3905f-0181-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629441720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441720, "uuid": "bb41d817-ef04-4cad-96ed-0ce80a4924f6", "comment": "Malware payload (NanoCore)", "value": "0690347a11c9113eec4d7cf87eb9105d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441720, "uuid": "3f4d5d27-aa46-4e35-aeb9-ae01b21657cd", "comment": "Malware payload (NanoCore)", "value": "1b336f7bed1b6490357cdf409a3b043a976c7fd0804e676743bbc629a9b94927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441720, "uuid": "2e159f8b-f91b-4708-94ac-79ea74b65cab", "comment": "Malware payload (NanoCore)", "value": "bd5765f615c8ab588dc7eaa21809af8dfac87c01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441720, "uuid": "2b6fd76c-af02-49ce-8ecd-9a2bb23c0660", "comment": "Malware payload (NanoCore)", "value": "7f9598fff06199468a93df76549bfcb50e3a1917e3b5a740dfcc89ac50b25a87fad1477bf3fdc4ac0fa667c4a8714b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441720, "uuid": "d3cfa447-cf8b-4391-a32b-7bc89df2d1fe", "value": "T1B2051211B650FB4FC1AFCE3759910C20E7B1F6A24313E747BD9321DC5C8E7A689262A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441720, "uuid": "50708932-622a-483f-836c-feef0d62e942", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441720, "uuid": "193992c3-f14f-4c71-acab-7c4cfd6e8e57", "value": "12288:WhETqkYh6kaSnAOmu8IFjQEJKnzU64bfy1qXP3cF1X6MQtQ+otAK7xEQs8xzVDCO:2ETtzSnAxuNFtgnlKPOj+ox15ZCg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441720, "uuid": "766a887e-6e0e-40a9-8ac6-029a5ecab1c9", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441720, "uuid": "5b5ee5e9-c219-49fa-a458-140641c399af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441720, "uuid": "807bd7cb-812b-4d10-90c0-e1b408d4227f", "value": "0690347a11c9113eec4d7cf87eb9105d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565a7a3a-0199-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629451863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451863, "uuid": "de13be03-202a-45bb-88a1-e9545bacbe16", "comment": "Malware payload (RedLineStealer)", "value": "acc4073919ccf1e57b495cd6aec95d0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451863, "uuid": "d06846fe-831a-473d-8aba-3db8b5d698e0", "comment": "Malware payload (RedLineStealer)", "value": "1b352faa42a25ce6aadee094f61b45cbfe783135b713b3badee956a9a37f8bdb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451863, "uuid": "dd58558b-afd5-4fe4-9036-a9827779c17b", "comment": "Malware payload (RedLineStealer)", "value": "66132542955e6e645f7922a0db295e3be58d749f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451863, "uuid": "409f6b8e-4826-419e-b369-b36e7a196674", "comment": "Malware payload (RedLineStealer)", "value": "08e9feac4d1aa16bc7bc92f7aa4684ba251080889e28f5c1fb9bafee7e2d4d680dd8f291bdfae811ee217f5e2260b477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451863, "uuid": "3d0ad810-3826-437f-a8b9-f42434a2d845", "value": "T145D40E186A7FC016D0E7EAB12DDCA8BBD9A990E3644D793710B4633B4B51744EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451863, "uuid": "4da344df-0c1a-4344-bc5c-70b9a2f75e4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451863, "uuid": "6bdf0231-0b79-4dd0-9a07-ad3b6198c345", "value": "12288:2kyf8+5eA1Goo4dPDb6+uLjfyxV1bO/yk:az13A+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629451863, "uuid": "5d54ebf4-8eca-4bbe-954d-22ee9675bfac", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629451863, "uuid": "87665bac-d1d4-4338-a6b7-20dee1ac6bf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451863, "uuid": "463c18b2-6182-4d88-ad44-5b9c730ca325", "value": "acc4073919ccf1e57b495cd6aec95d0c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a875332-01cc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629473774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629473774, "uuid": "f8030c08-cd97-45cb-99c2-feb9201acc91", "comment": "Malware payload (Formbook)", "value": "1429db94406815eaa9cf34236f480f4a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629473774, "uuid": "684b8c61-4fcc-47f5-a93d-c4218f991813", "comment": "Malware payload (Formbook)", "value": "1ba83ab6f009f73bcdf5114e31a0e2959bee3c8ce049d9a562c9d04ce6cdc11f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629473774, "uuid": "51b11aaf-b8a4-40d2-a2b9-98cee8d1fb2d", "comment": "Malware payload (Formbook)", "value": "551e873b9b2cd7b52e322b2eb40620e95b23d8a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629473774, "uuid": "74d060ac-8439-48be-8078-ebe03bbe11bf", "comment": "Malware payload (Formbook)", "value": "b1556c02d3f50c2369210568b346559b5fcd7df78d1dfecaac9a24593476eb086a672658e984e1e113a940b6b53202f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629473774, "uuid": "ec2c7ed6-8ea7-4ade-88e3-fc4ce627b6dc", "value": "T17DC1C416EBE84B37ED7B0B324C73A31122B8FB1289439B6D3494511FBD172984A62F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629473774, "uuid": "406ac36f-3365-422b-b61e-a03312fb0bbc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629473774, "uuid": "955aa613-2364-4d4e-8544-2bd8cbc55275", "value": "96:jiRXkLoN9c5t5GgN3cAjXZtJuqYmdESOzNt:Poqn13JjpV1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629473774, "uuid": "dd607cf5-1553-41af-934c-4aafa1363694", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629473774, "uuid": "04edd96f-aa69-40c0-a39c-1f0795e67fd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629473774, "uuid": "769c700e-18e9-4cb9-8b5d-34d4ec1f7353", "value": "1429db94406815eaa9cf34236f480f4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180d1deb-0172-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629435008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435008, "uuid": "8d55bc6e-5c35-40a5-844f-06eabe2246f4", "comment": "Malware payload (Mirai)", "value": "4f640af957e56509a938fbaa12fa472e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435008, "uuid": "d32df48a-ff46-4e2b-8a56-c3b2e28cc17b", "comment": "Malware payload (Mirai)", "value": "1d6d8d6a7e251a60c5341fbc9f4180ad8d6207f9fd9bb6ef8b98283a8b396270", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435008, "uuid": "0dfc3a68-59a8-4e96-970e-28f3b802bcd5", "comment": "Malware payload (Mirai)", "value": "f7a5c10ca59f3350c79534dafb3d0da9c4c8b368", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435008, "uuid": "b010b189-5c9d-49c7-b82a-a7c6b4709588", "comment": "Malware payload (Mirai)", "value": "128a4f3ae94658e13c72000969f8f407c54af91eea5cc2b3c3f8c462908d99eb9ce54e9a8aaeb2f61a732163c6bcfe11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435008, "uuid": "2e5af82a-9bc0-4c7f-8e49-3e24e825d42e", "value": "T1C053F181E522E0729BEA9DB1BD5457C32F396B3480DD319353F389592AEA9820F9C607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435008, "uuid": "2ed2d2c4-5272-45d9-b084-d5784bc35ac3", "value": "1536:uyDKekcMQ/XZTW+wloPjg9q51uCDeYGGJKYJsq6QE4:lDKeAQJdwlu51M3YJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629435008, "uuid": "b15434dd-d880-45f3-8a3b-975c0959d7b1", "value": 64696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629435008, "uuid": "8e67edcc-ae33-4394-afe9-46b37a8efb8b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435008, "uuid": "91a12709-8336-4036-8c38-a8c9b2115bf5", "value": "4f640af957e56509a938fbaa12fa472e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3386c214-0195-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629450086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629450086, "uuid": "065875a4-957a-4e9d-a9e0-55f97be45578", "comment": "Malware payload", "value": "0a0f4d526a2f196dc8046cbb6de33d52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629450086, "uuid": "dff93986-6a4e-42bf-b750-44fb40a5db67", "comment": "Malware payload", "value": "1d9c9e656125fb9ecf4952de9457033e41c832321db252b4fa696483b9937c52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629450086, "uuid": "8330da8f-78d5-4139-b00a-9a7d9afa2be9", "comment": "Malware payload", "value": "9c92b8029ef22ba1f62d7811a5f04738fbce66c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629450086, "uuid": "eaa91a4b-e98b-4337-90a0-16c4c3fa52bc", "comment": "Malware payload", "value": "812fa399bbcc5fcd240378ec900ea859321a15c11186189df975549526952c3b8f308d575ccafbb2f058c14d4cc6db62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629450086, "uuid": "f02fd23b-08e5-4557-8b10-96cceef1bf12", "value": "T16825F90AE6F611E4E5BAC13895A23126FD7138558738ABDB87805A0B5F31FE4ED3E710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629450086, "uuid": "2cf45a44-c250-4d27-aa94-04efb1e70087", "value": "749fef2365af3caa2e453f765568064a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629450086, "uuid": "703610d3-fbbe-44e3-9c69-c175bccd0f76", "value": "12288:ISvqZstBCd5wOiMPLYxpbRA/L/VqrsOTqiXhDC9HniheH7to86N3NnQ1:ISvUWBCd5wNxVRkzVypCtisHJ+PQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629450086, "uuid": "7b0e71cf-9e32-4ad3-9402-f7c85220c399", "value": 1051136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629450086, "uuid": "da10c7bb-7cbe-4dd4-bd68-a741ef6077ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629450086, "uuid": "a4be4d41-157d-49d5-b9bd-5d4091a84490", "value": "faktura343.exe_infected", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efffc7b3-01c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629471018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471018, "uuid": "8b852f95-927f-4af3-888f-4c461707d9bb", "comment": "Malware payload (AgentTesla)", "value": "af676749a9e000a51ad68977692d110c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471018, "uuid": "7ec305a7-6486-47dd-bbba-a55740b02d7c", "comment": "Malware payload (AgentTesla)", "value": "1e863cf0cd249892950069206507d4e81d69abf7dd9b1fb673fcb23099aae8ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471018, "uuid": "73ed4971-2f0b-4e7d-9faa-fc44533bd752", "comment": "Malware payload (AgentTesla)", "value": "7ad1550cb1c1e90602fa9cb56274d6afd8959b70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471018, "uuid": "dc63b3f7-dfde-4fc7-9451-9aec2ecc0462", "comment": "Malware payload (AgentTesla)", "value": "1cd73a6c30ae2340eb9a16d1f9af62691c6fd333feea1d7ccdc93378ac37d8ade634f2fb759b2b55c1ba3f748dff0659", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471018, "uuid": "607bcecf-4dc9-43a3-ae38-a583829ad281", "value": "T1690533C85A0ABC108D9D6FF19DFC870F261821A1B76F267D37823A76934639ED16CB14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471018, "uuid": "70f69fdc-83c4-45da-81f9-40db2a39f8f9", "value": "12288:2aG1t2utGPcfCfPR9zGFSDngQ8eJYVR47lNmR46mFDe2U/UkYDuJkJV3HN7P7D9S:vG6uFez4eJdEoi2wUuJ43H19waUSPRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471018, "uuid": "71d1f773-1a10-48ce-a19f-baf1ce816259", "value": 873114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471018, "uuid": "1377c5d0-039f-4e4c-a601-56260c559db0", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471018, "uuid": "256f8d73-4cbb-454f-8e25-8a1edf8f1a80", "value": "SHIPPING INSTURCTION INVOICES.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2578496c-01be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629467672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467672, "uuid": "7f6cb191-6471-433d-931a-8c73e046c9b6", "comment": "Malware payload (AgentTesla)", "value": "1db16047a8b74e030dc5a53f9de1ddcf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467672, "uuid": "469cde7c-b892-4b14-b20a-d54a6e4d9c42", "comment": "Malware payload (AgentTesla)", "value": "1f58016046475179846e2ded36d65ee893d0bc1b4f7a96eae51beb63406d455a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467672, "uuid": "99a5d4fd-6ea0-45a5-98dc-f870bc020753", "comment": "Malware payload (AgentTesla)", "value": "63c79d546e628cd1f58a8c3ffa8aa75351674d32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467672, "uuid": "60e4967b-dd95-46a2-acd7-dd57d09cca6f", "comment": "Malware payload (AgentTesla)", "value": "de80463ab4d0dcabc032941fb41b5002d36cc5ad007ae1c420df45e5c30f0d64403b95ed9ef34e9acbcce0c2f9f4e97a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467672, "uuid": "67dfb3eb-a554-4bad-8b2c-a7b7e8555cf4", "value": "T16E942393D46CFEB2BAF31276150D2A7ABAD08AD32CD080C292DF51FC58654395D7607E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467672, "uuid": "0b539d09-a360-4553-be1b-3a4b0d8a1f29", "value": "12288:n86ec7f3uH6Q9+R/syoxGxfdM3Qxy3yR7rGc:n86eK/uarsyoIxFM/Yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629467672, "uuid": "d1c699fa-12e9-41ee-aad3-f5fc0d3418d8", "value": 412534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629467672, "uuid": "e4a066e4-f0ef-4d8e-8438-fda19cd39dc8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467672, "uuid": "7f1cffcc-327b-409c-af06-3866ba48af2b", "value": "AD1-2001028L.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f22eb7-01be-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629467862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467862, "uuid": "13b878a2-bd78-4c0c-9b26-e486cc68ecc3", "comment": "Malware payload", "value": "c996f6a2787e755bff241018f54c850b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467862, "uuid": "7a7faa60-4838-4663-a742-a509ee698990", "comment": "Malware payload", "value": "208d68c431d58e6d311ae0f2574fab85a1205fc1597e10690116bf406eb5499c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467862, "uuid": "a9d6aaf0-b33f-442e-8b15-93981abff998", "comment": "Malware payload", "value": "a86b16798fc4b3170c8c2a3a7a86525bbf50ce4b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467862, "uuid": "849e9267-d77f-4573-b004-7ea1329ca9a0", "comment": "Malware payload", "value": "1daa9b347204e7c4535838763eec861e816936cb720694b7fdf68e5287679778eb02ea27ef742b3d9c15ceba650bfcc7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467862, "uuid": "5c769ce3-acc5-4d68-8b67-c9e5120c1591", "value": "T1DCE62244FFA0959AC47A723684ED09118AD35C86CC61961FBAACB58C0F739C41ED7BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467862, "uuid": "d474ea5e-e15f-4cec-a802-6678d7273274", "value": "393216:jiF3sGLjtYwprTqD6k94ulTbG2qD9S45Y/WCCwkhL7Y6joH7H:43TjhlSJTbGjS4aQwCsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629467862, "uuid": "e78137aa-349d-4ea8-93f3-40efc6fe0205", "value": 15219806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629467862, "uuid": "f71ffee5-c48e-4488-b802-0c8af03c9546", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467862, "uuid": "8f4e65a4-b5fd-4324-a57a-b75fa57b0be8", "value": "veradown.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9db6a8-0180-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629441377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441377, "uuid": "e1657bcc-f5f6-4efa-b715-ca5936daf02f", "comment": "Malware payload", "value": "36b7fbe01c434a909b1e65acef492517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441377, "uuid": "58f80fd9-ef44-40f9-8014-262a6a415c2d", "comment": "Malware payload", "value": "21431fc384a00434d01bcdd004c56d1a73e9aab4372098c4f175989e05563938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441377, "uuid": "d2cf3951-8ec4-4377-aeb5-9aeeef0dd1fe", "comment": "Malware payload", "value": "f3bfa0dc346d67d66f9522a4fe455cd59de665a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441377, "uuid": "53f02bc8-3879-4f96-ae1f-d1bc4aa8f883", "comment": "Malware payload", "value": "cd5bee6b984b0be8831209cc2a454a536661fc4b8a25f82a49f670fd8367e12f7c0ac3bc310bb0f173902fbb9bff5f37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441377, "uuid": "53b3d54c-53a2-4f9d-81fd-3d3fcc0393f6", "value": "T1D1E469919EEFCEDEC26F323FA01A0C8214DEC7160797A2E18B564D35B7845278D661E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441377, "uuid": "bf74ab00-0d55-4169-97a3-63c1c9b10e62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441377, "uuid": "43b24556-031f-4023-8fdd-899e623a058f", "value": "12288:/TJAE7RQtyG4hzWy6MRL4+OBWJQnvClSPbMo/8cV/ccl2LzNYkdQqQBhw1q:/TJYz4hAMRLlOBW+nQoxV/cZraqQHw1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441377, "uuid": "e0e0ed58-0aae-48e8-b33e-986ab3b32105", "value": 700928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441377, "uuid": "75be78ff-d7af-4810-abc9-2d551dc7096e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441377, "uuid": "e3981b11-c4a3-49b3-87e4-a783425dd721", "value": "36b7fbe01c434a909b1e65acef492517.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e9b64ba-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629424281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424281, "uuid": "c4bd63fa-58c5-4212-8f2c-25b60c9a8c31", "comment": "Malware payload (RaccoonStealer)", "value": "8d67e92d16bcb3f33a3114e14474fa58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424281, "uuid": "6ae032dd-4f1f-40b1-a567-36f70b1364aa", "comment": "Malware payload (RaccoonStealer)", "value": "23d27e3d7908bb0d08b3575d443036dc91aa2c390b170e0e2d8c5ab0dc054078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424281, "uuid": "23c2000d-7d90-404b-b1fb-64de97149071", "comment": "Malware payload (RaccoonStealer)", "value": "f3d0417dc639ca4fd7a22c07fb9dd3f5bd6cdc01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424281, "uuid": "859586b4-fced-446f-8eaf-444cc2f58496", "comment": "Malware payload (RaccoonStealer)", "value": "eb00615ac08d651ea19899cc2ea8bd3a06c59df3be587dcfdc9faf79db47805cbe059575ef5a40d0c0671239da4a3d6a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424281, "uuid": "b4473fb1-d8cb-4de6-aafa-75c6d74d9cb0", "value": "T10B26337A3E924941F64F1A3F4C9F6285659CFA3161FC438603611A4B232DB922D8F7DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424281, "uuid": "96a3a835-77d0-46b6-97a8-6c38ea2ba2bc", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424281, "uuid": "3152a704-38e4-41e9-bfb5-c5e958f14439", "value": "98304:yAZS8sVrh+5/NqFq/0afVxWRy10WJtl+gZKnexVw5y/PoIpUpda:yANstA5/0FqrzdJKneN/P75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424281, "uuid": "cad4c711-934f-4dd1-b203-f805e06330f8", "value": 4453799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424281, "uuid": "90bf1725-61ff-430b-9f44-338614d2470c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424281, "uuid": "0d761689-618a-46ce-9128-e56d31c689e9", "value": "8D67E92D16BCB3F33A3114E14474FA58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6be81f7-01e1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629483002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483002, "uuid": "c93e26f1-888f-455e-82a2-d5c004416d82", "comment": "Malware payload", "value": "a9534b4a3ab90371b3d2e360c7774939", "object_relation": "md5", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483002, "uuid": "90532667-cbc1-4b30-9845-8a4513cfeb5b", "comment": "Malware payload", "value": "243efe6250108294339e48488de4539eaf5baeaccca5a1be617dec7fa5eaaf9d", "object_relation": "sha256", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483002, "uuid": "0dcd811c-7b49-4e07-96e0-3c918a79c922", "comment": "Malware payload", "value": "458cbb170a0f8b26c53e5f10c8c0ce7c6ad085f0", "object_relation": "sha1", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483002, "uuid": "daab4804-e511-46b8-9bc8-f84c3febde1a", "comment": "Malware payload", "value": "e0316b9b3c37d63aa148d3982949d1d51720394f113c049e0cc9f2e9e54c4eaa854dd9069eccfd71c33411454f64087c", "object_relation": "sha3-384", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483002, "uuid": "e4c5029f-ab4e-43d5-9689-a9efb6b9f002", "value": "T1887301D83780C3D3E185AD71CEB585A53C50FDA72161CD87904ABA1A19F6ED8A6F822C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483002, "uuid": "24b01ac8-8be2-45cf-9e02-b394009e0a34", "value": "1536:1cOt3obYZDx0z7Ewyos08xJudw4ExJEjuimqjuI:9tGsx0z7NZ8xJr4SJEaimqKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629483002, "uuid": "5ec2de67-b0b6-4c9c-a71f-b9aaa5f90ea3", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629483002, "uuid": "c11ae292-9a08-4dbb-881f-19e319974310", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483002, "uuid": "8fae0d97-ce9d-4461-9074-e7b88281c820", "value": "document.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "100863e4-017d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629439719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439719, "uuid": "561f440e-8c50-4c6f-a9ac-9c7b6157e734", "comment": "Malware payload (AgentTesla)", "value": "329debbda9174757ac0678b3cb364e19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439719, "uuid": "197a8825-0f49-4dfd-8883-0fccff29ff6a", "comment": "Malware payload (AgentTesla)", "value": "2481629865775bb320d31a4ddb9bc9e8fccd5210df7006af7dd7bb0901e7510c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439719, "uuid": "4f294d42-5906-4927-b3f9-fc70aa0503f7", "comment": "Malware payload (AgentTesla)", "value": "ac81ed9f7188748eae725ef7727a7c0489e03cd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439719, "uuid": "fba42372-38c3-4dbf-8025-7002687b81ea", "comment": "Malware payload (AgentTesla)", "value": "e74aa23a2cb464fc895428624ea073f4f2187457bedc688ac5610c554a5ed135522006a44c420196bb4853d93575f20c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439719, "uuid": "966d3b95-ae9d-4494-8f3f-383524451066", "value": "T175C1A517EBE84B37ED674B328C73A31022B8FB1649528B6D3494510FBD173990A62F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439719, "uuid": "bcf54f27-92e3-419f-b820-2f44b1bd006a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439719, "uuid": "eea71ed8-6512-4ebf-8e87-0293734b526b", "value": "96:kuA+XALoN9c5t5GgNUgjXZtJ3ImdESOzNt:6oqn1RjpDlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629439719, "uuid": "de1066b2-f9ce-4845-ba86-386f2fd2bd8c", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629439719, "uuid": "5f2ea092-b11b-4132-9c71-7005b4341af5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439719, "uuid": "c4dc1575-1639-4c56-85dc-fb37f2cb9c16", "value": "nnxxxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afe58db5-01c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629470911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470911, "uuid": "8aceceee-9246-4e94-b26c-92a0f2af1029", "comment": "Malware payload (RedLineStealer)", "value": "2587dcc00649b5a2e97a2d9e936dc103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470911, "uuid": "fa8e8590-5dc2-4f64-ae82-6fec4cb767dc", "comment": "Malware payload (RedLineStealer)", "value": "250565a194e488d19aeeacc1cb9c673e31c20d583c5a15882d0193195edf5494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470911, "uuid": "ec1a8191-6d16-4bf4-9e53-b2890535d8c5", "comment": "Malware payload (RedLineStealer)", "value": "6b6727c4fbb18a7f3e2ae5bfbf3212656a579e51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470911, "uuid": "28fe6227-16be-4876-b606-2f61d9c5f8f7", "comment": "Malware payload (RedLineStealer)", "value": "a38801bfa6fac70e482060fc55542e312c720c9bcc794e3c4e007aa51ce5d3b45750523dbd74b574ca408415f70481be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470911, "uuid": "95ff6c7e-f1c1-43d1-b96d-8b44a0f8a7b6", "value": "T17CE533B55B5C3486FEC146B887BED23A86E80DC07ED099DD04C571BF24BD38AEB581A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470911, "uuid": "10c1cff1-c336-4190-92ae-347baeb65ad5", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470911, "uuid": "5c97bea8-fa69-4795-9689-4fdf6015151e", "value": "98304:6z7bg+MzCHAQngKxFz2gbGXvJVXrFBXSY:6z7bgP4/x9DbGXvJNrrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629470911, "uuid": "7fbb4ec5-7dbb-4095-a421-87545d80aa9e", "value": 3183360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629470911, "uuid": "75fe8d1f-b691-46c4-9de0-21ec8af90219", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470911, "uuid": "c34045a5-3281-49c1-b225-7b6fadc1271a", "value": "Flor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946885a9-01a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629458839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458839, "uuid": "f5208c62-669d-4035-815b-30bc51129807", "comment": "Malware payload (DanaBot)", "value": "5d8c26cf600c71e4bbfce15ffa44f14e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458839, "uuid": "de7364c7-2cc4-4700-8781-3d1c68c6e286", "comment": "Malware payload (DanaBot)", "value": "256ad361e3b197d08e734c3d116ae1311045cc11a9f7f7be4994ad9fb46a0ca0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458839, "uuid": "5e5a3ae5-c2bb-45ff-a552-5b6f2ff37cbe", "comment": "Malware payload (DanaBot)", "value": "e705f90d291c7bdc87fd794f25e26fa1f310f8fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458839, "uuid": "475e10c8-ea5b-4073-a958-0441df5523dc", "comment": "Malware payload (DanaBot)", "value": "541e57ba277d3fbb392ee7c7a0a57f0475b7dd3a2c9d9b2a49334dbc33bb2f8815d2f99b93ba7813bd787292953e2ce8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458839, "uuid": "00d7b27d-a5f5-4dc3-8c00-443a4c8ad351", "value": "T151352345BBD6CA77E5A609351FB02F4398A2E6324936951FD300EF8A7C514238A34BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458839, "uuid": "8beaf5c2-b5c4-4fb3-be78-d4d240b35955", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458839, "uuid": "fd1105a4-f7ae-4ced-bc6e-704cfbf38511", "value": "24576:z5X1ZOukQnPSxzxXdjT6YQJG3EtzgklajHZTRvi030ZwAhG++DI2/:9X1ZORQei80tzoR930GAhGHDh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629458839, "uuid": "7f12ab24-ab8a-42ee-bcc2-604dec942c33", "value": 1113109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629458839, "uuid": "b4bdeb65-f2d6-4a08-95ab-2f2067bbfbf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458839, "uuid": "e03e3b78-1ca5-492e-a770-a54c621dc37a", "value": "5d8c26cf600c71e4bbfce15ffa44f14e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e30d1ac4-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629424611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424611, "uuid": "f9d5bfd6-4589-4c15-a6ee-c103a73cef9b", "comment": "Malware payload (Gafgyt)", "value": "c68b6628549a240fb5235ec4e62d484c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424611, "uuid": "19e22bfb-d652-42be-8fd2-09caee2f4179", "comment": "Malware payload (Gafgyt)", "value": "263f3831f082a1526b3589118a03b49695a33403a290e08404a3dbe6c41a9490", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424611, "uuid": "9b6c346d-1d9e-438d-82f6-24b1785d6da0", "comment": "Malware payload (Gafgyt)", "value": "15c0a19d115fad9936d3226beee52c9e7625d3cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424611, "uuid": "864c84e5-0bea-4076-83a9-78a5f4c44c34", "comment": "Malware payload (Gafgyt)", "value": "2381f899b6dd5da1d35d1d77ea0526c290857b5150eb1e46b5192185343dd10eed85efc8d93eb1acebb0d02351532ee0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424611, "uuid": "62693255-06a1-4554-bb27-97e6b8dcd31e", "value": "T177143904DA805B57C6E327BAEB8E438D732357A867C7330549389BF43BC2B991E76461", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424611, "uuid": "a8750e4a-f203-4e1d-aff9-b8c15d8037d5", "value": "6144:CCGkqaXP7HN97R6l9K5hLr4UmOiSM/9fWmBwKBIe8X7:CCGkqaXP7HN9dQY5hLr4Ug7/QmB1BIeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424611, "uuid": "16dc31b1-8b35-4e2c-9e3d-a7773de12893", "value": 205246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424611, "uuid": "8433d7ab-f559-435e-a201-834c9bef37cd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424611, "uuid": "ce6cd8ce-ccfe-4b8e-b8cd-9651bd485bb3", "value": "c68b6628549a240fb5235ec4e62d484c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e3a2d6b-0186-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629443823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443823, "uuid": "2b95d85b-b46b-4487-afcf-dc9682d5015f", "comment": "Malware payload (SnakeKeylogger)", "value": "af6681a02fd0aba26025f09587bdd189", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443823, "uuid": "8d936c6b-68b1-4fa7-ac15-e9525b4adb3a", "comment": "Malware payload (SnakeKeylogger)", "value": "267d8be021bb69e89d2054d0019eaddd3fde37ade17841ca18c5cfff5d2530cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443823, "uuid": "13696a5b-7449-4756-a716-93b7d8a3ca35", "comment": "Malware payload (SnakeKeylogger)", "value": "b14327e670c41ca3a3d73c904cd03fa0454c83ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443823, "uuid": "babea7ef-fa80-462e-b6b1-bdd0ab0c63d0", "comment": "Malware payload (SnakeKeylogger)", "value": "e5a30cb1906c4d71459a3dc536b349b031f17ad4ca8e7511f5184068b9b6de08480018492147b51b8d4b5ae3b51f4d31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443823, "uuid": "1b5540b2-b0b9-4a06-a278-de8eca00e4ff", "value": "T107C44A243DFA502AB173EFA55BE4789ADA6FB7733B06A45D1091038B0623E41DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443823, "uuid": "3e20bab9-6391-400a-8108-2deeaec7482b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443823, "uuid": "6179e997-6dd2-4296-ad3c-54cafddd298c", "value": "12288:u66/lc5GkuI0kvSa0lY+i4d7J/iiPkK+kO9hb3MzZVcaCyoUGUH+5JThEC:4e5Po6ynItyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629443823, "uuid": "294099b2-1a0b-425f-9ce9-c91a8fbb5730", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629443823, "uuid": "842e09fd-a26d-40fd-8667-f1de84cc00cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443823, "uuid": "52a29bab-e984-4e5d-9fe3-73cfac931d7d", "value": "QOUTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459606e4-0180-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629441097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441097, "uuid": "dc6d8ed5-789e-43cb-bbf2-b5e7d8b600dc", "comment": "Malware payload (Mirai)", "value": "bb0b0a5cc1f1d21e31aa6b026176e26d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441097, "uuid": "8b7268ed-ef07-4c35-8c42-ad756f5a2a9d", "comment": "Malware payload (Mirai)", "value": "26a55e31654f321bddb55176d81d2c1fa790f82a8fb7ce190e39d8cec5bfa0f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441097, "uuid": "3f241e25-f21f-4545-8fcd-3ef60a28c7c8", "comment": "Malware payload (Mirai)", "value": "4afce3219d34c2027ed452e19100adf8e02b3dc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441097, "uuid": "11a97d85-5182-4a08-9ebe-29c86e5f0b40", "comment": "Malware payload (Mirai)", "value": "5d2ccf7306c92720a33dd1a832a240d629faec473c77bd07f2ff2aca2e7ab9ed3793b75c0af358d35a4130c2ee822255", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441097, "uuid": "286d7636-8df8-468f-92d5-3a2a4f679296", "value": "T1F313F13265991423DD31F835B89DD94360963F31D1A87DA09EF98761315B34E93B83CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441097, "uuid": "e2471a25-c5b3-488b-98be-6f7c95217259", "value": "768:zbMJFji72iXVKxq7jv0WM82Ul7zafbib+LqAQGKWz12o219os3UozW:zgDj821i062Ul7z9/Wz192HdzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441097, "uuid": "58c615c2-7a2f-4bf0-8213-b0571f0da6a3", "value": 45316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441097, "uuid": "d72aace4-2473-425a-8b1b-4953070b508e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441097, "uuid": "7584ef9e-1dd7-4cd7-951d-8ec65a46576b", "value": "bb0b0a5cc1f1d21e31aa6b026176e26d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2264e668-01db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629480122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480122, "uuid": "f43901a2-c7c5-429c-9f5d-2098c37ac3d9", "comment": "Malware payload (Gafgyt)", "value": "430f09caf6c3db337a993d65da2877ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480122, "uuid": "de71ce59-f024-4509-90d3-058ef89517e6", "comment": "Malware payload (Gafgyt)", "value": "281bd5a8269d88c43b5449c45812fccf94abe3b2df89abd5f3799a552d4c5505", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480122, "uuid": "e697aa4f-fc19-481f-bd7f-da88be0aac9d", "comment": "Malware payload (Gafgyt)", "value": "5a3c4361655ba8cdf73707601bdd601d862ea8ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480122, "uuid": "d4120993-4a56-47ba-b210-cfcd90ce713b", "comment": "Malware payload (Gafgyt)", "value": "f75b826522f482a052e8b71f0e0ade5d4ea87a0ef8019b2bdc952ef509ba7702d0259a20fe549771e95fe3666eabb4fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480122, "uuid": "bcc5bded-da90-42fe-a40d-3c64e4198fbe", "value": "T19E03F18A4D68C5B5D66ED178913D15F4396FDFBD018A565403D08FFE88280B0B46BF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480122, "uuid": "832a8ddc-5b12-4186-b6fa-5404c449ad9f", "value": "768:2rNJx8R285d9c6OihDDteuRUaIvizvne38Vt7DEQKfxyHvIv17Rwmzsv:mz8Rb5LrPhdeVaTvnJVtPpKfcHQ97+m4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629480122, "uuid": "66b89728-702e-431a-9102-4d2abcc4d6ee", "value": 39104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629480122, "uuid": "f685610a-5b87-4f57-9b30-f15eeea08b1b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480122, "uuid": "e073dae7-5081-409c-abf5-ed9fdd6bc216", "value": "430f09caf6c3db337a993d65da2877ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5e95fa5-015a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424992, "uuid": "9c752d96-859a-45bc-9b79-eb6c6fc9cb60", "comment": "Malware payload (Mirai)", "value": "cadc66dc965efb3a8a4d3b5b876eb0dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424992, "uuid": "cf2b553d-cef0-4343-bc2a-b89a90ea9485", "comment": "Malware payload (Mirai)", "value": "28404206f2e58960432a20f2a91420cdfca107345d2d306bfb7758cd390309c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424992, "uuid": "292119ec-fa78-4d47-ad4d-8cda7655cff2", "comment": "Malware payload (Mirai)", "value": "4d2fb8d9c6eba5131e76e0da5249696517ff5cb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424992, "uuid": "b1daf882-8d5c-4e13-96fe-2addf158b222", "comment": "Malware payload (Mirai)", "value": "f886272199dad4b0b9f68e986b5e00338a5da664bdae9941e8a4e1b3e006135a8bc4c81864562991e16905066b23241c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424992, "uuid": "e4183a01-5852-43f4-b2d8-b456eb9f0816", "value": "T1A4534BC0B643E9F5DE020674306BEF324E36F6F6211AE987E3E49573AC425419643A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424992, "uuid": "d40c5500-a023-42f0-92a0-3a12f1901f30", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKl++eKWoTnt05XFEiad:1jSwY4keBfrtOCQsnnFkGKNh0513a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424992, "uuid": "beee3d77-8f0f-49a5-a878-29348db2f12c", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424992, "uuid": "25ff3c59-580b-41b6-9b4e-843e627ec1fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424992, "uuid": "ba66335d-fe9b-46dc-901b-baf6864d8f5e", "value": "cadc66dc965efb3a8a4d3b5b876eb0dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22afb8aa-01ab-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629459507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459507, "uuid": "44363ab3-e7eb-48ea-9ebb-1694cf3ac3b5", "comment": "Malware payload (GuLoader)", "value": "558b9d8b9009a8151f240edf916f161e", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459507, "uuid": "a7372107-e956-49a9-a0cb-487d2202a8c7", "comment": "Malware payload (GuLoader)", "value": "29d68e2c435b92c09ae5d6739626efb907565569e6faf27dc2f26753b05f22ea", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459507, "uuid": "3d3d547a-7c21-4454-afb4-556d642fb387", "comment": "Malware payload (GuLoader)", "value": "2b23ed531c49989215949fae278d04db93b3df2a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459507, "uuid": "691fd199-0858-4689-9273-89c2e2a8b8cf", "comment": "Malware payload (GuLoader)", "value": "5618fcb7220d0022dedcca0cef4eadef430fd259d735f290490f0b350726521ffad0645db7f6579366fd291def0cef91", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459507, "uuid": "3d10abc9-b471-4b1a-a8b9-789723560806", "value": "T134A3024FC28B3D44175E7675179EB15DEA43108C777EECEA7E11300A2AB64A097F3862", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459507, "uuid": "fce46b2a-880b-4cb7-8c57-135cf9e2b81e", "value": "3072:GwbXNr6dCXnJ1wg6kfZmzGQQnMnjZ29n0H:5pXJ1N6kfw+nMnjZYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629459507, "uuid": "14d573d7-d5d1-44c8-9f23-a163466c2a6c", "value": 99787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629459507, "uuid": "40018c6c-67da-40bf-966b-35e9699b9568", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459507, "uuid": "312d5a16-621a-48ff-8a0c-461356fa9cf1", "value": "List-Of-Items.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e64cd58-019c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629453165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453165, "uuid": "e49c9f16-70c5-42e8-92fd-8c7651648c1f", "comment": "Malware payload (Formbook)", "value": "76d795e5dbb981cd4a162897a4a67f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453165, "uuid": "0fff6816-df83-4db2-9efb-d8195fdc0d0b", "comment": "Malware payload (Formbook)", "value": "2ae08b5584e30abd315edad1daa90759d442646ade096f38b6534d00f69e811b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453165, "uuid": "44653406-846c-4f67-be93-9de6ec8b0671", "comment": "Malware payload (Formbook)", "value": "22c0eefac22fb1d84a496f259536a1e9e98ab403", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453165, "uuid": "c6c400b2-a434-4db2-8f81-c03084b6f4f5", "comment": "Malware payload (Formbook)", "value": "ea6d12fcf8705a3a73093efa1224adb10b0c6c65b137a5ce48b211db01e56b9bdbd16a7cda579aa3c72e694b1df01ac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453165, "uuid": "8200fbfe-1ce1-4be7-b652-902fe1963651", "value": "T1E945393D1AB91633D5B9C335EBE58423F148985FB401DE6A6CDE03A7021BA8735C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453165, "uuid": "b37c2d48-8c57-4434-a09e-45392bb97f99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453165, "uuid": "df633bbb-26a2-405e-a3ec-09d82ea84e94", "value": "24576:ysggzIMZnjxkixPiUa3xJGpYlhCZsGUyK:fggzIMfaUaBopEhiWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629453165, "uuid": "db45fa92-9c13-4541-ab6c-3bf195eb05ff", "value": 1184256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629453165, "uuid": "e6345b51-da40-43d4-8bf9-85793a2c4807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453165, "uuid": "a8e8e333-dcfb-4a3c-84d3-b2ec53731096", "value": "PD0yHYNXgwELCtP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9efda5-0210-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629502846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629502846, "uuid": "f13ff155-871a-4164-812e-3dba99682a07", "comment": "Malware payload", "value": "6477b8bac9784a94be8227f76c4be993", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629502846, "uuid": "509efbc1-7423-415d-b631-a8d0b22aabba", "comment": "Malware payload", "value": "2b041192446931cb21427643ee4dd908d8567fe4fdc19c477687b7de002a4fc3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629502846, "uuid": "984d89d1-14c6-4e61-8551-fe0cefe13634", "comment": "Malware payload", "value": "686cd932f64a2fc17b4ade961289c16ccfe91ddf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629502846, "uuid": "c18e24a3-4618-4536-9564-88ad3db38d84", "comment": "Malware payload", "value": "9acc3017e9a0f570312fd391d98d13716203098d381629cc6bac440f462239d5ad4434dfaafbcb3d4709c725199ad1f8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629502846, "uuid": "8bcb00d8-d243-48f2-bc14-1f2d1dee7dcf", "value": "T149C3BFDC604798E94F2E01EF81352CAF49DC0704E77238B675A12FD6B646A6E24E2C7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629502846, "uuid": "855c5572-f952-461c-a785-ea87401e5f48", "value": "3072:jj3ldlllfqf+RRsCyFB99ufjCCa1aaN0o2:jj3ldlll0+RRsCyF0fM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629502846, "uuid": "3f485568-a212-4f7e-83c0-852b55849358", "value": 120542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629502846, "uuid": "f9364483-8420-432c-8790-f704e5e005f1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629502846, "uuid": "73db5933-e269-4745-84ce-adc33f9afb39", "value": "20.08.2021_siparis.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ed4167-0179-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629438272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438272, "uuid": "0f7a9997-c987-474d-916a-d34e8920a6c8", "comment": "Malware payload (Loki)", "value": "228ae9f3b0b8e8b6591211a1eb72dd3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438272, "uuid": "3a5f42ee-2536-4585-a045-3d13aeab59e6", "comment": "Malware payload (Loki)", "value": "2b8ac768796de30803bc5bb6f116d39d0ee7843715b66b875d0942029d14e172", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438272, "uuid": "79aa53be-2621-4ea5-aa3a-c4d050f15f3c", "comment": "Malware payload (Loki)", "value": "210d71ccc2b1539b65fb07a4834fe04d777ad88d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438272, "uuid": "2a65a4b8-f493-4d25-a9be-9832e7c4a329", "comment": "Malware payload (Loki)", "value": "8e46d9903d0f7716009e3f699e6b877c1711e5a6f4da8368ad30a96037a73d90a0f96e23b67f4ee89fa0e2984a6127d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438272, "uuid": "93ff24c8-b5f5-4c64-87f1-b9362da66b20", "value": "T16335393D19B91633D4B9C375EBE59423F248985FB500EE696CDE03A7020BA8735C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438272, "uuid": "608758aa-6002-45e6-ab95-5e6661b9c0f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438272, "uuid": "3e26684a-0c0c-4ad5-a199-c302c182d580", "value": "12288:xMqVqAggzb7TrczsRNfhOo0p+vIn1gtx+XWboesoAK7zxkZsG8A6G738:xMIgg3MKNf7i6Sm2xesTK7zCZsGUys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438272, "uuid": "cd0ab870-03c5-42eb-8a90-3799bb499863", "value": 1157632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438272, "uuid": "57262d7e-dae9-4dcc-985a-e02a2acce688", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438272, "uuid": "43cc7daf-c111-4f9d-95c1-8a050e4a738c", "value": "QUOTAION#323456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2a93a4-017e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629440407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440407, "uuid": "f12e664b-fba7-4109-b479-129deb2e9c56", "comment": "Malware payload (njrat)", "value": "3e662698c2d8a1d81f2fc43ef11f6323", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440407, "uuid": "8a909b43-885a-4a34-8b22-e73db83d4cdf", "comment": "Malware payload (njrat)", "value": "2c33f517d20dd1082281903dc49449a704e1e7696f720373e1afc175c34549ce", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440407, "uuid": "406fd3cb-1f0b-4590-a6b5-6e29114162e7", "comment": "Malware payload (njrat)", "value": "8ce2d62a4490bacbbbdbc0363235e536561a7a81", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440407, "uuid": "049d8002-afd5-40e3-b310-4c35062501f0", "comment": "Malware payload (njrat)", "value": "2421a181b13184805aa152f53d2de6cf314c0182552728d2100a3b278a3d0a87840b02708dd30b196cad69f2e099f40d", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440407, "uuid": "a4dce3d0-d470-45bb-b22a-39c5811bd617", "value": "T1D011C0394CA58EBA0345D0B100878DCCDF20C7577798FE792834B4595D5CE3A5E8D90B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440407, "uuid": "c9c2b4eb-787a-4017-8515-7a19936dbd25", "value": "12:uhutV6Q77Nm+liuNounuAbZbGJA8kcXO2qvELJ7g3NnLd+KPj2T+TOM:uOV7Nm+liIpGScXO2qvEcNngKG+TOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440407, "uuid": "81cbdf54-f651-412d-9500-913536579aba", "value": 950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440407, "uuid": "47d3d27c-e778-49e6-9080-fffb4cb681c4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440407, "uuid": "3b5aa6b9-cde3-4497-814c-b9aa03f9cf0d", "value": "Xray _Result.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f6be0f-0154-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629422222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422222, "uuid": "af14b0dc-5ca7-4489-8e9b-f0875c5c469a", "comment": "Malware payload", "value": "3f07c2bd2b76cb7afd3824603678952c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422222, "uuid": "78842bda-df03-4724-8df0-1c055d5dc035", "comment": "Malware payload", "value": "2c3aa67b0f251e7d514529a8c9cbbae71e4ebbd2e289e7ec73a4b9adaa11bdc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422222, "uuid": "05716a3e-f730-4b11-abee-ef9997eaf80d", "comment": "Malware payload", "value": "ce8337fc70ae44f4430bc2ff3bb2bffe1742d88f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422222, "uuid": "5721e753-6c0c-4d9c-b5ff-c32e0c445543", "comment": "Malware payload", "value": "734f495e45dbe8ce6f7eae61c85a851b804357bc62ee36564e9e4348d7ce22c75f654c6c5a472ee5eb6c74cb1230cdbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422222, "uuid": "e9890ad0-31ee-4e2f-bf75-0b5e7a91dbff", "value": "T18CD4F1247354FA8EC06FCE3A85514C509BF1F2766707EB072DD312DDA9CE7994E222A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422222, "uuid": "c5f3df24-c794-40d8-9904-1b960a006e41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422222, "uuid": "7e5c917b-ac8a-43f6-8035-e819affba7db", "value": "12288:2LU3GOJqy3uVmuZ670ceTTFXGXIou2U1zKSGk2:2qDJqyIzce9x/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629422222, "uuid": "9df0cecc-16f6-4006-8616-e560065bde45", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629422222, "uuid": "ad227f11-6549-4f0b-a2c5-469aac223d9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422222, "uuid": "fbea4708-b4c9-4c05-b7a0-49a4bf53a131", "value": "Scan090290202_2021_9099388390000010.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db31ed2d-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424598, "uuid": "aba9ad69-da53-4880-af81-aa0cac1ba02a", "comment": "Malware payload (Mirai)", "value": "e2ef588eb7c51638cfae508cbbeb9022", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424598, "uuid": "9226ca2e-688f-48a8-860d-13e7c27d12f4", "comment": "Malware payload (Mirai)", "value": "303607e1418bfa141eb71c05385eb18a7c8a58701a10be66b3edac1c49cfe463", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424598, "uuid": "6f1439ab-cdb8-43d1-8066-26abe2335af3", "comment": "Malware payload (Mirai)", "value": "d4bd4c96925cf4a3cb2f46b531f9ff7d7309d89f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424598, "uuid": "beff9949-2dcd-464c-b563-4f214d1621d3", "comment": "Malware payload (Mirai)", "value": "7d291668538ac52f67ea38711e181391db673178389647e44cabc0c8c6866a3fe479ad9dec7f837e09564cde1dadc797", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424598, "uuid": "7b694fe0-b1d9-4865-bd8f-ac741316d7b6", "value": "T18AC2D06AD156BAE2DE6D6C094B89CBF073F43F87A36ADA1070C21751DF81633B2419C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424598, "uuid": "d77c8f51-073c-41a1-a01e-0f4faacdba20", "value": "768:XBy8hVALFuZZXYIInSqT5DTgWKjZkkHQQ7v4uVcqgw09Kd:kR8XUnhdgWKjZJHLv4u+qgw094", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424598, "uuid": "62045127-0727-45e8-b300-cf1b349a59ce", "value": 27864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424598, "uuid": "7c8dcd63-a141-49c0-9f74-3ffb8d8850e7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424598, "uuid": "2d355486-616b-4ae8-a137-c274e01bb393", "value": "e2ef588eb7c51638cfae508cbbeb9022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5207317b-01be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629467747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467747, "uuid": "5e2862f5-7c74-4234-a2db-68a1a767a33e", "comment": "Malware payload (RedLineStealer)", "value": "fb93137981cf5ba08d4ba71cc4062d6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467747, "uuid": "87663c92-6cf7-4f16-8895-a6a81dc45e2d", "comment": "Malware payload (RedLineStealer)", "value": "311b30440841f3abdf904d3603b3745a981a67358cdcf76055e8b225b7e3cd4a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467747, "uuid": "513af975-d7c7-4640-af69-5f279c91c24b", "comment": "Malware payload (RedLineStealer)", "value": "84a4fa4d1ebafc4fb66402d511ee7b3e77ac33d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467747, "uuid": "1a48a536-2906-4633-baa7-06f08a293803", "comment": "Malware payload (RedLineStealer)", "value": "7e979a7454acdf94f9a03b171fb857f0c8804ae590fb6c878a4fb2c8bef3abd202586173340edba1a72924d4495a2c40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467747, "uuid": "e4039aa1-1271-4c6f-8af9-1fda14c01c39", "value": "T1FCD420185A7FC016D1F7EAB12DDCA4BBD9A980E3644D793710A4633B4B92744EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467747, "uuid": "bb25531d-0e43-4544-a065-91a37d531c8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467747, "uuid": "2f1cb0cd-62ec-49f0-9444-9aeb4fee8b03", "value": "12288:Nkz1HiaMl35ZwXM5eA1Go/uN4DEDB8TQf5rqQHVf7bO/lvVWWoQFKGg:wHW13s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629467747, "uuid": "48de9d2d-01f4-4507-8ec8-7e87aedc8ba3", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629467747, "uuid": "e32a202e-066b-484c-a745-19be60790576", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467747, "uuid": "e2f0862b-81b6-4525-adae-10d9116b232a", "value": "fb93137981cf5ba08d4ba71cc4062d6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10e2478-01e6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629485140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485140, "uuid": "720bdace-b34b-4199-b614-71f871d87b96", "comment": "Malware payload (RaccoonStealer)", "value": "bb82154ddf072bae44707290fb656d0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485140, "uuid": "32d62ef6-2937-4607-ac17-f8d159563b61", "comment": "Malware payload (RaccoonStealer)", "value": "321b8f87df4dd22bdfc9631a0d84f39b90f16cd8ea0e72f4a1f70df4b39b3468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485140, "uuid": "e0b3cde6-7a6c-46b2-88fb-90068ad95dcd", "comment": "Malware payload (RaccoonStealer)", "value": "35b294eb4341aaa48365e72f6beb71974ed7680f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485140, "uuid": "5a7e1a82-d0ef-431a-b2e4-316608d9d56c", "comment": "Malware payload (RaccoonStealer)", "value": "e056b5aa0ac22966567d8b696bffea178e259c9680e043edf2ff1f322ebc8ad85b4e92e5c20cd54f1282c879db844fd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485140, "uuid": "1b9e1382-a593-4116-807d-f0c91467aa56", "value": "T18DE3AE21F4F4C072DC99457148558AA05E7EEC215BA442473EBF336EDF31290BA2AFA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485140, "uuid": "43cb1cdd-3d14-4757-8274-748e47d6d0ab", "value": "d9ba9c76f1c1b9698712bcd1010ec021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485140, "uuid": "fb0566b0-4080-4773-b6b6-2902fa77121f", "value": "3072:ZGhYdgJDtFMJLzo+lapRtZsnHIdq20ROvzgFnLmG:kDtFMJITZ8gqX2gFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629485140, "uuid": "732d4633-538d-4d2d-baaa-f961b17b191c", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629485140, "uuid": "e102f90c-8b0b-4619-8dd9-95f0e3aefdb1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485140, "uuid": "26d0e8f7-9d84-409b-ad12-603d51367681", "value": "bb82154ddf072bae44707290fb656d0a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd61fb30-016f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629434024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434024, "uuid": "6bbf0322-fee2-4820-80a6-740c5862d498", "comment": "Malware payload (RemcosRAT)", "value": "a6e611985b092115ff3b5545263fca15", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434024, "uuid": "61a79e71-4fd4-4c6e-b3ea-0f3847b1af75", "comment": "Malware payload (RemcosRAT)", "value": "32342ee32126fb3c4040b943485319eaadd4cc3cee6816075e09dd9d3db5bc11", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434024, "uuid": "9f8157f9-13e3-4ca1-b93d-9a4e08bbdaf7", "comment": "Malware payload (RemcosRAT)", "value": "4379329f270a15bcee5743ac73996793dc72ae8f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434024, "uuid": "eda4d9b6-3beb-4db5-9cc4-0382d47140c1", "comment": "Malware payload (RemcosRAT)", "value": "b5cf07127e563516c63428143875ef2971d607bbb36ba436d8f970078738290270d6ce3aad862fbb505b6cb413145236", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434024, "uuid": "4c25a5fb-7483-499c-a295-8cb55f3efbac", "value": "T18F758DDEE37FADF2C0464A35AB36821452227D113B69BC8AA7D24E5C1FFC541352BC86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434024, "uuid": "60eb3996-ce16-48d0-8ff5-62fc3e6a975b", "value": "12288:7q8SB+x3pPT30Sv6kGDbdYMqFMS7kLWa4H+NZ6rq436TD9dFSKt8Ed8Fj0RIRcDa:m5UzPT3Bv6L9kaDNZAcFSXvVRQyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629434024, "uuid": "3ad3c4b8-87bb-438e-889e-64891e7fea39", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629434024, "uuid": "95df4282-e95a-42fa-b03a-a358619674c7", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434024, "uuid": "e4f7a6e4-d213-4062-8f1d-f80787b49a2b", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da417b44-0157-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629423737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423737, "uuid": "6c34b494-3ff3-4c60-b943-1b6d96557915", "comment": "Malware payload (Gafgyt)", "value": "3ae38f1cd4add1d3650ce07c642ef85c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423737, "uuid": "c59f0753-55cc-4342-8709-730d6d82eacc", "comment": "Malware payload (Gafgyt)", "value": "333de9d40b8d14bb2667e597a8a382ece2602aafc433bcf53030982da3a59aab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423737, "uuid": "ed396435-2ea8-4419-9de3-feab1c6c4617", "comment": "Malware payload (Gafgyt)", "value": "3f1e260d4c20f79ad7fc0a603a9da58e523a13d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423737, "uuid": "d8f4df6a-3136-4384-85ed-a7d8244f1595", "comment": "Malware payload (Gafgyt)", "value": "316b9f6071c83e7053e1a1665d71b16c5888384b3f550ff2eeaff5f1606a45ae3f319914f625104f18d5e4408ccdab91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423737, "uuid": "3c576298-1c3a-4a24-a5c1-03ccb50e17cf", "value": "T188F31705D8905767C6E327BAF79E428E73231BEC97C7332149385EB42BC17992A79870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423737, "uuid": "fa74fd5e-a17d-49b1-8afd-2a9451761ff5", "value": "3072:8FfM8KdtpEeQOM/idHixMEIa7pd3WhuWDSB0DpX45hLwicWOAvNmyMQBYS2jV7:/HiJIa7/WhDpI5hLwHWOUmyMQBYS2jV7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629423737, "uuid": "7dbddac7-edd4-4746-8420-1cf220bad249", "value": 163941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629423737, "uuid": "4196cf3b-aded-4b3d-8e0f-191d77842eb3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423737, "uuid": "6fb7246e-3185-49ab-baef-974a906d03b7", "value": "3ae38f1cd4add1d3650ce07c642ef85c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f98cb310-0193-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629449560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449560, "uuid": "84e343c5-4126-44b5-8daf-6431cab13503", "comment": "Malware payload (Formbook)", "value": "898d523f4a9d9fffd9333d49654803c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449560, "uuid": "7594bc51-b490-4388-8ba0-eb09277dacef", "comment": "Malware payload (Formbook)", "value": "35010478a1deb14596e40b68bff541fdf1567b67116de6c8b3146f7352159420", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449560, "uuid": "36cfeadf-8b43-427b-8ce1-7146685870c3", "comment": "Malware payload (Formbook)", "value": "9ac7dd3397bfb869071c9b65ec582895b3b8cca9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449560, "uuid": "9c916293-c232-4cf7-94b8-5d7595337d10", "comment": "Malware payload (Formbook)", "value": "dba6143eb31b518d907486e20708715a4e36eac56adc0e2b1ffb19a615fefd6833dfeb9ea5222ea91ebfda4bae7e16ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449560, "uuid": "fca1aa0a-0697-4225-b92a-644047e90db0", "value": "T17DF38E36D642C030E2B252F5B2791BBB843E0D35325490E6E7E11AE16EF59E6F42931F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449560, "uuid": "6828c652-362c-4e78-a930-c1dade0e9595", "value": "3072:vcB2QPxS6zkPaYhTot67n+Kw1AwxOEcizcupyyirouT8:vVQPx+/1oto+313OEcizVyyiror", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629449560, "uuid": "deee45f3-5a5e-41ac-9465-5f4449916355", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629449560, "uuid": "f374001e-ef43-43c1-bcca-1973a6ed7102", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449560, "uuid": "fca4a02a-16b4-40c8-9482-87e56464c30b", "value": "moses.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba4ac5b-01c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629471977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471977, "uuid": "e7946367-9dce-44f8-b764-10f24303b7d1", "comment": "Malware payload (RedLineStealer)", "value": "8b756355ba79bab7795210437c784771", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471977, "uuid": "0526c31c-6157-49a3-aa15-3b4430d1f217", "comment": "Malware payload (RedLineStealer)", "value": "359f4c7c14a68ed5b0a07902ea3dd7f7a5d51672baa0460a12f2c52098e5d99c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471977, "uuid": "460390e0-2ef6-4bb0-ae68-218757f17e38", "comment": "Malware payload (RedLineStealer)", "value": "b788b6d7f37802333a4d9b3024c7aad517796356", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471977, "uuid": "c826cb1d-61fb-4bba-990c-765f47b5b386", "comment": "Malware payload (RedLineStealer)", "value": "6a3157df9409e229bacb6bf790fabdf061733579efcfec633de0e16b60152e041b942d55225b160fb312f08f6ae889e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471977, "uuid": "3d05a3cc-b34a-42f3-afd6-7e694b63a4a4", "value": "T17B44EF207A71C1B7C4634F3048A8C6D1E57AB9011B7546B73F4B26AF1E71391AA2AF3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471977, "uuid": "7aa7cc8e-f1d8-4b63-ac9b-91d5c5cbf1e7", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471977, "uuid": "e98e80e6-2599-4111-a85e-e963843837d2", "value": "6144:55Uk/MLjt8gXswsbMZV8bXXc5FPh/f7H4gFnL:rUk/sctm8b87Phn7LZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471977, "uuid": "defd21c7-cd83-43d1-9bac-7055a90245a0", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471977, "uuid": "eb560f81-7dcc-45b8-acb1-74cbcd8c7b57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471977, "uuid": "16244250-2f30-4c2e-ae29-98246b312333", "value": "8b756355ba79bab7795210437c784771.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d90dbb0-01d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629476786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476786, "uuid": "ae2d0830-bd57-4c3b-b36a-1f4b2ef8453f", "comment": "Malware payload (Mirai)", "value": "9e2bd190b8ad00a243f3b895257eb304", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476786, "uuid": "ba7b8b6d-58e1-4a38-9693-3998624db36f", "comment": "Malware payload (Mirai)", "value": "35bebd9e8f965983a2ba800c76f5e34cffd6cd009bfa97bce66abc32ba714b42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476786, "uuid": "a8051957-41cb-434e-988e-e29c4fe714ee", "comment": "Malware payload (Mirai)", "value": "13206c7ede254ea587ef979f17bf76eb73631beb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476786, "uuid": "eeaf9a1f-36c3-4799-a237-f9e8e37b4c1e", "comment": "Malware payload (Mirai)", "value": "2a2521838af22d0906230d42ba9c0ec10f4dac693603b1bb8322dbf15cd23bf32350799d03ac5d2c97fbc697edd9be72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476786, "uuid": "fa57db19-ba02-4ef8-98a0-89873ef92f07", "value": "T137A3B51E7E259FBCF799823947B78E21979433C62AE1D141E15CEA015EB024E381FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476786, "uuid": "34c805bc-63f6-46a1-801b-47802a7c2a35", "value": "1536:oXuCluC9KSv4LhusM3lVq5tvzVrANVVRuAfj7naIx6z+JrS+Q8a:ouCISv0A3q5tvzVENZuAfj7naIx6Kc8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629476786, "uuid": "3c877af6-734c-4606-ae0c-9ec302e35a23", "value": 97816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629476786, "uuid": "21504c20-dd33-40d5-bc6c-2613ca14d83f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476786, "uuid": "3e40f45b-db5c-4bc1-8045-cedb00ab03fb", "value": "9e2bd190b8ad00a243f3b895257eb304", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8f863d-01be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629467707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467707, "uuid": "4a2c40cf-e536-44e2-9071-cc4a65c33444", "comment": "Malware payload (RemcosRAT)", "value": "750b82e17ffc95f0d1cbfe4a1ef7a18b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467707, "uuid": "1ac53375-a82c-46d0-84a3-481014db1374", "comment": "Malware payload (RemcosRAT)", "value": "3650a6db5c9e0c37b7d1b69de83f448829d9c94dc4410404dc20a29bd6942014", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467707, "uuid": "901b082b-d7e9-4b2f-8802-bf39ca4e23f8", "comment": "Malware payload (RemcosRAT)", "value": "01a0f4ae8f8b01a32693e44644859ed981588d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467707, "uuid": "35d3b6ed-f705-499a-b76b-eb44b7ba596d", "comment": "Malware payload (RemcosRAT)", "value": "4a0232ccaba76931d1eb984983b85366eb24455502fe3b2c3bc16cea8659eb7ea708d85297ffb391d6f563e14b9c1997", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467707, "uuid": "4a446773-bbd5-4c21-98fd-5c272933447d", "value": "T19B359D63B1824933E2232978EC7F577A053AFA233E65A9852BF91C9DCE752443C35316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467707, "uuid": "19e233ee-9dc0-4ec2-a0fd-6b90ed919d67", "value": "61da5f388fb525c6541a6c21304d4040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467707, "uuid": "40d12756-031a-4b8f-a733-567363542ab5", "value": "12288:VnCFpZeB7uGHKKaWU8drn/1iNyhpyv0oM+6yRXOuDvrq8EU0th6gq1t:VnWpBGHK4Um1dXq0oXec959n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629467707, "uuid": "ea6606be-0f3c-4cd3-a2c7-ffc4d419dfb5", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629467707, "uuid": "d68c9b74-0b32-4d8c-a14b-b5e897f45e3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467707, "uuid": "a6538b10-058e-4bba-bf77-38931f80b10e", "value": "RFQ NV76767986553 (DRINGEND),pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7968a52-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629424619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424619, "uuid": "2f522c01-bb60-4129-a3bd-fbb8b559fffc", "comment": "Malware payload (Gafgyt)", "value": "efd858081eeb1698be37491547c8ecbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424619, "uuid": "308f9c88-9572-41f4-be5c-01fd6e6d6a1c", "comment": "Malware payload (Gafgyt)", "value": "3661a5aba61308242de4c63f89ceb032428cfbc1bdec68130c7141651888102a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424619, "uuid": "4e197a20-eee5-4674-80c8-457888454b77", "comment": "Malware payload (Gafgyt)", "value": "93ed6ef0d9912a25e3b6cf8a7e8946b2854e4b2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424619, "uuid": "080dfab6-df12-4b08-96e9-bf1af98509c8", "comment": "Malware payload (Gafgyt)", "value": "844724b59bd293260e0f49e89240155a56461461f78be0588b8de07430b23ca1a7c47a06146380977d01fd3a715d963c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424619, "uuid": "d44f68b5-c1a7-4752-9e56-8e16702c0cf3", "value": "T1DFE3F704E8485767C3E367BAF79E438D773216EC67D333115A386DB42BC2B982A39560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424619, "uuid": "db7a2645-8fa3-49ae-81e6-e3e0063b9d8c", "value": "3072:JEDfcOlkmQCnoV14qQls0Kh3VKcxYNR5hL/lvxB14bojdQQkhM4ZAvR8:YsN3vYNR5hL/lvYojdQQkhM4ZAvR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424619, "uuid": "794202aa-da1d-4e59-9396-bde6f183c503", "value": 150787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424619, "uuid": "db87989a-6c93-419c-ac36-5c32372ebf18", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424619, "uuid": "8df7a293-c526-4c5a-ba23-5237773cad73", "value": "efd858081eeb1698be37491547c8ecbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05092f6-0179-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629438297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438297, "uuid": "06e65d34-727e-4368-82d2-d4c2d1b69361", "comment": "Malware payload (AgentTesla)", "value": "3469051880036b70db514e70a210e950", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438297, "uuid": "228541ca-c6d5-41a6-999f-7df689f15eaf", "comment": "Malware payload (AgentTesla)", "value": "3778f802cc311fcb6684a896b7b9d014d4ab469f438368830c96d502462efa3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438297, "uuid": "dd130d5a-7446-44d8-b641-cc97bc09e46c", "comment": "Malware payload (AgentTesla)", "value": "4ce90d4186d306a186c1aefb1145584a2197a6a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438297, "uuid": "e5b8a9b0-56b0-4f55-b36d-ca4014663e38", "comment": "Malware payload (AgentTesla)", "value": "d065d583d6292a76850784207cb0ffa9709ade46a6d5bc4770b99dc64e973ab44fd184f166326691cd432184d3ea19ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438297, "uuid": "16fa82d6-fa54-4d2b-9633-26e89ae3a5bf", "value": "T16CB423066642654C2EC620EF9BAD334BE405FAE8416064EC180EFDD563ED3FFA902DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438297, "uuid": "f64a5c28-c4b3-44a6-92e0-d9aa01bff605", "value": "12288:knTdbmj8UGvZY78YaCmAqCh53zOEoz2VQHNFnUBiO:knTdbC8U+y78YaCnZozxNFUBj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438297, "uuid": "b3aadd5e-f5ea-40d7-8fb7-2c061c53c1b8", "value": 505899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438297, "uuid": "d614f5b6-2aec-4c35-8ab6-feda330db5f8", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438297, "uuid": "7f611695-c186-458b-bed4-e071c30e8d58", "value": "overdue invoice pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f98bb5e-019d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629453543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453543, "uuid": "aa3b1b04-6494-4fc0-a363-6d92d15f88ae", "comment": "Malware payload", "value": "c8557268007f20f9ed1f206b85d30a99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453543, "uuid": "b135bbb4-85f0-4a0a-a892-ffb8a3a881e0", "comment": "Malware payload", "value": "37871ec354ede70797f7a39a90a5d45685f93e930cf99763b39adc029c7d9cbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453543, "uuid": "5d11eca9-f74b-44b6-9508-501473a6866e", "comment": "Malware payload", "value": "e55ad6cd392fbe9b8459790b1794ae7a5472e000", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453543, "uuid": "056dbeb4-255b-4d7a-b878-af6883bdca7e", "comment": "Malware payload", "value": "82e070fd9cd0dbd4803fcc1bb16c2db94bf9e1b8b205e7929373950853438f3658c3c17a3cae2416e4aabd072fe8792b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453543, "uuid": "55a35aee-7c8d-4604-ab6f-c47ff15740d9", "value": "T14C352A6D37407ACFC427CE3689685C24EBA0787B570FD603A05322ED9A6DA97DF150E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453543, "uuid": "b7c09fea-7f21-46cb-ac05-4cb1dfd55106", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453543, "uuid": "a6ea1c33-14b9-48bf-a2ed-fdd2230b959c", "value": "12288:Dna7gsDr7U0KPUWhLZZAdbAEyTvy8CBZLgIxXKDrvGn9R742U3K/M0T8sEvqd031:DacsDr7UdMaZZAgItKHqb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629453543, "uuid": "84d5321b-c35c-4be9-a207-db469271d198", "value": 1113600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629453543, "uuid": "aaff929f-e275-4088-8841-0bd3834b63e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453543, "uuid": "3eb4e3e2-5469-4855-a9a0-4b2d5dd4a436", "value": "c8557268007f20f9ed1f206b85d30a99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6707122-01ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629495913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629495913, "uuid": "0b8516fb-1441-441a-9eb7-6b07b4b5453e", "comment": "Malware payload", "value": "446637e3ae69f3bc221b8be9c410f3b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629495913, "uuid": "cc18fd88-3102-49fa-80ce-bd44d1f4866c", "comment": "Malware payload", "value": "38df33e5620212d6d993610a8cf2f8620e18c91266cde9773072cb53f98a7dbd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629495913, "uuid": "1a0e51e7-1884-4f4e-98ec-f84eeaadbe75", "comment": "Malware payload", "value": "c066029209e5315749e6143832a9feeae2080ecc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629495913, "uuid": "bfb795f1-5ab5-4a95-836c-96ef2246c7c1", "comment": "Malware payload", "value": "42ea906473a51bf025bc87677ae90b5d4455333d6dfe8fe2b72d03b619679f65fbed3e286a117708cf10d143fcfb2eee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629495913, "uuid": "ca57680c-7d9c-415c-9ed2-10f1f4024db2", "value": "T19EF31A2263ECEB1AF7BD0B3568B0111587F0A08B3411EB5A4EC174FADD7F7816944AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629495913, "uuid": "5791588d-5006-49a8-b3e1-94e804b5e35b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629495913, "uuid": "5a8fcd73-cacf-4518-98cb-cb4a1a5f7597", "value": "1536:lo6aGLDCpep+NSHuk7DoRxA5au4wRUgbue7vguv+yAsdYcetx5RE3G6WAaoigX:ldx/CsD1J4DgJ3guGyddgNWNH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629495913, "uuid": "f5bc1a1c-6878-40e9-b744-964440dd40ca", "value": 160768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629495913, "uuid": "fc50bf02-77be-4ebc-a52b-031e3dd64d67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629495913, "uuid": "c77d2a8c-8e45-4169-ba9a-f63fc3aeb911", "value": "446637e3ae69f3bc221b8be9c410f3b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7cc4fd-01fa-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629493591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629493591, "uuid": "3511ec6b-e006-44d8-8911-4673ac5f8f72", "comment": "Malware payload", "value": "b0cdc459012aae2a5210da376f5df3e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629493591, "uuid": "45c3790f-d7e1-4cde-86a3-8d252b88f003", "comment": "Malware payload", "value": "3a83e58f8dc0015d65374b7715f89acf15ff08c82837c8f6f66f64db21732644", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629493591, "uuid": "eda5d710-0441-40ce-8ac9-533bbe1ba36a", "comment": "Malware payload", "value": "39a75f5e2ef88432c1d0f4ccdf9109697f0a8a3b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629493591, "uuid": "82c0448b-e092-48b1-ab4a-a935bb799ba5", "comment": "Malware payload", "value": "6865488cd3bf7dc51a047338d3886b30ae749156269550778d241f1eb1ed9a59e3e8fb645818ab587f60bb9431e80020", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629493591, "uuid": "39909112-f548-40d3-b5e4-14507a667053", "value": "T131A32A2263ACCA29F7BE0A366470012587F1E0CF6412E75E5EC1B4DA1E767826644FF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629493591, "uuid": "671edc32-a7ca-4cef-a9c9-5bf0a1b7c1bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629493591, "uuid": "993bb684-1487-4032-b38e-5ecdf279a356", "value": "1536:oo6aG7DCbgQjHVub5NWRSBoh56oauEw0gbue7vNuvNyAsdy6etx5REbG6WAaoigL:odxvCpMbyRsB7G3NulyddENWBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629493591, "uuid": "4bdebbc3-f3ae-4bc4-b089-c944145038de", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629493591, "uuid": "ed978d5a-1441-4b72-89a2-d277d2b2cde4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629493591, "uuid": "2bc19bd0-216c-47bf-bb63-18664d5ec396", "value": "b0cdc459012aae2a5210da376f5df3e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3236556-01aa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629459347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459347, "uuid": "9fb2911c-8025-4c98-b3eb-19bdac25a65a", "comment": "Malware payload (DiamondFox)", "value": "ad1ca7ff685a17765d86adb4105b7bd7", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459347, "uuid": "03f6721f-d05e-47a5-bc3f-169bdc1fc8ef", "comment": "Malware payload (DiamondFox)", "value": "3b15547e53d7254ec42974dc5a1d7b72cffd722a41114944b5606a845be7b76d", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459347, "uuid": "e952368d-3c06-4cd5-a25d-fa756667dbb4", "comment": "Malware payload (DiamondFox)", "value": "96291cf1ce155f393919965359de528b2d661186", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459347, "uuid": "fce02cba-328c-46fc-9f36-0b23b493396c", "comment": "Malware payload (DiamondFox)", "value": "4c5cc2bbbde11f7ad6ac8cca884e380ae7cea0f516248401d3fdbe522cc446005715194012ca02822db57ee0d463c598", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459347, "uuid": "3967e5d4-6b60-4c6b-8de9-3d0a747bb4e1", "value": "T1EF563301F5ECD8F8DAC2B1348EAC2BB689D9F20907BC19DB7791968D3F34951D54222E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459347, "uuid": "ee738fcf-2607-49b1-9572-4df32b23f5e7", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459347, "uuid": "9bdebed1-efad-4c4e-a036-11c76b4d3ec5", "value": "98304:x7CvLUBsgSqm9iwNZOmcJ9sTqEQxvTNDagiE6ixeZKjG/RrkIk8lfYhlB:xALUCghwNZvWDOTBKjgd/lf2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629459347, "uuid": "c8bf2c78-30a4-4183-9b2a-6e62cf00832d", "value": 5988139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629459347, "uuid": "0c77d15b-31cf-4144-9fa1-e32062169c4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459347, "uuid": "60ae18b0-6353-4423-907f-4bb7c13f4c62", "value": "ad1ca7ff685a17765d86adb4105b7bd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a412fa6-01c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629471921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471921, "uuid": "282600b6-2f12-44ac-bc98-975e0833863e", "comment": "Malware payload (AgentTesla)", "value": "caee8a78b47ba3b6fb4fda0e14081ed6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471921, "uuid": "bf8a5153-1e9e-426e-9ebd-4904820803f7", "comment": "Malware payload (AgentTesla)", "value": "3b328b4944780b2e55f490e655a556978f0f6bacc57cdd01d06ea65258d58208", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471921, "uuid": "ede1db27-5006-4a35-be45-7cb80176f995", "comment": "Malware payload (AgentTesla)", "value": "f0512b65b02381f76965c96ba8da67e0967326f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471921, "uuid": "8897d2b5-b78b-4966-993a-001e5d54aebc", "comment": "Malware payload (AgentTesla)", "value": "88cbd2dc8ab8eb251f4e36e9f58529afb9d58fd45cc8a0b68fbb1cbba2ef5bb9782167d6e83a5c352e602ef02ec5a845", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471921, "uuid": "ecca55e4-4b79-47aa-b23f-b3392e872867", "value": "T17B25373C19B91637C1B5D375EBE48523F258985FB400EE69ADDE03A7031AA8734C726E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471921, "uuid": "00648706-7421-4bfa-a660-c4de4e1752e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471921, "uuid": "f6a94ff7-7b2c-4e4f-8f67-26710c247eea", "value": "24576:FGZDGGzJwH3oPpYFibOTjGUuvE+B4tI6PcPZeyBH:wZDRlq36p8ibOTjtzWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471921, "uuid": "cd4d3a48-1798-4e19-b8a4-dc27932befd4", "value": 1051136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471921, "uuid": "9dd8d1a5-dea0-46e3-a457-57b0eac76574", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471921, "uuid": "ac9bd1c4-cd3c-4c6b-9694-8a4cc50498d1", "value": "caee8a78b47ba3b6fb4fda0e14081ed6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1209a8f-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629424608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424608, "uuid": "1733c7fd-25d6-4731-ad48-3bf407b9df56", "comment": "Malware payload (RedLineStealer)", "value": "994b0bab7ff8444a2af843037db8ddb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424608, "uuid": "13b41a54-c8f3-401b-8b9b-879ccb6c8c33", "comment": "Malware payload (RedLineStealer)", "value": "3b3af3c0c0ccff93c1f62d0e00a25e76b856392c604e209f93e987a7a913a727", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424608, "uuid": "42550146-5b9e-4711-97f1-9d9b79224ef4", "comment": "Malware payload (RedLineStealer)", "value": "a0570a216c8503c416de8fdadf69aa8c8e20a447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424608, "uuid": "c3f4eb31-1bf6-4597-b213-d864335ec37a", "comment": "Malware payload (RedLineStealer)", "value": "cc2b73e00a32b4556ba02d0f82e0e074d2259abf9a706274e5d5ca9a5d1516b4aaa9f688421ad9e63f4cba6a1a760ed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424608, "uuid": "cc2ccaf3-8cad-45b8-a99f-30ef68a22813", "value": "T10A263342B2D780FAE9975136EB685B3622B9C2A419B840D37340DF2CAF344F2D73566D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424608, "uuid": "ce10166d-c51f-4e82-bc8d-72db62115b19", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424608, "uuid": "be246ffe-45c7-45db-9830-25779e9d814d", "value": "98304:xsCvLUBsgVWV1isl2OuKtda5UimgQb8Q6uNQYZO:xxLUCgVU1io29KIUimb8Ru6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424608, "uuid": "93c3b23b-3165-4b33-9f5b-502a51bba204", "value": 4472894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424608, "uuid": "d98a4ac8-f3c1-4086-aee2-fd099d4e98da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424608, "uuid": "4c9ebe67-b51e-46ae-bd93-03f489755b15", "value": "994B0BAB7FF8444A2AF843037DB8DDB5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b684a4ad-0193-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629449447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449447, "uuid": "d8a916ce-1253-44c7-9c08-9b1962235745", "comment": "Malware payload (njrat)", "value": "ac9479813dabcc000c2439c16e0379bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449447, "uuid": "557fa756-b0b2-46a4-96ae-0821b81cdbe8", "comment": "Malware payload (njrat)", "value": "3b4f4290b209eb1341fcf01a1a9252d2fa694cab67278bd431e6cc6d952fa60e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449447, "uuid": "a857443c-9124-4368-8e23-a7daf98dd897", "comment": "Malware payload (njrat)", "value": "38b159a9426b8da9700dcff2e03e753b0a594a88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449447, "uuid": "b3fabf2c-b28f-417a-ae7d-2bccf7abfcfa", "comment": "Malware payload (njrat)", "value": "2c24e937c5bdc8d5d07e38ae438e7413ee0ae024a3bac7456e157502770cb18e73dd2092a5506ab4646fb51f7c3fde5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449447, "uuid": "890d6b7e-9490-41d2-884a-e67307b4f180", "value": "T12EF22A4D7FE08168C9FD167B05B2D4230777E04B5E23DD0D8EF6A4AA37236C18B54AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449447, "uuid": "1f722999-0622-40fc-822e-7d87f5a9ebff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449447, "uuid": "feb083db-fcf6-4ad9-b96c-ebff72ffafc4", "value": "768:rE9QFZiCXH7k/EPywESkTrM+rMRa8Nugxt:rEgZiCXHgkywxks+gRJNz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629449447, "uuid": "a99647eb-15ad-47b4-95a5-ffabc5d7c8bf", "value": 36864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629449447, "uuid": "9905217d-0b53-4e3a-ad0a-c07836615e04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449447, "uuid": "7d5772a5-89bb-4ec8-86f3-161c5dae5708", "value": "ac9479813dabcc000c2439c16e0379bc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43d8e868-01e4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629484044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629484044, "uuid": "f45251eb-cdc0-47e2-995d-8b4cbc225f4d", "comment": "Malware payload", "value": "29d1bec4d39165cc2c1e193fced1c6c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629484044, "uuid": "3265816f-3fcc-46f8-b9e2-35f93318248a", "comment": "Malware payload", "value": "3b533b1f9b9976117438a4f3742cfb697b847cb81ee53045eb03f30c0a402196", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629484044, "uuid": "7fdbb007-e1c8-4735-bb42-2397ac5ea28f", "comment": "Malware payload", "value": "b8702cc7e9e4ce6d7fd4617713c2d201ef0a418b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629484044, "uuid": "e065daad-5570-48fa-8ec4-60d7b91a3c6e", "comment": "Malware payload", "value": "e66ccdefee479d1b1e663d902a2114e9f6d3cb91d88920cf102596a431e6f0395a17fbee844de850497193199ed7de82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629484044, "uuid": "0c279f40-5df5-49d3-83c5-3efd26041dfa", "value": "T1B41502697EA4BE4EC12B4D354EA16410E7F4D7221A07F303ADB70DEC5A5CEEA8E411D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629484044, "uuid": "47096ef3-4fed-45bc-97be-21467601e319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629484044, "uuid": "9ad53c88-ad50-4284-b335-af3f8f77599a", "value": "24576:/nv/iZPp0vCHQOYYMYwR3SoKbYlmnp+LdDM:/CZPSKwOk9RbKbYlmp+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629484044, "uuid": "db7d36ca-7a15-4873-940e-e4dac4a33812", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629484044, "uuid": "9640f987-ddba-45ec-bf1a-c40373849c26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629484044, "uuid": "5eef6321-b23f-42b9-9836-df4e4e07dbb3", "value": "copia de pago.pdf____________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0936fc-0154-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629422160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422160, "uuid": "0abdb894-3e6e-4846-b020-5ccaf4c1663e", "comment": "Malware payload (RaccoonStealer)", "value": "8dcc97027d77b67586b46d6ba571d2b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422160, "uuid": "a89e3ef5-d2a2-4953-bff8-4e21c0f638a6", "comment": "Malware payload (RaccoonStealer)", "value": "3bdaeb542939de272d46fa125a9fbfc4a2bb551c3a49c5fbb68d17c45a11446d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422160, "uuid": "5ef48e06-2179-46b6-a1fb-dd17a72dc53d", "comment": "Malware payload (RaccoonStealer)", "value": "ad22432eda3951e822f5a5ec37e66d503a4703eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422160, "uuid": "795e7f70-5c8d-4eb4-8e6a-ddd1cabc3ff4", "comment": "Malware payload (RaccoonStealer)", "value": "1c2ed1c7d2fcbf3af00f9a30b2389a13b861a94ade13aa0f133267d430147d5c39e08cd71636d1b413ff102508e11be5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422160, "uuid": "6089a63f-4af2-47dd-afe6-ed4becf1e6f7", "value": "T16875120B7B26052BF08948B41A7469FA0BBD8C37B1926C4FE754ED5804F1ACBB9C1277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422160, "uuid": "d4c69272-a4b7-481e-a74c-b08141a287e7", "value": "fb0fb8edc31fffe9bb05edbac608d5c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422160, "uuid": "98b2f652-7d74-4fd0-9f38-f7e6b58e4cfa", "value": "24576:i13JKz0ildRWDDD/I1bH1tORRC+ixrw3ORR1+h5LORR5+X1S:i15KzmD+T1toC+ixrw3o1+h5Lo5+X1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629422160, "uuid": "b4c9b0e6-b049-4c75-8680-75d383ba6177", "value": 1593344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629422160, "uuid": "a636008d-9d47-49fe-8b32-9b1ad2457e89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422160, "uuid": "a4990bcc-85f4-43e0-85a6-401776fa0121", "value": "8DCC97027D77B67586B46D6BA571D2B4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fc43e37-017f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629440577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440577, "uuid": "8ea63312-4e91-4d1c-bcb5-53632ef04bea", "comment": "Malware payload (DanaBot)", "value": "23d39eb713a310071bdfe9d05ae62a90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440577, "uuid": "d2b269c0-6fbe-4523-b95b-b680159845f9", "comment": "Malware payload (DanaBot)", "value": "3bdf70af77190546ce6cbd5ad5490b2b8ca087015c041cb188567211d5fe5cf0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440577, "uuid": "afdeb896-fa53-4cac-a660-1e17a696ed2c", "comment": "Malware payload (DanaBot)", "value": "c241342849db3be6e762776f8097bc674183a4f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440577, "uuid": "f5298b30-ff47-49d4-a0f7-58ec05757747", "comment": "Malware payload (DanaBot)", "value": "43cb34e66c27f43b5094a8a6267aabfc35273f3d66257bb117f88ed42f52e28d4cdf57e9739bdbb7f1c321df1f674030", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440577, "uuid": "97adace1-c01b-40d6-a7e0-9ebd23250965", "value": "T11035230ABBF9CB3BF5BB15390E712F575C92F9214925562B8200EFCA7C518128924BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440577, "uuid": "b460e9f9-9c6e-4a03-8055-66007907a1cd", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440577, "uuid": "3a496e79-f616-4cb6-b404-9d5dca9e6aa4", "value": "24576:zT1ZOukQnPSxzxXdjT6YQJG3EtzgklajHZTRvi030ZQPTSj:H1ZORQei80tzoR930aPTSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440577, "uuid": "4041dffc-ac93-44d9-802b-ffd4461a0b67", "value": 1113073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440577, "uuid": "43b20731-dddf-42f1-b49e-f2a9f7600c1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440577, "uuid": "f99c4fb8-f59d-460d-88d1-f2176e0bd199", "value": "23d39eb713a310071bdfe9d05ae62a90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98443f37-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629471730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471730, "uuid": "93e563c7-be2d-4b10-a068-2daaf7c14461", "comment": "Malware payload (Formbook)", "value": "8b636c98adc8828e0bfb3756c72d8ecc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471730, "uuid": "b9709f31-f340-462d-aa48-7520227d8d65", "comment": "Malware payload (Formbook)", "value": "3c75184f86f6231ed38be583a300e5af220f5d68654ea1fd56c833f333d0a589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471730, "uuid": "95825a18-a66c-4ec0-bc1d-23708606d49f", "comment": "Malware payload (Formbook)", "value": "db2bf07d5200ce08a1c97746034eb96e057895f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471730, "uuid": "5c6c9270-ec72-463b-adae-32bde78971b3", "comment": "Malware payload (Formbook)", "value": "70a93c8ae9caec1d54e509271edf848001068f0ee0e907bc51c2cbab8ba6faed6f5faa36921d268b6811bfe0f3e3d5d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471730, "uuid": "8f79829d-bf89-4fc9-9f6a-37d50827b403", "value": "T16CA5BE5072B4E710E87643F0D863D6F087B63C6AE86AE21F5D82BEDF7971B410652A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471730, "uuid": "94ec4a84-871f-4701-b2cf-f72e1118289c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471730, "uuid": "7521b6be-c8f9-4096-ae1d-aa762ab0cac8", "value": "49152:IQNQNQEQJQEQJQpQEQJQNQNQEQyQ1QGeNk5zGISQNQcb:IccnWnWsnWccnFiANkvScL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471730, "uuid": "4939b6cb-86d4-46db-b080-49885d9c06b9", "value": 2102784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471730, "uuid": "576ff84b-5e7f-47ae-8316-d10f1ba569b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471730, "uuid": "5f14d8b8-e64e-45b0-8fe1-a30bcfc5241f", "value": "8b636c98adc8828e0bfb3756c72d8ecc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a808259d-014d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629419358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419358, "uuid": "d57db86b-e3b9-40e3-acbd-a30204251584", "comment": "Malware payload (RedLineStealer)", "value": "bb2e98e725fd42de35f1e68c3f154f24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419358, "uuid": "78f70aa2-db31-47d6-b1aa-c04d1fa368fd", "comment": "Malware payload (RedLineStealer)", "value": "3d3e60e7c19e4774aba44e1f8d8bf52f58d2a46c73a486098101e1dc81875a5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419358, "uuid": "53469366-40ed-4528-ab9f-0c3afd9b635a", "comment": "Malware payload (RedLineStealer)", "value": "8c3c3106cf467c83c63121562aa07a0240d8554d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419358, "uuid": "0caf1ae6-d683-4db9-ac40-49521b421078", "comment": "Malware payload (RedLineStealer)", "value": "813f85a52b5eae8b8fa7922efd9f53fa8827509637b9ab457d862c6470db89f4cdd70a8215f1f8acd6883b8d50f7eb00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419358, "uuid": "6da61d7b-12ca-49d4-b8b2-fce8d413d208", "value": "T15525073C19BA2637D1B1D374EFE08413B148886FB9449EA56CEE43A7420B69274D367F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419358, "uuid": "b40a68da-8d19-41ee-8ed6-05b179d76a4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419358, "uuid": "f308b5fe-8fec-4aad-9f51-9a8a49586839", "value": "12288:iLuhej02L3Rumob4cu45Ale1myh0W8IV38PuuDGvkPfVzMXCLV4kVEpMOZ:iLK2L3EbRuzGhH82uNPfVdV4kVEpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629419358, "uuid": "c4ad3404-713b-49d5-9b71-f5f20b03ebf6", "value": 997888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629419358, "uuid": "62be220f-02ac-4857-8743-8aade1c1a215", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419358, "uuid": "b7b6583f-40a7-4e09-8b15-747f1188e549", "value": "bb2e98e725fd42de35f1e68c3f154f24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e462c3f-0158-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629424012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424012, "uuid": "dfefa8d6-d011-42a2-8977-557bd22d728e", "comment": "Malware payload (Gafgyt)", "value": "3569bfdbccaa9de1958c74f6f0ad410f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424012, "uuid": "1f6a1d51-3393-401b-8863-f710b0991e20", "comment": "Malware payload (Gafgyt)", "value": "3d99d0aa1cca30e81e465d9171ac37c92f87e04217df39ecc625152416bdb16e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424012, "uuid": "cc212621-2499-4600-b429-89e54e2797fd", "comment": "Malware payload (Gafgyt)", "value": "cf168149484675d8009caa3ad99c4419c328211e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424012, "uuid": "b9d57ccd-69dd-434f-8263-2f2234604143", "comment": "Malware payload (Gafgyt)", "value": "b01bcd1c1974edef34a4ffa05a65f4b8727b077a92c3da16d5486865dfe34b81630278c1b8753c1e24c12cab1a83b32f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424012, "uuid": "1870bba9-2e05-4560-973f-e6d996d8356b", "value": "T12904646F7A22AB7EE6A4963107F66FB0C35521E22391D352D12CD64C5EF228D1C4FB60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424012, "uuid": "55aacc6a-a716-4a83-bfa0-f3ed60b92db9", "value": "3072:N0tF6LKCQas+kria5h3REvOwAcfHxRxu6qb1cWgdh8:tYJWa5h3REvbAqHxRxu6qb1cWgdh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424012, "uuid": "2c1c0e52-4c16-4d44-8092-bf316e0a9cd9", "value": 187398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424012, "uuid": "9f0db21a-51d2-4f08-90e8-6bae18f924ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424012, "uuid": "01e8015c-0499-4869-90e5-4caf8589e104", "value": "3569bfdbccaa9de1958c74f6f0ad410f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a7020c-01ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629488768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488768, "uuid": "3c658d7b-e68e-4ca2-aa16-ab63b34ddea8", "comment": "Malware payload (RedLineStealer)", "value": "0e86a231689637b656a0764f2017d22f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488768, "uuid": "5f4d8201-e61b-4fe2-99f1-0831b2f7cb5b", "comment": "Malware payload (RedLineStealer)", "value": "3da0e424a6f1268f5682d59be1f83572479c28ca1fb7dab48d0b53220acef66e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488768, "uuid": "8fed49ce-1a00-4267-bd80-93620579204f", "comment": "Malware payload (RedLineStealer)", "value": "70954ef5b83a7b0cd9dca4542d63bf3a7dc7ac97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488768, "uuid": "17bd061b-2787-4041-8908-216a5f57004e", "comment": "Malware payload (RedLineStealer)", "value": "ed9a3b2c76730c20d2a92f26030eff4e5b46b185345be636aa46642a58bb758973edd0fc5278a02481cf1d0f78c3f490", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488768, "uuid": "9ca5a510-1b8c-477e-a006-7f910ec01ae3", "value": "T13615AE0F3919B990ECAA063A9CC742E527E25D012B66F26F3594FA3C2E353DDE705C94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488768, "uuid": "693a3976-e998-471c-80a0-903a229a173c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488768, "uuid": "2610bea7-ab7e-465b-bc1f-8c91cf9975af", "value": "12288:bsp0kUKA1PfP5k9FLRqYjtatql9MiwlDwhl6s5Ep7XzNwzVzTEVGp7K1k:bspuHaFLsqkqyEl68E5azVzwVBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629488768, "uuid": "34e21f41-bcbc-4129-80a3-58f9e1eb3b32", "value": 950024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629488768, "uuid": "d4178051-0b3a-44e8-afd8-c46a5f1c7702", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488768, "uuid": "3780567b-98d6-482f-8066-52d845718aa1", "value": "3da0e424a6f1268f5682d59be1f83572479c28ca1fb7d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f399e65a-01c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629472313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472313, "uuid": "84f5b0fb-3624-40a6-8dbc-56e6ddd6e3da", "comment": "Malware payload (RedLineStealer)", "value": "549d13312cefa7ec561948aaefca954e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472313, "uuid": "7c2693a1-f51f-4655-8373-6b47267f1649", "comment": "Malware payload (RedLineStealer)", "value": "3edf09675c8b5f71e38f659f50e7cbb5025cef595297424b0e553373312e6b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472313, "uuid": "6162a260-790f-4bea-8034-32938a7703ee", "comment": "Malware payload (RedLineStealer)", "value": "cdcd213c2ca5bfb5e054fea3cc5528f211b0f3a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472313, "uuid": "b329ff02-ec01-4ff7-9813-ea3830f938c2", "comment": "Malware payload (RedLineStealer)", "value": "0b35747d1896364ec81578d54803f72f74d723b7c761dbe5181296e96d57101447569c8a608cd976689c81c2a7b2e3a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472313, "uuid": "f930e035-314d-4eec-a73b-9d4925d4352c", "value": "T11F44F15179B1C373C083143048A2CAE1626AFE215FBA71473FA72A5F5F313919627F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472313, "uuid": "30974337-0146-40e0-9b07-26576f05befc", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472313, "uuid": "e63c0608-9512-4246-9f32-703c4da22fb9", "value": "3072:HsPpNOcdTtX2i57fPLMoGrYKlj9z8FFp0JxXcRB43V4LtwRWmQzgFnLmx:n4TtX2cWrYKj9gLp0J2oV4LFmSgFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629472313, "uuid": "bbf78a3f-224c-40b0-97e8-689444ebdce3", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629472313, "uuid": "b9e03afe-98d3-4e3e-8baa-2cf8cfa2145b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472313, "uuid": "22e10004-0d65-491f-8855-5a429942d4a5", "value": "3edf09675c8b5f71e38f659f50e7cbb5025cef5952974.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "844578d9-0162-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629428317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428317, "uuid": "bcf5ec70-9c82-4bc3-b2a7-3e03e02f97a7", "comment": "Malware payload (CryptBot)", "value": "71a9d91cfbd2cfa97dba3bcf47af4a4f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428317, "uuid": "84d9ba49-2dfc-48ab-811d-96a90813255a", "comment": "Malware payload (CryptBot)", "value": "3f03a1ba7c95be04ee555c6277ba4f70609f6f75e81c4ed7e0e630bc2e33c081", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428317, "uuid": "3ea895d8-eb95-41eb-928e-d48356438950", "comment": "Malware payload (CryptBot)", "value": "e9351cf7f8c362765edfa34cb1b70119b08dbf19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428317, "uuid": "08ed5cea-d120-46ec-a72c-5b18d726f5f8", "comment": "Malware payload (CryptBot)", "value": "651e107cae47d7a6af953ebbdeb3eeff1ff2793c754f5810cb9457bc2cbacd2e949d141eac88737626948ea12467e748", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428317, "uuid": "96dc34be-2252-4300-8921-27782f6d00cd", "value": "T18EB41234786E9376C8C25170481EFAB0882F79425E3E515777583B6F5E323A22A3B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428317, "uuid": "7daaa9b2-b18d-4ac6-b1fe-a69f23839b8b", "value": "3627f9b92d64ac467223f2af87166a04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428317, "uuid": "237ca7d0-5867-45e0-b54d-890723b0a66f", "value": "6144:PIn2LFH8IAwJ9BiS6eG6dfJ39YB1rDFK2qwfX0miJCHnt5f2YuMPIA:gn2L0+i1enfPEUfiFistQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629428317, "uuid": "8da942ee-acf7-43ac-9a3d-12b863462172", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629428317, "uuid": "d60883e2-cc9c-4c11-8ff9-3211d093a9b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428317, "uuid": "b0c901c3-d016-4d58-9002-5e3aeb14a3f4", "value": "71a9d91cfbd2cfa97dba3bcf47af4a4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1409797-0188-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629444714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444714, "uuid": "29a5d778-34e0-4527-8256-94ba66a4897b", "comment": "Malware payload (Formbook)", "value": "33b24c1c259b9a52fe3e4c423eb7d64c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444714, "uuid": "972540dc-8ae0-4583-8ac1-88b3f52b13de", "comment": "Malware payload (Formbook)", "value": "3f8cd22d1b3b93b4884c70e6a9c032d2d7e2bb341db8ea85d4c86b1d0e5cfaf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444714, "uuid": "b8e69519-1145-4720-82d4-725c8c979e3c", "comment": "Malware payload (Formbook)", "value": "e43c54b1e82f4adde71add116e022cea34972457", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444714, "uuid": "8b1d38cb-0dc4-493a-a884-d0f62aca6c63", "comment": "Malware payload (Formbook)", "value": "7a16edef1a44fcf3677aeec149de717f42af49343618652f49fe9fd82fc5579db94f342d42fe2e586cfaf93cba63ec67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444714, "uuid": "03fca462-d368-485c-b325-e5d5a9e0d139", "value": "T13FF40215B740AB4FC96F8E36D8614C00DBB2E2775707E3476C9315EC99CF6898B272A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444714, "uuid": "590333fc-dece-40a1-86c0-014a84d77f94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444714, "uuid": "68dbd6fd-c6a7-42d2-a497-54ffca81ad53", "value": "12288:3jBIwBFD4RgUpDV/ZQfpYvOitf44xGXwX3Q2PHvFiezfTocBcbtgJiO5H97TiLDx:FIgF8CmAfTitYwQSxbTocBWIH9fiL4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444714, "uuid": "22031024-2047-4d0f-a106-2d3759ba7050", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444714, "uuid": "111a7d61-6e42-4222-a0c0-c2ee2ca0e868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444714, "uuid": "80ca5de9-7a40-4f61-b0c2-0cb6b9e6ef7c", "value": "33b24c1c259b9a52fe3e4c423eb7d64c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6a3e6a-0157-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629423744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423744, "uuid": "17e51f06-812d-4b45-9c16-92efacacfe40", "comment": "Malware payload (Mirai)", "value": "5e4aeb1021f9d0552634782db689bccd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423744, "uuid": "33999ad2-9a09-4b61-bde7-6df77d61f4db", "comment": "Malware payload (Mirai)", "value": "40b2958da8687040710f6d1fdd763138937679f36cfbd5cd31ff5aa9e4e79836", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423744, "uuid": "b92d4102-cdf3-4b52-8c9b-c0bb34e03814", "comment": "Malware payload (Mirai)", "value": "3b5711c34b7c5e6c2be6d0fc74c86216395dba08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423744, "uuid": "757ef563-764f-4992-ad4f-4a66a7ea21f3", "comment": "Malware payload (Mirai)", "value": "e5052a4b00dbcb38d92a116a0c3db9aa5f2c08de401f51c43a4bcb240708478b7a2ede2a57f4bfef9218a864c24de92b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423744, "uuid": "21346edc-f04c-4946-924d-88e4ebdd47a3", "value": "T144330991B9824E6AC9D513BBBA6E55CE331063E4D1CF7313D8201B543ACA51F0E6BF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423744, "uuid": "2502d739-5930-4675-a568-e2cc812e2abb", "value": "1536:CM6A0Y6wggbL6DCgz7P7BWy4LpEyT1GaBy21TNA:mxwgKLAC0r7gzLuyT1xs2VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629423744, "uuid": "e70492bf-2b57-4d62-9f33-f5ee188536f5", "value": 50800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629423744, "uuid": "8ed0c8d1-430a-445b-be0e-6745603cf0f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423744, "uuid": "172b3e3c-15ed-4a84-88fc-d3efc5be0f5e", "value": "5e4aeb1021f9d0552634782db689bccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b5f8060-01ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629488835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488835, "uuid": "fe98369f-bed2-496d-8688-9098d9e85f64", "comment": "Malware payload (RedLineStealer)", "value": "213f82871cb2d2a27cc6f543f47e8745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488835, "uuid": "73fb5ae4-7f4b-4198-b7aa-cc32f689ac55", "comment": "Malware payload (RedLineStealer)", "value": "41583d50aa4458788132cb26c1dc83a135d419b70e29efed30217f797d6a13ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488835, "uuid": "4c03d6aa-3d36-4771-911d-1e33175c5a8e", "comment": "Malware payload (RedLineStealer)", "value": "f8eb03e8fa1a9308a0b73fa14b5054b7dcf511cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488835, "uuid": "6fb6d97e-6189-4f39-b51a-5c085c847209", "comment": "Malware payload (RedLineStealer)", "value": "a4de8c80046daa828b2617424c066d3ae3dcfd7daf68e3f1d787399bdb91a795eb16e8acda3eb675f8914a5c8f8f0c5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488835, "uuid": "5e672132-eb18-433a-8f2e-1e371f0d7c88", "value": "T17BA33B3663ECC629F3BE0A366870021587F1E0CB6401E75B5EC274EA5E767826548BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488835, "uuid": "cf6d0a1c-7e20-4205-add4-ea68e97a9fb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488835, "uuid": "eee03ab0-132f-40bf-aaff-4fda0cb07051", "value": "1536:xTo6aG7RC1g29Vt5ND+OcoRQMau7wdgbue7vuuv4yAsdxgRetx5RE7G6WAaoig9:9dxtCvv/+3cd3uuQyddyENWht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629488835, "uuid": "dbd226b5-600c-40c0-898f-4b0b94da3b14", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629488835, "uuid": "11e6a543-dc25-49e9-b21f-168bd8ae7a86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488835, "uuid": "56f8b69c-3275-420f-8ad3-ec6edd3d4cd6", "value": "41583d50aa4458788132cb26c1dc83a135d419b70e29e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1432f67-01f6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629492039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492039, "uuid": "8b96eb89-e230-4123-9817-3862554eae51", "comment": "Malware payload (RaccoonStealer)", "value": "45a47d815f2291bc7fc0112d36aaad83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492039, "uuid": "9d202529-5da3-40a9-a1b7-2f708ba88bf3", "comment": "Malware payload (RaccoonStealer)", "value": "416e63fb614101d5644592d5f589f358f8d5a41dd6812a717cbf05470864ac6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492039, "uuid": "c2496473-0714-4dd2-bda0-16774c943f42", "comment": "Malware payload (RaccoonStealer)", "value": "db1dc02b2d64c4c3db89b5df3124dd87d43059d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492039, "uuid": "17bffd27-1c05-4cd3-9d2b-d995d0582ef2", "comment": "Malware payload (RaccoonStealer)", "value": "8d4f5cb3792f20bfef792bd70a3fb79f300a844aefcaca08b29c3fc83164af3d266957538c187c842f054c372127ef39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492039, "uuid": "e2707437-ae63-4d18-8fa6-48a0d7add854", "value": "T172F1D506B7E90737DCBE4B7E98B3471053B2E7154D12CB1E58C8825E6CA27140EA2BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492039, "uuid": "7aba675f-0de1-4902-85a3-a39056396919", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492039, "uuid": "9df9158d-c629-4622-9569-6a597352afa3", "value": "96:gJOElmu1B9ilJJMOfEkdEKozt1ExQf8cqkTzNt:gLkJwGE3Eez1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629492039, "uuid": "2e4a4175-d3d1-4d54-a371-497f7349fa74", "value": 8192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629492039, "uuid": "d89235d1-e832-4eb8-b82e-e2ad9db9bc82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492039, "uuid": "ce2ae607-2c30-45db-905f-4cefdc0d1e6e", "value": "45A47D815F2291BC7FC0112D36AAAD83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400e8e19-01ed-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629487903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629487903, "uuid": "d4a8fd8b-b99e-424f-ba6b-edba556fe5d5", "comment": "Malware payload (RedLineStealer)", "value": "20e9069cee1f45478ad701e6591959c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629487903, "uuid": "5d471ca0-e126-41ec-9865-da6f84156d13", "comment": "Malware payload (RedLineStealer)", "value": "427d73d80919455ae07701d2a84e6b242ea2ecc0adc345648bc3f236ffb6cb9a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629487903, "uuid": "2c4cfeb5-5eca-403d-aca2-cb05eba298e6", "comment": "Malware payload (RedLineStealer)", "value": "1b555ff58a7b6d6899148dff7b7049d5f5a416fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629487903, "uuid": "777e8f10-53f6-4a33-8b86-72d54d55a9ef", "comment": "Malware payload (RedLineStealer)", "value": "aefd1810758ec5c704788ca39d78fca1a53e09db4699f7e57909b9a051f84a3ddb0495536934f96c4969dcfd79a3d703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629487903, "uuid": "64bf4e4d-370a-446c-97ae-aa3bfd52b6f7", "value": "T1C9D4FE1865BFC016D0F7EAB12DDCA8BBD9A994E3640D793710A4633B4B51784EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629487903, "uuid": "cc528ce1-6de1-450d-99a0-ba1ff8941775", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629487903, "uuid": "916e52fc-ecd4-4d22-9ba9-40b8ff3a6bc6", "value": "12288:ZkpcDcjzR5eA1Go0LARSRnl302dN+CP9VqbO/IPfHpKLy/:LDcjzh13kO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629487903, "uuid": "f8a47b18-719f-4905-b4fc-596d4adcecfc", "value": 626560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629487903, "uuid": "5f1c0b4e-a2ef-4146-b1c0-a95d9e4a84c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629487903, "uuid": "86297f7f-4b64-4aa4-92b0-df12aa3c59db", "value": "20e9069cee1f45478ad701e6591959c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ca3369-0188-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629444559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444559, "uuid": "e5b93f14-520f-4f1d-ba97-d451a9a5737a", "comment": "Malware payload", "value": "7714deedb24c3dcfa81dc660dd383492", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444559, "uuid": "8fd25378-f514-4d00-a567-d8606df33d80", "comment": "Malware payload", "value": "435badbad2fc138245a4771a74ebb9075658e294d1bcfcf191ccea466eea825c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444559, "uuid": "ec2dfe6b-80b7-420d-b1c7-9a7b94ed2568", "comment": "Malware payload", "value": "56fae3ab1186009430e175c73b914c77ed714cc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444559, "uuid": "fbed64ec-ba47-4c10-a2f8-4c3db422804a", "comment": "Malware payload", "value": "a67700e66b60ae76e36d080bbe7c5d80c8641d40ff81877d114fe1d5f3902d2f43070d1ec7d835f7fdf9c957bfb82bdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444559, "uuid": "fa68fee6-f424-4fe8-b076-d5dabc7754fc", "value": "T15C159E4BF36042FAD06F513089CBC677E7B076A91A35A72F4290D9DD2F339126F1AA11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444559, "uuid": "50486c93-2a10-494b-9b30-046890b43d5b", "value": "045715ac29c84a0e47dab339e337bc06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444559, "uuid": "eee47c18-ec43-4b15-9067-1042d66ebd76", "value": "12288:jx1vJUpzeLkTqhqeEmC7QOZGafeei7fqiHf:H2zIkTgqeEVQO5fess", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444559, "uuid": "fd4429f6-e609-4242-8628-2a19b74f4ac5", "value": 922112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444559, "uuid": "0717eaac-3394-4cf2-8eac-dfe40656db18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444559, "uuid": "ea2bf8eb-b5a8-485d-b139-221b089e1420", "value": "7714deedb24c3dcfa81dc660dd383492.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29222a15-01db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629480134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480134, "uuid": "be9426f5-413f-44d0-ba74-3a18b93cafb3", "comment": "Malware payload (Mirai)", "value": "df0da470004e4729fe25bd9f9c179987", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480134, "uuid": "d4e11b5d-ebeb-4dcb-b472-30118af9918a", "comment": "Malware payload (Mirai)", "value": "4362f1f5bc00164a23ef837e4a06c44d8e5dc44b7329857efbd2bea50bf7fa84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480134, "uuid": "be359db8-da81-4543-87dc-c8e57d1a3d3d", "comment": "Malware payload (Mirai)", "value": "51f95456849a9a850b99637bc2a7d5be1f52a7db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480134, "uuid": "f3bfb5b5-3142-4c17-921c-85888b86c6e3", "comment": "Malware payload (Mirai)", "value": "fd9974bc3579442121bb4a28855e96467c26c691beb7894a2d3084e40ee59ddc45b9412b157a4070389420daf04c06a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480134, "uuid": "2e3856a7-54bf-470d-a911-89eda067536b", "value": "T10503F2DA1B15D4A3CD6A70FC6C6D12E0B26CF13B519E3711A23C55713224B778EA7414", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480134, "uuid": "2316b805-846f-4b91-908f-876b8a42a638", "value": "768:HvvJLlM3upyFujoeo5HEEqdHSlEehFiEHnW/nW11vWP:HXrEYodejdHgFRF1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629480134, "uuid": "33c3187f-2fce-46aa-809a-64790d07802c", "value": 38164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629480134, "uuid": "7748114a-0145-4cbd-b9b4-43f58379d20e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480134, "uuid": "6014399c-dc56-4332-8962-97901059dc0d", "value": "df0da470004e4729fe25bd9f9c179987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a203a9dd-0155-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629422784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422784, "uuid": "dcba73a6-9ff4-424c-bfda-2a05929c5262", "comment": "Malware payload (BitRAT)", "value": "86009042a75c710296312488dcfcfc70", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422784, "uuid": "9bd4cbc4-092b-49d8-9bd1-661e872ce380", "comment": "Malware payload (BitRAT)", "value": "4363f2046d4166b7b774500e8e4df6047dd4ff321131bba97388b81631ab595a", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422784, "uuid": "048c0ebc-b850-42ed-a25d-6a0976ba0a99", "comment": "Malware payload (BitRAT)", "value": "3f92a7e460334b7eb1c86e50d9425ed386572f64", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422784, "uuid": "ec728882-e9a4-400b-b150-d082227ce187", "comment": "Malware payload (BitRAT)", "value": "aa2729e0ac4f060348db70141f231074d1748a89ba378df9c09ae32a40ef55601920ddc267563be7ab91f4c2cbee53da", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422784, "uuid": "edae8c2b-5608-41e9-bef3-8a0749510c5a", "value": "T182B5021477C48E22C87602B16D38F4C8EBBAA9276105AA4D34CC7EF70F73BC15657A66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422784, "uuid": "f9d9ce16-5fba-4db4-979b-ffcd461d26b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422784, "uuid": "18f77309-0688-4989-ad1f-88afe8169133", "value": "49152:qv9vdTUD/SmVaITzOUOft/CCK/6A/lKeRJ//9Ev:GRRe/SmVlCUOft/U/ldp/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629422784, "uuid": "7ae28bff-e789-4546-8e39-1ef03bf3e41d", "value": 2314240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629422784, "uuid": "75cdd324-704c-489f-b947-547ef22f58d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422784, "uuid": "ecd40cd2-b466-4c2b-a9c6-82abba7b4a79", "value": "86009042A75C710296312488DCFCFC70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2ef5d2-017d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629439905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439905, "uuid": "3af765b5-cd86-4cb3-80c7-59d954cd2898", "comment": "Malware payload", "value": "93d00a52720b98570ad54a8ae5c2411a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439905, "uuid": "84773a18-a606-4383-8a12-51d07bceb3d9", "comment": "Malware payload", "value": "4465deaaeff5c68689f14af3d9d27e67158fed1300c72d193b6f6c51b4ad69b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439905, "uuid": "ce8fac92-ad30-440e-bb45-80d717727fc5", "comment": "Malware payload", "value": "87ee18bac3cf80f0cb56ff3502ea2eb02c23edba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439905, "uuid": "ac80fbfc-7295-47bf-9871-faed69a9d0e4", "comment": "Malware payload", "value": "15f0105e8c24be978eb764dac82add8ab92e73a0e6f28cd4ac8112c06177c8f3a6e6e3e80190fe06dcecabbcb70ed649", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439905, "uuid": "e79216a4-0103-4923-8de5-40654cae7414", "value": "T1B172191D93C49630E8FD1E7ACCA321914B71C75A8957EF3A25C8D052FFE329851A2722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439905, "uuid": "597bbe4a-9746-4104-9381-36ec51d21a67", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439905, "uuid": "42db86b6-4326-4740-9166-dc4c65b7eefc", "value": "384:M1hOIy1JPfD1UGITVz8ywjfQP6mlY/Ou:EWXDFIRRwevlWOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629439905, "uuid": "a9c0bd81-1787-4e67-b169-fc6b898f1d83", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629439905, "uuid": "324de4b3-458a-42af-97f8-4a419e0e28be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439905, "uuid": "0bdd3176-cca7-450a-a119-878bf244c52f", "value": "wdqdwq.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c173c8c3-017e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629440446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440446, "uuid": "3df985fe-441e-4987-bfce-529f88fc0fa1", "comment": "Malware payload (NanoCore)", "value": "fb6aca6ece036febbbec836dd55d1126", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440446, "uuid": "b995180d-6678-4a6d-af67-033d575b834b", "comment": "Malware payload (NanoCore)", "value": "44a6344f92cd1c3b44c1a6ffa47b1c9bef04261f06f2c523e674ec8eeafe73a8", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440446, "uuid": "a35d8e40-3d93-4512-ae76-e8e0b67297a1", "comment": "Malware payload (NanoCore)", "value": "d9b521b67eae457b24cdb8f31665f7f276e4a14a", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440446, "uuid": "1a8be7fa-97dc-4d7a-8b42-7c9d3896ad99", "comment": "Malware payload (NanoCore)", "value": "d310c84b8a0dc7b58a36897ccd54171d6fe48f5a9145640b4cf9dc3ebc48154da221ce2e5cd8e5e905a41b92b3e7f02e", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440446, "uuid": "7456782c-2ae4-4368-a397-ebbcb065fd55", "value": "T17175D0B299F36C5DFDEE0AE62A151C538C100E1F87A24648E2D277F859E5C15EF280F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440446, "uuid": "cd881148-9f39-4709-89ed-f3accf7854c8", "value": "24576:Or4MUjzwp6YZcyXFt7J7UMx7F0l3ad42GdIUtBa71AakYeZyXFW7ROUMx4M6A:OkQ6m5t7dlUAUq7eKW7APp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440446, "uuid": "45d5fd71-764b-47ae-81a5-378ea874ddc4", "value": 1573267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440446, "uuid": "f86a852b-5fb8-4d41-9e20-f7e60252ae61", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440446, "uuid": "649a27c5-6e91-4944-965b-38622ca2472f", "value": "8192021_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f630989b-0169-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Pitou)", "timestamp": 1629431515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431515, "uuid": "ecda803d-b1dc-49cc-aa69-dc5a80ef6f2e", "comment": "Malware payload (Pitou)", "value": "27157f1f86ce2f30cc89af111308f8be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431515, "uuid": "db4f4f9a-3ded-480e-a88c-4c158bb439db", "comment": "Malware payload (Pitou)", "value": "452d5c770f42fc7b4498394fec4acc5254333b13e3715cabfee6973ce8c029a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431515, "uuid": "ad5dcab1-a546-4a54-9265-3a84ea1670b9", "comment": "Malware payload (Pitou)", "value": "3bf1b227b8fa86f3bc0009325426b10fe114e3f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431515, "uuid": "f40c00ed-778d-4126-ae03-cb5810aa36ae", "comment": "Malware payload (Pitou)", "value": "25e16badd9eaca77697895edf4437a127973e24c7bf52883534a6473317ac17b9ecc9866d658b1c3e027059a9415cda9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431515, "uuid": "90221881-2905-4306-ad96-ee60eec25230", "value": "T1E0B4123135709033D49AA5F0C929D6A8097E7C61A6B0919B2F97B31D7E71290DE3EE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431515, "uuid": "687d470a-3eba-493d-a921-4a53fa92b81a", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431515, "uuid": "c252fab8-8659-4580-a8a9-5dce6baaac41", "value": "12288:izBCLqkRnMnICFyR9XmXDZ9r5PZTcB6ZL:izhYnoICFyoD04", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629431515, "uuid": "dd45b6ce-f255-4f57-82d9-1ee026694f85", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629431515, "uuid": "c26ac2c2-3d71-4b72-9ee9-c44d884c20f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431515, "uuid": "a169d1d9-0e4a-4f22-9aa8-d4910af0537f", "value": "27157f1f86ce2f30cc89af111308f8be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88e27c4-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629471757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471757, "uuid": "ecf90129-5f21-4410-bad5-f329615a21cb", "comment": "Malware payload (Smoke Loader)", "value": "716e808961c26085303b90cedec7ae17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471757, "uuid": "7c5fc713-7ce7-48a4-8069-50f2e41c32a9", "comment": "Malware payload (Smoke Loader)", "value": "4564475353ab3f0d5e9200009b3e8f0ab950dd140720a8ac3ecd054b80b9cf8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471757, "uuid": "94cd8f01-3751-4c39-8a8e-4e262e5b2016", "comment": "Malware payload (Smoke Loader)", "value": "9d4c5dc49c0d24e244090f38a87af186163fcd14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471757, "uuid": "14273add-2a88-41dd-be95-892c8c0b6e58", "comment": "Malware payload (Smoke Loader)", "value": "1707b159b0919c3b850215fa4095690a79e5955e2ffb920faa0f30aceaf35056c226b0c4212c24145145d70f98b510bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471757, "uuid": "cf24c2e2-4bb8-465e-8c39-5f897fad91de", "value": "T17FE3AE1034F0F5B2C4550D3398908BA0D63AE865FF7542473E6F275E1E2D2D0DA2AFAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471757, "uuid": "d2eed59c-791b-4db6-82e7-97eea7398953", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471757, "uuid": "bef4fb34-b629-4b95-9de9-ee6dc06fdb8e", "value": "3072:HpHSh0hXk6HfgLp+1iReblGYeazgFnLmx:1ShP6H4d+5JeYgFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471757, "uuid": "d2383d8e-f693-47d4-a84b-20f9838d4141", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471757, "uuid": "01a92d95-5ba9-4668-b2d2-cea04955e5f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471757, "uuid": "be0d3a07-4c06-40c4-bf43-9a2ba44cd150", "value": "716e808961c26085303b90cedec7ae17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fee1c149-020c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629501538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629501538, "uuid": "224c8fda-5258-4bc4-926a-5877f6b8a402", "comment": "Malware payload (AgentTesla)", "value": "1ef0bdcb61054cb80306fff6f29063ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629501538, "uuid": "50daeff3-8b9e-4f36-a196-5c6049a4e495", "comment": "Malware payload (AgentTesla)", "value": "45c16b65e635a567a7dd0e2a8781e8a15f3688de9bb1aa9711d1319010016aad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629501538, "uuid": "47f18aa0-b986-43e6-84d8-95039f22dab3", "comment": "Malware payload (AgentTesla)", "value": "e6f116dda1413e085b7cc2263d636d5a42df2be2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629501538, "uuid": "06a1cdce-fca0-40e3-b7cd-e5ba74c8ce4e", "comment": "Malware payload (AgentTesla)", "value": "38e55c2253a3fa1b8a1342c525c1cadb2569a31425daf85ff4f8809cc545e15cd06691a3e6068fe224eaaecb3c8d47f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629501538, "uuid": "c3f30642-0dde-4c14-b35c-b67516f0a0cc", "value": "T1CB7423A457F81B0E1B78B079E61A57FA4633D05B933C45168DAC3CCB7826F488967E23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629501538, "uuid": "5380f91b-ce21-4c2f-a6dc-9e4a9d8ec74b", "value": "6144:By3B19biD+++G6+Iqe5hZijzvtrf67aKn7E1LgTCjzM/TK1:BmL9biD+++GpPevZMFrZKno9IuzMm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629501538, "uuid": "9f9a7277-7695-491e-be43-3e8ba911ff5f", "value": 353748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629501538, "uuid": "a411ec47-9907-451b-a7dc-80eaf1bcfc32", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629501538, "uuid": "5a2f92ed-b784-4456-8d82-384b35869bba", "value": "payment.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9256b459-0184-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629442944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442944, "uuid": "1f8200ef-5e4b-477e-9141-2531dd0c4023", "comment": "Malware payload (Smoke Loader)", "value": "9313d3fd389f39354aa0b63824cd4aae", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442944, "uuid": "422ca661-0452-45f9-a3f0-4ca5d4f195d3", "comment": "Malware payload (Smoke Loader)", "value": "45d0060ff892ad4d258a44d245120126ace469a5aa256e36f1d28b5506ac8ec8", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442944, "uuid": "7803b6a4-9c4c-4d30-b19c-71eeeb0a744c", "comment": "Malware payload (Smoke Loader)", "value": "c39a367e5a61782b12dc2e3216b2f4395272e927", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442944, "uuid": "16eb7c6a-d44d-4bf4-b237-c7361575b98a", "comment": "Malware payload (Smoke Loader)", "value": "3be7d43bdbed8b3c22ad32f6d372bce9114c0449cb162d6615e560556a543caf78c737b34c9f697603f65db2dea12d47", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442944, "uuid": "3e25cc00-4da0-4d22-9060-acf83a91debc", "value": "T1D2E3AD2179FCC472C09749304955CAA09AF9F8715FA086473F9F226E1E71F809A3BF96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442944, "uuid": "4fbfafae-7046-4f3f-9666-8bbd4f9d0a34", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442944, "uuid": "701ff3a0-44a0-4e1d-a0ee-bda85beb8e2d", "value": "3072:df7Y1zrvThLmMDznvziRUYiPotfzgFnLm6:df01/tLTLjr6gFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629442944, "uuid": "7232f95c-571f-4bf4-ae89-3ae9ea530ce5", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629442944, "uuid": "d33deb81-c849-4014-98b2-a14247c09eb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442944, "uuid": "c1ec8da5-c847-4e32-b52d-8c237d0938d5", "value": "9313d3fd389f39354aa0b63824cd4aae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8636ca-01f8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629492680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492680, "uuid": "a90a8e95-d318-4e24-812f-2789a352d646", "comment": "Malware payload", "value": "3f44e53892fe1ea4abb5eb537ca347f7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492680, "uuid": "8003898c-9956-4d79-9285-fe4e8ac7bf9d", "comment": "Malware payload", "value": "463ca1a29f83ee11ed4d37bf6ce314dcad99c8fcfe4ae3e3f7fcc2574f3c70c7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492680, "uuid": "cd773628-ab87-4a88-bede-d3cffe31d4aa", "comment": "Malware payload", "value": "7514748d3f77056e71055134bb417ee519f460bd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492680, "uuid": "6dc3175b-138b-4d1f-bd02-8a4427d8c3f4", "comment": "Malware payload", "value": "c701f97f8f06821e1469ad32ca11120d21147439a4a45a5a01b933eb6f9668c85502a2cc41ef05b2efae38d89c31e005", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492680, "uuid": "aa094b51-6046-4e5a-a92f-6383117087a9", "value": "T149E53366AB41C548E52B4233C08F35231666A6A8D5C3983F097F00EB64DBFCDDB16DB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492680, "uuid": "270a29ff-23c5-41ab-a9c7-02fa931a9ff1", "value": "49152:4DbPoWUOyc0t9TEw+YGFLcHiLJMnbA53gZ8fmrPQycdFIVVGolJNhkV3rzjQBYC+:oUTZt9JtMLaA3irgIDhm3rzkY511N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629492680, "uuid": "20a7361e-f148-4280-a1f5-a6ce1b1771d0", "value": 3297382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629492680, "uuid": "a9876c2a-3eac-4019-822b-953320624bae", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492680, "uuid": "e35386eb-c7c9-4307-9739-1432765e5f69", "value": "Android_Guncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc1c9aa-017b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629438854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438854, "uuid": "8c3e0600-598b-419b-84ae-aa25e1cae31e", "comment": "Malware payload (Formbook)", "value": "9794a0e0e404424788c9739f23f0d88e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438854, "uuid": "db64245e-fda4-4a66-a605-fffba21e4205", "comment": "Malware payload (Formbook)", "value": "464c5a4e1aaf57bd6f49778d3e0a680cc47b09570df05c4fc6a9c5c789010fea", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438854, "uuid": "3e0c1c37-fd36-442f-9a9d-6700f117ca54", "comment": "Malware payload (Formbook)", "value": "4d5de3eb3a79f204ca44e6092eb3b738e83b047c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438854, "uuid": "817ea911-c624-4845-9a8a-e6ea7306a466", "comment": "Malware payload (Formbook)", "value": "31d265e810ee2e71a57a444852921016be2ff3c12174f6d86d2a60794e8cce9c754039dcc960a7ea04e9fcfa992f988b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438854, "uuid": "19b9cc69-992c-4627-bc98-b2aaac34b161", "value": "T1954512FCA4C2CA25D0838474925DD568CEEC8E1A695A54037338F6A542B391B1FFFCB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438854, "uuid": "4ac9247b-c60c-4c8d-9f3c-1b39ecbff756", "value": "24576:all+eLwNG6Zzex49rSoNQ4OTFYLhWxJ3DPgVjkEzUy90wJs2BpNc76h:muGCSAST4OTSLhHjkEzv0wi2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438854, "uuid": "26ad08c5-acec-4cfc-b735-de042fdb3a4d", "value": 1248280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438854, "uuid": "f5f20bfa-a4d6-44c7-b571-192fb521a9e6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438854, "uuid": "d30b7303-25ad-49ce-97f7-f493ecb97956", "value": "SEPTEMBER ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c38105-017e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629440418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440418, "uuid": "bbe00a44-7520-4606-9af7-b37bbcf8e17e", "comment": "Malware payload (NanoCore)", "value": "cb27afd63b2c8ce8beb1dec8929594d8", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440418, "uuid": "db4102c3-49db-40be-babd-348ab3ae0157", "comment": "Malware payload (NanoCore)", "value": "4681174596e52b50da1fdef15ecc5f5348ae415eb7b851a2bc0aadaf5a676209", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440418, "uuid": "e62d8f88-9178-4d4f-b281-ea8af7b00e3f", "comment": "Malware payload (NanoCore)", "value": "dd3728aeb00bf8a68c7a972f8519cc81caeb2de1", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440418, "uuid": "fcbab210-3401-4f57-ba58-b66325a2cd6a", "comment": "Malware payload (NanoCore)", "value": "3c1d2dc92dd735a9c395065bd1136ec6ddf7a9125b0585c9ad3564f91490c114e29398dc7f3dd74ce6e1f385ec49a0d7", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440418, "uuid": "e3257292-ce32-4f98-8322-fe7488a55703", "value": "T18411AD394CA58EAA0345D47100878DCCDF20C7573798FE391834B8995D5CE395E8DA1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440418, "uuid": "13846028-1067-428e-8c3e-951a3f970b9e", "value": "12:uhutV6Q7zMBNbiuNounuAbZbGJA8kcXO2qvELJ7g3NnLd+KPj2T+TOM:uOVzSNbiIpGScXO2qvEcNngKG+TOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440418, "uuid": "3d766e9f-b0bc-4803-b4b2-00c1c3c88e7e", "value": 946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440418, "uuid": "488df40e-e030-48ad-941f-5cd990cb0f7e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440418, "uuid": "a887b4c8-1662-4460-8332-9518ed494bf7", "value": "R73981_Payment_Invoice_.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4555a0-0187-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629444194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444194, "uuid": "8475a712-fe1b-46b7-bc48-09fe75fccc39", "comment": "Malware payload (Mirai)", "value": "38050d890381e163ae90a3e45dd116d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444194, "uuid": "cb1336ca-166f-44ad-b122-c273570cfce8", "comment": "Malware payload (Mirai)", "value": "47206dfbcde737f142d0bb675f9352e1b9b3d2a83fa28e2d9374932787160b74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444194, "uuid": "1161a175-71b6-498d-b201-2252be413625", "comment": "Malware payload (Mirai)", "value": "0bc7d3d517285f6a62a57bf61933c06eddcf5333", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444194, "uuid": "700c3473-327a-4f62-86df-2256602b9912", "comment": "Malware payload (Mirai)", "value": "8fadc9e21ecf26741dc1377294587cfc8a23de66bda67b7c34f5085b338716dbb63f29acf56dea872064c749f12fb304", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444194, "uuid": "467868b1-2025-4ff5-944f-a3bbe269497d", "value": "T13A731986B9419A10C6C517B7FF1F014E33035798E2EEB3239D145B647B8EC5F0E2A65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444194, "uuid": "e76eb3fa-a589-49fe-8a5a-0592baba25cb", "value": "1536:FNnYwmy6+c1jEWS16iT3rtqtli/NkCzVL9D11K7AyCcsI2i+GSdTL88J:IwuEEKbtb1hL9D3K7aGYTL88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444194, "uuid": "1252f065-818f-456f-afdf-e0d1511d668d", "value": 75056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444194, "uuid": "5ba3cd88-fb00-4261-ab2c-110924534808", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444194, "uuid": "52ec28f0-e1c3-4558-a558-080e0b77d955", "value": "38050d890381e163ae90a3e45dd116d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b1173c-0172-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629435329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435329, "uuid": "f36d0eb8-7173-4438-8778-41f551acf523", "comment": "Malware payload (AgentTesla)", "value": "0fa918fe8c3bd5f23ddb1f550744131e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435329, "uuid": "afe25d20-3845-4f58-a319-1ef8d07907b0", "comment": "Malware payload (AgentTesla)", "value": "48554b2f110a44d4c7e070b6ade171ce0dc0184d616a5b38c259ca38b978aec9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435329, "uuid": "19d4b4d8-8666-45d6-b529-a94c502701ac", "comment": "Malware payload (AgentTesla)", "value": "a0a639cf31feac09dbeaca52b83e1b070bbfeae0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435329, "uuid": "3c139fcb-bce5-43c3-ba58-69a77998fb50", "comment": "Malware payload (AgentTesla)", "value": "3202c7910193948ecfe7e3738d7433565adeec57f40e89854604128b43d28b986a0de4ea5297322e27fb181d83e547b5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435329, "uuid": "b44cb6dd-b911-4db1-b497-4cdf3d1506c8", "value": "T146A40148B754F68FC92BCD7688962D009A30657B6707E383ACD722ED558E7DA8B011E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435329, "uuid": "f3895634-3827-4af8-b142-57abc3967aaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435329, "uuid": "a8b322c0-3702-4573-bcff-2062058c1d2e", "value": "12288:MB7WAbPPUNkc/nM+0RWIFr1GKh9iAgrDFFcTrNfGmm3:S1rPUN1/n/0RWIGKziTrDjcV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629435329, "uuid": "c44e56ad-3d7d-4771-b66e-45106b9fe9ed", "value": 475648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629435329, "uuid": "9bc04771-8879-4bde-a073-2ea74e4f333f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435329, "uuid": "3b6257d2-2daf-45a7-bb71-5acfba00882b", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905c6b3f-01b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629463556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463556, "uuid": "99840762-07f9-41b5-8591-e0b9defef8e0", "comment": "Malware payload (AgentTesla)", "value": "9cbf06b85052eb976f4ea3f61efaed7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463556, "uuid": "8fbe57be-93a3-4384-a253-5e5ff3c92090", "comment": "Malware payload (AgentTesla)", "value": "48736680320a3fd04af46ba5334f180c8a62ae99f3aa0fbdc41c3d0afc54504d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463556, "uuid": "688ac715-efc5-4663-aa16-81462f178446", "comment": "Malware payload (AgentTesla)", "value": "38a9937b404153adaefd5fb7acf1797979c4e202", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463556, "uuid": "ee54757c-8e24-4bae-a216-f9dfe0de3a84", "comment": "Malware payload (AgentTesla)", "value": "b64b3490405913d978f54206a5bbaeb5733652a2063615810265b3c0ba4f6f00e6139c02631db8f672c382140411881f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463556, "uuid": "1ed3a0cb-783d-4d43-a366-84aa9605bf4a", "value": "T1B0A4F1083794B69FC52F8D3A88612C20A730A877570BE743694736EE595E78ACF052F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463556, "uuid": "ef409eea-cf20-47a6-b348-29d4b3d44d5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463556, "uuid": "320ec397-7b8e-4b62-905d-9b271cc07a5a", "value": "12288:925WSbQG9pqvJHa2tfmYmKON5/YlSOZBAVvhTZhB:kQGHeedNOZBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629463556, "uuid": "e66adc87-e5ec-4c19-8d1d-83456afd183b", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629463556, "uuid": "ff2717af-0ba0-4a1b-8831-47c42ba5910b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463556, "uuid": "6c7b402a-f185-4b14-8b63-787ec7cb9bd4", "value": "Scan (32)-2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83154d4c-0188-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629444636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444636, "uuid": "1adb1c22-4265-4208-b50a-aeea9e91671e", "comment": "Malware payload (ArkeiStealer)", "value": "51f13a5067cc1b4c8b669e2368757e8e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444636, "uuid": "ba9438e0-ec7c-4ad9-998c-0b02036ab865", "comment": "Malware payload (ArkeiStealer)", "value": "48ef7270443883f3f012d137892e1eb382d5894a1e73ab2cf364967b1ee68b72", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444636, "uuid": "e12cda54-bf01-4fab-ab1d-ff4edc3d809e", "comment": "Malware payload (ArkeiStealer)", "value": "0163ede5a488f64b0d5f2c5fd8d8df5819387f6b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444636, "uuid": "dc19f516-6946-45f8-984b-6bce085a3dd3", "comment": "Malware payload (ArkeiStealer)", "value": "28701ca663e4c9930f7335f3116cbe8437cdba96e977cc9c7f560496f1663ab417ead8351a97d218509d9499285789f8", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444636, "uuid": "5dbb9794-d68e-4c23-b15c-a7d300487d64", "value": "T17DE3BE3179B1D433D0925D314824CB907639E9646EA486833E8F2F5E1E752C18A3BFAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444636, "uuid": "aaddecb8-fc9a-4f24-8acd-754628de14a0", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444636, "uuid": "a54764bf-0ff6-4498-b9d1-843f7fdbb8de", "value": "1536:BAVtHm5su0XnYfj2RsjuCKXyn65JdyqDbiXArP+8/r2Rm7tDVA1Us0eyCAzABFnT:BMYqRu565Hdz2RmpVA++PAzgFnLm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444636, "uuid": "8270accf-11c8-4cc7-badd-6ca7464b0f0a", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444636, "uuid": "42a7b7ea-94d0-4956-a60c-d235c5fde4aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444636, "uuid": "9d9dc2d1-818e-4ca8-b27d-47258001751b", "value": "51f13a5067cc1b4c8b669e2368757e8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eac2528-016a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629431717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431717, "uuid": "684cb636-6175-40ad-bc0a-0a13b3ffbdd2", "comment": "Malware payload (SnakeKeylogger)", "value": "086110f0550234fa31a3b8a26ab1586d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431717, "uuid": "0d28570f-78a0-4647-bdfd-bbe55bf4251f", "comment": "Malware payload (SnakeKeylogger)", "value": "49c4a448a0ecd6aef793300c0eb7e32d236de4cca4c5dfc53645ad2c1103c9da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431717, "uuid": "09b4564d-cf2c-4263-ba50-3ef8da21c3f3", "comment": "Malware payload (SnakeKeylogger)", "value": "bb9278b14d8ad75aa161975d7a138c3d8b75dab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431717, "uuid": "f04bb724-8d81-48f1-a3c9-4daec7e42640", "comment": "Malware payload (SnakeKeylogger)", "value": "3f9a4a073706b742352d32535252d2252083ba582426f7d4441a4c0a88062804479c045af8479be85914279a92f12403", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431717, "uuid": "d0781b3b-7574-4c42-8686-53d6f1bc9542", "value": "T145B4383439EA5029B173EFAA5BE475EADA2FB7733B06641D109103864723E81DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431717, "uuid": "642eacea-fa98-4313-843b-b9baa8b13464", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431717, "uuid": "2d030418-0813-49fb-98c0-5481f0480667", "value": "12288:CX3fF1Xa1wEUStusbCV1FMuB0RKGCbHOFJGpHplfjdGiQrCX/6:4NayEF8HcGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629431717, "uuid": "22dd1a67-1461-4542-a17e-fae8e06bb493", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629431717, "uuid": "bbe92968-981d-4ede-81a5-ce14f7555c91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431717, "uuid": "6d3b3b77-f73e-41f4-912b-3d00ab51944c", "value": "Quotation2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fd2e25-01f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629491423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491423, "uuid": "c97ea1ab-e37f-4c0d-8c1c-65d4a43ed8bf", "comment": "Malware payload", "value": "ae338ecd0e84e30cb0962d26ea2797cb", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491423, "uuid": "a9ee5bdc-ce17-44c2-94bd-d7673181e0b8", "comment": "Malware payload", "value": "4a3d77f8c3e8d8ecbbfeda70b661f57dc4d2382996615938c71de6a4cfc2f03f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491423, "uuid": "93911ad3-4e54-4ebf-b3ec-9d6d8a88afb9", "comment": "Malware payload", "value": "04d1634a310fa44282d8abe6763dfd851d84c4d4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491423, "uuid": "e099e7fb-9591-4b52-8981-2e9e1c817dfa", "comment": "Malware payload", "value": "e042e79ce5d9e193fcf1abb27832108fa7ea647f88047cf52a23aa8ef68aaaf97e2eee61531715325fb96e7e7c1c93fd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491423, "uuid": "fe9dbe0c-a314-4f4e-9b2e-2a3cd0cbc5ea", "value": "T153F533469F92C048D6378273422792433B75285F91C2BC7F4C6B88776CD3A68CBE5E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491423, "uuid": "0ac63021-e919-47db-9441-9d6833380e8a", "value": "49152:s5V2pYyoevMC7JZ2AMrvHGFOWkMHlkOIdrg3nD2nexrqP+BNfEsholdZOOUkv:5ToekpepQW6neh7ei4v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629491423, "uuid": "cb97349a-a170-46d0-a2d8-8e3e19e2898b", "value": 3357938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629491423, "uuid": "c581a143-2bbb-4b79-a83c-ba32c1b9e2eb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491423, "uuid": "62a61f50-33cc-493e-accc-908a3617a17f", "value": "AndroidG\u00fcncelleme (2).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd68f7dc-01c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629469752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469752, "uuid": "a70e2cd9-581b-4bc7-90c6-f219858379a8", "comment": "Malware payload (ArkeiStealer)", "value": "c68dc582f455248cf8926dbbd13aacee", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469752, "uuid": "557f8ad9-167e-475a-a845-1ffd05ed5840", "comment": "Malware payload (ArkeiStealer)", "value": "4af972633da29b91c8d527ee6e2df6e6eecff0f9b42918417e13b521e7ee5a39", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469752, "uuid": "4c9dc5be-7a7d-4014-a894-ed78cce2bd91", "comment": "Malware payload (ArkeiStealer)", "value": "c4f7efa4fad1724696506372df44022c00c024aa", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469752, "uuid": "245fa9e5-54ca-4ff5-8ff5-2329b866b4de", "comment": "Malware payload (ArkeiStealer)", "value": "747c45212acddcb82a459937284011bc641d329ad925a6e8fb99bc3f64251dbe55f4d5f5bab51ff5291ef722079e7815", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469752, "uuid": "f94c0c40-412b-4dc5-ac9d-a9ec26d9a65d", "value": "T1060623F46531CE21CDF5963FA000B07F89AB64624769407073B7AF4D663AB60B657AC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469752, "uuid": "32ebe0a4-73e7-4641-a1f3-dbd0e4ea4c0d", "value": "96778352d99ca84b52328b0725ee1935", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469752, "uuid": "4cf893c8-46ab-426d-bd84-3a3e819ffaae", "value": "98304:4bu6hLdVgih1WKRMsG5ZfA3ylEuL4LMYvN4C:MJ1f2WjNMYvN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629469752, "uuid": "2b0f4bad-efd9-4632-afde-c3d8f1d2b5f6", "value": 3713536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629469752, "uuid": "eba68bdc-48ca-4c1c-85a8-099df11c70cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469752, "uuid": "8ee0b543-e35e-4e7f-a1dc-7f4121b6cf42", "value": "c68dc582f455248cf8926dbbd13aacee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb20d7d-01cf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629475306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629475306, "uuid": "acc7c95b-ebcb-4bca-9544-83fb138579cf", "comment": "Malware payload (BitRAT)", "value": "bd291342f9e67e12cfc6ba494b95be43", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629475306, "uuid": "2d864a01-4548-4f5c-a44a-c9d35dd7eaf4", "comment": "Malware payload (BitRAT)", "value": "4bddc1b65b7a24af3d24bddcd3722811775f3f98a65fbc433c762e1615af28c1", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629475306, "uuid": "831902d6-a5ce-4be9-b684-5d7e11b57cf1", "comment": "Malware payload (BitRAT)", "value": "477df3d4bc80e5a41ac22fa5fc0b652511e43907", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629475306, "uuid": "7dca1c06-7a67-4955-a3d4-33c122de70a0", "comment": "Malware payload (BitRAT)", "value": "f6ee3bea9c36d68cc74354f05d2d8f3e158d87108c9bf534006be07066d6bf2ef24957f6cd00386272ac7b8c1e419d72", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629475306, "uuid": "34eb692a-e0a2-4a4c-a654-7f30b66fa544", "value": "T1E606CF02FA46C562D2170230E96E77BE053CF9354B2085C3B3946E6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629475306, "uuid": "08e118b4-9e93-4e40-8c58-f77827b6a015", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629475306, "uuid": "bfe1374e-304f-4163-a74d-b09362c4ed75", "value": "98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/zmlwXVZaFB:K+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629475306, "uuid": "9d12b482-99d6-4de8-92c9-c73162c1f23f", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629475306, "uuid": "c1f245fd-c59f-4d09-bc57-8313d53f28c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629475306, "uuid": "141211a5-8192-4ca5-b680-dfdb21b0712d", "value": "BD291342F9E67E12CFC6BA494B95BE43.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4e35a0-01f3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629490501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490501, "uuid": "84afd325-2b6a-461b-a5ee-857834140dd3", "comment": "Malware payload (Loki)", "value": "0088e7505906e2b4e1cec18cc7f435e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490501, "uuid": "f82fd364-e101-4dfb-ba5e-68e5a83bf46c", "comment": "Malware payload (Loki)", "value": "4cc271a6df4a28ad8527132cd2ff5b6682dc4f8948233a450d251e48e5976204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490501, "uuid": "c1fdb0a8-d609-4569-bd1b-423d4b13fbc2", "comment": "Malware payload (Loki)", "value": "948bd131dc8a5ed819274464a3ed4845ee81c780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490501, "uuid": "499c7ce4-6d83-4666-8db2-32ac54ae08f7", "comment": "Malware payload (Loki)", "value": "efa91b6a11d002d0ed587e27e327ae65956e7117bf6ab820127d031db95ba6fd8b2ae3a42438775944139d0d32439d81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490501, "uuid": "dbad434d-8d42-40ab-88d5-9ab9c603da23", "value": "T1E87448003B986A2BF130D6775757C23682B24ACBE1D5D740CD55D3BD7A31334AA8EA8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490501, "uuid": "57d266b9-ff53-4aa9-81dc-94b13c243169", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490501, "uuid": "4e1ad669-4024-40a4-8101-ff253336c61b", "value": "6144:FYvDis6If1T+vOuXBm3jiI5omOmSCJGEWE/VD2LYWfoI+:OM21a9BYSdEpD2Fw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629490501, "uuid": "3ce9960f-0cd9-44f5-86f3-81e968a1335c", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629490501, "uuid": "5c774e25-7d45-46f3-abcd-0459d26136d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490501, "uuid": "6eb28c33-5a4a-4baa-b060-da88a292f23f", "value": "kl4tJBxIAGQsw7X.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e851233f-01ff-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629495916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629495916, "uuid": "3a0223b7-ba87-480a-b0c4-ced93b4d250b", "comment": "Malware payload", "value": "c583127f8d8cc307084f3071010d7cc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629495916, "uuid": "f913dc4a-1540-464f-a2c9-b09f50d8a98a", "comment": "Malware payload", "value": "4cca9091484e1b53c182d79607fe3c334c19176a1d5f8f91624c3565e24f49b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629495916, "uuid": "bbad027e-47f0-47f9-abf9-482d43d87fd4", "comment": "Malware payload", "value": "761eae12ab1748b2450637822472c58663a2c041", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629495916, "uuid": "16547754-97ed-49c7-a982-48a2d1e1ac4c", "comment": "Malware payload", "value": "2d95b3021f04a4502ee8ac6022d0988728198513993972b5636650ebe478b8c75f49d6b300dad837ccedec54934c0d00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629495916, "uuid": "a7444250-47dd-4bde-8b22-aa07f61e99e8", "value": "T15A740111B6B0E132E190943C9916C6905BFEA861FE70D1873F47E76E0EB1291DB3AF16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629495916, "uuid": "512db07d-3c5b-4421-a02f-aa18432da4a3", "value": "eff27d48d68df0af1612601744441acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629495916, "uuid": "d6d066cb-fe77-4875-bf16-5948e327d1c4", "value": "6144:bZcp3+anf1v9fZhCQSx8gMPovz7ERoAMwd7Y5k8iR2Y4zgFnL:bO1+and9fZhyaPov3ERzQ5k8iRIsZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629495916, "uuid": "e9c92826-6c05-4d23-b142-7058963e4c94", "value": 353792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629495916, "uuid": "d163b579-5502-4296-b433-45fd90fda8b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629495916, "uuid": "77dc93d6-3133-4e8b-92ab-d7e566456842", "value": "c583127f8d8cc307084f3071010d7cc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d27f4d-017c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629439574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439574, "uuid": "d9652ce6-5f66-4e94-84a2-22ec5efeea1d", "comment": "Malware payload", "value": "314cdd6a6a7cb63e4b02e01e1ae26faf", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439574, "uuid": "451b9a26-84f9-438a-898d-2f760c4c1e1d", "comment": "Malware payload", "value": "4cd77e64342e3064620cee61f3dae2b709b30ec56628fc0f76758fb8f2b5cfd6", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439574, "uuid": "849395e1-c56d-4448-a5ae-dff944bf949d", "comment": "Malware payload", "value": "c209be123c98495e2bbdacf7ccb61a5e03d9a1ca", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439574, "uuid": "5b461d1d-8283-468f-b04d-5c2f5bc1b421", "comment": "Malware payload", "value": "438883d9d25478fd3b02355a6e43bab01faa128772093a7e212b62a7abddd46535c2fcea405e5b22716694b66ae1986d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439574, "uuid": "f3382f7e-ec14-4fb3-870a-7da275eb9d0b", "value": "T180515DBD5399DECBEA4355EB584CC2007868B5E8822833C9072D451E2CC5C8DAC8FCA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439574, "uuid": "3d68e10d-e18f-401e-a318-481421fd9fbc", "value": "48:XwzmRLX447XrQoVALv/+EzBv++Ss3FSYKOYZLUmcRGrG4GeTwJzDGz6QYLWPW4:rnnQSy+UR+fsVSJOvXspEzHWPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629439574, "uuid": "c6122ed4-d043-4d0e-80b0-1390a761830d", "value": 3021, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629439574, "uuid": "ac7b8144-2d9c-4a4e-9c91-e8d4ed555af9", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439574, "uuid": "ed4792f3-122d-4fcf-9b57-a41f973f3fd9", "value": "RE Revisione dell'ordine.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f8150ed-01a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629458831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458831, "uuid": "66245604-a6de-4ab2-952a-1ee6fe8e8c58", "comment": "Malware payload (RedLineStealer)", "value": "97dff6707d5ede160839a484c460879c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458831, "uuid": "e73f98e0-f2f5-4b0c-a039-e1a498c424a3", "comment": "Malware payload (RedLineStealer)", "value": "4ded15181d011315903883feaf9b400f9b680f50429d73351ee79f79600a080e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458831, "uuid": "d1718bd1-9e7c-4e7b-b1b7-e13d0fd3ce50", "comment": "Malware payload (RedLineStealer)", "value": "51ae9ae79bce450466145dde1ca39fea97e7b348", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458831, "uuid": "b0619927-e6e5-4239-832a-84cb35424c80", "comment": "Malware payload (RedLineStealer)", "value": "934435a4a40089a5b99f6d971fd01a93c819e0b29d30625855cc3de3a6cb76cf139c1a9cad9f3290f093a267fb4c3b85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458831, "uuid": "e643644f-7e7f-4ae8-892c-c080e9f2c778", "value": "T14505122272D1C032D97318709CB8A762EFB5B9315775EA8BB7540B6E2F31AA2C315743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458831, "uuid": "9390f615-a6fe-4467-9c46-71c53bb2bf37", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458831, "uuid": "de59d804-0c6f-4194-af27-66ec646ebe33", "value": "24576:a20gPgFKTIQxAVBbIcXrq+qjx5LuNC7Tu:LK6xAjIEuTjxRuaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629458831, "uuid": "36ac48f3-a6ab-4d75-abed-77662fbc2fa2", "value": 845795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629458831, "uuid": "ea555fba-4f5c-492a-8a29-66d2440394b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458831, "uuid": "ba433332-47f9-422e-8507-487742e61b6c", "value": "97dff6707d5ede160839a484c460879c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4edbf5a-015c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629425929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629425929, "uuid": "80b7bd14-ad1c-4ce1-9b9b-555c7e373ad0", "comment": "Malware payload (AgentTesla)", "value": "aa3fe76e56df94841da2468cd7c21258", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629425929, "uuid": "7d036fa4-7212-4af8-83b8-eaa6b3761755", "comment": "Malware payload (AgentTesla)", "value": "4f19c2982cf61597478ed2e5a336ab73adf4957e9bdb6f44828202a7a93fa1dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629425929, "uuid": "9edd9cfa-f11e-4d1e-956c-f326d4a2a39b", "comment": "Malware payload (AgentTesla)", "value": "f48dfd85f2cd1e162d51e369b6ded52823971371", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629425929, "uuid": "9033c768-fb70-4d34-b99f-c685b2e37803", "comment": "Malware payload (AgentTesla)", "value": "183052ec142d6300f9558e4a2738fe7db15a43dff221828ca10e4ba6ae8acf97e4c96cf214088220fec29a4c392abf26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629425929, "uuid": "a180f9d5-2466-4e7c-a0ce-57ffa9fa4f07", "value": "T1EF45493D29B91637C5B9C375EBE59423B148985FB400EE696CDE03A7030BA8735C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629425929, "uuid": "25eef07c-08eb-4737-b6f3-5ec834547679", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629425929, "uuid": "714c3397-73a1-470a-8187-ae37fd54925a", "value": "24576:h09ggU7Jzh9ad6CSm64YqKBsPbInX3ACZsGUyq:UggqJzjpxm64YdBNXQiWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629425929, "uuid": "b3fc9f7d-a15c-4b07-abba-aeee2fb285df", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629425929, "uuid": "c50eb963-e67f-4202-9c9d-c42f217d8c80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629425929, "uuid": "d135adc9-c2e5-4b10-bb9f-28bab74af6ab", "value": "SMS-Q40208-30.06.2021-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a86823-01d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629477039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477039, "uuid": "6dd3ec4b-c982-4dc2-b8ec-9b09e787ad57", "comment": "Malware payload (Mirai)", "value": "de45c3b1e724343ad294e43b38d13ff6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477039, "uuid": "5f8c17c7-bb04-46d9-bf23-e45111664719", "comment": "Malware payload (Mirai)", "value": "4fc7db6888d5222143bb2b882917c6047c131f02b4b71223dc3dba70c5fed6da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477039, "uuid": "a7c4c7de-22a8-47f0-a946-67948d19d004", "comment": "Malware payload (Mirai)", "value": "0ff634e23b41cb00d24151bd1a1fa95915c2c208", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477039, "uuid": "90664ce3-83db-41bc-9d37-374c58d2e85b", "comment": "Malware payload (Mirai)", "value": "3c09e596c3a93e8c64bd48b73bc87ff7320f7964ee79697cd95e118f1ea049e3f8301a6e6047344957d4c208ae51771d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477039, "uuid": "01a72e56-4486-4fbe-94bc-7e011dd626fe", "value": "T16943F862B8D26A2AC6D053BAF9AF558D332527E8D2EF3117CD211F117BC910B1DA3E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477039, "uuid": "4dfecbbe-b45f-4b1a-bb22-ccd0dc817a86", "value": "1536:AmEYgmsSlhiQo3Wz+JUzJzhhjoXg4mOoh+zCtNqmL:AmEDmEpeGXlmrhUtmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477039, "uuid": "dd0422f9-e3ed-4c56-af0c-060ea5d1a230", "value": 59580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477039, "uuid": "4ae60a34-e993-4bc5-bd3e-6b696a4a4b2d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477039, "uuid": "6be0b50d-c6d4-423a-a745-91301815594d", "value": "de45c3b1e724343ad294e43b38d13ff6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6c6b4d-0163-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629428814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428814, "uuid": "9e6a01f8-3cdc-4ca1-ad54-babdcb3dd7fc", "comment": "Malware payload (Glupteba)", "value": "beab7d3714008f32312b375eb14fa9df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428814, "uuid": "b45e15ff-2006-4c0b-8f9f-a43e145747ff", "comment": "Malware payload (Glupteba)", "value": "50ab699ceb6bb259199d197392ea0ed00d024ce77d3d663ea13fe7b93a4ab50e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428814, "uuid": "f3c3fcba-2706-4350-ba12-0c60969fd995", "comment": "Malware payload (Glupteba)", "value": "bda62dedf7c9739ed5942fe395eb658c175ecda0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428814, "uuid": "ce4c2e82-90f2-4b70-957f-ec8428e705f7", "comment": "Malware payload (Glupteba)", "value": "3dace875475a3f734f382e74f4970141871e92cc70ae81da7b1a11674e197569b58761c85c3f9ab3fdddeb45288cf70a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428814, "uuid": "4643d637-4b63-4e2d-a86a-71e1bb9f687b", "value": "T14C263301B0E21937C238953771852DB63832F9CA1925A72BAE5F1A0B7F13346D939E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428814, "uuid": "6861ec4b-7c45-47e2-bcab-be9055b0d676", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428814, "uuid": "d941a766-9366-43f5-ac30-d7978a501923", "value": "98304:SvH5Ty4vqUb9LW+RTyqdkIS4yC9ynU1kei0YwOtitAGbG:SvHJvdhC+FJy+YirytGDK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629428814, "uuid": "41233057-73f1-4bff-9be6-7973e74baff9", "value": 4558888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629428814, "uuid": "237a07ec-d754-4d98-b384-933f4862d9e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428814, "uuid": "83dc657f-06f9-4a4c-8205-aa5acc552d46", "value": "beab7d3714008f32312b375eb14fa9df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a56d4a9-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424328, "uuid": "d1bf898a-c062-4464-b780-fd1c4b935361", "comment": "Malware payload (Mirai)", "value": "5ce6ebe0aa38c07ea3e1a11f8880542d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424328, "uuid": "db915ec8-3a36-4b93-94a4-400e989f7769", "comment": "Malware payload (Mirai)", "value": "51972f316a984da228551904c65c7a8b9a8a147ef1ac3ef18263182ce73f864f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424328, "uuid": "a7eadca7-acbe-48b6-b996-3f27db8567be", "comment": "Malware payload (Mirai)", "value": "7529fc80cc1fa5105bb15de708245fb6beeb633e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424328, "uuid": "dea5f163-490c-4e3b-9d99-9d81d7af44df", "comment": "Malware payload (Mirai)", "value": "0dd065878133dce189054eca3ec9b3e301ff3ef66f7965b1d90dab4f4ce43c090a01c4bbda7e7348ca08984a8318106e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424328, "uuid": "13c58d51-1053-4138-8ccc-72fbca9c045a", "value": "T1F5D2E16B84E88BDDE21B55305AEF775C9301F83F246869F1FFC8B0197496B456025AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424328, "uuid": "8d44301b-dbe0-44de-99bf-331cf0289bf3", "value": "768:F+eiZIiTk9Lv0lxi710xWN+XxIVUXH1UnbcuyD7UHQRjW:FYNyLWQJ6Xx8yWnouy8HyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424328, "uuid": "1653bc24-4c3a-4100-a127-a9f048ee5009", "value": 29564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424328, "uuid": "582136fa-354a-4d51-bcb5-52f1276d2c27", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424328, "uuid": "f16e0d47-b66f-45ab-bab6-950aa168bcd2", "value": "5ce6ebe0aa38c07ea3e1a11f8880542d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae1cbef-014e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629419819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419819, "uuid": "c5ad1396-0da4-4538-b405-92e24d5af4ac", "comment": "Malware payload (RaccoonStealer)", "value": "087888c1b56195cbd6badd3876767a35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419819, "uuid": "a0bb653b-8f8f-40ea-aba4-0875bb80fec3", "comment": "Malware payload (RaccoonStealer)", "value": "51d876460fa02bb32eb2d66e36702327a1a76e3e89ad4ad60d1cde1e47382c98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419819, "uuid": "e532cc2e-9cc8-4d76-8de0-3f6e3817cd2e", "comment": "Malware payload (RaccoonStealer)", "value": "148400c88d839dde182846f7b5a06f45742dcd00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629419819, "uuid": "b415007f-c60b-46e7-9929-892ec450d249", "comment": "Malware payload (RaccoonStealer)", "value": "5612b3bd72594a759bc7d1964ae615c1a9744685abba799e94b2da13482110504a995f2522cb4d5cbe7af19885b986f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419819, "uuid": "cbbfb655-1f6a-4130-a84e-1fda3b52960e", "value": "T185C4D120B6A0C075E4A713F469B682BC6B2C7DB45B2411DF62D93BDE17386E4993037B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419819, "uuid": "e49a6d52-6ba9-468c-a35f-9a6e3e10d88a", "value": "f29709d3d8fb23714c868be088ee3357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419819, "uuid": "190e6d18-aefd-439c-b870-786cd2458ee3", "value": "12288:Ur44H2GYIUkeXrwTaKZZ5v5B3DaQiwtIf+Sa1J6:gH2tRwJTeQiw2Far6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629419819, "uuid": "c33d48de-3ec8-432f-a124-2b72c8af74b7", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629419819, "uuid": "b627f763-6052-4072-8e90-b8da6a03d77b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629419819, "uuid": "a243757e-660b-46ed-8142-62883bbb2b14", "value": "087888c1b56195cbd6badd3876767a35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56431e72-0209-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629499966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499966, "uuid": "2f1bdaf3-60a7-40c3-b5b2-e62a13712bad", "comment": "Malware payload", "value": "8b504dfabe407c31c122e2df5f589f42", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499966, "uuid": "3b725024-4928-4b2c-be77-3e7fe3732cc1", "comment": "Malware payload", "value": "5375ed5bf5cc2df45e19fe0c3ef7b98473d1907f20b2bb1243eaf6d3eb2a1d66", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499966, "uuid": "92b86320-590b-435a-9287-21eb1da6d031", "comment": "Malware payload", "value": "d58e93417044d57a7851b733fb4fce36c12ec3d9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499966, "uuid": "813b2752-071b-4d14-8f32-6414ad720861", "comment": "Malware payload", "value": "24409cad9248cf2da3791a8e37e5490dda83bb2b2780573602234589dc17b98d7ea9609908408c60138c70b1e0f455aa", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629499966, "uuid": "6078ca1a-9bfe-445c-bba7-13c616e948f2", "value": "T1E5F5334DA3629716CD234132C18B31010F5566998ACDE26F827584536CFBA9DCE2FEFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629499966, "uuid": "945d7f7d-2add-4cb7-a02c-ee0abeb04e7a", "value": "98304:X+MlRhSI6vc9wJG7lcGDaWou1xLk6B96M3DsEd:X+gRhMz5tWou1xg6m0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629499966, "uuid": "d48e65fa-1e77-477f-8b0e-70906187de5e", "value": 3354020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629499966, "uuid": "be23b069-6688-4246-9290-b3e9275663dc", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629499966, "uuid": "393c7a5f-1dde-4cc0-a21c-3a1f04eb51be", "value": "Android System Update build_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "603f5560-0197-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629451020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451020, "uuid": "ab59d503-b1e5-4135-8b7c-e3e67c215f63", "comment": "Malware payload (Formbook)", "value": "c62a147c7e9984b5664238874be1ccf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451020, "uuid": "8c173964-ad59-4f68-9220-c4e53db0a6af", "comment": "Malware payload (Formbook)", "value": "537bcb10c903cef3b3ce38482dd1cde1f5723e8b1b928fcf28d1ba6773995b37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451020, "uuid": "b4029795-701e-4c1a-951e-71d3e0e87e89", "comment": "Malware payload (Formbook)", "value": "d9cc9a28a5d536da7ea739c254ea78610bca0e6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451020, "uuid": "d83241eb-a65f-4f56-b035-71eb4d450264", "comment": "Malware payload (Formbook)", "value": "fb5ad0b15aadc187e7091174a7b04c052a5f223664ccbd36ff4771994914349b4dd76db0fc01adae2e112a43a8b9416a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451020, "uuid": "1c4e7e14-5441-41d0-ab69-4371e74cac26", "value": "T1AB15063C19F91637D1B5C365EBE58423F148985FB510AE6AACDE03A7031BA9734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451020, "uuid": "43d567b3-2e18-4a2f-b455-f7b6dde6099b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451020, "uuid": "892d56ac-9b15-470c-b445-167a235d19ae", "value": "12288:kf0tvnM7TN0cB6sROqLrst6XZFZnB5tozna7hl2/CJQchwmO1gvI1zHavSg:k6eKxsLMSvZYnh/CJQchwdpzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629451020, "uuid": "dbd68d5c-592f-415e-82a5-e424c5157634", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629451020, "uuid": "28dd489c-fe15-4078-8acd-b240ed6fb27a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451020, "uuid": "6c233191-d009-46c5-8b31-fddc7c9bc591", "value": "78320082021.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4924471c-0179-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Dridex)", "timestamp": 1629438097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438097, "uuid": "fb72c47e-07e8-43ea-809a-ae6205818a1f", "comment": "Malware payload (Dridex)", "value": "aafaeb157be3e6f9250b324d55acfed2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438097, "uuid": "fb005663-59af-4d9b-9cf9-946b602abbf0", "comment": "Malware payload (Dridex)", "value": "53ce752aa18d36320fc8a1c0fa6993dc866416bccc613a4fef80f2427d224824", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438097, "uuid": "883859be-66da-492d-861c-1e39ff7129fd", "comment": "Malware payload (Dridex)", "value": "f117cff3c0faebc00edf9e53494f110d204d6b7a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438097, "uuid": "c8a9921a-6c3e-4fe9-9603-b6dc38292520", "comment": "Malware payload (Dridex)", "value": "8081066f5ceb152600f0c5914b67e7ec562b293f20820331b65eae94b2f7c101f3fe12a850bda81068c0bd005b81ee97", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438097, "uuid": "67ad479a-a045-4852-ad0b-63258b1082d3", "value": "T12DF4DF1267ADD658C8ADFE31DCE596B28363FC215EB0655B3B40391A3831B620DDC72E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438097, "uuid": "d29efe8b-795c-4328-8682-4d4a26996fa2", "value": "86360006ae3e568402cb51af35d0bc4c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438097, "uuid": "c97fba78-682f-472c-9395-48cd6e6040b0", "value": "12288:FM+ZdkmHubeaCo6Vyg2A/sUQBJ8zSVacsb0z:FMcpTo6P0BOmkc1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438097, "uuid": "593c9215-73be-4c95-83c4-b26a6851a4c4", "value": 732672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438097, "uuid": "1fe14b2b-5d40-4b7b-ade3-139e5ac5608c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438097, "uuid": "c9579452-50d1-41fb-9eb8-8e9e958db92e", "value": "aafaeb157be3e6f9250b324d55acfed2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eceabb74-0154-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629422480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422480, "uuid": "bd46999b-2745-40c3-a66c-70cd95ec1c34", "comment": "Malware payload (RedLineStealer)", "value": "60ebd37da0f9d6fe13fbbfa81b8440aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422480, "uuid": "7583b0da-e6c9-4113-a22d-c21aed277e9f", "comment": "Malware payload (RedLineStealer)", "value": "54516b31cdd596a0f688a71a2fb9410ff6c10e79ca4316c02ad906e55fcb1029", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422480, "uuid": "65a0b938-b14a-48d0-94a5-586c42c97431", "comment": "Malware payload (RedLineStealer)", "value": "7422b549d932616c7603837845685c1596ec6b49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422480, "uuid": "59d7ae50-e75a-4d4a-bffb-94739ba34469", "comment": "Malware payload (RedLineStealer)", "value": "bf987e59981b67bf12fb30eb411800a64f6060ac49203b2ac87bfac6c1e35830d938752febe471c9e5bb895638d4f141", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422480, "uuid": "f6d87ceb-7807-43bc-8310-c854c63979e6", "value": "T15644F11176B0C3B3C4870D705895DAF46A3DBC525B6485473F5F2A6E2F213B09B2AF1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422480, "uuid": "550e93c0-587a-4eab-9591-855840084984", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422480, "uuid": "3f3e0d41-4467-4c03-9504-c1da4f1e57b6", "value": "6144:t356KKo7VSnapwlySjuwPhgtkd8Xm0b2RbRigFnL:yFFaGwG3IO8Xm6glZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629422480, "uuid": "b15de268-01ef-450b-99da-a07328b938b2", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629422480, "uuid": "4e6eb3ea-22a1-46f3-9768-8ab8f0300014", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422480, "uuid": "85dfa596-9ae8-402e-a5e6-0e42588513be", "value": "60ebd37da0f9d6fe13fbbfa81b8440aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b2c5d1-0188-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629444743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444743, "uuid": "bcd96746-0379-4729-8698-b88f02f5a293", "comment": "Malware payload (Loki)", "value": "9f81ea95cf7ba5762d3a3cad6ede84b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444743, "uuid": "e0796576-00f8-430a-a5ce-b5a2813ae960", "comment": "Malware payload (Loki)", "value": "5472b936bf1bff3eb96ccf9f9426b55ddd3a31973991c970438bef00e034e430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444743, "uuid": "25491400-34bd-4d13-850d-8268f8271b5e", "comment": "Malware payload (Loki)", "value": "456a8c3bf3c9cc355f3588eeae30c2b09ce091af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444743, "uuid": "31e4d893-35a5-4873-bbae-296af532fd0b", "comment": "Malware payload (Loki)", "value": "9a4b542c6673d691e080abab521a349ddaf5645d29ee19a0093a80342641f4de07d739c5e048e717d7cd5735530c5ecd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444743, "uuid": "58eaa65e-16cc-4b9f-a8a9-5bed7bbefb80", "value": "T1F7E401247384FE8FD1AF8E7A99940C00ABB1F5774707E7432DD306ED6A8E69A4F12095", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444743, "uuid": "d7582087-66a7-4d32-b602-8359a7a7a335", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444743, "uuid": "99acc9e5-3c3e-4a75-ae6b-cba09b621b29", "value": "12288:Fgxk8N0W3KDLvRNEVcGLoeQGj9kF/ItK9HNMMA1RKKDe9p7AMb8JrxcS5l:urN1Ik1LZQGjyw4TMMAmKDeH4b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444743, "uuid": "6f9f9682-3d13-4248-8b1d-d799105fdde3", "value": 680960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444743, "uuid": "99a567be-8b64-4347-9b3f-9ce50a178d4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444743, "uuid": "b2f37bd7-d888-4e65-af12-d57c289f24df", "value": "9f81ea95cf7ba5762d3a3cad6ede84b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b9cb86-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424342, "uuid": "41cae69a-c625-4d57-944c-87bc181d02ec", "comment": "Malware payload (Mirai)", "value": "19688b7bb9f259eaa2366d6bb579c85b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424342, "uuid": "77271189-624f-4e74-ab86-a1402c661c43", "comment": "Malware payload (Mirai)", "value": "54a1082567106054f2dfa33eb5fd9497aca88000ed37a9ea93606f3371466b72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424342, "uuid": "4cd141b4-f779-4ee2-be71-82c8ec4f49e4", "comment": "Malware payload (Mirai)", "value": "2b9f88fb05b446bc1843b5bc268cb452d328a645", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424342, "uuid": "697f0183-696d-4ae4-87e5-88d792ffa1a7", "comment": "Malware payload (Mirai)", "value": "04c0f02de8b19e97a2c8ddec587d67eb032fb0195e09b391acd863fc89403f5d17238197397574e7875de1149420ecc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424342, "uuid": "0bf1d264-273f-478b-bb75-5466b2c11970", "value": "T106C2E13401947D50F6F0017CBD708EC7638A42B9A63F3530199D872899EFE4A5AB9C9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424342, "uuid": "4d8179df-9ef4-4322-9f36-fcac445473e0", "value": "768:f+TX5ohK76ag8qCidYn4mgbDK/zmHcWLs3Uoze+:f+TahF6idFcKN2zX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424342, "uuid": "7db90cb7-8001-46f2-9052-bf3dd1c70943", "value": 26860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424342, "uuid": "fd3d0222-118e-4c0a-97b1-b108dfe05f55", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424342, "uuid": "b5d222dd-b38f-442d-b8a1-865b5e1fa44a", "value": "19688b7bb9f259eaa2366d6bb579c85b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72805fa3-0181-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629441602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441602, "uuid": "0bd75b0c-9b38-483d-8e30-45a168c55d42", "comment": "Malware payload (AgentTesla)", "value": "df08638eae9735f03508a32548ed3e0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441602, "uuid": "f311038c-cc46-4646-82d6-9b4cc0084f36", "comment": "Malware payload (AgentTesla)", "value": "5506dd9ea76ac8e47f8eb144b42e940349dc993c56cf6ca8b9e602a0e4f90616", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441602, "uuid": "f0d91b0b-c1a2-4511-af82-dc700df76bcb", "comment": "Malware payload (AgentTesla)", "value": "633ce23cfd4f42a387200535b944d8f979024cf3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441602, "uuid": "2683596c-9c45-4709-8129-5ed0042625d7", "comment": "Malware payload (AgentTesla)", "value": "59cc83124c4d2b373078549b5aee699f6afc8d9cc285a35cf001d389cec66758607859f80d2d2270aab923ae967b8061", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441602, "uuid": "2b7b6719-22a3-446a-a94e-a3e8e945408f", "value": "T1C5F402057740FA8FC5BFCE3684A01C10EBA0D5769707E7533CD316EE698F69E4A221A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441602, "uuid": "48770fb8-20e6-426c-bed6-8e0d64e6910a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441602, "uuid": "d17dd332-c24c-4a7d-988d-1aa61238f842", "value": "12288:KhLD3MGSUNHUbs9DDCX5xDi924qijDef1pFw4h1w9MqA9RQnc1ZNEh:KBcGxNKs1D85E924Tj2pW6wlA9Onq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441602, "uuid": "226ad5ce-8f06-464c-b576-cc7133c39de9", "value": 738816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441602, "uuid": "e9e3e3b1-b82e-40d4-832d-a02e78c3adbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441602, "uuid": "48c8d376-35d8-476b-a721-b2a80c1e801b", "value": "df08638eae9735f03508a32548ed3e0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701ad30b-017e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629440309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440309, "uuid": "8c546e9a-0655-4dae-9f57-2cc9f14b138c", "comment": "Malware payload (Mirai)", "value": "265add4dc09c0143ae0317947f286bcc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440309, "uuid": "d61e4ef4-52c2-4dca-ac99-1ab45dc5e4bd", "comment": "Malware payload (Mirai)", "value": "55274195c77b8b2ef4207ec0153bd3638fd23e7f1cbaf4162ebb792a131cd733", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440309, "uuid": "7f784ab4-8c1c-4af2-bbbf-950a4e6c4c51", "comment": "Malware payload (Mirai)", "value": "1d27ff0287025cf95b2cb202edb1170bc3d1fab0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440309, "uuid": "f1516174-0e17-4a8a-a8d1-02dada55a387", "comment": "Malware payload (Mirai)", "value": "e9d8a2ee604869c62cd739df144b3212cf3e07423cc01d51f7d5d76788e1a80ad383ccc56d56490ff3fc8996aee07ea2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440309, "uuid": "2049800c-194f-4e9f-b761-5bec7defcef1", "value": "T1E723F1B8090046AFF859E670854A4F203C281F76D76F8D5FBAE9B58C06CB8E977076C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440309, "uuid": "6f50aa62-3b6c-4723-acd1-5016d7788f8f", "value": "768:4vdCbvsA9feQoKHba97aC4oW4tmWHPGUxqacIlyQ4uAQWTUZA4O/6CNuSJgGlzD+:4v8bvsIvJsQ0qaByQLArk3EuWVJuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440309, "uuid": "f3010f1f-3978-4dc5-a849-542ac8b2e548", "value": 48988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440309, "uuid": "b6f0872d-89ef-463b-8c20-d24411f753af", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440309, "uuid": "05050602-06c7-4d41-aa0c-6ae65d0d642b", "value": "265add4dc09c0143ae0317947f286bcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "486556de-01e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629483622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483622, "uuid": "e6857cf2-597d-4c57-958f-0ea5fb4c9bbf", "comment": "Malware payload", "value": "3edf6838968cab469299907969cb1092", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483622, "uuid": "aea673ac-1dd7-4c5d-8697-46258d5a47fa", "comment": "Malware payload", "value": "5799c24da8ba2d1a80ca802aa3f0d527faacbe1a162454d14e181aed7ff1b77f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483622, "uuid": "d387fb66-f39b-4917-a42a-f27a6f23a209", "comment": "Malware payload", "value": "a538115cea95c8e3c319cf12e8cad7e49206a2a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483622, "uuid": "283ba026-7d36-46aa-ac5e-6056d8f11aee", "comment": "Malware payload", "value": "b4410e522e4033bf49f8956b6486a464d60ff05e10be7442bb03e39a177489f407cd79198583261421d0db6bad394348", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483622, "uuid": "179ad4e2-dc49-4e1a-b60d-81d50c16da4a", "value": "T127D2D036BBF51664FCD7473E2460626503B9FA72852386BDB5C1416E092372815F2BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483622, "uuid": "63006a4d-e860-4f89-ad2a-f769c1b61dd5", "value": "768:tUipXP4CM+GgDvmiA+BLQlBU6NDFk/yGDV8F8LH:tjdwHPgDvE+RQQ60KgLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629483622, "uuid": "9c553048-b750-466e-a9a5-7e30c079201e", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629483622, "uuid": "71a2ad91-3c58-4051-aa3e-d9298c0348f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483622, "uuid": "581fbd8d-9697-4b06-b127-07468313d461", "value": "3edf6838968cab469299907969cb1092", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad7b1ba-01e5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629484539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629484539, "uuid": "d5f4cb19-6034-42d5-b7dc-8581989129f8", "comment": "Malware payload (RaccoonStealer)", "value": "061172bd4751a7fdce803061e139e43c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629484539, "uuid": "46da06d6-3809-4ace-a764-68e49c52edba", "comment": "Malware payload (RaccoonStealer)", "value": "579ef1b6904472c94949cbe7c01cd22901797bb4e8da54b6310754fd0bc9224a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629484539, "uuid": "61c1f604-41b8-4cf4-be16-6702321d34a8", "comment": "Malware payload (RaccoonStealer)", "value": "94d9f36f0d18d8740e16553c7ddd1fbd212d08c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629484539, "uuid": "53d5c650-4518-4d13-a8e4-2347c8e8092d", "comment": "Malware payload (RaccoonStealer)", "value": "5d220629ee27c148f8b22ea299fa48c0fbbafaf9b26c9120aeb3ab6162c380ecf3b58e041005cf8684a2d71d9563c766", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629484539, "uuid": "5a271134-38af-46d2-8a01-0a42e5278de7", "value": "T15064BE30B3D0C035F5B712B455B9937C653D7EB16B24D2CBA2D52AEA5A312E4AC30B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629484539, "uuid": "97cca973-d182-4a46-9d9d-4fe1cdf4ace9", "value": "e16577a15d2f4b952ae6a4b3a61075c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629484539, "uuid": "43382332-518f-4017-8abd-1cbea5ab5b8e", "value": "6144:3RMnN6muXvZx37UI5yJy7d5YljwEa4Hisrol5Q34Fj:unUmuXP37UIxd5cwvQisrIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629484539, "uuid": "d39fb03d-fd44-4bb1-a12d-e8e8e1dad7af", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629484539, "uuid": "53f8fd3e-9ab2-4232-8625-487768e166c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629484539, "uuid": "027ee599-1ecb-4d09-bd4f-3b134988da4e", "value": "94d9f36f0d18d8740e16553c7ddd1fbd212d08c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c87dc60-01b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629463523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463523, "uuid": "6e61fc8c-4cfd-4e52-84e2-889c8b5799ba", "comment": "Malware payload (AgentTesla)", "value": "bbe99fabbcc735969d7836a4c84bea4c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463523, "uuid": "d3756fd2-8c68-4bed-a339-5ac21920a544", "comment": "Malware payload (AgentTesla)", "value": "58851dcce027d248b0a5fac3bcd889c408ed56589d50c78f733fa665ddb9d0ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463523, "uuid": "b3217fcb-3f8a-450d-9fd1-9721b9c70fe6", "comment": "Malware payload (AgentTesla)", "value": "859c9d3f9c2f7b15e00f0293c54446ac94393dce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463523, "uuid": "df57db69-c4c1-4b95-a7ac-e0312a59138d", "comment": "Malware payload (AgentTesla)", "value": "9ef917abb4e97e7adcb8de6dce1dbf68e205527a54e0e760c91abc392a2eb1afa96cd73c4f59ca598e62e0dac48a44c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463523, "uuid": "1f56d75e-164e-4fd1-a9ad-56c756baa259", "value": "T151A4F1483355768FC21F8EB6CDA62C10E364A5375B0BD347A88726EC594E7CACB416E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463523, "uuid": "7bc04143-18b8-4a2c-81bb-0094913b2835", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463523, "uuid": "a267af31-795c-4898-84ad-e6d040ce25be", "value": "12288:VmR7QsladEgoaISG6STCldrCylKHInzxIOxhfrmwMT997:7i5NodrtlKHIzxH/C9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629463523, "uuid": "7f2f1857-0445-46ec-8022-61593befc613", "value": 474624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629463523, "uuid": "2e0b653a-f5b0-4f19-b9a2-269f429f0d6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463523, "uuid": "df881b6f-dc1d-4856-aa78-5f1ec015b1dd", "value": "New Order Inquiry Grupo Dani.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c13b9f6-0181-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629441430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441430, "uuid": "7a2f70f2-1abf-4eea-873f-db8bc9760236", "comment": "Malware payload (AgentTesla)", "value": "39e583028f2aec842858851886df6846", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441430, "uuid": "b031075a-66c8-4420-96f5-df550261500f", "comment": "Malware payload (AgentTesla)", "value": "58c0584a80bf12518e17cc0d734866ea52b11a33a8b3bf8ed945c846348cb046", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441430, "uuid": "3e081187-7aa9-44a0-b9f4-8db785ceb32f", "comment": "Malware payload (AgentTesla)", "value": "931b2809e7b669877bacbb3b6fce7c4912a469b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441430, "uuid": "f717b682-b97c-4e32-adf7-7b02a06dc66a", "comment": "Malware payload (AgentTesla)", "value": "228de3defc8a62f53d1d2445ea468259323e54d71fdcb200a68f6969c141dc824d1cc45250733843fe1dabfd04d62b91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441430, "uuid": "c9daaa5a-0d04-47a7-88cc-699996838ddc", "value": "T102F401287750FB8FC57FCE3688555C009BA1F1774707E7836C9322ED5ACE6A98A23192", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441430, "uuid": "fd1b4f77-ca7e-47de-a0a4-edffb69aa9a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441430, "uuid": "cca63a9f-fa42-494f-92dc-6f88dd220d9a", "value": "12288:SA5NByYhI5/zGrDast5ly8tGbw50pvC3ScG0DGAIkhJrMXbeJ/8/WZp68KBpJuh:SWNTO54DzkY5Wa3SL0DuCJIXbeJ/8/pb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441430, "uuid": "12d09574-9044-4602-a7cd-77afb79522a5", "value": 775680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441430, "uuid": "80f3d3a3-0e13-499d-a7d8-021186df3e74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441430, "uuid": "d54a4d24-5c33-420c-9ad1-e74c4602d774", "value": "39e583028f2aec842858851886df6846.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448ec9fa-01e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629483616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483616, "uuid": "7f11dd2c-16c2-42ae-af54-6b7b305c7430", "comment": "Malware payload (AgentTesla)", "value": "0955107728dae962ac0a54070c539caa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483616, "uuid": "1f2972e3-317d-47db-ab49-532d76658d00", "comment": "Malware payload (AgentTesla)", "value": "5911249fd81e0d868e6b50ecdaccdeb754137b67a5e3a1d1cf6a846258fbc505", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483616, "uuid": "4ac73c3a-818c-4e36-ab8d-262c363272ac", "comment": "Malware payload (AgentTesla)", "value": "cea3face327aefdb41b4d42df1d184dd72ad8ed5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483616, "uuid": "73128be2-fd97-4bb1-9684-043437d38e6c", "comment": "Malware payload (AgentTesla)", "value": "e3542d8c7a818c33f4ddab255c2eeefd9d273042fbfdea0d0d7fb1890b4752756406bb4de4dd3a39aab30c67501d4799", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483616, "uuid": "6548386e-5374-4e91-8f9e-ec45bf3bf946", "value": "T1B2242A562714D521CB5F527EC01A811832F1E703A72AD29F5AA2D8FA1F832CDF90BDE5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483616, "uuid": "7e24273d-049f-44e3-b3ee-9dbb6bb37333", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483616, "uuid": "faf8c424-9722-4a10-87ee-a0c9cd25143f", "value": "3072:0mSM0omKX/Edvi6IRVdbU9Bo13FLnHsYEkLASre7ElEPrQBuu7tyCVEwHyo/Fc8C:088k6IhUUpxnBdAqEP0ouxdaMyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629483616, "uuid": "df5598f7-dd24-4d36-97d2-d43c334dd17f", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629483616, "uuid": "f1ba3dc1-ac1b-48cd-9d53-da9ca5e76821", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483616, "uuid": "5c5ea803-8df8-4777-b132-7cd1c3c6147e", "value": "fyi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977424d9-01f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629492345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492345, "uuid": "8b26a2d1-8271-4042-9ca6-390df49a2fc1", "comment": "Malware payload", "value": "3cb66d271255d59945381fdc6fab9b91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492345, "uuid": "efb8f546-9aa4-495d-9f1b-ced300007d82", "comment": "Malware payload", "value": "5911ad0a2f2f76cbe6e83b58b95ac820aee88b7fb37e017275bd3984b3b92bfa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492345, "uuid": "cc81a0b5-645b-4437-9365-2cb9b71ab35a", "comment": "Malware payload", "value": "cba5bc5d238ffa84cadb81d8ac65c81c289ec74a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492345, "uuid": "0bc8f09b-b47d-46de-b813-09d4069e5648", "comment": "Malware payload", "value": "fa338c28ce6d002690be06e3d8821e8ee65c1839e64cf5f26ac9d1ba1962ea0ac4829fb18ee9c0a000c4a126d0945791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492345, "uuid": "ad05df98-a121-4315-bdc1-47430637e332", "value": "T1C556F107BC9064B9C9E5E23289B592923731B489073937C72F95A6BB2F777C41E353A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492345, "uuid": "91bc92c6-9d95-4c81-ad84-f084299ac7eb", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492345, "uuid": "8001d905-e915-44f0-ae89-4d3a7ca66f19", "value": "49152:ZvAR1erb/TkvO90dL3BmAFd4A64nsfJibC5IaYNPk6bs3xwXmUGzDrQMHLPSZaaH:ZvQpbwmAQQQQQQQQQQQQQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629492345, "uuid": "ffdc931c-061b-4c68-9d55-236d25d89e9d", "value": 6203392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629492345, "uuid": "7b8ab2c4-b724-433e-8f53-5d85a9166c2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492345, "uuid": "e87e0c09-bb16-41d2-891f-30cc6fc41cc0", "value": "3cb66d271255d59945381fdc6fab9b91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9447086-0152-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629421561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629421561, "uuid": "ae9b6967-b614-4ceb-a9cb-e19cc9618b86", "comment": "Malware payload (RaccoonStealer)", "value": "788045d291dccd0c7bdf32e1d8e2ae51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629421561, "uuid": "c644e654-d55a-4cb2-a63c-767a458e6411", "comment": "Malware payload (RaccoonStealer)", "value": "5ad7bfb790fc652df60360024af60578790930bb78489aabf352eae3fff103fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629421561, "uuid": "6756e867-3f2c-4861-9d70-bbac29c5f725", "comment": "Malware payload (RaccoonStealer)", "value": "ceda27c0b8d08c34d131575557a5ba20e797bbd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629421561, "uuid": "429d0c72-4c3b-47e8-b898-72f3c2fa7eed", "comment": "Malware payload (RaccoonStealer)", "value": "fea8b96e2755abb8dc71a8dab5b57877767487c1ee89e9bb2a3d2dae98bf11931084da0f487dc2b6afc9104430d7f3b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629421561, "uuid": "175e72a5-2565-4086-98a7-cf65e84ed424", "value": "T1552633023BDA80F7E593513AED189B32A17CCF954D7540937B809D29BB358EAC133AB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629421561, "uuid": "d3008815-ac69-4640-9534-32e20428beea", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629421561, "uuid": "32f3c257-f9f8-4514-a621-cd3e074edfed", "value": "98304:x2CvLUBsgj5x9GaxH9s8sKvdz0WV43wEdYUwGM:x/LUCgjb9lxHiCh0Wq3oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629421561, "uuid": "4fa59c21-d9b1-40eb-b38b-7621e2bbfad0", "value": 4426981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629421561, "uuid": "8a723c7b-28b1-4d83-9b71-4aff7022d4e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629421561, "uuid": "6cee5f6b-b919-4cb0-be86-6b511c97eef3", "value": "788045D291DCCD0C7BDF32E1D8E2AE51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbb8e44-01d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629477054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477054, "uuid": "cb2f8e29-eb6b-4481-aa6c-461edd2aefa1", "comment": "Malware payload (Mirai)", "value": "26cf421d008b0edd622dbbab56781bb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477054, "uuid": "cc3f2d93-cc1b-45ae-84c5-276e9278285e", "comment": "Malware payload (Mirai)", "value": "5b10a124174e83a9752b9dc8c95c3509f562a91166ecd4cfb34a06ea1816dee4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477054, "uuid": "1951cd2c-4807-4817-8f85-3b11da6e136e", "comment": "Malware payload (Mirai)", "value": "a123a7ef1b06c61984a4c6a9e653f35c1837c293", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477054, "uuid": "03911fd9-b69b-4b1d-bdaa-4fade5ad0a5b", "comment": "Malware payload (Mirai)", "value": "a3cda46124cd1a8f338ba9052bb5d74bfe5d27eebb358c0125bf5cb8806f80ab2e9c587e6740a9a5f504f47ecc9a9b0f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477054, "uuid": "5e3a723c-656c-4485-8be8-31c70e8d6fa4", "value": "T183731752B8829A27C6D013BBFA6E158D372567E8D2DE3213DD212F2437CA41F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477054, "uuid": "75106d36-4a0e-4cd5-9e28-f80b1b0ac399", "value": "1536:DVaVqWVELFQ1c0ST5OVSzXvvTK0jNiahW0o4NiM5gT7E35vbG:DVagWS5lfvhjNthrUM73t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477054, "uuid": "5e6972c5-672a-4d48-8cb1-6df29de08aa4", "value": 79552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477054, "uuid": "f0fd93f0-8416-471f-9766-7b4e23cdf009", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477054, "uuid": "804ccf66-9ed2-4918-a175-f213280c5785", "value": "26cf421d008b0edd622dbbab56781bb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbf94909-020e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629502338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629502338, "uuid": "3d92db08-9bde-4d73-beef-be5b03b26318", "comment": "Malware payload", "value": "7285d3b9ad2fee1969a22408f7efc324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629502338, "uuid": "1e00e6e1-4d95-49ba-a626-eada7292b459", "comment": "Malware payload", "value": "5b8b732d0bb708aa51ac7f8a4ff5ca5ea99a84112b8b22d13674da7a8ca18c28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629502338, "uuid": "29e5b6cf-1a0d-4254-86e3-373da1210915", "comment": "Malware payload", "value": "ef071f69df4a7ed21526804830d60a67c604228f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629502338, "uuid": "6d45eb39-911b-42bf-b273-3716d8a81bb8", "comment": "Malware payload", "value": "d72d5864076095a74cef65326675369e2279b0087b0f98d5d66165e2d33fdade6d1a8f1922b5a064a583188227a6330c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629502338, "uuid": "c5563575-c3b2-4cb2-a617-44388a1289a8", "value": "T1E472AE55F7AA2732EC3E4B358EE311662A30D6406C13FB6B60C541A77E275EA0A27361", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629502338, "uuid": "a28f509d-5485-47c3-b755-5a5e0a19a65b", "value": "384:YDN5on4oyt/EkGjJCMiA07sNBke2UggqQPGCIXjeF:Yx5on4oyt/EtjJANsbkhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629502338, "uuid": "ebf4ef1c-9178-4137-8cea-17402009e81c", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629502338, "uuid": "86443ddd-d982-49fb-b025-61a7ffa36dcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629502338, "uuid": "19ac3899-6deb-432e-8f36-2a0f057185ea", "value": "5b8b732d0bb708aa51ac7f8a4ff5ca5ea99a84112b8b22d13674da7a8ca18c28.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d407df8-0176-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629436842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629436842, "uuid": "ab966e62-48ef-495c-913a-a35e1d69e8b6", "comment": "Malware payload (Formbook)", "value": "a643cf941d79729759ddccb98aeb76c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629436842, "uuid": "54332eaa-52e2-4c9d-9f76-70fd5b4f7654", "comment": "Malware payload (Formbook)", "value": "5c6fbba6c71e8f32179d03a591f729e7ee5dbdaf9f89b1c476f01586625035ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629436842, "uuid": "b6d790d3-4a38-45e6-b13e-0e85d8e2cb13", "comment": "Malware payload (Formbook)", "value": "3eeef5faa8d399b5e084259aecb6e24956f17a00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629436842, "uuid": "96e86755-b045-4d55-a3da-98cba1f71e52", "comment": "Malware payload (Formbook)", "value": "8f67ae385e81b53ada0baf9102311a13ef879bac211dffe867a78857cbff74586e7cf12b18ba095db67090d03f981cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629436842, "uuid": "01c2ac2f-dca0-4658-9543-6c7ca7336044", "value": "T1DBA4F0553620B29FC41F8E76C9A51C60AB70A6BB530BD3436C4379DD590EBCA8F026E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629436842, "uuid": "e307c421-9c90-4bc1-9499-22dd0a1a24f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629436842, "uuid": "01342148-0376-40a5-97a1-d8f3768b026a", "value": "12288:lHho+YwllGmXaaZZJTVWWD7kEpU524S3uL8pCbSy:lBo4llGmLZNc2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629436842, "uuid": "ca5b407b-33bd-4242-a0bb-9b473013ca01", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629436842, "uuid": "1bd1e9d2-2016-4294-9bd1-df052818e488", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629436842, "uuid": "0c8d5458-06e5-4266-a568-4df44f97717b", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2d97e4-01fc-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629494525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629494525, "uuid": "984d25c9-a9ea-46e9-b286-ea1ca5fbe356", "comment": "Malware payload", "value": "89cc6c4d274d958d2462a86b00e0629b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629494525, "uuid": "57af3a6b-9405-460c-b494-65fa684db206", "comment": "Malware payload", "value": "5e32dde3db9a7d039d34767ac8a0e1ca7ff251f0200186b81408d70e807ccfbc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629494525, "uuid": "5b9bbccd-1fba-484d-ae16-babc4f75ead4", "comment": "Malware payload", "value": "3d755a1f548ae81f3c5875f5ffa467b6265981fb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629494525, "uuid": "4a155e9a-8bf4-4154-8219-bfb84feaa1c0", "comment": "Malware payload", "value": "d56439e5335d695230504f32744adcd9cdbe4bf65025fa830fcb7611b13c76f09723c8621128fe1353f51f8595b0e317", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629494525, "uuid": "5c058492-0419-4fce-a91c-c1c26a9ce9d2", "value": "T160141226DF00DD55C068CC3EAE554892778310C27B60ED5FA622D68F9F5E64F1A107BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629494525, "uuid": "b0d48bb6-1cd9-40c7-9a40-fc21d8a535fd", "value": "3072:61JEn5r2RvF1R/g+4lYLM6nxIJ4bImhO8jNCSqVbU5TXbzDWMN/Bg12LFAkQ:Vn5aNFf/g+4YnxE4e8qpU5LnDz/q12LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629494525, "uuid": "6e1f04d5-dac0-450e-aa8f-6beeb1fd9274", "value": 192066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629494525, "uuid": "6a9eb113-7fcc-4765-bb58-afcca2952d4d", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629494525, "uuid": "400aae3e-5751-4561-bcfe-73c21bd3e88b", "value": "5e32dde3db9a7d039d34767ac8a0e1ca7ff251f0200186b81408d70e807ccfbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33880267-01a5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629456958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629456958, "uuid": "97e4b35e-43fc-46a8-aaec-dbc141a7ba93", "comment": "Malware payload (Formbook)", "value": "67169c2852a353f1ee75de275bdbca92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629456958, "uuid": "18abb808-bdca-4bf0-8c0d-6ffe54cae217", "comment": "Malware payload (Formbook)", "value": "5e4a7a05fd61a82f8bccc6a21dfbcfe91310e4051a0fc7f2c358037a223e193d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629456958, "uuid": "89c01493-3d07-4891-8d56-6a89b2a20109", "comment": "Malware payload (Formbook)", "value": "79ad709092e60e48c4864e6955a6dc9bf4f9dce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629456958, "uuid": "d41f1230-5f11-4b3b-b57b-cf3a74c60b30", "comment": "Malware payload (Formbook)", "value": "31cd82f8aedb55b9b9df748446f1ca0ca4584dbfccdf61ca571aa7e8a697b68b1f3c00b33066905e87cc945f48978006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629456958, "uuid": "3c09ce8f-3f7a-4487-930b-cfadae923512", "value": "T1E045493D19B91633C5B9C335EBE59463B248985FB500EE696CDE03A7031BA8735C362E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629456958, "uuid": "d7528f2e-c244-446c-985f-2ab9cca7edf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629456958, "uuid": "941040f2-1724-46fc-8d90-1d399b9bea48", "value": "24576:SYjgge8319wMTQOK8sC8QV3wr0IFaCZsGUyA:Hjgge8319T0OKxTt0iWN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629456958, "uuid": "238f9ce9-00de-4618-82bb-c22d054e480b", "value": 1199104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629456958, "uuid": "9cd8f1e0-f22a-4f70-96fb-df9a2e2fa297", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629456958, "uuid": "aac132e3-5d57-4b4d-8e53-b9b6681c0ae4", "value": "uzorak proizvoda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35be0697-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629424320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424320, "uuid": "300e64c6-a4d8-4f9f-b52d-d1a85a3bc213", "comment": "Malware payload (Gafgyt)", "value": "b1c2d695e00fbbe944d04fa8b06bde1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424320, "uuid": "738d87d7-a1df-40a0-82db-b4fd5f883e2b", "comment": "Malware payload (Gafgyt)", "value": "5f78a35ad9022566e8924a99b1206c96cbcc95da57b41b81460e2b566874fd7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424320, "uuid": "6421bd19-8303-425c-ac57-04d215094842", "comment": "Malware payload (Gafgyt)", "value": "c975f0f64a392e847e056702140e44a08e5d2692", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424320, "uuid": "cfa33b3a-183e-418a-a0cb-04efc0fff2c1", "comment": "Malware payload (Gafgyt)", "value": "72634b2b61cb86c2e425604e65f907454b6cb4e84240d00f3c079102fcd8a132ff8d012079ddd0e8b99dd02bad409376", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424320, "uuid": "8c03110f-ba7d-4d75-8251-6e251ae4de04", "value": "T183E3E501F8885767C7E337BAEB9D438D773216AC67C733115A384EB42BC5B982A38560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424320, "uuid": "63677ffb-d92e-45a7-a788-f17bcd1d0b9b", "value": "3072:UEDfcOlkmQCnoV1+qXulsUKSa3VpU5pI5hLnwRv69L30PoCODQUDMj4AFx8:Xsea87I5hLwRvVoCODQUDMj4AFx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424320, "uuid": "83c66089-564c-4d7b-b2ec-8b75bc9597b2", "value": 145937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424320, "uuid": "4d021ce1-f4a9-47a0-a546-c3d98092863e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424320, "uuid": "ac0c7fa6-93d7-462a-886e-37524383769b", "value": "b1c2d695e00fbbe944d04fa8b06bde1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b708660-01f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629491036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491036, "uuid": "498446c4-979a-4576-b417-957d2e3545ce", "comment": "Malware payload", "value": "113db41da8155b317f84e9764ba1e7dc", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491036, "uuid": "3a8de36c-d6a3-4770-9be4-7251445415fb", "comment": "Malware payload", "value": "601e0e63ff7e1b7f8fffb42139c8a8049dc13b871840ddd08aa5933436582e1c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491036, "uuid": "63f7d290-199c-40ba-9727-257d5d864ccd", "comment": "Malware payload", "value": "1eaa388c6971e32dc1ee65a4a63008fe4d8be223", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491036, "uuid": "af038faa-f138-4825-82e4-d19cafc68b0a", "comment": "Malware payload", "value": "55acfcfcedb3eb028f9b86697cb17db561c870443bb0cbc092d08af57bb29f61ba6b87ce6074a404be8a145bcf567b23", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491036, "uuid": "9cde6122-78a8-416f-b7e8-2fe90dcc5c1b", "value": "T1D6F5338AEB815808E427453387473B577F0B291E47E52EFFC331544B28ABD948F2AE65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491036, "uuid": "d159be14-4107-4143-9234-1e713a375ba3", "value": "49152:OTGWSDpf4ZPqZsBo80+yBuGn3H6rSF7fPU41qaZHAFKPP3FTXnNxdGeCVfD2r2:G8flX80jBrKww6og1TrdG1Vqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629491036, "uuid": "19c8e62b-be88-4f06-98d1-23f05a96eb5e", "value": 3345727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629491036, "uuid": "56a57757-87af-41f3-83e5-aaf4b47a92a9", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491036, "uuid": "01bbf84e-696a-4feb-a7dc-fb5f8c00f0f0", "value": "Google_Play_Store.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056382d5-017b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629438842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438842, "uuid": "9ab03f8a-36f5-458d-bee4-9276d6a7f0c9", "comment": "Malware payload (Loki)", "value": "dc5a288495261c9516ce546c1d5dc2fe", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438842, "uuid": "d9777c9c-79bb-465c-b38d-91d9ac94d762", "comment": "Malware payload (Loki)", "value": "602787461573a5edc7b3f3e0b16ed1198ddd172f0c61cb1e76fd01c6c18cd375", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438842, "uuid": "a7a17e0b-a792-4ea0-800a-d0d9f3aaadb2", "comment": "Malware payload (Loki)", "value": "e80c7fb1427b4f0178301f12a3c7871e168c43d2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438842, "uuid": "eabf10b9-c5a8-4e9c-a40c-054b0112a350", "comment": "Malware payload (Loki)", "value": "b1ee62c7e19f4ca49e39b4f261e4d0ce2d2e7e790c69661ba2534d59d959d4e0afe6585f798a4bbe0238aebbd66ce22b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438842, "uuid": "2d9e9676-9e3e-4304-b3b2-afa163b95453", "value": "T1045512C2DB81D32AEC1B04771DBE6F2D05F0EFDE2241A60A9558F36926B3F20649716C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438842, "uuid": "d96c5da0-dd44-4395-8739-d7338df36ffb", "value": "24576:bM/BYOcTXPzM9UplHcLXcyLaxd7+qHEMTroKvBKI61e4kljz3WMNw3:bM/WOGsUpdcLXcFxd7dJTroSBokleMNq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438842, "uuid": "faa886a0-0282-4428-b814-d0e42009b6b7", "value": 1347176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438842, "uuid": "5d3cd5d1-8131-4b21-8cd3-279729de5060", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438842, "uuid": "094a01a7-8ac8-4f06-8691-5cb017d3be4b", "value": "Swift Msg.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d934c55-01ba-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629465941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465941, "uuid": "4ae993b1-9f15-4112-a464-59a7efad186a", "comment": "Malware payload (RaccoonStealer)", "value": "b159631a705d9275bab65c5449aa6675", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465941, "uuid": "9259a636-0659-424e-b1aa-607004762af5", "comment": "Malware payload (RaccoonStealer)", "value": "64781bc15996584b320f4436adc0b7fb1dd869664aab443ef3c1f1684b62c6e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465941, "uuid": "1758d7cf-e2cd-4764-82a7-5208858b223d", "comment": "Malware payload (RaccoonStealer)", "value": "19c356251fdee08c9d661639cd73c954387bbc1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465941, "uuid": "706777b1-12bd-4713-8137-b87c7521722a", "comment": "Malware payload (RaccoonStealer)", "value": "4c59bd051c764bae2facb7d419618069ffffa65e181db553404045ea7eca3b2a5f69a492bc9e69e93c7915722e76fc73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465941, "uuid": "4e36f861-cb17-4db8-8625-a2aa1aa18a4f", "value": "T17CC4DF30AAE0C035E1BB06F598B593A8683E7DB19F2451CBF1C57AEA26346D49CF0753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465941, "uuid": "4ad55aff-4345-490e-9892-b965098ea7f9", "value": "a8e039f6ffeb05815a04e81d73607108", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465941, "uuid": "1f142416-a5ec-4477-84b4-8c12d4485cc7", "value": "12288:vmoLyPoT0x3o0x3SFUuPxAhX7sZbvBiroW3A:+oy1o0gFUUxAtoZTBsoWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629465941, "uuid": "fd426f86-4d8b-4959-9568-10fe0462bb70", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629465941, "uuid": "c8a32871-e461-4bcb-83af-bdc0ae15656a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465941, "uuid": "2e16c367-a0af-4cd7-952c-30cb105869a9", "value": "64781BC15996584B320F4436ADC0B7FB1DD869664AAB4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ea2514-01b1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629462041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462041, "uuid": "891b2f84-4501-44ee-b945-1d27b0575902", "comment": "Malware payload (RaccoonStealer)", "value": "ad7a4b5c6bc9383e5a244fda169fdb00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462041, "uuid": "f3b65921-63ea-4b2e-b836-a32341dfc776", "comment": "Malware payload (RaccoonStealer)", "value": "65af64061884c6ff247e9bab07a94f778cebec4c55da07ee3abb916dee0ddd71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462041, "uuid": "cb645c35-5c25-416f-aa07-c9da86104ebc", "comment": "Malware payload (RaccoonStealer)", "value": "14b24a4a1b0ef73c9550a5788dc3c687d633ce34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462041, "uuid": "2228a0d8-1c87-44a1-a620-45a168614ba3", "comment": "Malware payload (RaccoonStealer)", "value": "0ae64570a1c63b3a9a77be50a7fa2cd55672756a8e6c98e8011cabb70027b47c86fa97f9f02539ff847ce536f49fcf94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462041, "uuid": "5769feb8-931c-4c69-a4b5-021fa558c152", "value": "T17C65125FA585B5BBC09F36F2740EE775A0649D6F0BE5C582238CFF0EEE2D2918916180", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462041, "uuid": "676f6072-9e28-4ca7-a7fa-09d02353ea75", "value": "667e6d0f434d248524103ade13b913e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462041, "uuid": "dcf826ab-e3b7-49f7-9f2b-ee71bd426caa", "value": "24576:sSLXsG83o1wTJIC0IhecVBgHigJujOTNNVJ7M/4/659fs13evY5MS9IEckPY:bcb46TJE1cjgHiyMOT3VJo/l9fs0vYN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629462041, "uuid": "f931dd29-ab85-4061-ae6a-4abb11c8e0ff", "value": 1536409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629462041, "uuid": "ed0df858-de5a-4a9c-95b5-5d8c40c4ef63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462041, "uuid": "c3f00e3b-66dc-4ecb-a40c-3da0081d04ff", "value": "AD7A4B5C6BC9383E5A244FDA169FDB00.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9840afb2-01a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629458845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458845, "uuid": "9cb73975-9785-493b-a958-73ac2691145e", "comment": "Malware payload", "value": "72e64cc1dc94a90fbb2b625d3a61957e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458845, "uuid": "7aba6c7a-5ab5-45fe-b72d-2a11ce17c2bd", "comment": "Malware payload", "value": "65b93f1505201eab6ac6e7d516db7afca0efcad6157dc666684dfc6c7caf5458", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458845, "uuid": "00b69b61-c016-41a6-9e8b-7d094965a805", "comment": "Malware payload", "value": "90b60ec6d8519ad15714c9849165a93ee0ab4c9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458845, "uuid": "e5288849-62d2-49a9-8730-1d264cc7585e", "comment": "Malware payload", "value": "3c2ff4e084463a3cfd8faeb73af175cc429882b205d0ef49210edc2613227596fe09d413e468c02e7542ec782fae713d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458845, "uuid": "2a6194d0-0cc8-45ef-971d-7cc12d724359", "value": "T14004BE277865C553C90D1B39E4656F473A78CD3949C1F389B0CAB3998C3838E49F93AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458845, "uuid": "48fa34bf-5201-437e-a2f6-20475006a1b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458845, "uuid": "612a6d52-006e-4bd7-b076-a067acc3f7b9", "value": "3072:stPg12PQyA2ySNLBkkbpekOBrXwDRlYNklZL7:ig2PrAl6BkupFWNkll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629458845, "uuid": "0ab98222-5f4e-4ffd-bc3e-46bf4d442069", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629458845, "uuid": "a2dd1720-9f18-46f1-9f77-c2c7e7cffefb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458845, "uuid": "116ca621-3faa-44f8-97dd-1f0f8c07336f", "value": "72e64cc1dc94a90fbb2b625d3a61957e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "873d4bfd-01b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629462682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462682, "uuid": "3cbf09a6-d59c-4f78-870a-3c1830ac011c", "comment": "Malware payload", "value": "c5b237b38ad088198018b8c9d6850d4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462682, "uuid": "94c71fc5-d8a3-4738-89a1-9029a5166665", "comment": "Malware payload", "value": "677263cf207099d83bd67a3b5c1a02a72e5533ca7d6636ea05036a5f79aa84ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462682, "uuid": "b0550be5-04af-499b-9947-9c9db3e71311", "comment": "Malware payload", "value": "5a514e0e9e4cec6a965ef0cf19d89ffe967efc26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462682, "uuid": "dd321fdb-2ece-4261-aa66-a3e024723162", "comment": "Malware payload", "value": "b257e24c83ca5c733ee8448032f9a59c28be530496fa6f0d4ec8a86b869b2b47f53d5277bc8ed3c8061cfb0114973480", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462682, "uuid": "f4e350e5-da49-4441-86a3-9846a943ae09", "value": "T1B615063C19B91637D1B5D375EBE49423F258985FB405EE69ACDE03A7030AA8734C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462682, "uuid": "5d022ed1-812f-47a2-be61-b4b6f2850015", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462682, "uuid": "b59d3ac5-b09e-4e2c-9f3b-f3415d77f1f3", "value": "12288:cZi9700tc+O5ueHISd1ZNSESFBSpg2TSBkZRG+ysVWEG+hiowTq31t:cZlv5u8I8IE4BugGSicYVVio3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629462682, "uuid": "922d3f26-ef42-427a-ba8f-4a7ec00036b7", "value": 908800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629462682, "uuid": "e278a6b5-fc5c-45aa-b351-e9c8fd3c7d59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462682, "uuid": "8a37ced0-c200-48bb-969f-aae492f3bb82", "value": "Payment_Advice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c12d85-0208-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629499460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499460, "uuid": "6030caae-9aa6-4e4d-927c-42c5f6f3e1a8", "comment": "Malware payload", "value": "b3cfc2e808be7cb4eb50a6dedf73bee8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499460, "uuid": "efb28460-7223-4e4e-ac9b-f669d3ec2c15", "comment": "Malware payload", "value": "684aa3d044556d1883bed06b737a297eac301d14872e1813b0e5cd78cefaa95d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499460, "uuid": "df38623a-fa18-40dd-9320-a24c77f963d1", "comment": "Malware payload", "value": "7b7afc5a4bec143f31833f952bc240abafcb1940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499460, "uuid": "5073fb0c-ddb0-4cd3-84e4-ee888dae0354", "comment": "Malware payload", "value": "3bc1c7c3f05d1c50cbab8797e18ad5dbc8f3d50bd430f903ea1d8e62405facf85b3b591956fee4144267ddc63d15104a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629499460, "uuid": "7532a56a-fc38-4cc2-9d2b-8626e851f75a", "value": "T1E1E623C4573A0EE7DC23D3B1C7B246B768E0692F46D3930AE86013A68A52F5D663DD70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629499460, "uuid": "43861c58-376e-4918-9090-6213793da1de", "value": "f4cf09dd5265ea802d83e943c2137765", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629499460, "uuid": "f2a2c326-d4d1-4bfd-ba7b-5b3b383d0211", "value": "393216:rClCHPNCEDmlh2pNU2ciIrHWicCukKwjhhWJiHt:mkCEDUQpNFILICCahqiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629499460, "uuid": "3d51355d-4270-43dd-86a1-c157de043bad", "value": 14177640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629499460, "uuid": "1019a3bf-09a9-424d-8926-ba8f96a50087", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629499460, "uuid": "d3ec804d-534b-478e-9196-d3785817f8f5", "value": "Vape Lite.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e2b739-016e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629433573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433573, "uuid": "14fbd2ac-c510-4ca2-87da-c85b26dcf0be", "comment": "Malware payload (Formbook)", "value": "de8c69d84e9d3efccb31651cf1d9ca4a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433573, "uuid": "188715c9-a39a-4f75-8267-4df3c1918518", "comment": "Malware payload (Formbook)", "value": "68a5d1f3cde5948d9b3d0c55942b19ca859f859af258cadcdc724351ee5e5401", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433573, "uuid": "8e136f93-c7d1-4777-9eb2-3b53940dfe31", "comment": "Malware payload (Formbook)", "value": "f37511be3e9f7948f3bbb77a2ac51e138d59d61c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433573, "uuid": "51991b0a-ebb2-416f-93c5-d49643096601", "comment": "Malware payload (Formbook)", "value": "a08e71e53993f40b66f97cc57caf34abf13fb2ecdf6f42822199a939b373eab9e9c719ed0f20aa0f1449e1b1ac8be053", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433573, "uuid": "f3fc3df7-62bf-4a19-beb3-24ab7bf64a97", "value": "T1B4E423CD6DA480B0DD1E6851BD26B1CCF88D25491FB1A176B25CAC2F71B301C2DAB8F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433573, "uuid": "933b21ed-39d1-4d11-a7c4-46c268acadbb", "value": "12288:1TQku+UELEHi799mSNI0/X6J73ZiyYm5JGSA4AmlSoTADRNQmc6DjCDmomKZ1Mpu:1TK+U52mzM6Z0mHGS5l0QR6Dj77uqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629433573, "uuid": "f2d35c9c-a363-4d3f-9cc8-87ad44ccc859", "value": 675216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629433573, "uuid": "4ed8c142-769e-4b6e-b104-b4ca3a3f99f1", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433573, "uuid": "e4c8e033-dd8f-4d9f-b370-b2ff1427c00c", "value": "Request for Quotation...pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfec0b64-01e6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629485138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485138, "uuid": "e72d02d9-00fd-4e73-af76-5267e14e2fbb", "comment": "Malware payload (RaccoonStealer)", "value": "6469ba473439696a2a0c87957e9a49ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485138, "uuid": "54c2269b-502c-45a1-9649-e7d0f9a57fb0", "comment": "Malware payload (RaccoonStealer)", "value": "69148105747e1f74106dfb122777b7b91ea987e691403d1e13e2a290158f5260", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485138, "uuid": "6ab004ca-bab5-4ea0-973a-ce1f0d56a5f6", "comment": "Malware payload (RaccoonStealer)", "value": "8b957b947af2231315835e37505db3660431a9df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485138, "uuid": "7066ea58-1d57-41c7-848b-8ad9db5f2e19", "comment": "Malware payload (RaccoonStealer)", "value": "ea44f026b19168916b521f1f580c3d18e54285b5995ae2dfa87be0333956e07c8bbde7f5429c9c6a833a47bec5132554", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485138, "uuid": "42ef185d-b02a-472c-90d9-d9731cc9f408", "value": "T18394021171B1CC71F7057570889685E0356AFD949E6103337E8B662E1EA2FF08A3AFA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485138, "uuid": "aacbd9b7-3174-485f-8edf-cfc128026e50", "value": "d9ba9c76f1c1b9698712bcd1010ec021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485138, "uuid": "11314e3f-e648-4a35-8528-4216db463ce7", "value": "6144:1eDR++jRR3M0h5GvexqpWRdBQ9OwFeeWOMCNXriiPC1g2bYcmzqKT8lgFnL:1e9++jnDkrERdBQkeWOMCtb8ecyBTZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629485138, "uuid": "f04c4ad8-8857-44cc-9f2b-67bdc5f70752", "value": 439808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629485138, "uuid": "f5af2f02-9fb3-4f98-8e6f-e13c284e5b8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485138, "uuid": "dda3e926-0987-4d6b-a9d9-34bc2f2c55da", "value": "69148105747e1f74106dfb122777b7b91ea987e691403.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71415d2a-01b2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629462645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462645, "uuid": "d4b9649b-3ba3-4f1c-a47c-bbdd4ea4f0cb", "comment": "Malware payload (RaccoonStealer)", "value": "ad8a3e6b1ad102cf25b67e3843ec2f63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462645, "uuid": "59e2059c-7bf3-4fc6-8815-b45f3e118257", "comment": "Malware payload (RaccoonStealer)", "value": "6954e84e27926d02a392f13fc11ec75b0a4e726fee013098dada32a43a2270e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462645, "uuid": "cc55d902-2479-4b68-a864-d0a1e8e6f5f0", "comment": "Malware payload (RaccoonStealer)", "value": "d9c17b1e4348bd872042df2ae644317d044115cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462645, "uuid": "3d2d8a3b-9f98-4c1e-a9ba-86354ad9a3c2", "comment": "Malware payload (RaccoonStealer)", "value": "5de054f640485f329901ca5847b35f5b33f97aa93f2468eda55c8412d52334373469b8353323c8f1516e1b7f1b808ef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462645, "uuid": "2c8ba115-3f80-4704-9de2-f8ab14d8f310", "value": "T15DA4F1D1B843E47EC489D5F00962D7B5373568952519068FAAA43F6B2E333E346FE2C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462645, "uuid": "36ed02f0-4a84-4682-aa56-0d55990d6c91", "value": "d1727cc76cb77410e59de4eb81f68a0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462645, "uuid": "50800034-9063-4bf5-9a75-8719b1ba2209", "value": "6144:SLpkSd7zYQmNWllRIPYmcoj9Y1X1jyU8fZ1RpNH1bhKakk3C1IekOqr887Vr4IPC:S1RpD+PnGPjyFRZzbhoI4U8BOOqPi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629462645, "uuid": "18d072aa-a2da-44e2-97fe-81877b0228a1", "value": 476672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629462645, "uuid": "67d59669-5660-4355-9382-e84153304575", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462645, "uuid": "7cb2609a-d20a-49d1-bbaf-2d440abd9339", "value": "ad8a3e6b1ad102cf25b67e3843ec2f63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37438d7-01e3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629483829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483829, "uuid": "0ff8375f-1be1-4fb7-b3f9-6d007bbc689d", "comment": "Malware payload", "value": "c44e15de6b11544c8939c89a4146ad1d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483829, "uuid": "c57da5f9-48ed-4445-9995-dfe8b413a7b4", "comment": "Malware payload", "value": "69bd19f78f689f6e4852f3be6f0b2d75ce32a7f8145794a0248c665ccaa6d59a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483829, "uuid": "08a8374c-6037-416a-9661-678efb8273af", "comment": "Malware payload", "value": "572e89e58250a4d453d7c786fab976f3714a1417", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483829, "uuid": "ce77ea69-97b0-4bf3-8298-03b8ebd98101", "comment": "Malware payload", "value": "0c6917b2711ae03b4e5a0e6354c5ea822ae3bce57608990ca8237904b1e3596127408bb582275869fb7a489ac68184ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483829, "uuid": "00795a4c-f65d-483e-90d8-6daece7a37a4", "value": "T19755167864B84927D4BAC3B1EEE59423709AAD5FB450890C6DDE3767127734330CBA2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483829, "uuid": "83711fe4-ec22-4837-af59-2f61ce3e4db7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483829, "uuid": "81443a3a-acfa-4c5d-ae21-d7f453b5f8e9", "value": "12288:luZi970TGfnGaM/tixNSxFwy6mSz274IG6S2pmCfJdcUY+Gk5CdS3:luZiGn/isxz2z2TYW9fzY+GsQS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629483829, "uuid": "8e837d69-6b2f-4a0f-b9b3-72da2a4df207", "value": 1306112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629483829, "uuid": "f95ab555-1554-4872-8267-3554cf4c7665", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483829, "uuid": "37ae6251-fbe4-4ec0-8ff9-33a892632974", "value": "Container ETAbest offer 8796___pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ace313f-01c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629471949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471949, "uuid": "58de4ebf-523b-4972-bdd9-2d1e620c6e60", "comment": "Malware payload (Amadey)", "value": "9aa792a1a28586afcb42e80c9ef2d3d8", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471949, "uuid": "b1664614-0903-4c4a-a022-60ada6ae39f3", "comment": "Malware payload (Amadey)", "value": "6ac1d6af900ec43548183a768163b626bcc3fa10e0722874203270b83cb5b851", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471949, "uuid": "c28fbbf0-41d6-4fac-b3c8-c297f1c08f22", "comment": "Malware payload (Amadey)", "value": "b96d61348eafebcca0895e09077298cfbda0f5f7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471949, "uuid": "106a619a-9d52-4966-909b-e8717f239111", "comment": "Malware payload (Amadey)", "value": "c6783e2425e39a2fbe74b3ff7a2d1cdaf4784dfae431656b57fcdc685070874662a9d6544e5bc4ef97a5b5b0f883580b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471949, "uuid": "97e57b09-f2b0-4dad-a1cb-62b52de7aa1a", "value": "T1A934E02138B0CC72C5E7553078FDDA60563ABDA55B6791437F8B262E3E312D09A36F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471949, "uuid": "1197ef13-7bc0-41b3-8202-cfb8ef673814", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471949, "uuid": "1b8d3701-9db9-4ee9-ad01-a839dd02fff6", "value": "3072:xv2H8xgTg+wuLOXKgCj2CkDGtsB7nD3qnCSTXcvijfo3QR/5BUJTzgFnLmS:VxgTgJuLOagCjQ5BnqFjwi5mgFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471949, "uuid": "8cfbaacf-9b6c-4f48-8d40-f4126b0a41d0", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471949, "uuid": "11e771a3-4edf-490d-b0c3-30b44b3a1c13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471949, "uuid": "a138582f-4c06-42be-a6cf-0f25777d4836", "value": "9aa792a1a28586afcb42e80c9ef2d3d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58afd37d-0172-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629435116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435116, "uuid": "e9515e4c-605f-4ccb-ae8b-b21c61759136", "comment": "Malware payload (Loki)", "value": "6713e66d74207f42abf5e27ab348b5c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435116, "uuid": "acd96cb7-d661-417f-a90a-125ad00816ce", "comment": "Malware payload (Loki)", "value": "6ad1a9114fabea8c23151bcb789a9867cb2345e7b65187e5443e6f76f20c7037", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435116, "uuid": "3ea8ca86-46d5-4c00-a571-e2875d44ae53", "comment": "Malware payload (Loki)", "value": "b5913c9562d2cb75bab2b49aaca6166a33bd5c6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629435116, "uuid": "dc28b5db-86ea-44ad-ba4c-48ceb7423a92", "comment": "Malware payload (Loki)", "value": "7be64d53dfc7bd82fd11d42fd7ef1a1402e354aee5df6e638d6909b8c3442e7fca2bc1afe60b5abe399188aafc367246", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435116, "uuid": "13bcf14f-1b29-47a1-b8e4-8ed378832f61", "value": "T107B4C011B8818072C673383047B8D6B24D6E6D312D209A9F97C87E756F74782EA35B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435116, "uuid": "7cd2756d-fa9a-4b9b-9e0c-d5e59065eccc", "value": "7e10d8f3c6a91a68257beb0c2e7d22cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435116, "uuid": "ef277be5-4a0e-461a-aa3c-7bcad87439ee", "value": "12288:fUgGN5bbCs0t0Eii1KWGV+Bc1v8cydPombrZRsADaP0X+:fUdEii1e+Bc1v8cyRzbrPsKhX+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629435116, "uuid": "ac3d784d-b590-4bee-bd33-966241bc7f65", "value": 531203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629435116, "uuid": "da2aa43c-e2ad-433a-a314-497fd216546e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629435116, "uuid": "27fbb858-a186-4b96-ae5c-7bbd3d71319a", "value": "Updated Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfbda772-0154-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629422431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422431, "uuid": "e820e21f-251c-4f71-b47a-9b97a8f2d7d6", "comment": "Malware payload (AgentTesla)", "value": "918428f4a3175d531c0cdb734a300b81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422431, "uuid": "08c0f215-30c6-4957-a031-2bfd53810168", "comment": "Malware payload (AgentTesla)", "value": "6c12a3c4cc664db51852cdedf7c28d6a4684228beafbabcb300900131544e12a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422431, "uuid": "2159aa70-0b09-4b6a-854e-69f2dbddf15a", "comment": "Malware payload (AgentTesla)", "value": "d732ad45ddcccfd4420fbe3f056d87c6d0a2d5d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422431, "uuid": "2c47eccc-28a5-47ad-b915-db2a8a3407f7", "comment": "Malware payload (AgentTesla)", "value": "130c0e1c395a9ee898facc08051de495dab7808e6b411e7adb151c57a57c284587ba1e985baf4e4966eca3aa46b132a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422431, "uuid": "e5c7ec8a-2650-47db-8762-278cae21e9a3", "value": "T1EAF4AE12A5808472DA723B308276DDBE086F7E717D30A65F578CB9361F326C29536B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422431, "uuid": "691cf8bb-af11-41df-b1ee-378e199544b4", "value": "7e10d8f3c6a91a68257beb0c2e7d22cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422431, "uuid": "c902fbb1-fcf2-4197-8d43-79ec5a1ff811", "value": "12288:VUgGN5bbCs0t0Eii1KWGV+Bc16/8apbdKiPrIcSt8cJ:VUdEii1e+Bc16/8apbfPCt8cJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629422431, "uuid": "abf96582-b1b6-4d88-b233-da292985827f", "value": 726487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629422431, "uuid": "843230c7-d4a7-43c2-8eaf-99e9fccdaa42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422431, "uuid": "0c5f12ca-9fb2-4e71-824f-41ff5097ecf2", "value": "payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a3eabb3-019d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629453534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453534, "uuid": "804e295e-f923-4a6c-b5e2-cfebb8a30ec3", "comment": "Malware payload", "value": "f9b9717cc21b3faf2d7387ae6d2c0958", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453534, "uuid": "6f873ab5-4fc6-4e39-ab56-b4174f521c92", "comment": "Malware payload", "value": "6c2f3787eafe01e876776b4ad14ee74e2b5df1483b7d8193b256c78572d2cf7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453534, "uuid": "1278f764-36a5-4a64-947d-a3e0552fbb0e", "comment": "Malware payload", "value": "ceb2b732c2de69d2b04c608616d40e64d4e72a24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453534, "uuid": "db2fd914-d486-4c36-9c88-b3e5e84695ab", "comment": "Malware payload", "value": "12ddd3923e5289f27e8022f2dafcd271ce684f4ad4859759c59099455fe0724aece14c222363e59db182ebf1388e2fa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453534, "uuid": "af635b8e-e611-4936-8bc7-67ab4f079642", "value": "T14225AD9C7650B6DFC867CD36CAA42C64FA60B876431BD303A45322AD9E4D69BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453534, "uuid": "661ae1eb-a843-4277-8dcd-4388bc33a624", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453534, "uuid": "1bc75e89-7736-4da8-8252-26a184dbd4ca", "value": "24576:XO9LEU+eZ5JpxjYOQlfNAzo+Lf+zkn7m5LjAZI+:eKU+eJplYOmFcoSkkni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629453534, "uuid": "703eae73-26c6-4aef-8f4a-f50bb4672bac", "value": 996864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629453534, "uuid": "1b1e6e49-4c85-4c79-8b37-782d0cb5d3fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453534, "uuid": "2017a7f6-f468-4056-afe7-a326a414d44c", "value": "f9b9717cc21b3faf2d7387ae6d2c0958", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a6ba5cd-01f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (BitRAT)", "timestamp": 1629490927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490927, "uuid": "0b86c266-1850-4ce7-820f-d4b8070d1c81", "comment": "Malware payload (BitRAT)", "value": "4910d6a23280578ab838476ea8bfdc9a", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490927, "uuid": "73a369c3-974f-47f6-b2fd-3c39ab0d7c46", "comment": "Malware payload (BitRAT)", "value": "6d9ae2b15c6995be94b84f2a1d86fc8945594215678711318c88a447263a201e", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490927, "uuid": "28949240-5812-46ed-a2b5-2384f51d5bf6", "comment": "Malware payload (BitRAT)", "value": "7075d8998729640a7adb8f9ddfacba408bdf3109", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490927, "uuid": "06ece45f-e589-427f-89ba-8642d4e6c733", "comment": "Malware payload (BitRAT)", "value": "451da069de757f32ef5a0e9a31e665d7e1a0d40bfb3b0d017f42fb506a6487cd478f3532ad0f988fe152320f3a7ee448", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490927, "uuid": "b847d51e-2173-4ad5-beb1-0ba5e81f82a3", "value": "T17BB5ADBC59B97627D479C675EAE58823F0409C9F3111AD65E4EA23B3032FA5234C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490927, "uuid": "e0aeedd8-7b83-4e5e-a1e6-e069bba4855e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490927, "uuid": "a230c824-4374-4238-bb3d-5ee587abc381", "value": "49152:gv2T1elN3tjmR35wgI46vntTd2sIDzh3emlFAlPTmow+VM:tBYN9SDwu6xIs4zhOmbAlPo+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629490927, "uuid": "2d5314bf-c59b-4f51-bd73-328c5d17e19a", "value": 2376704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629490927, "uuid": "95fd6c20-c1aa-4be8-8de8-5720a0da0f9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490927, "uuid": "efd102bb-0cf3-44f3-abfe-760186dfd954", "value": "4910D6A23280578AB838476EA8BFDC9A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413b6eb1-0180-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629441090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441090, "uuid": "d66117f8-4026-41dd-9dfd-f0186efa2ff8", "comment": "Malware payload (Mirai)", "value": "4ed34bb8f2b1da8e974d58f699905799", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441090, "uuid": "eabe0c64-5fd0-4894-a462-478a13bc3da6", "comment": "Malware payload (Mirai)", "value": "6eab642b93262b616033390c3d3e7b8f2cc3f5db8f4f9db6e74f45c4d2d54d4d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441090, "uuid": "b7153855-29af-4bb3-b8ba-451c1a2c1fc9", "comment": "Malware payload (Mirai)", "value": "3befd77e6b8a20cb096cf07ce79cd66ce63464bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441090, "uuid": "8064955b-8988-4c0b-8302-2ee59e519237", "comment": "Malware payload (Mirai)", "value": "3f4c712f23cd96b889e43959e2f7f14f57b83139d3472fd4a595c44a3c6ed56e65dd06fb70fd053b84f7331e902ec7f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441090, "uuid": "a2c5228e-c574-4612-b105-f1e43c070f00", "value": "T1CF23F1B81E038929D6A18CB4FA77C27357FD675AA5E23469090904FBB5C702F1BB6307", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441090, "uuid": "b8527a77-23ef-4f76-b5e5-7a0c39d4310c", "value": "768:Ksz7QhccjSzR30dED9yYYBQNMDvJvrJbEgg2jSydWeyqgrOs3Uoz8:PDcjSh0A8zGNmvJNpg2fPV2zz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441090, "uuid": "bd5d36ff-d94e-4f31-9b8c-8122808c3b27", "value": 46764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441090, "uuid": "605b57a7-16c9-4179-b4c7-710300c9483d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441090, "uuid": "ff07159c-d8c9-4e86-9766-8d0edb87eaa4", "value": "4ed34bb8f2b1da8e974d58f699905799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f78f1c-01d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629477046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477046, "uuid": "8125683a-8d0d-49f9-8f34-6fd7e084ceed", "comment": "Malware payload (Mirai)", "value": "34196e8d01649883d21910382d1e0196", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477046, "uuid": "5853a484-4f1a-452b-ac0d-94db137870b8", "comment": "Malware payload (Mirai)", "value": "70ed88618749fc3e81a40913e402855c77ce78ca28fef1b1ce09b7c9a1f8be48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477046, "uuid": "1a7debb0-03cb-4a08-a44c-3c4eb22f9a55", "comment": "Malware payload (Mirai)", "value": "74926b04219407c25434ba8c33892565bc68a2fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477046, "uuid": "a1deecc9-1eb5-4304-a96b-141ae6155c6b", "comment": "Malware payload (Mirai)", "value": "61f1c2e7948a9025e5b0ca4e7f40d316f83e330e00bca53984376fefdfb6d55bed1accccd036f98ef0a1de53d3b8f8d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477046, "uuid": "dacedcb0-4de6-467c-ab17-80d27613ba0c", "value": "T17D735C99B8019D3CF84BD6B964160E06BD31238947C30F2BA6EAFDE37D73154AE02D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477046, "uuid": "43af6770-8701-47db-bf88-1f00b38c03d0", "value": "1536:EGIDD1q5U9VFlymf1C8zk/3oU0ny93bjl:EBDJlTFlymt8/eyd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477046, "uuid": "61f6ba21-9667-4c8b-9b9f-3b819aea3dae", "value": 77104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477046, "uuid": "26d72ed2-f8e8-480d-93b8-3a915ab5ed94", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477046, "uuid": "625d2e00-156b-4cf6-810f-c1dc751ce77b", "value": "34196e8d01649883d21910382d1e0196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01c9d42-01bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629467475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467475, "uuid": "5bcd65e9-9fc0-4acd-aa84-54446270c1e0", "comment": "Malware payload (AveMariaRAT)", "value": "3e1793f39d9cb6102373e8aecbda99ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467475, "uuid": "c7f923e8-7a10-4fd9-8865-84cf0144de71", "comment": "Malware payload (AveMariaRAT)", "value": "73136a6c7bf7bc82849dee7af09a474dedd974c19cf8def9be508c28de5a4109", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467475, "uuid": "3879f92c-8473-4018-8453-c29c97b55c2c", "comment": "Malware payload (AveMariaRAT)", "value": "a257aadce96e40558f67dd21fb55d535345be999", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467475, "uuid": "2c4b14c0-ecba-4ad4-8f29-5be55534b808", "comment": "Malware payload (AveMariaRAT)", "value": "55a34ccc0813d84dd225eb3771d09d101fb32eaf75813b68e375cd96159cafd221cc68a94c9d17dbe895218513628960", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467475, "uuid": "6e635d1b-d001-41c6-9e1b-4646d5b6cf2e", "value": "T107A5180277AACE20C96969B84D6BDBFC1239FCC1DD2517D33BDC33AE1C711269A82651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467475, "uuid": "267f2ced-9a19-461c-8b93-69732e9f66c2", "value": "5a8ba3585208b07d92687708fb0bc513", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467475, "uuid": "d24a4a62-e986-45c9-8723-f97bab9d899a", "value": "24576:kl6AO+W19BgFQIOqoppwJd4LJMhXcsj9MUScYema8:kl6AOv19BKZopqJd4659MUScYema8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629467475, "uuid": "67596c8f-5bd0-4bd6-857b-12eeeeaa7a7d", "value": 2089472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629467475, "uuid": "f3436ceb-636e-4421-acc9-c051c46dbf60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467475, "uuid": "188fd1fc-155d-473c-b4d0-5377bc255a17", "value": "3e1793f39d9cb6102373e8aecbda99ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4bf36b-01d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629477325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477325, "uuid": "e3cc211a-3e2e-4d2a-8d12-20327df1c8ca", "comment": "Malware payload (Mirai)", "value": "208f6c10991efef60388171f41d0d4f8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477325, "uuid": "52541afa-e029-4c1a-94e8-9f07a372257f", "comment": "Malware payload (Mirai)", "value": "733013101a3299b588928ea6ba35c4812ed92db3a8e40a5295da39c42de29f4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477325, "uuid": "7cede450-34be-4090-ba0e-3546c291f0c4", "comment": "Malware payload (Mirai)", "value": "17462940f4d9caa3a63203dbb1db3dc2f2653ab7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477325, "uuid": "6c259d19-3fcb-40dd-8354-2cbd1592ff6c", "comment": "Malware payload (Mirai)", "value": "a6759bbc33b3e26cb7243ac8459332bd400c16f46406f8c69e4af9e809a803e59f7cc7e510f15cf270085ac3d85c695f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477325, "uuid": "f7d3af72-207d-46b8-bec7-1b4cf8020309", "value": "T1EE735B4272280B87D59309B02D3F5BE047BFEAD024E0B684695FDB568636E77104AFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477325, "uuid": "5fddc916-b1c2-41c7-9834-4d5fa17d52ad", "value": "768:DJIg/m3bjRyUOHCFmONm4MC18z6C4EDJsH/4JGeVL/QNUfJ9cHmeXgsjpyhDd7dY:NIg/IjIC18z6bk24xJ9+YDTkItwVnzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477325, "uuid": "df613040-473d-4fab-a276-899d08620357", "value": 75720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477325, "uuid": "bad1b795-16f4-499d-9b6e-0b5a5a01822e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477325, "uuid": "980d3dc1-3a02-4235-9a54-a2c46901bfbb", "value": "208f6c10991efef60388171f41d0d4f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "278d37aa-01ab-11ec-8fa1-42010a9c0011", "comment": "Malware payload (GuLoader)", "timestamp": 1629459515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459515, "uuid": "e5a12c65-8099-4145-9719-634dde647418", "comment": "Malware payload (GuLoader)", "value": "366a58f8429f0b50b86c5f24f04c99d1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459515, "uuid": "0d8a7ae9-3f30-441a-b170-172e48bacf25", "comment": "Malware payload (GuLoader)", "value": "73969152c8f24282f45900d73080334fbe498c96c60b15d72a72ebe0560e7e05", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459515, "uuid": "faad2251-4f7f-49dc-ab4f-468b76bc9422", "comment": "Malware payload (GuLoader)", "value": "d465033838d9168cd053873776a2da344913898e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459515, "uuid": "13f39370-d326-4188-a721-dda49bf18d03", "comment": "Malware payload (GuLoader)", "value": "d1756d493607ad61c13e43f10bd7070983a0cbc7fae4efc105b6f841a74bc3fb8c25f99e6217ebc948e8fc71b9f5f199", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459515, "uuid": "6a64a691-bf54-4934-8059-847a161b5225", "value": "T169547C2BF254CE2AF3F51B358EE6C69861A0BC165D81531B36CC3B3D1C31A516D22F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459515, "uuid": "6a8b31b8-662b-4d11-884c-d7098f5da13e", "value": "3072:Trf3NYMZWfujWkqzSGie/K3cDtpVbpqb8vIo:TrPNrZWfOXGpVbpu8vf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629459515, "uuid": "fc2130dc-04fa-482d-b5ba-708f510ec169", "value": 282624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629459515, "uuid": "c7c12060-da59-469d-a6df-6748bf5f246d", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459515, "uuid": "cd733a6d-1277-4538-ad5a-eac4bfa2ebb3", "value": "List-Of-Items.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038094e8-018f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629447429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629447429, "uuid": "e2737b83-b8f0-434d-a02c-9856d4a02c2a", "comment": "Malware payload (AgentTesla)", "value": "cd4cc9b78f593943aa5186d34a43a76e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629447429, "uuid": "abdba99b-bce5-408c-a4e0-60e6c5accb5a", "comment": "Malware payload (AgentTesla)", "value": "73f021d253821e0fd2a2f4f619eba982b20ca11f323a44bee488cba17a9b3876", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629447429, "uuid": "740d3817-55e5-4e86-a0b4-483832593619", "comment": "Malware payload (AgentTesla)", "value": "4d8b097402c1719dcd9e54c6ff2f4ebf5723cb62", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629447429, "uuid": "fbc63637-e6ed-426c-9eb5-2aaaca29dffa", "comment": "Malware payload (AgentTesla)", "value": "74c155c8f38eec57893ea1baedf9ba04963d5569583fc9aa5870a44d68421eb21aa68b68e030154fb674602c9ad4036b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629447429, "uuid": "2f2cc48e-7edf-4405-9063-279729166849", "value": "T19E455B3D19B91633C4B9C376EBE58923F148985FB401DD6A6CDE13A7030AA8735C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629447429, "uuid": "2e35c20f-69cd-45ad-9ac6-6c31cfab874b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629447429, "uuid": "0a65f682-6ea8-4ea9-8210-91e5187c96e5", "value": "24576:JiTggzk/g6JnkMiKaouf45Ht7gaQCZsGUyPr:JiTggzkpnk6aouMJgaQiWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629447429, "uuid": "b2fa34bf-2779-42b3-b682-83bf9e3f05fe", "value": 1265664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629447429, "uuid": "ec858947-febe-45f0-b356-d5cdaee051f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629447429, "uuid": "d691c254-c9a4-4951-b596-8727275d3812", "value": "SHIPPING INSTURCTION INVOICES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b04f12-0205-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629498485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498485, "uuid": "ffaa340a-907a-4725-b05c-3c1401626b57", "comment": "Malware payload", "value": "21bbb1625ea28415e3370304c8d02f20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498485, "uuid": "25647390-214c-4d0a-9d8f-de6cc0693550", "comment": "Malware payload", "value": "767a951ea1f41e10287199d95ffed5a84a94e1d33d82d519c91db89d37941f42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498485, "uuid": "99081b6c-221a-4aca-8958-0035653c066b", "comment": "Malware payload", "value": "0602488f6144d1443b63136c5a1531731da91daa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498485, "uuid": "692c1efd-94d4-4d4b-b2d3-75f186770651", "comment": "Malware payload", "value": "b8ab205d2876c37492fd669fd2621a8d89502972c0e12f735b34878e2117196bb7a7eff76fa2b8b7aad957bce30af9b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498485, "uuid": "3406056a-75a8-4a29-aaeb-e15bf152f2b5", "value": "T1E1F5029E7DD4B12DDE2B9D3B082080C5E619B468C087D45B02AC8681AD33F796756FFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498485, "uuid": "a2292ecc-37ab-451d-9a77-f1f83dbe3265", "value": "c6e51dda1622035b42b177c9afe67c30", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498485, "uuid": "75638940-00bb-4ecf-97b2-f376b9c39f4c", "value": "98304:KxWaFF9TNXabYp8d5b9/hqjybCweYp/3K:0BTNKQ8b9YubpRpvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629498485, "uuid": "0722af2b-e36e-4c04-a5d1-c27567e713c2", "value": 3581709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629498485, "uuid": "13b3b30e-aeed-4652-b71b-95b5fe9d9630", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498485, "uuid": "715aeeae-e264-4172-8958-f4bd5f404527", "value": "Antic Ghost Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcb1b3b-01d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629477031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477031, "uuid": "5e151f18-44bc-47a4-b151-c2b2a40b33a1", "comment": "Malware payload (Mirai)", "value": "14c23e1c41a9e28805a295fe42c731b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477031, "uuid": "f7a749f6-92e6-4cf0-ba16-9f220e46f6e8", "comment": "Malware payload (Mirai)", "value": "7686d7eb71db083dfe7b070112759132240870beb8354544591e3554723e45d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477031, "uuid": "dcb421e4-7e0b-4c08-b6d6-9c75a8e6abf5", "comment": "Malware payload (Mirai)", "value": "08135428de967e247bbc8d9ab85feb74be606155", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477031, "uuid": "901a38f5-f43a-485a-b9fd-8517d14f1324", "comment": "Malware payload (Mirai)", "value": "96804f8a20509155ebb231d57c3993176116563f3f37452b8ee17f910815a0831f7a4437d30d98153467ae82ed0ae208", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477031, "uuid": "900880ba-8be3-4cf1-a8fb-06aa832b93d0", "value": "T171A3D715BF210FB7E85FCD3719B92B05198C650A22E97B367A34D918F64B21F29E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477031, "uuid": "01c9c269-7d25-42a9-a6a9-f2590e5f16bc", "value": "1536:d2T+h2EiDWyS8gKoGWehUH+Il1PQhWR/S8Zx+6Z0IApeq2+:d2T+h2EiDWyaoWsa+ockx+6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477031, "uuid": "7680d5cb-abc1-458f-84b0-67559b2a8bee", "value": 101688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477031, "uuid": "384377e2-2483-47ae-b3e5-8db32a35dd59", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477031, "uuid": "0f7fda16-7fd9-43a7-9364-6599cacb73c6", "value": "14c23e1c41a9e28805a295fe42c731b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f32fe224-0169-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629431510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431510, "uuid": "f43c72c7-4a61-4e5f-af44-2b284134703b", "comment": "Malware payload (Glupteba)", "value": "cbd118707938b5d036ee0030e38cd147", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431510, "uuid": "872e4231-5e1a-45a6-b17a-5430ced9cc91", "comment": "Malware payload (Glupteba)", "value": "769a9ae9ab253e8cce64c35143eff02b2ae70e53465ab4aa4f6cf1b2d4fe698e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431510, "uuid": "4a28a4fd-7b91-46bf-a7cd-6534ec6189bf", "comment": "Malware payload (Glupteba)", "value": "d75ebc012670780a8825f21760494ef1b6da217c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431510, "uuid": "60518883-3efb-4a91-9cd8-92dcad1e8a0d", "comment": "Malware payload (Glupteba)", "value": "dfd6a677a49ac57d7752e8b408dd7e4a61e2452ed3417459682285dbeb64ade23e294e3712575dd0e828483429768e56", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431510, "uuid": "0059b52a-2ee8-44fa-a747-3a6a5d1de576", "value": "T149263322BF7ACE36C45639364E0FD14EDAEA1F49EBE48143F86B5A4A0D60062C577F11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431510, "uuid": "4aca6d1e-52c7-49ba-afa8-fc64a9812988", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431510, "uuid": "b8801107-7cec-4939-a578-436bbd237e8e", "value": "98304:31TzRGKPodCfDP8F2RbfhW1WuE4yPDWPCqKz9cT/m/DkgWxtyUW6B:F3wKPog8F2Rbf4Wn4+DW6qU9B/6yHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629431510, "uuid": "a2caf7a5-74c0-4759-98e0-798104633069", "value": 4558888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629431510, "uuid": "0b85fab0-7d4f-4301-ac44-31ac0530de4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431510, "uuid": "abcef395-f443-431b-b2a0-66c5ad01a757", "value": "cbd118707938b5d036ee0030e38cd147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580891bb-0154-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629422230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422230, "uuid": "95cd08d0-2d82-439b-a45f-58bfdefd66d0", "comment": "Malware payload (RedLineStealer)", "value": "42fdf557c2eaed4cde25c9bd9e0f9421", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422230, "uuid": "04da4b6f-6bb3-46a8-8546-b4ab3e84f6e7", "comment": "Malware payload (RedLineStealer)", "value": "76a21b0bee6ab30012baad17980251957c0b0e2117a6c17466258c3a5e6a147a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422230, "uuid": "9701f7ea-52b8-483c-9af5-c37aa0771ee5", "comment": "Malware payload (RedLineStealer)", "value": "beec39c2ce17c0a344887a47f4757e20e3df6b6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629422230, "uuid": "3028a9ad-d01d-4467-adf5-24efc7b4cc95", "comment": "Malware payload (RedLineStealer)", "value": "fc34f525cd947ac93e18f47c5a9b3a93fff6911b9b2136761f3538aa8b62ade3eb39bdf60ed646b5a31076adf115084a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422230, "uuid": "a8e2edd3-8117-4bdd-af1f-9efe4b72c140", "value": "T1C444F12175B0C173C453053089A2CAE06539AE515BB9D2073F9B27EF1EF1392A626FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422230, "uuid": "d1e2f4db-9912-4eeb-ad42-6cfa3e44c047", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422230, "uuid": "843db4aa-d2ed-49c1-a6c0-afa3adacd8e0", "value": "3072:lREqr6rTejFbFd37D+F9944/AyrrcvRST5Dj+AUR1AuxYVHIzgFnLm6:jd6/eZbFZ29ZAyrrcZ8DjrMAbHKgFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629422230, "uuid": "519a5f69-93a7-4112-97ea-b6e1b5f3714e", "value": 253952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629422230, "uuid": "622e2a9e-12ab-4973-a8aa-78ba49b7b2cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629422230, "uuid": "4490f7e9-d36a-4c06-9df6-4a5a7e7d8788", "value": "42fdf557c2eaed4cde25c9bd9e0f9421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "622ffdb5-0171-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629434703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434703, "uuid": "1a2131a8-a078-4187-be7e-4e452acf8dcd", "comment": "Malware payload (Mirai)", "value": "5b0be1c7971efe47a86660efc6809f4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434703, "uuid": "bc4bfa5f-e52b-493b-9e58-6c0f5b448a2f", "comment": "Malware payload (Mirai)", "value": "76a549181ae20a597cc40ea5d887f8f3ef48d368f8593a84067aab15c0574093", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434703, "uuid": "02e2ce1f-b2a8-4ca8-8b4d-c9043e217d58", "comment": "Malware payload (Mirai)", "value": "b0963b0a406be266f602a90d8bd593d90173c430", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434703, "uuid": "0319c3ac-f148-44b6-881c-a90379311765", "comment": "Malware payload (Mirai)", "value": "f864866880fcec815f9d0d203db85dde1e2df3dfcf67ed8f3e5e68a556e996a50b2d37c2c9222e384db28295469e5615", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434703, "uuid": "0ffd94b3-c29b-48a0-bf64-1cb5ed8d72f3", "value": "T15DD2E126E4B9D7E8E45D003A189DA60F8504F85E9352877A9FF5643F82F2FCA523D780", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434703, "uuid": "c3f59afb-27b8-490e-b861-4f32a0c27616", "value": "768:AQNQc+mWpt4RGjEw2onKBaBCo8fJyf9gEnBuzf6cWCo8enbcuyD7Uryqs:A0Qc+FU6ExonKBo9iyfOEBuj6k9enou2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629434703, "uuid": "3e8189ae-1d82-47ff-a45e-f48cb693ff8a", "value": 30860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629434703, "uuid": "e3ce618f-be4e-4791-9836-1c22e3b5acbb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434703, "uuid": "f0070f11-ab14-4151-8e62-5a24201360d2", "value": "5b0be1c7971efe47a86660efc6809f4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8cef0ae-014b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629418608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629418608, "uuid": "e3f57271-d66a-4e25-a057-373628278d74", "comment": "Malware payload (RedLineStealer)", "value": "c28767cd04b0a90ffc09c5e7d58ec760", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629418608, "uuid": "82727642-87e3-48fa-a1ef-e2529a036497", "comment": "Malware payload (RedLineStealer)", "value": "786011dec9484fb81863be557b51a2adba291cee4cc6c6f91fd21c2ce94cb1a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629418608, "uuid": "f9468c0f-af15-4502-bc2d-384a1585b96b", "comment": "Malware payload (RedLineStealer)", "value": "f68636d3c5379358971c63e14464f7930c57ef0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629418608, "uuid": "9a4d639c-aae4-4d72-9e45-a0ab35d43c13", "comment": "Malware payload (RedLineStealer)", "value": "db2a603f67723cfee1fcb73ce66d8b0d29934127a60fe16847a5cf258668e86877283867e6d3de8e8f502e0e0b8bed65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629418608, "uuid": "b9e7c021-8724-47c5-8797-8adc41269c9b", "value": "T14FE3AD1135F0C473C195353048A08EA0A67EF8656BB4B6473F6B637E1E316909B26FAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629418608, "uuid": "d5cb955a-28b8-4e2b-92ed-4b9dcd59616e", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629418608, "uuid": "48ad3f58-b252-48dc-89a2-794c1c3227ad", "value": "3072:xBX359/cUT58oj5RlaOERDrhO2zgFnLm6:x9J9/cG8YG1OkgFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629418608, "uuid": "5cd0d33f-6551-4b78-a2f7-ac0e4b7213d8", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629418608, "uuid": "90ca03ea-9a79-4000-9965-9593a6b0f9f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629418608, "uuid": "9a8862ab-f722-4f9a-bfb2-f50264f8acd6", "value": "c28767cd04b0a90ffc09c5e7d58ec760.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2846bd5d-0170-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629434176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434176, "uuid": "2b3dabbc-e3cf-4576-8e64-40038c2c0310", "comment": "Malware payload (RedLineStealer)", "value": "3eda59632a67aa35beb3417be7547010", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434176, "uuid": "91359941-fddd-401c-a18b-7474748e46b9", "comment": "Malware payload (RedLineStealer)", "value": "7868847d629d9e4466c428d9864475cdf3f3c39dfd0f92a1b6f89b5f41c0ec16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434176, "uuid": "3b8076bd-1161-41b5-9326-4275b4483750", "comment": "Malware payload (RedLineStealer)", "value": "29e27862c577d4f53fd7b7ee4bb1efd782c1e5a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629434176, "uuid": "522bdaaf-53b8-49de-808c-6def224d27cb", "comment": "Malware payload (RedLineStealer)", "value": "1d57d589968b0ec8dc760b9c6dae29708343118430afedbf356f0e0302604f7b4f091d465394c4dd13373d3c5767598e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434176, "uuid": "a3595517-78e0-4c8c-9077-825316d94737", "value": "T1A3162201A7B25035F4BA0A354A6B4E165EF37F2129E971152EF8F28D18731B2FB72721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434176, "uuid": "2913ea19-a69b-43a3-b5fc-4e51602e6384", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434176, "uuid": "cabf2749-a99c-420b-84a4-dd8486331a87", "value": "98304:qElTKuucpFQZ/kmmHgIlgbfR5A/MbtF/dIgKYdGyom:P+uT6TJkgbfOC/dqY8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629434176, "uuid": "b4f7472f-046c-4785-85ee-8091f9a73b3f", "value": 4074248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629434176, "uuid": "a4ee5c0c-9235-4f11-bf12-7c39ec335b86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629434176, "uuid": "71b2f3b7-2b39-4cea-8f62-41aac57d7df0", "value": "3eda59632a67aa35beb3417be7547010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89dd96a9-0179-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629438205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438205, "uuid": "acc59f35-5016-4b5a-9be7-4b61f38661bc", "comment": "Malware payload (AgentTesla)", "value": "f57263419fe0914beb62ae858a79cdc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438205, "uuid": "35b68f22-2377-439f-88b5-651683400cb2", "comment": "Malware payload (AgentTesla)", "value": "78d3ad16e57e8018301fae1a0ec78d3148a1ca1c1efe1e343c20a84861431675", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438205, "uuid": "43451805-478d-456f-a3f9-3d5334b7a752", "comment": "Malware payload (AgentTesla)", "value": "dc3a8ec321f881aa420f20a4a9ca8e324506e62e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438205, "uuid": "38101d06-2328-4384-a4a3-fb2181bff785", "comment": "Malware payload (AgentTesla)", "value": "0781cb8a337e159c20a0b12f2cf221b8994f3b44ee4279bb5edf3252c1d0415070b91665caaf8e4f6115e969730f5c03", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438205, "uuid": "29de4539-5f5a-4355-a04c-59b6b973a825", "value": "T15F9423CE123B3985D0C4142FDD28E16892A90EDD9ED4B65C9EC3A5783BB54EB2C5CC63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438205, "uuid": "24ea65ba-cb2f-4866-8555-adbf042c518f", "value": "12288:onoltLn/DxJQNcrEAB65HeZFsn25GSsrxR:0oTn/DTI5HeZ6n25grr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438205, "uuid": "c403b186-3f02-4e81-a47e-71331c8af66c", "value": 427595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438205, "uuid": "b28692e5-3ded-451f-956d-c555b59f25a7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438205, "uuid": "768c1c35-c762-450a-a092-40ce52bf1556", "value": "New order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f1b99d-016e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629433553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433553, "uuid": "632d7045-a04f-42be-8b50-0178a57837aa", "comment": "Malware payload (Formbook)", "value": "c489912068a72c74eb218562beeaaf8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433553, "uuid": "afb3270f-1878-4f62-b9ff-ddf95b7295b7", "comment": "Malware payload (Formbook)", "value": "78ddeffb28de453b1235da58833f3e8532635bf556fb2ef23e25aa58b15506b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433553, "uuid": "28271666-f389-4a67-8677-b204508e6bef", "comment": "Malware payload (Formbook)", "value": "6348afcd2c4645d983f6982bc3271646a3049fd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433553, "uuid": "b7d4069a-2c2b-4902-b694-c075ab0fbab7", "comment": "Malware payload (Formbook)", "value": "af578ca1ac04df6c9494bef9af574d9a7ec91d436e526c1d23381e3d54967c0cd35325ecf9e0f147347f58d08852102b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433553, "uuid": "4347c691-faea-4947-8d6e-27f94de587ba", "value": "T17015053D19F91637D1B5C365EBE58423F148985FB510AE6AACDE03A7030BA9734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433553, "uuid": "8b21ad6e-e8df-4085-9476-c2cf795cbd80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433553, "uuid": "5dd7c085-4348-4be5-bc25-ac010f9b9d89", "value": "12288:E3hYkBcPwb/nRlnGWsDzvFXQKoXVtnL+BpD2ePG72HrV7:hK/RlnE58fnKrvPG7gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629433553, "uuid": "8677539e-bbb9-4160-af27-6aba97218085", "value": 906240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629433553, "uuid": "467d6660-0806-494b-9827-f30c40fcad38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433553, "uuid": "be535bb6-f2f1-4f51-9899-f8ce509370c5", "value": "letter ref MAKRA-303GN-017921 Dated 19th August 2021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16113586-01bf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629468076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468076, "uuid": "5475666f-909a-499a-8cf2-3e8176c00374", "comment": "Malware payload (RaccoonStealer)", "value": "cf78810c40cbcb12fa07cb735e7f2db6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468076, "uuid": "6761ff88-c804-491f-b3ee-fe44831ad953", "comment": "Malware payload (RaccoonStealer)", "value": "78f958d430a4dec84e4126958d0bde722beab77f03f1ecd733ba94827997dec7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468076, "uuid": "54e47973-fb68-4897-b521-23e25b0f14f3", "comment": "Malware payload (RaccoonStealer)", "value": "89b0e2ab88c766fffc317819945ebf93243e12ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468076, "uuid": "5285a2cb-db27-404f-8dab-cd91521ed6a2", "comment": "Malware payload (RaccoonStealer)", "value": "57d6ba0f54987975eece8751d1bf541d3409fb093338af3c9a742d270fe2de17c37b6465a03171fdcaf3cc088340fdfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468076, "uuid": "b1008039-facb-4ef8-9453-17f3401d099e", "value": "T1CAE3BE017AF0C3B2ED9705314875DA90963EF8646FA086573E5B272E1E712C0DB2AF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468076, "uuid": "9d2a46ff-db5b-424c-b155-984846f363fb", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468076, "uuid": "779d3a03-b142-4d59-ac3d-db47caa1efd8", "value": "1536:2aCeHr0t2D9kCZvPTmOkZqbb9gE/+5Aym3rK/26UR5Q17/4vmzABFnLFBMK48o:lFcOhlp5FI2xR5Q1r4+zgFnLmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629468076, "uuid": "d2b8f89f-a5c2-413d-9314-df14630e7034", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629468076, "uuid": "a112c774-1279-43ac-b391-acdee229e2e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468076, "uuid": "d3b48273-6b29-4ed4-87a5-7777ad9a7a97", "value": "cf78810c40cbcb12fa07cb735e7f2db6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14293601-017b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629438867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438867, "uuid": "311858df-f864-4b5a-ada9-18070302e710", "comment": "Malware payload (Formbook)", "value": "4e74a70899aa1af8e8232012c343852e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438867, "uuid": "a238c115-e9ea-4fe8-b893-d8b1b45b22ab", "comment": "Malware payload (Formbook)", "value": "7b20de1d2525a1cad912a61ce5dddeeac439db2a5fcb18ddfbce96082e342a0e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438867, "uuid": "b2d906d9-745d-431c-833e-e9a8a05289e2", "comment": "Malware payload (Formbook)", "value": "13d5de1d0f50dfc0ee3d6a199173b324ee6e779f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438867, "uuid": "d162a534-68e1-4c0a-af99-c41dfe5abd42", "comment": "Malware payload (Formbook)", "value": "09f81f75574ea10337b5f001b71b7439fb7ca15819aa120a3e5eb7815613d2bb3101878ed763a33542da492fa95c7886", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438867, "uuid": "af62a7bd-f6a6-409c-bc89-92ef28aa56dc", "value": "T1B845122CB7A99263F5593CF2BD76836306C86E007100610797FBF09264B267BF94A4AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438867, "uuid": "2aa93630-691d-48be-b0fe-92ede015fe4f", "value": "24576:4eRwGYTdZQvRhM11q9a9cfLNiqEG1hqtIUyvDa7nvCA0KOOvp0jm5wk:jRwG425hM1oa9QNiKQyvGvwOvp0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438867, "uuid": "5d71378e-9f5b-40fd-8f73-a517d9403e4b", "value": 1201384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438867, "uuid": "ee679736-3b30-48b2-9732-f9acf6312432", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438867, "uuid": "018c25a5-bb79-4906-9765-a117e78ffbc3", "value": "19082021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af5bbad9-016e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629433544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433544, "uuid": "a136ffc2-8d55-4da9-bc8b-c569bf09d64f", "comment": "Malware payload (Formbook)", "value": "3170c18d47f7d8a188da758ac8018098", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433544, "uuid": "6d9ee184-bb8c-4e52-ba43-5b4ab40d114f", "comment": "Malware payload (Formbook)", "value": "7b72553cb79055a53309a3a8b771f7690cefe48dc0cad46d52a53cfb322e203a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433544, "uuid": "897c3c11-c248-4225-8c95-a52bf0b0e00e", "comment": "Malware payload (Formbook)", "value": "a8ad10f72dc61e3e1bdf88788725b7f941f03669", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433544, "uuid": "799cf2b0-130b-4ff6-b382-c9a48a38b706", "comment": "Malware payload (Formbook)", "value": "4bc741b5b5b3943ce7983d077a3085dd969a81fb3a398db2c2c177c99cacd8f790f7e118f9f2e27abf02045b89b69581", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433544, "uuid": "4e19e0c7-6948-4b52-8ba8-12ac3a2e71e4", "value": "T1E7E423CD6DA480B0DD1E6851BD26B1CCF88E25591FB1A176B25CAC2F71B301C2DAB4F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433544, "uuid": "a3289dfc-4758-4b41-b831-f3b08ce583f1", "value": "12288:XTQku+UELEHi799mSNI0/X6J73ZiyYm5JGSA4AmlSoTADRNQmc6DjCDmomKZ1MpF:XTK+U52mzM6Z0mHGS5l0QR6Dj77uqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629433544, "uuid": "7b1c1f9c-c596-466f-8f6c-0f1575584046", "value": 675274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629433544, "uuid": "5bfc9072-b106-428f-aa52-72186292795a", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433544, "uuid": "56b4f4d5-3bf2-4696-bf44-2c880d37e6ec", "value": "letter ref MAKRA-303GN-017921 Dated 19th August 2021.pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65329132-01f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629490972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490972, "uuid": "23436bac-2a26-4e1f-9e0b-094111d7f60d", "comment": "Malware payload", "value": "0b649bc5dbbf21801c21aaa5e5f79fc6", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "BLUELIGHT", "colour": "#14F1F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490972, "uuid": "edaf524d-f550-4082-9ea1-2fd2458412b9", "comment": "Malware payload", "value": "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "BLUELIGHT", "colour": "#14F1F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490972, "uuid": "f3771827-62a3-4a7b-bd7e-a5788c4e1220", "comment": "Malware payload", "value": "c644e8d446bb6bbcd4696d6a19d009b522258c9e", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "BLUELIGHT", "colour": "#14F1F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490972, "uuid": "90122da9-acd2-4f55-bfa3-7959384b0736", "comment": "Malware payload", "value": "8470c417d29d7fe0e8063253a34dd975f25405f071e9ff87ecce0b2968391a06135ae90c5be1cf22d992872e6963b4f0", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "BLUELIGHT", "colour": "#14F1F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490972, "uuid": "5cdf4220-d3ce-48e8-84f8-967b80c7df27", "value": "T17835BE61B283D032C4B200F04A7EBB2668BDFD250F364ADBB7D8195D5E744C16B3A667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490972, "uuid": "bd47172f-ae90-42e6-96a0-285c0a0e306d", "value": "183938668ab3224cfaf4850d7aef7fe5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490972, "uuid": "0ce2a6b5-3a35-4375-a055-69ad4f80a639", "value": "24576:OUzrYO5dkMxkKmzTk50aSdjVeszpojB0CAfkmh3U4A2K8ASRNbpMf5o5JWweo:OykM7KTkXSdvzpojZmJUj+g5oWweo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629490972, "uuid": "8f6c7f4b-3ca8-4ce9-a300-21092108fad3", "value": 1069568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629490972, "uuid": "6a6e9346-eefa-4faf-83b8-301f19ed5211", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490972, "uuid": "461e33b6-a166-4f3b-a9a7-b5403a7db5c6", "value": "7c40019c1d4cef2ffdd1dd8f388aaba537440b1bffee41789c900122d075a86d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98eb3f98-0187-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629444243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444243, "uuid": "a6dd17ac-fa8b-4a49-a8f1-79f455975316", "comment": "Malware payload (CryptBot)", "value": "0032903fbb10502ab650e9f0a489929e", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444243, "uuid": "30264792-cdfb-41d1-a3d9-8b0d9aecee78", "comment": "Malware payload (CryptBot)", "value": "7d251b498744a4f44c42f4cec028cbc965772e45248fc25aa999b5c0a109e6f4", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444243, "uuid": "f8e2a44a-edc6-43e1-a8ef-b2e26aadcbd3", "comment": "Malware payload (CryptBot)", "value": "4e411076c0b05a5f1d5f3160523b6d8164631926", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444243, "uuid": "af94c8ca-d1c1-4247-b795-5a0e5a79e83a", "comment": "Malware payload (CryptBot)", "value": "f835eaa7da0eab021f9a3c32e65b0a8912ffcac3540bbe097dc93d8698574b66e07fb5db319f3fde51027439f695c0e3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444243, "uuid": "53395bf0-303e-497e-8e5c-a5e1c0c14afc", "value": "T167B4123925F0C372C1271970CA2ACA942A78BD654A9092473F4B670DDE719919F3EF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444243, "uuid": "e3a05554-4911-414e-9dd8-e50eca5b8d78", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444243, "uuid": "152ab245-cf8a-4a17-999c-99ff8c15aba0", "value": "12288:Iu2eROxykhK2AvQBf9jByaxv9DQg/Y3SGyH7n0MEZL:yKc21vQ19FxeR39Q0M8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444243, "uuid": "8d6080ee-1c8a-4bdf-a898-48ca1e0e623d", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444243, "uuid": "cf0b8e8d-b318-4715-acef-7e450ef75430", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444243, "uuid": "6ef3dfb1-f7ba-4758-82f0-e12344a68709", "value": "0032903fbb10502ab650e9f0a489929e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c10cb1-01be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629467825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467825, "uuid": "5b2bf443-fa19-477f-a149-11f0cbf4eb0e", "comment": "Malware payload (Formbook)", "value": "5adeb1a8ee5c1e4248459931b9644817", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467825, "uuid": "4ba93723-5fc5-4787-9e0e-eeeb09aba35b", "comment": "Malware payload (Formbook)", "value": "7d47b1eaa9220a288db19efa3cf6990e42ca2cb02ad2994af62b6aec79cd97ec", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467825, "uuid": "0a984cb9-52df-40d3-a26c-27b9d966a428", "comment": "Malware payload (Formbook)", "value": "b491444b136ea3a750bc361adc7d87bb32dbfdc0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467825, "uuid": "1b690bf6-309a-4fe9-a6e8-b8e75a5377f6", "comment": "Malware payload (Formbook)", "value": "9e477de036b2242de1018a285a590f7fcbda292688696fa9881f304d74c685a0dccd8eed10a7cd696499f0070c96f902", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467825, "uuid": "30103df4-7e34-4b36-8c6f-b252a9e80796", "value": "T1E64512DABEA70B76E47F34372952838B3984EE593538C1862634BE52E179334472127F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467825, "uuid": "24b3ad81-bc6a-425f-a065-7e6714700cb6", "value": "24576:lrEDnKA9SjlxMYoAFGhpuhaDihJ7dmfyE54XQi05CtvUAZTNqzV:hEzKsSjlJo1hchaDiO36vUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629467825, "uuid": "51be2329-4971-45de-a6d0-99e65dc3098f", "value": 1229400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629467825, "uuid": "937d68a6-4f25-4a72-9182-26ce8d726dec", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467825, "uuid": "1a7cc44d-ef1f-4fe1-9d12-7f7c236c3667", "value": "20-08-2021 order confirmation 2111304 Polyvim.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c55e4c6-0209-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629499896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499896, "uuid": "726799dd-831b-4874-add3-2968c77e19a8", "comment": "Malware payload", "value": "03f03027f6d1f021e845b23cf3a15aea", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499896, "uuid": "d2a51efe-f6a0-4517-9d88-db8c2e33f827", "comment": "Malware payload", "value": "7e914e4c0769a7a1dcf7d3a06160bfbd9f7b583695ccc9282854c2946b0321db", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499896, "uuid": "9af1dd72-60d2-446f-a9a0-23926d7dd469", "comment": "Malware payload", "value": "76d1fe6ca6ef8bb7f03574c60ec5259c9dfd6bf6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629499896, "uuid": "dc1ad0f2-c7d4-4f94-b32d-dd273d80fe55", "comment": "Malware payload", "value": "11a7e4c71bd98b956b99aab305fe0a1153c77bc25e6bebf2fe6df270283d231d11b7f0f1ed0e19f0ce581a00a61eeb0d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629499896, "uuid": "70b694a6-53ee-4e6d-b4c1-68e3eb5e260f", "value": "T14CF53308BBC3491EE93B8532425F2663BA18112465F9633F02774067D4E6F988F5ED7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629499896, "uuid": "6659bebf-9d58-48df-a520-e5eabd3c5741", "value": "98304:u8u3g1G0eluSakIJ27zhQQCiJawwTosko1m:03WG0elJaXyz3CBvVko1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629499896, "uuid": "da560642-59de-4b98-8e41-dc56fcf4c812", "value": 3375375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629499896, "uuid": "f8a585ee-c795-49bd-8320-a5c278fa4dd9", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629499896, "uuid": "fe007f38-aadf-4e7b-8d3a-56ce028796eb", "value": "Porno_Izle.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c99b87-0198-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1629451479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451479, "uuid": "fc85afda-3337-4ae6-975d-ea32f9c4b26c", "comment": "Malware payload (AveMariaRAT)", "value": "6452a476398bc73e815078a0342425f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451479, "uuid": "c8f85919-ca29-4419-86f2-7e879a59a2b0", "comment": "Malware payload (AveMariaRAT)", "value": "7f6b099267911103a2ed4968d73900bbdc667fde2d574fe8300f891a25a33f55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451479, "uuid": "fea31418-f963-4376-a634-030752049478", "comment": "Malware payload (AveMariaRAT)", "value": "83e43bc2ad75844c5e7a474aa009acaed4244a1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629451479, "uuid": "f5bb5e86-909d-409d-a8c0-f1b0de25968a", "comment": "Malware payload (AveMariaRAT)", "value": "fe508d8cf44f71f756506293905a802f07067a33f30d76979d4a29028f40cc17823900a0d3cc4875743dd173191626c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451479, "uuid": "e3df4bc1-777b-4177-8632-3e836f63b5bf", "value": "T1E0B39E13F7E54835F3B201B01ABD7E7ACBEDF9700628C49FA394858A2D31946E925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451479, "uuid": "9076731e-7633-4063-b2d9-f1fdc1e0de2a", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451479, "uuid": "dcf9844d-98a9-4731-a22a-6f7c888747a5", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629451479, "uuid": "d8c4af44-ab66-4511-895b-7de381184fbc", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629451479, "uuid": "0705e02b-8c5e-403e-aa32-178a6d9335f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629451479, "uuid": "e8fb0a00-78d6-416e-9502-e40131a6fa7a", "value": "6452a476398bc73e815078a0342425f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee899da-017c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629439341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439341, "uuid": "e89ad6ce-86c2-4ce5-bb57-3e2bbf3a337e", "comment": "Malware payload (AgentTesla)", "value": "81b207b96d9a93961ae4ebbe19ca614b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439341, "uuid": "a242fafd-a22b-47a2-8973-0861500c36f6", "comment": "Malware payload (AgentTesla)", "value": "7f76b7a992043d4a9225ffb70ff2194b472df9f65fd9949d92ccc17a020dd6b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439341, "uuid": "86ef84f6-7462-4f1d-9cae-605a974c340b", "comment": "Malware payload (AgentTesla)", "value": "5a0540450ffba4d3adb4437aea403894f345ff57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439341, "uuid": "95216598-79b2-41ae-bc1f-4a53c9789046", "comment": "Malware payload (AgentTesla)", "value": "a22402b1b38cebc6f5cea697fea28141bd797003d5a6c2a7f37941a1160b0dde06f587e4e4737cd88e50fdb06b0fbefb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439341, "uuid": "009cb1f9-55a1-48eb-9bda-20ad8cb7142b", "value": "T10C454A3D19B91637D4B9C375EBE58523B148985FB400EE69ACDE03A7030BA8735C362E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439341, "uuid": "deadd28c-bce1-48d3-95ad-b93fb52d665c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439341, "uuid": "9c8a941d-bf43-49dc-be17-0d47b3ba07a8", "value": "24576:mHgg8l1l8jh9007zg9cdKWX/0svCdXlCZsGUyL:Mgg8/lM9007qwOViWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629439341, "uuid": "21f8b927-4e5e-41d7-9f2e-ccd4bd998928", "value": 1216512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629439341, "uuid": "fdf001a1-c868-4d6d-9b67-c0eeb14c96d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439341, "uuid": "4f9a8c84-3456-4d38-b875-b57cec97757b", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.14546.2817", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac2f363-0158-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424060, "uuid": "fea2e4ac-3268-4071-bfbd-34b75f653d7d", "comment": "Malware payload (Mirai)", "value": "e879adf4ca5701581f287f03a1ee098f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424060, "uuid": "d2529d8c-96b9-457a-bb19-95e33bb071c2", "comment": "Malware payload (Mirai)", "value": "81e1027891322e97ee9caa6be25e20a26b5933437357db4c9aca9dc00c28d6fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424060, "uuid": "0abc47b9-07ad-4155-b2b4-7f1977232667", "comment": "Malware payload (Mirai)", "value": "a35a811de20c89b13e53221ad32c8bdaa92000d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424060, "uuid": "cc13d685-3545-49a0-87ae-aae69b94eb71", "comment": "Malware payload (Mirai)", "value": "61c0c26a38e18723eb8f109dcef5f7d96764f39f490dd113627722cc5e19076f71f489e17467a2565ba155d75f8b6a3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424060, "uuid": "a8f2e6e2-fd4b-48d5-899f-8eeee57742b6", "value": "T181330991B9824E6AC9D513BBBA6E55CE332023E4D2CF7313D8201B543ACA51F0E6BF41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424060, "uuid": "3db895df-429b-458e-a543-90313d2465f5", "value": "1536:/+6AkY6wggbL6DCgz7P7BWy4LpEyT1maBy21TNA:BxwgKLAC0r7gzLuyT1Rs2VN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424060, "uuid": "34954946-8209-4ac2-a24e-cf7f260a997d", "value": 50800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424060, "uuid": "1e3d78bf-e0c5-42c0-9078-57bfe8f73fd3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424060, "uuid": "466a23ba-184e-419d-91a2-d3657b90272a", "value": "e879adf4ca5701581f287f03a1ee098f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0987b26d-01b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629465048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465048, "uuid": "5764ca73-de0c-4f87-ae94-5c9f870f02b0", "comment": "Malware payload (Loki)", "value": "e8219295cc4ac381cd048fe816926147", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465048, "uuid": "d87bf70e-7a24-4f29-9c91-546a62a00e19", "comment": "Malware payload (Loki)", "value": "8262b2bfaafdeac857fc62dad45d02cdaddb8457f317549b3176717c1223c790", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465048, "uuid": "4ff2e2bf-baa7-46fa-898b-2e22b69a07cc", "comment": "Malware payload (Loki)", "value": "0a55a3b854b5d6a88562da2d31c33bf6f10a7b89", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465048, "uuid": "0257beac-94ab-42bc-b5e8-203df98dbc4f", "comment": "Malware payload (Loki)", "value": "c832354862e4c568378ec678781a0483ad4aa84ab902eaa1a2838cbadf30b0f86faf6b36605d7382236ba0bdb83d82fb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465048, "uuid": "668e9db9-79ae-42ea-8262-8785991aa268", "value": "T104C42351A35B4AA283794BA9B93927E3B7C33BE26195B10CFB63C511346CD08F96434B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465048, "uuid": "751f986e-f4af-4b48-9c54-d27158512715", "value": "12288:QtaBzTvJ+DFn/sq7mugyIfxazLfRQ7QpOauaEGqybjd7st:TBvB+B/DSyExazLftiKL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629465048, "uuid": "969c593b-1f3b-4e41-853a-0e0dca8b3019", "value": 547845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629465048, "uuid": "74838eed-0e2b-4ef0-a19c-fdc91ea356f2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465048, "uuid": "56a27ebe-2246-4755-a980-4719173c7101", "value": "087cb4fc52df1c6d245ce0f1486b2c1d3020349d90546eff9700666facf694da.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7dfaab-01d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629477317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477317, "uuid": "aed7124d-0d75-411f-9884-01423ec4c859", "comment": "Malware payload (Mirai)", "value": "7f7fbb358f385c37a3bd6702dd4e66c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477317, "uuid": "87214d46-5a76-47e5-8773-96d0c66644c6", "comment": "Malware payload (Mirai)", "value": "840a1de6bf418fc4d62e1ba441e74b9c9e36617a9d0c40538c254c6c7be0e17f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477317, "uuid": "164fb1ed-4a3d-45cd-bfa6-1a75fa21b602", "comment": "Malware payload (Mirai)", "value": "27cc516f9f8273c3ae756eebc9b24479bfda41b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477317, "uuid": "3120f3fd-f933-4c3c-8092-3c4b0fe1eed9", "comment": "Malware payload (Mirai)", "value": "7af76fd9c0ca1d88ef773590a79fddc6f8c8cd41b91c445b8842f1c32a2a87d2401c47ec762759d63b07579834745cde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477317, "uuid": "d3d56d6a-f6eb-42a2-9b7a-c9ce9fe70ca0", "value": "T1C2734B31B9392E27C1D0A47E11FB4B15B6E12BCE26E8C61E7D720E4EFF116506412EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477317, "uuid": "5808ecb5-6f41-4894-95a9-bdbd6dabf1f3", "value": "1536:CTwQHPhzG8j9SOxqAxSS/iUjggM4xqCJGhoUpHS:IVTqytFepy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477317, "uuid": "b1f062c5-8b91-42f7-8858-0d260677ef3c", "value": 80168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477317, "uuid": "59486642-054c-4561-93e8-131e47550773", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477317, "uuid": "d4d0b46f-81ae-4981-995d-9857abe7e9f9", "value": "7f7fbb358f385c37a3bd6702dd4e66c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bc42a0-01d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629476742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476742, "uuid": "9e9b0429-98b1-45c2-92e4-e8c329df8960", "comment": "Malware payload (RedLineStealer)", "value": "9a32d09b3ff7d36351292f34f98d1d35", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476742, "uuid": "6bc83953-1be1-4b22-bf98-433654612a2b", "comment": "Malware payload (RedLineStealer)", "value": "8657e386693f95e28e69b6a24876daa5f54052fabb2b6c2e1238bc55b6d85b09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476742, "uuid": "1b61d2ce-a9f1-4e44-8f62-6c3f7afed317", "comment": "Malware payload (RedLineStealer)", "value": "17d987ec42717afb1f9ab2143696a6111b9a5599", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476742, "uuid": "36952c01-7289-47ae-ac33-02fd1af77501", "comment": "Malware payload (RedLineStealer)", "value": "5c747843838c9e582cf207072858e963b517957e725144dd22fec1cf1c5778979445259351b9db99cc3e4d61356a2e83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476742, "uuid": "2f1ef0a8-9c86-4786-9df6-46b166073966", "value": "T1F6E3AE11F5F0CDB2E152053149D5DAA0663DBD20AF6486D33E9B221E1E612D0DB2BFAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476742, "uuid": "595cb340-ab0a-4108-8edf-5f71cdd36aac", "value": "d9ba9c76f1c1b9698712bcd1010ec021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476742, "uuid": "3ee53c53-1c6f-4a4b-8df3-1a87f4f23e0b", "value": "1536:nFUqjNONMpj0l6pEzMizNuM+8ScKHJLBvW36BAR7paGJNNXsY1zABFnLFBMK48E:W3PtzH+RHrvLBAR7TbpzgFnLmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629476742, "uuid": "f3754d27-2ced-493e-b3c8-d14f35a4649b", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629476742, "uuid": "ab2db476-5339-4023-b1f9-85e40c606d35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476742, "uuid": "67f88db1-d32b-4140-bb20-5bac30a32326", "value": "9a32d09b3ff7d36351292f34f98d1d35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3cf888-0180-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629441112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441112, "uuid": "66627c10-a564-484c-a41c-12fa0aefc02d", "comment": "Malware payload (Mirai)", "value": "85f270a8caf8aae7444d65a54f95583b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441112, "uuid": "202873b1-7e9e-4da3-ad6f-e0cb7249139e", "comment": "Malware payload (Mirai)", "value": "8895df091cf50dc46863d8fce41389dbe70f23b47f26005aa8bb7855eaf711cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441112, "uuid": "0e40b13f-81dd-49c9-88fa-a67f115ecf2c", "comment": "Malware payload (Mirai)", "value": "c6febdd465b25a84045c2db897f3c23b422b1ad1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441112, "uuid": "421943fd-5fe7-478c-89a3-c331598b67eb", "comment": "Malware payload (Mirai)", "value": "836163164ed50aec9786f9ac6dad08e8a78296fb366a9312932bc63ee52c2c8c79bede4430db85c360be794b0f04a158", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441112, "uuid": "991508b4-7939-43c9-a8f8-f09a8b97b79d", "value": "T1F6731200816125D6C5254D7FCCEC4CC2B68349DEA193BCA33790CA793DD2F6725AA3DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441112, "uuid": "59cf3111-49c9-456f-8aa0-6bc291be7ec1", "value": "1536:+bB0/O3GbJ/aqLz/6UG4tUUDLCT6IADiJLw1LMrx6q5fX:t7JzCUXtUcLc0WLw1LMt68P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441112, "uuid": "88f10790-dc16-41da-b592-56f3ba594e80", "value": 74448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441112, "uuid": "8e492c5c-a4e3-464d-901a-fccf9c23649f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441112, "uuid": "20b68951-af5d-4814-b547-11352bfcade4", "value": "85f270a8caf8aae7444d65a54f95583b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db761cd2-0161-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629428034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428034, "uuid": "86313ce7-54dd-4274-b72d-d3fb0961d2a9", "comment": "Malware payload (DanaBot)", "value": "d157c539679f91462ee6e2cff76acae8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428034, "uuid": "cdc50020-57fc-47bf-8af2-690040f620a7", "comment": "Malware payload (DanaBot)", "value": "8978d903a382c93f9cafe1102cc82e66fa467a151cf925bf0024192e24d71874", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428034, "uuid": "b8b83065-1ee9-4cd3-b456-0a95bc47e7db", "comment": "Malware payload (DanaBot)", "value": "b0151b8da860dfbca242e6be6dc80bdc5ececf06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428034, "uuid": "760e78c2-7510-493a-a94e-2f8625801015", "comment": "Malware payload (DanaBot)", "value": "4697548acff69b46f3a224216dedbf37610cbc5a27f38d4223f3678bc1c8dbdedd9967d8577c1d704120316f16b86f1b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428034, "uuid": "a8381b72-6958-49a4-a922-e201d18f70df", "value": "T17445331577F1593BE6F24D75CAB4A26BA577FC91187AC81F33C0898C3E80981842BF99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428034, "uuid": "7c8ac549-d882-4852-8135-72d31dcc1af5", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428034, "uuid": "ebd6f66b-dbf0-459b-bed3-882f41815049", "value": "24576:kWjmOm71ZuollCx48MlE6gSmpsaIVGA1bsnp7gVmP0rURv:bqb71ZuollHBssXI79c+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629428034, "uuid": "0563e2ab-3629-42bb-9bee-eff7f26ea37e", "value": 1218295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629428034, "uuid": "61ca84dc-18b6-49c0-93a4-540162c0aae4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428034, "uuid": "9e1e558f-20f5-4436-a8e8-3a111a967600", "value": "d157c539679f91462ee6e2cff76acae8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f855aa-01e8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629485814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485814, "uuid": "3fe92b4f-340e-4ba1-8a66-e8f7dbb38c08", "comment": "Malware payload (AsyncRAT)", "value": "54a6ca0fa421479963b571a123d11b52", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485814, "uuid": "c63e0c2c-bb41-4084-bd1c-dd34dd865a0c", "comment": "Malware payload (AsyncRAT)", "value": "8980a1ec6abab03028e36a7e7e8757c567208cd91fbcb72725f96f9952be0b61", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485814, "uuid": "8df9bffc-aff6-40ca-9d16-8e6555e2d03d", "comment": "Malware payload (AsyncRAT)", "value": "edfc6ec20e3069d6f04a3f7196a7bd6cdc59e092", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485814, "uuid": "6f670bf0-ceb1-4588-b151-f2f98f16a708", "comment": "Malware payload (AsyncRAT)", "value": "d4ba8a49e3773555a6ec5a5c18da04be1aebdb7f0b02f5390c2b03588dec11040be276fa9b7a6c09f1020ec0ceb1e23a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485814, "uuid": "cb2dc76d-1f05-4e33-ad3d-8387113488fc", "value": "T17604DFE0A74718C2E8BDA27DE09A952F57B0C6AFD4A5C39B7B4687C06C585433CF46C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485814, "uuid": "99de8eb3-796a-40d9-af1a-c2b4ccce8414", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485814, "uuid": "4da98ec9-a5a1-4625-a033-d0f01c3d5446", "value": "3072:dS9I7H919vuIhbZknfcrUPmhsz1MWaBe/wumRE6Q14vmOw38a9Mm:dS9ab9vuIFyfcrgmb69OQ1qoYm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629485814, "uuid": "e00442bd-0e50-42ab-9768-9fe7f02cfc17", "value": 173424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629485814, "uuid": "e46de21c-5cda-468f-95f3-72ebe9aa755a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485814, "uuid": "107b5ccd-43ef-4232-8740-f217d0fa00f0", "value": "54a6ca0fa421479963b571a123d11b52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2825eba-01bf-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629468338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468338, "uuid": "56a4f33b-925c-4a6c-99af-813775e51812", "comment": "Malware payload (RedLineStealer)", "value": "1e90d4583252fab21abf7d5f9b8ec294", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468338, "uuid": "b6764ba0-73a6-47dd-9279-693309481ea1", "comment": "Malware payload (RedLineStealer)", "value": "8a0c92492986fc6dde9450672a3f76d05beee65f95b997a7866c7bba341bbaa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468338, "uuid": "ced6bb6b-943e-4446-bd17-71c034b854ae", "comment": "Malware payload (RedLineStealer)", "value": "3dc826b1bf737364bfc0bbc665b89b306e06e5d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468338, "uuid": "c5feabae-1c82-445e-90ec-7e4946b25737", "comment": "Malware payload (RedLineStealer)", "value": "eeb984bb024f3ddd91736526fd0e6da2044dee0507bb95dd0e67a6abf7dbef1ac24dc7104966a6b89e9c66591fe4a915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468338, "uuid": "095f2f29-8b07-4adf-a977-1e96c9e71435", "value": "T1D1E3BE11B9F0C772C15635314871CAA01679B9616EA8B6073F7F337D1F622C0DA2AFA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468338, "uuid": "b273a656-1aa9-4806-b852-3db76c012cbb", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468338, "uuid": "27bef38c-cd94-4748-8e0f-dfa57db0a9ed", "value": "3072:egPcX4tcj3sNj25RkJ4q8FZ83zgFnLmx:w7Ex08DgFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629468338, "uuid": "0728bc49-c1c5-47dd-93ff-116461aaf4a1", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629468338, "uuid": "d80bf2d6-ef31-4d61-b078-d58aa427cb24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468338, "uuid": "ab996b7d-2939-49c9-9345-8da042a97a28", "value": "1e90d4583252fab21abf7d5f9b8ec294.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ec6f701-01ea-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629486639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629486639, "uuid": "d2cd2cc5-a6da-4316-b581-e71985f1752e", "comment": "Malware payload", "value": "4489353e8bedd0034d2cdfd156081e25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629486639, "uuid": "2d875a9a-dddd-4d9f-9e9d-441aaf80cd48", "comment": "Malware payload", "value": "8a2296b2224c1d9fca1b5c87203e093c0efd9f21b1b2a3ff7d0fb0a28d42f314", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629486639, "uuid": "61fb4054-1ebc-401e-b4d5-f81cc81efe9d", "comment": "Malware payload", "value": "23843406ab46bb8517f7c9fa5e22d32ed4a77800", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629486639, "uuid": "5d54d2a8-e8e8-4c61-bf5f-47e214cbf993", "comment": "Malware payload", "value": "cdb42471e32610af80964acfd41584d38af62d6a53a843358798661ea296df356885424574f7717927997d3a3cdbfd8c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629486639, "uuid": "f1c1b1fd-acd3-437c-a6bf-6dfaaa22d264", "value": "T109B42328B8A1B91ECB7507E3B6585C5F3D92C18E48E860BBBC6D4CD808D1D985CAF347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629486639, "uuid": "5308a039-a85e-42ce-ab14-d0d161f897f4", "value": "12288:VC6DMQZlbCzOLU0WVa661mJTGRtuYh1jK:0AvbCgGjrTmtuYhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629486639, "uuid": "ed80847c-6b8d-4bc5-adcb-f82904e773bf", "value": 525400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629486639, "uuid": "12966ea2-2bb1-43c1-b8f8-04190b3172b6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629486639, "uuid": "546c16dd-25a0-4ad6-bced-69d3a47b6022", "value": "SOCOL 10 PARTICULARS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fcbb59-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629471814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471814, "uuid": "0d0b522b-4ed8-4990-a645-c1fd52c14d18", "comment": "Malware payload (Smoke Loader)", "value": "82e46332f262e9ddb95002bd7cf544ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471814, "uuid": "6d0043e5-eb7c-4dea-b7ee-fab7d5705de5", "comment": "Malware payload (Smoke Loader)", "value": "8a9f3452db181e6a402c1c2b5f4848c657535bf94572a12eee70a57721f9931b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471814, "uuid": "6caf5b02-9d77-4a93-815d-d47495221d7e", "comment": "Malware payload (Smoke Loader)", "value": "984eac7eada895b48756f465b426f1483868bb0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471814, "uuid": "d18d9f55-f3e2-4549-b2a9-5b6452a55e6b", "comment": "Malware payload (Smoke Loader)", "value": "38d37ca9112110b20c82bed9ceac1b17c7428146e009f3c0f74fc502983c127d37726b848a2c7794ed5852347d1be5f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471814, "uuid": "676d0345-4214-4ff4-a100-64d9fa7e67b6", "value": "T163E3BE2275F1CD73D096593D0825CA905A7DFD712EB08A433E9B236E1E712C19A3BF92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471814, "uuid": "f421a689-5e32-44d4-9663-eaa3c23cbdb6", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471814, "uuid": "6f0ec56d-eb11-4c59-9a7c-aaddde39c592", "value": "1536:eEw4XUR0oWjdDvxW1tW7vdO4sy/QNR1ID0SpBZ6hxFOT7U65FzABFnLFBMK48o:eiFvEbWj2YQNR1ID73CFMT5FzgFnLmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471814, "uuid": "34d868df-6fd7-41b0-a352-5b883762bc8e", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471814, "uuid": "debe8d7e-a8d6-401a-b062-859b16efc753", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471814, "uuid": "31992f1d-4652-43e5-a6e6-1384b0c91f70", "value": "82e46332f262e9ddb95002bd7cf544ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea0272a8-01b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629464136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629464136, "uuid": "ddab4d47-bdaf-4dd0-b269-3470ae574832", "comment": "Malware payload (RedLineStealer)", "value": "43b02a14fffb9e507334cda2d535cd37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629464136, "uuid": "8202ded5-cd83-4ea6-bb02-4903da6fb22f", "comment": "Malware payload (RedLineStealer)", "value": "8ac2514676f8c52d011269995e5198e89389d11c05d73dadc67f709994280728", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629464136, "uuid": "659ef534-641e-4010-b9d5-712649534658", "comment": "Malware payload (RedLineStealer)", "value": "669381163e77b1cdb692300660d216fc44866415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629464136, "uuid": "c82f8b30-2b1d-4885-a949-aa7f7ff02c99", "comment": "Malware payload (RedLineStealer)", "value": "8127cbea28b26ab555157588dbcc87727a571e6ef3fe673ff397e3b40c5b55e1dc5538dc2e8be38442420e31dc0ea73f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629464136, "uuid": "c9463395-3d52-4013-821e-84513eb59344", "value": "T18844F121FDB0C173C063117048DDCAE0B52EB9155BB59D477E4B2B6E2E312A0DA26F7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629464136, "uuid": "d2c5c2b1-e6e6-4081-a8b5-cf9b285ae726", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629464136, "uuid": "7e83b706-b8e1-479e-9474-62bd6d0cade5", "value": "6144:fee5PBBfMmceAl8S2sZ65x7GNI/+RlqgFnL:mQBB0mtA3c7Gfl9ZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629464136, "uuid": "bb4cb23b-531a-4d39-ae2c-be7769f2b099", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629464136, "uuid": "2f87dc3d-c43b-4a41-a658-0193fd607b47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629464136, "uuid": "bd4c1091-72da-4a2c-9f35-0a4c35523d47", "value": "43b02a14fffb9e507334cda2d535cd37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8335439f-0158-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629424021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424021, "uuid": "cdac1412-e14f-42a7-8004-5c290875fcff", "comment": "Malware payload (Gafgyt)", "value": "3c8c00034e066d9ede4c5b0a26bf04f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424021, "uuid": "01a538da-d2b0-441a-abaa-1ab0e067d2de", "comment": "Malware payload (Gafgyt)", "value": "8b1fbfa8dc48817631a85e8453801c81f63e52955cc802d578e18972a77fb657", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424021, "uuid": "86348c90-799f-4fbd-a0f2-a22e880588b4", "comment": "Malware payload (Gafgyt)", "value": "593a2a04a0b789119779b1debbf338aca1aff5c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424021, "uuid": "27b23b65-e685-44ee-a495-ae2a038b05dd", "comment": "Malware payload (Gafgyt)", "value": "eb22b38318756b4fdeaa67edfa27d41b829b5dedc22338139cadc2ef9b2acdb19803013ec3529e19f31a203c21d3beac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424021, "uuid": "2fad88a8-69d6-45f2-9104-fa542769c53c", "value": "T1EFD32896F800DFA6F40BEA3605DB0B21A630EFF50F435A6762473A679E361D53827E41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424021, "uuid": "b20e9b26-7011-44c3-af5f-2cc34f67d1e9", "value": "3072:Dnkdb/vrUxtmG4laY8ucHbyLEuJ3i8Q3zomvL0CDYabQN88:DnkdbXrUtmG4l2yLVJ3i7zomvL0CDYaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424021, "uuid": "ad5852ed-169d-41cb-95ed-c212421569ba", "value": 136929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424021, "uuid": "2042fbcf-a46d-4703-b142-38feb677b3a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424021, "uuid": "3ef0115d-c14c-4c3d-884f-8b64ff44c818", "value": "3c8c00034e066d9ede4c5b0a26bf04f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15791c16-0162-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629428132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428132, "uuid": "9dca21f8-aa12-43d6-a4a5-5224a8c78430", "comment": "Malware payload (AgentTesla)", "value": "b70f1e967fce0d0bf564ee8b3f4f2507", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428132, "uuid": "44ccf901-319c-490d-959a-d11069e22fdc", "comment": "Malware payload (AgentTesla)", "value": "8be7d128eaa0e4a7a98dbafba2d1b7c4f212181c376442c12c4665e0c8b00a96", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428132, "uuid": "8c3b0eb8-1de4-48c6-bdc8-ad30b163b6c8", "comment": "Malware payload (AgentTesla)", "value": "4fefa4ee090902f74e132290994aab934b2495d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428132, "uuid": "e0c8a658-f472-41c9-9003-9e9ccc5c2919", "comment": "Malware payload (AgentTesla)", "value": "2c070b923b91982e55d7fcbbca356c52081b832c7141760343fe398df685a89ac55b28bf65a64279852bc55b38960d05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428132, "uuid": "0cda7a7b-50a8-49f4-8d4f-d632b8624b78", "value": "T164E4BE85F51069AEDD2A9B319A32CC300723BDBDA975D45D24CB7DAB3BBF2934012097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428132, "uuid": "721440cf-a084-4867-88c1-a2ff158d957f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428132, "uuid": "f4d70bd7-dcb6-4465-8a9b-6eeae5e7a2aa", "value": "12288:EuV5txE1wEJNP9mRI3YWkjUSJSTM5b0r6bdP8lhLxlpJXh02rI+ppppppppppppZ:EuVWGEJtkRIVkjUSSTM5YKd0n+PjUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629428132, "uuid": "bf838d4e-5be3-4e9a-bcb6-4f2a96cd6538", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629428132, "uuid": "5c8a9dd3-fd85-4f9a-b3dc-ce38db675fac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428132, "uuid": "3b2b3173-9503-42e9-b3a7-d40da4323352", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f58268-0157-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629423708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423708, "uuid": "20a84b4f-9083-40a4-b71f-b5b4dc984411", "comment": "Malware payload (Mirai)", "value": "95cd1ac5eee63b71524581e34a97ae64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423708, "uuid": "fd9857c7-d5b2-415d-bd2e-bfc5684962a1", "comment": "Malware payload (Mirai)", "value": "8c54944b3262b9d200cdeea4a466f9ee3272234589011218942a96cc3fd1a584", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423708, "uuid": "229d0c43-1dab-4a76-a3d1-1f34d79fb123", "comment": "Malware payload (Mirai)", "value": "170868221bfba4dd1f861477f8a064609eb7c509", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423708, "uuid": "365e2b26-f335-4f37-ae26-28504ba3f32f", "comment": "Malware payload (Mirai)", "value": "2efe9dbce2edb781311be1ae068974e1923d470d0bb1e49ba176ad941e581f1c55f029a6b1aa333c96d30487efc9eca6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423708, "uuid": "d4521cff-3c54-4834-88ef-48eaf60c95fa", "value": "T1D393E709BF610FF7E8AFCC3709E91B05198C550A22A97B367934D868F64B65F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423708, "uuid": "d2824e7d-2d06-4086-8db9-4ef694e635d0", "value": "1536:nSITUINkErQWG6fZnH/zoSAkaI91rFSEZa72PrQ:nSITRNgWjtHUibSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629423708, "uuid": "ff277602-68f5-4b4d-9c78-6ddb45c3655d", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629423708, "uuid": "4ec4a5b4-6f3f-45b0-ba11-ea40b2d87085", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423708, "uuid": "6c4be399-cd94-4636-8d04-d89c0d8d09a4", "value": "95cd1ac5eee63b71524581e34a97ae64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756fd3af-01d7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629478544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629478544, "uuid": "31feb85f-d06d-4e2d-a42a-a0fad1d1509c", "comment": "Malware payload (RedLineStealer)", "value": "e2c2b464a1d9a3c366c2bcb523b5a20b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629478544, "uuid": "3a6e00df-2089-46b6-b7ee-85a4b3e3cf41", "comment": "Malware payload (RedLineStealer)", "value": "8c6e8a02877680a2b503cef0b068b452221f95e68f9131a59421ca95c4339eb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629478544, "uuid": "83c42b4f-b059-47f9-9700-ca8afd6eabac", "comment": "Malware payload (RedLineStealer)", "value": "273341deb43de67a9274482a2a0397c45c0aff5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629478544, "uuid": "5a576f4c-47ab-46b3-9bf2-9fe004a06040", "comment": "Malware payload (RedLineStealer)", "value": "62cb3003fb5c87b10cee765bdc61eaf8176b564165f46626ac768fca386164da6665dd6824b0a6109ef8f09a2981d749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629478544, "uuid": "d9ddf8b3-0338-4169-a021-da15cae056a1", "value": "T1ACE3AE6175F4C472C58205300851DAA0663AEF75AFA096833F6BE33E1F712D1DA2AF67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629478544, "uuid": "526a6985-2996-4d7e-978d-6fdcee525b51", "value": "d9ba9c76f1c1b9698712bcd1010ec021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629478544, "uuid": "365d15b1-69a8-44f6-99ae-6076ec8cbbe3", "value": "1536:FcbqjNeNMpj0E6pi9e3jHcUYjjf2mqwHwRad/Rt5V6+jE3XzABFnLFBMK48E:wuX9e3TmjjfXfjd/RtCHzgFnLmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629478544, "uuid": "9a4ec9bd-0f0b-4909-bafe-29d8d5f0e755", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629478544, "uuid": "0f92b401-561d-44d6-9ae1-68dabcbea286", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629478544, "uuid": "d203eafa-9709-4964-9d46-bf85d081218c", "value": "e2c2b464a1d9a3c366c2bcb523b5a20b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11ba53ad-0179-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629438004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438004, "uuid": "1b5e94c8-f0fc-4438-ab5c-d8ec4e4863dd", "comment": "Malware payload (RemcosRAT)", "value": "e17afaa832a1b59168ad87a146ece5b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438004, "uuid": "3e162446-4daa-4c3a-93f9-ce5a5a885554", "comment": "Malware payload (RemcosRAT)", "value": "8dd453814cc59ecb7918da706244b3e8aacc66146b9ff80bcad195e066464139", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438004, "uuid": "e77fde1a-cfb8-417f-890d-75e04846e81c", "comment": "Malware payload (RemcosRAT)", "value": "cabb2d38201c22042ed64cd5104d101acde454c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438004, "uuid": "ae8550e2-33dd-4361-9983-0ff13968ad6d", "comment": "Malware payload (RemcosRAT)", "value": "2c166ffa4db658c648e997a29b2658e932bb43a1df7005cea0f59d30aa1d08ceddbf6c1e113f3794c668ac5cf8380db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438004, "uuid": "78f05cc9-a870-4b8a-9cbe-02a24bb86cc2", "value": "T1DE359DDDE7BFDEF2C15201B4DB3B952A91527C217B58B8421BC04E8C1AEDA027927C67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438004, "uuid": "6baf00e3-f649-4219-8706-ee4d5e45c32e", "value": "cd897a852beb0d729ee0e0d2a4c10746", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438004, "uuid": "720b4ae0-0b5d-4760-8e15-6149cb74caa8", "value": "12288:Qq8SB+x3pPT30Sv6kGDbdYMqFMS7kLWa4H+NZ6rq436TD9dFSKt8Ed8Fj0RIRcDI:r5UzPT3Bv6L9kaDNZAcFSXvVRQyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438004, "uuid": "0183a496-273c-4603-9d4a-0dd5798a7c05", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438004, "uuid": "6cd4beed-f7cd-440e-a191-9c8439a4ad1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438004, "uuid": "1ea0cc90-4201-4396-be77-8ab61c50450f", "value": "orden de compra - Anamin Group,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "375ca890-01c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629468991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468991, "uuid": "02d6091f-fce7-4b9c-9964-f193145a0d2f", "comment": "Malware payload", "value": "de1df01456364c514b216af83daded89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468991, "uuid": "8d91a6b1-95cb-4a1b-8feb-8a3077511c0d", "comment": "Malware payload", "value": "8f407a22a19c782e272e39e05731e9c563a09c3ead5e1c0538abee2e8d62836b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468991, "uuid": "7695f98d-acba-437b-aca2-733b76d90194", "comment": "Malware payload", "value": "5ce96c4d8309744b4ea9e2499af3aa00f41d724e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468991, "uuid": "9ac8e74e-42df-47e0-a1b9-d80bf2a75d3d", "comment": "Malware payload", "value": "60b9592773aa7b7fd2f049a3e6e2f5f35a38aa8e3825fb2423f4c7abfce5a5e9f0822256dc9736296ced330b0de0db05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468991, "uuid": "0d7922d7-31aa-4b18-b81a-a984ec307649", "value": "T12156F117BC9574B9C9A9C231897592A13731B889073867C73B84A6FB2F77BC41E39360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468991, "uuid": "cdc1bdd2-470e-4a3f-b4e0-b1cdcd44daa1", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468991, "uuid": "ffec5bad-0a3a-41f6-9888-fbe7e7997919", "value": "49152:tvGIuxrb/TkvO90dL3BmAFd4A64nsfJ1XU59mMJETIR1iVhYOxbJBKqKhmYYMNnw:tvGfXdmAQQQQQQQQQQQQQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629468991, "uuid": "7d0236c7-26b2-449a-97da-b2e4cb5e3566", "value": 6139251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629468991, "uuid": "8961a42e-7d95-4b55-9207-1b2db3287c5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468991, "uuid": "f930e5b3-80e4-4595-b06d-5123698cee05", "value": "de1df01456364c514b216af83daded89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c5dc5b-0157-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629423703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423703, "uuid": "f23369c0-0c31-4dc2-93ea-6e95a8531f0d", "comment": "Malware payload (RaccoonStealer)", "value": "960973f6b7ed0ee47d6e49088388593e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423703, "uuid": "ececdf04-17bf-42c4-a5c6-38af7815ff67", "comment": "Malware payload (RaccoonStealer)", "value": "91ebc274cf3cb31f0f0bf64e429b03f06a502834fd70e7c6127acb7331adec99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423703, "uuid": "b986a927-fea1-4468-92b8-34ede0154568", "comment": "Malware payload (RaccoonStealer)", "value": "7d0b3223a19ebdf1f7812eee8ac5d51a93afadc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423703, "uuid": "6efc7457-b172-46f9-9310-98d2c937bc8b", "comment": "Malware payload (RaccoonStealer)", "value": "64a11616529f2f69549bbc3166bdcd1f26e5cdca72c1a79d5aaecd987da637c8c3972b541e96a792cc1ce7523856caa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423703, "uuid": "c4b79b04-2931-4baf-955e-4fec084bb5d6", "value": "T132C4D0316690C435F5B711F48DBE8378A5297EA15B2450CF92E52EFE1A346E8AC307D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423703, "uuid": "5dfb3a4b-20f0-4285-b810-cbb15372053b", "value": "cc12335fcaf380223f708d3b30304b0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423703, "uuid": "814934a3-2867-470f-b55c-baa428f8deb3", "value": "12288:H7Y9LKbxj62JtkyLBRnS7tm+oHlbHZONkXFDn0E0:HqKbxbSIZZgyFTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629423703, "uuid": "916dfdf7-acc6-4ccb-b5d2-93732a654175", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629423703, "uuid": "be14b857-50d9-4e47-baa9-d31d42f3396f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423703, "uuid": "fad9a47b-fa40-41da-9b51-1cd63ff20e84", "value": "960973F6B7ED0EE47D6E49088388593E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8668ebf2-016a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Lucifer)", "timestamp": 1629431757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431757, "uuid": "2231d389-1ebf-442f-935e-c81ed8b77c8b", "comment": "Malware payload (Lucifer)", "value": "53740b5e22325039fb36edebef2e3abf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431757, "uuid": "32a523fd-f746-4c0d-8d36-ea7128a431a1", "comment": "Malware payload (Lucifer)", "value": "92500c24e39f3b7039e7e9ef8af9352ccda7025f5a6c65c6377f49e74beb1d37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431757, "uuid": "9967de64-3112-4407-badb-40a5bfad8ed0", "comment": "Malware payload (Lucifer)", "value": "19fdc40ee9c4d4d49a75521001f68cd943764099", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431757, "uuid": "9ffd5aff-8cad-4e28-8be6-9779d485bba9", "comment": "Malware payload (Lucifer)", "value": "0be8ebef22822555c94118a5dabeea61339a403fb18d381bbaf5835548964a8abfedd34649b23aadc5e4e6ffd2f79e30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431757, "uuid": "b6bc4b9b-0ca8-486e-8a09-663671b52d6a", "value": "T18BD4F1197B94BB4EC16F8E36C8515C109BF0E937A303F7576CD312EC6E8E2998A26161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431757, "uuid": "cf812608-ab60-4f46-b5c4-f87f9d23617f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431757, "uuid": "c4f8c734-4238-4226-a0b0-d6d8053627af", "value": "12288:AFNxQ9HKefECaOiWCxSfNeeE1fABdtTycgzefKX9+1KhUil53BCp:AFNYHbfECP8xSYeY4BTjgzemjB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629431757, "uuid": "db6e28e0-8cf0-4ec1-b4ae-f744621b70b8", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629431757, "uuid": "4a10ad44-f639-4444-b150-908887fe6097", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431757, "uuid": "dcffd569-e6c7-4ab9-99f8-e0f7bd5855da", "value": "53740b5e22325039fb36edebef2e3abf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb9be174-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424625, "uuid": "5f314f9b-2394-4bca-bded-a66ef898ce4f", "comment": "Malware payload (Mirai)", "value": "562257c20c546559ddeac879e22bf455", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424625, "uuid": "115285d9-f62c-4088-af58-cec40282452e", "comment": "Malware payload (Mirai)", "value": "928f953401005202277e1fb54deec8ebd012c51cbc97ce307a197904857e8223", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424625, "uuid": "c83e72ff-0bbb-4b67-8212-eb871c1721af", "comment": "Malware payload (Mirai)", "value": "e1fac981d475b8e2f92d0a2bc5bdea77eec125fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424625, "uuid": "232ce538-e866-454c-b73a-1ef2369d0238", "comment": "Malware payload (Mirai)", "value": "3485572393799cadd351a3b89baf0f19aca5f88d9f51b8407aa3793a192d1dd39b6685396891937250dd10e7e2ff8130", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424625, "uuid": "966443a5-628f-4d0d-8974-a8890ecab418", "value": "T153D2D0BC334D51A9CC31D2F8938683E11DB11FB66042ED3628A7E6578E55C2478A3FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424625, "uuid": "6e9a6536-7d65-4953-b634-25b044a83304", "value": "768:fEVHeZqrgaTuNBzbAqmrt4+R+VtX3FkJgGlzDpbuR1JF:Gzrgaehm2+EVLcVJuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424625, "uuid": "81dfafd6-61f5-4427-b2f1-e9e0ec5b6180", "value": 30440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424625, "uuid": "2bd1d743-edaf-411c-a8c9-c35ec0dd7837", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424625, "uuid": "5ddc8d70-a46f-4f25-9fda-e557aa3459cd", "value": "562257c20c546559ddeac879e22bf455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc24f1c1-017f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629440920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440920, "uuid": "4740a26d-66de-4206-a368-cfa4ea2818be", "comment": "Malware payload (Amadey)", "value": "a8deb5ea02086f0f2560508fd661e763", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440920, "uuid": "e9410adc-d71e-4f12-8869-97d5fc9d980e", "comment": "Malware payload (Amadey)", "value": "93d9e351b653644e90b445c05b2ceeb1867dee267a9b50b0fe50c59989ea1a96", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440920, "uuid": "ec00d0c5-24dc-4a4a-8283-5c8c0bdf1b58", "comment": "Malware payload (Amadey)", "value": "8b93e2e4c1bed663184440d9cdc1bbf8fe66eec7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440920, "uuid": "35e4a96e-c1b4-4bde-a614-c6bd5b5d5843", "comment": "Malware payload (Amadey)", "value": "8ff1f01a4a68db3790cec7c7eee112d3df9466161e5aa4e27e5e9071207613dea2003d131d4425ee9b1405679b4cc6f0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440920, "uuid": "d966ad9b-f3e8-4275-8222-aa1e3c7e0380", "value": "T1CE64AF20B6A0C035E4E613F159A986B86B29BDB05B2450DF73D637EE57382E49C3067F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440920, "uuid": "34cd8141-267f-425f-84ab-ad1a6c42bdb7", "value": "f98082b3dd4af392746814cb64f8deec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440920, "uuid": "20788626-e5a2-46cd-896a-21573815de51", "value": "6144:KdyJG6KFYxFKc7L2+sUQE2j0yyn8Ybi9FGZLGxliE62LzoyUuYlLM3c6:VJG6mYx77zXQE2IfnWELG/36iUd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440920, "uuid": "3fb1779c-7d56-48e7-ab73-fe615d90a312", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440920, "uuid": "e02a84a3-53e2-4f31-9dd4-2d31fdf45914", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440920, "uuid": "44a1c961-72f8-4848-b9dc-f660691b47e6", "value": "a8deb5ea02086f0f2560508fd661e763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e3f11e-01f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629491003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491003, "uuid": "dadd97f2-0d96-4a10-9a31-d1db2df72b59", "comment": "Malware payload", "value": "bfbe94391dc7e0eaa1e59ae6d6029393", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "BLUELIGHT", "colour": "#14F1F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491003, "uuid": "a32d746b-9e76-4302-aadc-fdf4046f60da", "comment": "Malware payload", "value": "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "BLUELIGHT", "colour": "#14F1F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491003, "uuid": "a7087451-105e-4221-a95c-35a08285b3e3", "comment": "Malware payload", "value": "67c27e2817d83786d95221ea4a02842847515f25", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "BLUELIGHT", "colour": "#14F1F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491003, "uuid": "31f327e9-0a3c-411b-83e0-144b79f0a116", "comment": "Malware payload", "value": "526f4cccba8a857e08349de9fb8d84e374b4aff4b3ad8901a8004d0cda4d0e803e7bb8155b524e885b40f33ad254115b", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "BLUELIGHT", "colour": "#14F1F1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491003, "uuid": "a31e3eac-19b8-4da6-91b9-d86053952a88", "value": "T11335AE21B642C031C8B200F04A3D7B6A69BDFE250B3499DBF3D8196D5AB11D2673B75B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491003, "uuid": "fd5cce56-a2c3-4c48-9e72-3c8352034e1c", "value": "24576:aoLLMmx1kMV8Om7LwFQqaRDl+iytYmcPcqd3wAIDQMi1hTQ3iweo:aykMbiLwXaRpyhqdwH+TQyweo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629491003, "uuid": "acab7e4d-d0c2-4501-9cec-e0b8e3e374da", "value": 1097728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629491003, "uuid": "2ca1bbb3-491e-4e1c-83c5-f8ba23d7c295", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491003, "uuid": "de0c9d04-bc43-40ab-89f6-bdde0d17ac11", "value": "94b71ee0861cc7cfbbae53ad2e411a76f296fd5684edf6b25ebe79bf6a2a600a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e56fe0-0158-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629424045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424045, "uuid": "4fc270e0-f39a-457c-8d96-d4611bb1edc1", "comment": "Malware payload (Gafgyt)", "value": "452e3a46039b4bd0899da0fa07f10827", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424045, "uuid": "b219f965-e9c1-4c43-8e26-6a8b300a206d", "comment": "Malware payload (Gafgyt)", "value": "9677d2d1aea6ff3dfeb630ea051bff2d5d3850f330641e485f510f2ac566c337", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424045, "uuid": "623bc1ac-b1ee-484d-aaf7-5aef02730d99", "comment": "Malware payload (Gafgyt)", "value": "19dd69735e22bdd147be5185021aa6ca18f2fed2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424045, "uuid": "2fc76776-4f39-4206-a799-6788e02e156d", "comment": "Malware payload (Gafgyt)", "value": "2a567fec0245f9d2b80d41f36de666f5db40de594fe79727ca7fc5298b779901787a36772a211bead67d181117dc2411", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424045, "uuid": "89fe1d09-780b-46aa-943e-9ae8e4707382", "value": "T11ED3183772E1AAF6C04351701ADF96A2C832F5FD0731611B2394ADA43F0DAF66699B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424045, "uuid": "48e800ed-2cd2-4c9f-aed0-7cdd7a450bf4", "value": "3072:PY2nwI2CUn2jf2pbECHNMUVS95gphaX/sVmPCOV/XUa9uMU8:EkUn2jOFBNM2jphaX9PCOV/XUa9uMU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424045, "uuid": "86fa8e46-86c8-4151-8002-b9e54290f4f2", "value": 137611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424045, "uuid": "69c536fa-2222-4346-b677-55f8a7aaf4e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424045, "uuid": "6a743cdf-292d-487a-b5a6-4154ebde9956", "value": "452e3a46039b4bd0899da0fa07f10827", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4781076b-01c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629469018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469018, "uuid": "a20d5bde-c55d-41fb-9b3a-14923ecee6e3", "comment": "Malware payload (a310Logger)", "value": "b02a63fa9c807c8509341d264e494f99", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469018, "uuid": "b9c08e54-14c6-49e6-93d0-3f1afea230cc", "comment": "Malware payload (a310Logger)", "value": "967f7296fc850d9a5c810776f910b5ac22dbff3a31f00c7641bdb68b421b7caf", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469018, "uuid": "685caf69-80db-44d0-afda-4ba090bf2177", "comment": "Malware payload (a310Logger)", "value": "dd9a5cfc7dbe769be5a9edb8f1e6e1a5e17bf8ec", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469018, "uuid": "3b94b03e-ee36-4a71-b458-ac070b4be075", "comment": "Malware payload (a310Logger)", "value": "78f54cd18a8a88df5fb12ad52a6b19f4b0a40a8e6782f50d22150c0de184a8616012f4a1262a45f395269fad68955311", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469018, "uuid": "783153b5-752e-42ef-84a0-984916cc6499", "value": "T14B35063D19B91627C1B5D375EBE48423B1589C5FB414AE696CDE33A7033BA8634C322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469018, "uuid": "b86224a1-2215-4de1-b2c7-d199ac079621", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469018, "uuid": "4687efc8-76b9-4371-b7e3-29e42f647e28", "value": "24576:Z/FAjZ1EVMqHj1q0oc163Dwlrp9KyxsuM:YZ1EBHBqakDwlrbKCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629469018, "uuid": "d5031274-194e-48bf-89e9-cf15182d7c1b", "value": 1142784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629469018, "uuid": "aedb4960-40e3-42ea-8f36-a21167c9f96e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469018, "uuid": "7b78d51b-05db-4d5e-869c-13ace9c98487", "value": "RENT PAYMENT CYPRUS__________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5357bb2-0161-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Pitou)", "timestamp": 1629428051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428051, "uuid": "d3b03f0e-85bc-467f-919a-22f554688290", "comment": "Malware payload (Pitou)", "value": "96f508e792087c2bd592ffe0e052e8d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428051, "uuid": "0b2254ee-1c83-4a88-aa20-f3709ef3df45", "comment": "Malware payload (Pitou)", "value": "97e8767dcb985a30b1ee30f43b64a3ac2213694af887306dfb3e4a1c58814205", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428051, "uuid": "678a0dd9-61af-4239-84fb-32619465db8c", "comment": "Malware payload (Pitou)", "value": "46e56cf3926d3207b2d1e8bd43dc605b188f17f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428051, "uuid": "85b2a020-6521-4dbe-ae48-39a579ceaf5e", "comment": "Malware payload (Pitou)", "value": "b47cf385cc7855307796fd1f766ffcad285ee5220b39f2ec0f9c51071ef3e4b4c31e41c8735355e68f5bc7423bb5be30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428051, "uuid": "6d7c685f-1dcf-41db-a79a-92512ce2a0d4", "value": "T1DBB41211FE70C036C14745B088268BA0176E7D629EE1A49B3F8B277EBD621C1B726F75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428051, "uuid": "0e4df28a-f566-4d9b-b20e-4236b77bb17b", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428051, "uuid": "8784456e-4577-49aa-b83a-8b97796b0fb2", "value": "12288:/ZQErtN5T4vN9iLnUVxtUqdUjR2qV/+KXU79w+0zZL:/7tEvNYnQxPUcqN+PM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629428051, "uuid": "463a6abe-c27c-46ed-b3a9-d05387274855", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629428051, "uuid": "643d62b9-d6b3-404b-a097-85116c4e5c7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428051, "uuid": "46494996-3974-427b-b99f-e13bddb94947", "value": "96f508e792087c2bd592ffe0e052e8d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04542f38-01d4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629477065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477065, "uuid": "e98e5960-d270-483a-8df0-1f1570a478b3", "comment": "Malware payload (Mirai)", "value": "eb622897b65feea5fe1292db044abaf9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477065, "uuid": "5cccf154-3180-4afc-aecf-58392b71521c", "comment": "Malware payload (Mirai)", "value": "98162a88c26ebb4cafa792febe1b076d48b7df0995c985417e96485fbda10d95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477065, "uuid": "b82de81c-20ec-493a-857a-01f00ecfc933", "comment": "Malware payload (Mirai)", "value": "e6fee5608e46ed63fd46ee77a4226d1945744959", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477065, "uuid": "0ee60e09-ffd3-4531-9f97-9eb8486a4b42", "comment": "Malware payload (Mirai)", "value": "cf501f9fa3c232a007a2c52a83d013d904e6c0a98942764436cbfa476acd8eb339e212b008a2649d3ff374f58c4596a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477065, "uuid": "694faee2-6bcc-4358-b6d5-1fa5128f8758", "value": "T17B43D695B883892AC5D913BBBA6E11CD332477E9E1CF7213C8105B647ACA51F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477065, "uuid": "c725ea7a-2d23-4455-b766-e8003b6bdc16", "value": "1536:EZL733vX29g/OC06AaP6k4h3rxennJiikzHNyl1XfFknn:C3vX29OO36xCkUbxenJii+IlBG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477065, "uuid": "e31483ab-d217-43bd-bf1d-a6b60bfdfae4", "value": 55312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477065, "uuid": "41c6d3c2-d699-4100-9d1b-5f19f2457f65", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477065, "uuid": "dc1f4015-6ae6-4f4d-bc3c-450b4387179b", "value": "eb622897b65feea5fe1292db044abaf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b039ac0-0185-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629443173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443173, "uuid": "d8b04191-5d63-4201-adff-93652f780ca2", "comment": "Malware payload (Mirai)", "value": "218097e81809c6afac8b912938fdefa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443173, "uuid": "ef077c46-1571-44f7-84fa-e8642475f505", "comment": "Malware payload (Mirai)", "value": "994e167a67d3df8aeb1cccd8030ecf179e5a6750d7b9a74ec30eb1061b12c2ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443173, "uuid": "5631ba63-1ac1-4289-ab01-cde826e47a82", "comment": "Malware payload (Mirai)", "value": "2be1a310b768209242a3f0094dff092527cb9040", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443173, "uuid": "01853db1-2583-4367-93fa-e7a19d552336", "comment": "Malware payload (Mirai)", "value": "2c72cc78ccd69205dc791c05d2f598298a63224fc27d55c4c7d5f2f3c25a0bd4ee0156f89d558e2d718f7dbf5e77da83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443173, "uuid": "80d22cee-4caa-4dd7-ac3d-f071d6e04cd4", "value": "T1714319C4E4C3F8F6E805147C207AAFB2ADB7E17EB4359D9AD7D91423E901A02D60639D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443173, "uuid": "d26b8437-3059-4d32-8f73-7eb35e877c05", "value": "1536:xb/2+OX+hs4pIq/sNSWk/zvwt33U3zo7:Z/2+++BWNSWk/TQ33mE7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629443173, "uuid": "722d20e3-c329-402e-99a1-b3192e667550", "value": 58448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629443173, "uuid": "2a68f209-1a16-4b5c-8e93-72e842445cd9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443173, "uuid": "28b866a1-c76a-4350-8475-ce9f8840fc22", "value": "218097e81809c6afac8b912938fdefa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b2096a-0180-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629441121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441121, "uuid": "d71d6291-28d7-4bbe-b240-98c85ca05231", "comment": "Malware payload (Mirai)", "value": "66001d1b5de02281adde8d60ba9904bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441121, "uuid": "a401a265-bd8a-4497-9729-b7fc96d9bf95", "comment": "Malware payload (Mirai)", "value": "99f0deb543f5761f1a18896d0e1b044338372aad22e23278f6383d6da14a4a12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441121, "uuid": "91eebdb9-900a-4622-8b54-8f771a6ca196", "comment": "Malware payload (Mirai)", "value": "31f82b5900ad95f4b02f6661589e3487afdbaf90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441121, "uuid": "92a423d3-0627-4d3b-a0af-0cd98759f806", "comment": "Malware payload (Mirai)", "value": "79b97c0e5dd33e9ff40cf20010d5dc2d986a2325d0d11ee1c46217d582dd1c13544a86c9c48b16e4e82c26b0e7bc3eb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441121, "uuid": "1a8b5b7a-0a3a-4d78-92f4-a5d266201395", "value": "T1E723F1ECDE70F99CCDAC6F78A61C075511A1E29612871604F205AE84D3A874E7DBFCB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441121, "uuid": "39ac9a96-884d-4c4c-a7ad-d46551a605ee", "value": "768:+Xu04w8OkKBmHkySHEC6QsX/vMOryzSTM2mW5ExAfEjUFrS1MQWWd:d9ciLiEC6QOCeT9XEjYrTMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441121, "uuid": "b04039df-d7d2-430d-afbc-8cb38c187f2d", "value": 49876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441121, "uuid": "941d5d47-0198-469c-96e7-5c979a91a053", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441121, "uuid": "6276ae9e-04b5-4ed4-8c6c-c354d41c33df", "value": "66001d1b5de02281adde8d60ba9904bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "985a0c69-0187-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629444242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444242, "uuid": "f94a7710-8a6e-444f-a726-5518b4ef62fa", "comment": "Malware payload (SnakeKeylogger)", "value": "71ab0c4b8b1a06cd99025461f0b75017", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444242, "uuid": "26e88e39-52cd-467e-b06c-0031fa5e951c", "comment": "Malware payload (SnakeKeylogger)", "value": "9a2a943ceda30676241acc9e1e57300ec7516c14fba6a78e8434f608102cc1f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444242, "uuid": "ed2d1a04-084c-442b-a963-883cf3330510", "comment": "Malware payload (SnakeKeylogger)", "value": "8593684b10b6897dee6e1354ca8482fd1ac9c21e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444242, "uuid": "a54f3364-07ba-40ea-8a6c-896f2fb00b9e", "comment": "Malware payload (SnakeKeylogger)", "value": "fb44889d11ab5ef13827e91b244f86a3ed18aced849ef7465bbb5a14549e30a39b3829cc036239a1ac95d5805dfe18b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444242, "uuid": "01a30476-977a-4754-bf17-7c63c0535909", "value": "T1D545393D1AB91633D4B9C375EBE59423B148985FB401EE696CDE03A7030BA8735C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444242, "uuid": "46883c8b-4a18-4bc9-a47f-550b7b2b7702", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444242, "uuid": "7e6bf5cf-fc85-4279-957c-3a795051b736", "value": "24576:5YggVkneytLubb1Bj9mfNFEHaxmgIyBCZsGUym:Cgg2VLcb1kFE8mgIAiW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444242, "uuid": "40f33a1b-38b6-4df4-bc64-a814e5c9f0df", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444242, "uuid": "af3eb55d-247d-475a-b56c-b59362a6eb30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444242, "uuid": "5a8e184b-fef0-4fdf-b3c0-20669100de7f", "value": "Halkbank 336,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3346069-0157-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629423752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423752, "uuid": "28c94306-87f8-47e1-970e-8a77ab47e935", "comment": "Malware payload (Mirai)", "value": "1d6c7bca9b6f711a84d35f6d64ed23b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423752, "uuid": "808b3219-c141-4e1e-bf4a-f6fe27be5ae3", "comment": "Malware payload (Mirai)", "value": "9a4a025cb051d4c62bd0e27c1a2028e90072b2d6b8bd03fe6e51a0c51ff5f22e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423752, "uuid": "71da4d97-2b2c-47ba-9702-00c2eb906252", "comment": "Malware payload (Mirai)", "value": "3fb14c0f5dc646e3c664a84ec2c0d527eebf3f9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423752, "uuid": "fda042e6-b0c1-447f-9106-6a2f52dbb7a2", "comment": "Malware payload (Mirai)", "value": "53284d9f3e94c00be842c342e0c801d2465edda5c48180bcf73ab77445ae00e62cf29cf66e364a04f2aa92822e6247b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423752, "uuid": "22a62448-a958-4d69-a061-fc6942780f22", "value": "T158E2E1CDF8ECACCBE9AC2CFC524A17A1661200D6724E974713155EC8F65AC4A3C8E0BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423752, "uuid": "8cfd4364-1606-441b-a77b-14366aa9807b", "value": "384:eACtY2JghN20yhzC5K03AA3vOjCEi2UDTea/j+HoSBwax42asfHnped1zWVQjqNh:eJVChN20yp0lUeDaa/l4425Bej476WD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629423752, "uuid": "dc4d89cc-5784-491d-b272-d5328e4f6bb1", "value": 31480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629423752, "uuid": "2f52ef13-7fb6-4b0c-819a-c5b12f8bcc51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423752, "uuid": "c7381f60-933e-4123-b0b5-559ec3d79aa3", "value": "1d6c7bca9b6f711a84d35f6d64ed23b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f130ee9-01d1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629475902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629475902, "uuid": "161d74ac-a7a8-499c-a727-62f337991293", "comment": "Malware payload (AsyncRAT)", "value": "bd9d3da2c7a63a88c44c8857fb285062", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629475902, "uuid": "5f1d2a6e-72e9-495f-a39d-fe4072648dd9", "comment": "Malware payload (AsyncRAT)", "value": "9c32dfe9366cd900b272ce625381572ad85be6d6fd1c452e48c2b289103522f1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629475902, "uuid": "9ce568b3-5400-47ff-afb3-3ae673695880", "comment": "Malware payload (AsyncRAT)", "value": "4e6dc23cb739abb7f926daa22096832da8d4fcd3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629475902, "uuid": "71fb1735-ea66-45da-ac32-3cab2c2531ee", "comment": "Malware payload (AsyncRAT)", "value": "64b096f8992e8da208c58ecaa88fdc7c41192be6681f8de06b775dc00f576708160e2b1cb34cb517fed022793d2215a3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629475902, "uuid": "dc9c51e0-c8dc-4131-853c-b7d5ecbd67dc", "value": "T117C52350E6D684F2E0722D328835E7616A7E7DB16E38D99B93944DBF5F701C0A320B93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629475902, "uuid": "1f0c6a29-618d-4a33-b77e-1f41586adae2", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629475902, "uuid": "a82a5c09-6694-49fb-90ce-25581fb3de7b", "value": "49152:X5k3D1W2tOnUN7+b+/2RqOaRtm2jc7MYuKVpZebnlT1c+Hc+9u/Sm1M:X5i1JtOuSS/2L6t/4Zu4van7zzn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629475902, "uuid": "79d06784-57c6-441d-9834-73468e5a4467", "value": 2655855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629475902, "uuid": "df2f0c30-8db6-4d35-8127-592f17740fe7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629475902, "uuid": "1d088fe5-6249-468a-b706-7f62736f723b", "value": "BD9D3DA2C7A63A88C44C8857FB285062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4f7906d-0184-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629443002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443002, "uuid": "ec46454b-9b00-41b0-97d0-098bfdb1c5c8", "comment": "Malware payload (TrickBot)", "value": "70fedd6b5481144489b6dfa87608e7df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443002, "uuid": "889ae7e4-5e91-4b0c-a659-fd40c733cac0", "comment": "Malware payload (TrickBot)", "value": "9c8e26bdf89634254162a5529bd2c8c3bc4c2215be3d7cb39a47fcd0327c045d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443002, "uuid": "42c1643e-bf7c-4ec0-b244-474b4aa43276", "comment": "Malware payload (TrickBot)", "value": "ead945d89ed084dfb1972fbdf3041c44bd973a9c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443002, "uuid": "3a75757b-6656-4542-aa47-62e1a4a6852f", "comment": "Malware payload (TrickBot)", "value": "0d5057cce48f0a4f96203d3fd0e71893bc02b9ca3089cb4596bc5671bbea84f6fcebe0b88761214c334789cbfdb5e3a4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443002, "uuid": "b0e2e607-e47d-4841-b358-0671bbf5b5d3", "value": "T1D184E062F2D600B6CDBB5AB4082F2AB2CEB52D485BE44BCF1F94EA8F10375D19532355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443002, "uuid": "9476ad2e-92ad-45f9-b819-eade60ced470", "value": "89aafe32fea223936c5c233bf06df6d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443002, "uuid": "e3b56a21-79e6-426c-a814-4d54ab186579", "value": "6144:vW3hPRF9A3hAfKKC64zROB6NBbTN+qGfhI6zSRZKhoRli2fFzs:vWRJAhAfKbRO6NBbTMp/STKhoHi2fFzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629443002, "uuid": "2c50102e-c3f1-44f1-a1ae-89e6493b7680", "value": 397355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629443002, "uuid": "ad9b0c3f-0612-4562-8df2-67a3c7f9bebc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443002, "uuid": "fec89c05-a568-4c45-9905-16f137511a8f", "value": "70fedd6b5481144489b6dfa87608e7df.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46dd525b-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629424349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424349, "uuid": "40cff13d-8333-42cd-b1a4-88ae746bed16", "comment": "Malware payload (Gafgyt)", "value": "857a395c3da83b69d77180775bb97c10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424349, "uuid": "e369e4eb-82b0-4774-8fc8-a0c093b8a545", "comment": "Malware payload (Gafgyt)", "value": "9ce49b651a7d9dd88d1ba4949367c65db294f5feeabc2e9ca18025f6263a3c66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424349, "uuid": "1d44fa38-63b5-4da0-bd40-89ad68a9b57b", "comment": "Malware payload (Gafgyt)", "value": "41e112180183e902f3feaf7227beed7864fae75d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424349, "uuid": "a521b120-e823-4343-9b27-ddac02af38a9", "comment": "Malware payload (Gafgyt)", "value": "8ddb70eea25bd6759d0c65bc19b6a12c55b37cb534ae28160b4885ff8bf29d69695113f87841151cea1d931613e7c3dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424349, "uuid": "6808e2e9-6695-4d05-b915-d0626b11d0bb", "value": "T1E8D35C0794A5AF73C086E97619AE69300725EA960B3F1E9B257857F0074F5CE700FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424349, "uuid": "e85c4194-f2d5-41c9-9381-5f9bf2f627d4", "value": "3072:G+5KMHDM37FfPsH802m5hLp7zILk60C/TVQN/g:G+cMHshXQ2m5hLpPILk60C/TVQN/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424349, "uuid": "47a7d06b-720b-480d-ace5-8a36bec62f3f", "value": 137385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424349, "uuid": "1ba98fb8-9032-403c-9de8-2bd33266250b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424349, "uuid": "c72e932e-3523-4353-8301-ca618af96249", "value": "857a395c3da83b69d77180775bb97c10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd33102-0204-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629497808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629497808, "uuid": "13ec5b65-ceab-42d5-b4a0-cc40b486233d", "comment": "Malware payload", "value": "71da07376987682c8b30681324585e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629497808, "uuid": "231d03a5-3a42-4f79-ae18-704af27cc935", "comment": "Malware payload", "value": "9e03f772f926c5875d716ee78ba7e6477578a78f63880395b32565bcc09251f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629497808, "uuid": "781742d2-64ab-411f-968d-4122485c82fb", "comment": "Malware payload", "value": "a5193ef8359e57870e7dc9a3bc61c1c2be67af17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629497808, "uuid": "a39b864d-f095-4809-815f-09a547954a59", "comment": "Malware payload", "value": "6fddb2e669a65f240aa5ae7f7f3b83024d1cf83bd084d77a40a1c3152cc7e5842fb47b4aa17a3c3a30941bc621134ab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629497808, "uuid": "1800372e-2bf5-420b-a6ad-8ff8a159bb7c", "value": "T1931502293EA0FE4EC25F5E354DB19820A7F1D1221A07F347ACE61AEC5A4EFDA5D021C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629497808, "uuid": "2c0ceb19-86d6-44c1-bbd9-ec43c5b1b1d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629497808, "uuid": "fa1f7b21-166f-4364-87f9-808eca8799e9", "value": "24576:tNoj3YXZ0Srdcfb2o60yLu5lQYPwpt8fpsNU76Zq/iar:Qj3EZ0idGVpSu5u9H8fi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629497808, "uuid": "16b6a0ce-93de-4f61-a489-070e3fb0ffb2", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629497808, "uuid": "fa771a65-3ee4-468e-8f18-fdc968012599", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629497808, "uuid": "f3f8965a-0a86-489d-9e80-ff7e65474fca", "value": "\u5fae\u4fe1\u56fe\u7247_20181017153614.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c57ca49-0180-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629441082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441082, "uuid": "0624bff6-259a-4e96-be04-b1352878929e", "comment": "Malware payload (Mirai)", "value": "11ea6fbd7e6909e57a3f6d1d3cc32707", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441082, "uuid": "fa7bfa68-b947-4065-ab28-ec5fb098a0e1", "comment": "Malware payload (Mirai)", "value": "9e35fed2492b834f480998781aa5e2ea4f9a7e283f889a7a8e9fcd46d8d08522", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441082, "uuid": "6d574c2b-86a5-4b3f-b757-13cb4267e7f5", "comment": "Malware payload (Mirai)", "value": "bc024d6c87e3a3b4bb605a6405aeee5a1b9f2fdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441082, "uuid": "0142a561-a746-4bc1-b0d2-5ba2d4901bef", "comment": "Malware payload (Mirai)", "value": "a914cd5907922357f186e8a23ab6f33a31cbd0c562bdea5134a150693763b496f69d1be310a2efbc5ccd0003d6810040", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441082, "uuid": "ce705cf5-1bdb-4f8f-ae04-69f8ea8a5db9", "value": "T13203F151C2E46348D6D195365AED381DCA61A20D37B9DCF986DCF3C1E812F4726BC48B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441082, "uuid": "d4bf3e6e-c7db-461b-a11d-c303764bd306", "value": "768:YUTA2O9xyK5Nm5JeC9++3IZH170PDmz4MOJRuMh0faqJRyvnbcuyD7UHQRj/:YUToDyiUPyH1Em4MOJvDFvnouy8Hyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441082, "uuid": "010cec2f-709d-4fa0-a938-06ebe10928bf", "value": 40168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441082, "uuid": "8c506076-2582-4604-95db-eca90bf1bb27", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441082, "uuid": "75f425eb-2e53-4639-8999-4efa1845a262", "value": "11ea6fbd7e6909e57a3f6d1d3cc32707", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9989602a-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629471732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471732, "uuid": "0918e465-6f73-4001-b758-d144fbf709da", "comment": "Malware payload (Formbook)", "value": "14035831d9b086963a7ab5d7fef18c6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471732, "uuid": "0e586ece-a6ba-4bf7-b742-75d45f981a48", "comment": "Malware payload (Formbook)", "value": "9ff8797cc0af7792eb3777eaa15c5458110c3f2bdb51bb61e3c6f256c44277f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471732, "uuid": "25fbf41c-bbfc-4681-ae92-dff9fb942f91", "comment": "Malware payload (Formbook)", "value": "75df72d00fa15487a590f569a5039cd1f1feff63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471732, "uuid": "41add693-10be-48a5-8165-51f4958c21bc", "comment": "Malware payload (Formbook)", "value": "c672f4eca77f07dcb474e1d9e3eae91ba1a74a85d587eef5b8dfedeefdc56ccb56eb68c9a716622e11fca373a8d109a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471732, "uuid": "9c9523b4-85f5-4fb5-9caa-f5c50ec7dd09", "value": "T1AC45493D19B91633C4B9C375EBE49523B258985FB500EE696CDE03A7030BA8735C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471732, "uuid": "e2c1f3bf-0a70-4861-91d6-6903f293a8ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471732, "uuid": "3a6dfb6a-2177-4fec-9fec-ac862e758b7d", "value": "24576:qjgglHdo5iYDQM5qZPPIpDHOoaCZsGUyk:ggglHesEQMIZnIpDHOoaiWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471732, "uuid": "14912e94-e610-4b20-a123-91c2dc318e8f", "value": 1170944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471732, "uuid": "8dea4825-ef8b-4dc8-8ea1-b0ff17adfed3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471732, "uuid": "b9a8b51e-30d6-40a8-b945-0c0a48b81888", "value": "14035831d9b086963a7ab5d7fef18c6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6901a894-01d3-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629476805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476805, "uuid": "faa2e16e-6590-4f6b-834d-29d8779cc963", "comment": "Malware payload (njrat)", "value": "72d788c844ca40bec84baf77ebcd531c", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476805, "uuid": "c91308aa-526f-487b-8d3a-a72f5a4a1833", "comment": "Malware payload (njrat)", "value": "a0ab3ba06ede4ced5c9ea2a9d87c49063249d1480c72b56ba4371b69b92c6fee", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476805, "uuid": "16130883-da47-428d-a705-9b2696842c5d", "comment": "Malware payload (njrat)", "value": "714b32a5115ca560e59436d53404c6761ac599e9", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476805, "uuid": "5b602965-6704-4a51-aa31-22f87e290979", "comment": "Malware payload (njrat)", "value": "cf2028c560211ae821e60e34ed255d2bcfff352789167bb8d69cdc862a520f3af25014584ac68bfa617f45486986cf2d", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476805, "uuid": "c6b08b72-f339-4dd0-8a8f-3e6e88c04aa3", "value": "T12C11C0394DA58EAA0345D0B100C78DCCDF20C7573798FE3A2834B4595D9CE395E8DA0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476805, "uuid": "49fdcf93-f49d-47b7-97d7-3e6b9b4ce309", "value": "12:uhutV6Q7zMBNAkiuNounuAbZbGJA8kcXO2qvELJ7g3NnLd+KPj2T+TOM:uOVzSNpiIpGScXO2qvEcNngKG+TOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629476805, "uuid": "2f350e14-f3e5-4da4-8fda-8052ae73206e", "value": 949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629476805, "uuid": "558f44f3-8df3-43a8-978a-dff133dee62d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476805, "uuid": "edf10791-4a8b-421b-9858-d7b3220e2cea", "value": "W00903InvoicePayment.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ff35d5-01a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629458758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458758, "uuid": "2129352f-da90-47b8-b7e4-3d7b2901b80f", "comment": "Malware payload (AgentTesla)", "value": "662b2e10c90edbe3395453e6515914d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458758, "uuid": "e27aac58-34b7-4aa9-9d39-0545a836abe9", "comment": "Malware payload (AgentTesla)", "value": "a12992d2733b20376aff7d4a9303e2a1cd7f12adec5bb54325d443b6b01771bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458758, "uuid": "9e86b3a1-821c-4e81-96cf-c2c2414ca2d2", "comment": "Malware payload (AgentTesla)", "value": "92f5f59e532d84bdf8d567ae3a5c92d0b738a815", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458758, "uuid": "53eaa978-932d-40ce-ae41-b398ad4648af", "comment": "Malware payload (AgentTesla)", "value": "aa4a38758a72bdeaecda8f0838baf8b8cd2b2cb7db0f8e595798a22cfb081343af92e8e7cdcee163d891005be9d24f48", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458758, "uuid": "1913a8f6-c7ec-42dc-80ba-25362f12facf", "value": "T17EF433059CBB44A2D19224FB7B7993C55B542B002D7DAB8AA2701FD3329C83DCA677E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458758, "uuid": "eb5bc194-76ca-4715-b649-b881edcd2db7", "value": "12288:wNUcGBXcov2GJHzIM+8zhFabSdVmrhCPyMVkMQZsq8isgnqqT/F5lmcGtLd26V:ZJlZe8N4OueQsqagnPScyJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629458758, "uuid": "60c88e35-1c9f-49ca-83fd-4462d75487ae", "value": 769849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629458758, "uuid": "769b1b76-9751-44cf-b9ad-eeeb46689e45", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458758, "uuid": "606d1412-5080-4697-82e9-ee2597e3d53a", "value": "SMS-Q40208-30.06.2021-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aefe1b94-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629471768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471768, "uuid": "ac44e593-e52e-4e23-95db-b04801ae2bec", "comment": "Malware payload (CryptBot)", "value": "dc7fa5e9590a5655e2599a34ebe7418f", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471768, "uuid": "ddd5b076-195f-4785-9d46-52815a272d26", "comment": "Malware payload (CryptBot)", "value": "a228971bef4b94f2319bda9171a810d555238208893c3609d3291e24591922fb", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471768, "uuid": "d64cdeda-0052-4a08-be15-8dc017274540", "comment": "Malware payload (CryptBot)", "value": "5315cc45343f942cf8a7d9009eb9eed9a3cf25d9", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471768, "uuid": "367ac979-4d22-4a02-b733-c599b586614d", "comment": "Malware payload (CryptBot)", "value": "4cde88d7a05e9cdd2a91c276c70a7f33d4745e1ce5da68906cf879a1e18ec887ddddb84e5ce3bf5763a48c53aea7a903", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471768, "uuid": "7ca5d409-de0c-41e3-9d2d-aab8311d5b52", "value": "T149B4120479B0C233F065A130499ACB94E77EFD712D1092862D8326AE5E732A1EF36F75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471768, "uuid": "a029c361-349e-406b-9290-e63cbc030f65", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471768, "uuid": "764b8532-20e0-464b-852f-3b87fc2893aa", "value": "12288:uz+ImOoPNL6oQCktuSglKcftk10P3st2YUf7hZL:uqDwzXglKCaA3uyf7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471768, "uuid": "e45e6f46-0b21-4463-b0ae-6832ad4937a3", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471768, "uuid": "8f65b18b-a9c1-45fa-a597-cb8da0b37424", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471768, "uuid": "e701b4e9-c876-4ca1-8189-89737c65ced3", "value": "dc7fa5e9590a5655e2599a34ebe7418f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a8516b2-0179-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629438233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438233, "uuid": "8e137457-ebf1-4cfc-9489-95b3bb558ef9", "comment": "Malware payload (AgentTesla)", "value": "ac121feb46254261308cd381a6ceb125", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438233, "uuid": "879aed44-3b68-47e2-90cc-d9ba5f5e67aa", "comment": "Malware payload (AgentTesla)", "value": "a27c14f4956a58c80dc0915f46f1dab9ba9c5527fdcb15a7a34497f1deb4e3ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438233, "uuid": "899a5da9-d5a3-43d4-8357-4e3b6079221b", "comment": "Malware payload (AgentTesla)", "value": "8a68e6703b019c2481bf1103fcead0819aecb5b0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438233, "uuid": "754a04b7-23ae-4894-9a16-057fb12cc934", "comment": "Malware payload (AgentTesla)", "value": "8e3174c1097191da43e98ba0e528c78efee0b25ad4ba590c80e6a251a24c39b25803be4b7d397f2fbde981039b50580a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438233, "uuid": "7bf36642-a463-4cdb-ac1c-32070db8b7c6", "value": "T152942362A86CB7B1BA6322B9290D5F6A79D0DB833DC054C596DFA2FC0C660784D7703D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438233, "uuid": "cbedbbc2-59b2-49d5-acb8-06f8320a2593", "value": "12288:o86ec7f3uH6Q9+R/syoxGxfdM3Qxy3yR8/Zo9l:o86eK/uarsyoIxFM/n/W9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438233, "uuid": "c7b6a50b-618a-4674-a410-79b698f42164", "value": 412698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438233, "uuid": "4e9c771b-d5dd-4977-bcff-22de51403b85", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438233, "uuid": "ae404212-3842-4752-9b7a-f61a5d16b81c", "value": "TT COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a234186-018c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629446151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629446151, "uuid": "aead7b27-5c4b-4924-99c9-b6439dd5b267", "comment": "Malware payload (AgentTesla)", "value": "65f9545d9f07da334d1679a5e03cdd8e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629446151, "uuid": "d821db63-22f5-47e4-bf84-52e112697802", "comment": "Malware payload (AgentTesla)", "value": "a3eefd2f547134b5dda6a01e9247eefa51f8e764d1b83e3037f80ad465890024", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629446151, "uuid": "911c57cc-d3ae-4bb4-8e55-566a8a225032", "comment": "Malware payload (AgentTesla)", "value": "66e6daa8ef7e228e394ad3417db4236a2e7e495f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629446151, "uuid": "8ed6623c-a0af-47ef-9ba5-069069ae13ca", "comment": "Malware payload (AgentTesla)", "value": "86f43581fec3f3afb51782cbb32a6b89ed279608295baea5adfea41aaebbbfff1b2ee4285f78f21ea8bf9db7b10a7ec7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629446151, "uuid": "4b244573-be05-46c9-996b-fb9d3d3cd418", "value": "T1C0454A3D19B91633C1B9C375EBE59423B248985FB401EE696CDE03A7031BA9735C362E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629446151, "uuid": "cb78d29e-bb1b-490c-930e-316fcf00d962", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629446151, "uuid": "617a69f9-ed31-4c23-9d87-db1986b40595", "value": "24576:L9ggRSHnJSrJr3RLt6ULO2PaKe8TwgTMbf5qzCZsGUyx:xggwJSZRLtgDbyiWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629446151, "uuid": "53eb6a42-9fdf-4cb1-bab1-24154e63b2ac", "value": 1234944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629446151, "uuid": "80621127-e8e3-4683-bd3b-eaedfc3fe74b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629446151, "uuid": "73072837-3081-4500-b24d-d5e90b0c9652", "value": "New Purchase Order - August 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c275fa27-0204-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629498000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498000, "uuid": "61f1e96d-1105-42a8-a068-265d254b9dd6", "comment": "Malware payload", "value": "d9b583dae1c7d4bdef40a58e084651f8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498000, "uuid": "dafb7922-ff78-4fcd-a407-0f9bf2639784", "comment": "Malware payload", "value": "a4781b36e0846a2a6b8e80e41367b70b440293eac9071f9bff8a9c44ae4c6cb5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498000, "uuid": "8b66fab3-61e9-4ac0-88dd-5a75421ebec7", "comment": "Malware payload", "value": "0c8baa183fef4a7fa920ceafaf0b92ad4de773db", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498000, "uuid": "d5de360c-dd95-4930-8c8e-05b9c514c710", "comment": "Malware payload", "value": "9f71a89722043b28cca7c497f3c697abaf0621964dd6aeccca269f8f7a871e91e67dc850460bb90d7e164319109bc15d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498000, "uuid": "8c1ad645-6a6a-45e6-bf96-a9182e78fb2d", "value": "T17192C02ACB19F43AE7C2C17E60D45BF3F59D83089B13241C0D55C6A8C11A6C75726FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498000, "uuid": "6a344096-c181-4619-8f81-ca59d4b6581a", "value": "384:tcKf+StdSjYHTSksFqXKFVOfSQm1sqcwNc:p+odMYdsFr/t1sjmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629498000, "uuid": "d9746eb6-b8e8-4ef2-9c4e-e2fe4e7ffacb", "value": 20558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629498000, "uuid": "3b66d338-f111-475b-b9ac-f8c725348299", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498000, "uuid": "55254d86-bbde-4b5f-bad0-4d1d797f9864", "value": "a4781b36e0846a2a6b8e80e41367b70b440293eac9071f9bff8a9c44ae4c6cb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e1b31e-017c-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629439588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439588, "uuid": "727eeca8-3489-46f1-b593-fee3cd75d8da", "comment": "Malware payload", "value": "f6cca89862b92a935c78b589c76f0623", "object_relation": "md5", "Tag": [ { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439588, "uuid": "1b81bc0d-2c2a-4f01-82f0-9fd6860bd39f", "comment": "Malware payload", "value": "a61a8eccecedb3a00240340b216c1d59b6f9c9dc73c8ddefe52da7de12d399ff", "object_relation": "sha256", "Tag": [ { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439588, "uuid": "c5657240-91c5-445a-8a73-35860b8f8e2a", "comment": "Malware payload", "value": "30fcb7b77a52eff66460dcdfe3c4c4a8c1a7a5d1", "object_relation": "sha1", "Tag": [ { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629439588, "uuid": "a8816dc7-15d9-4e2c-a9c0-5eb80a6f3e2c", "comment": "Malware payload", "value": "f58500712a01d6a6e7dd3ab5beacf5fbbd776691a03cff2b2bb2565edff19acd71a695b08c874abad80861cb3dc89c8f", "object_relation": "sha3-384", "Tag": [ { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439588, "uuid": "6bd14696-c26c-498d-9a35-259f454a86ba", "value": "T18E514AB7F3AE181CD5A216FA71DEDA195F3F81DC22C1FB1F1000D20A54135692A394E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439588, "uuid": "e27cbf87-681f-4286-943a-59f5ce893314", "value": "48:9KbVURxqSwZM7FHqEBp8ArYuOdqv+STlL2ZkLBjmNyIXJX:Q+3Hwu5KqCAbdlL7BjpIZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629439588, "uuid": "3f165193-6862-4acd-8ddc-f1b0db6c4f74", "value": 2999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629439588, "uuid": "2dddffa2-79e4-4742-8e35-e2f5bcc33ff9", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629439588, "uuid": "e4993b71-1482-48d8-95b4-245e0ad5428c", "value": "nnxxxs.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baecbf2d-0206-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629498847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498847, "uuid": "4924ee8e-ec12-4fd6-98e6-7c0388c5224b", "comment": "Malware payload", "value": "e5b027f80c3acb8eb4c59cc23c0942c3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498847, "uuid": "dac506cc-dbc3-4373-8c15-747838d29d79", "comment": "Malware payload", "value": "a6c11288cb0d8c5129e3cf3b3ab1cb4263b2344acc884dff9da5dbf1027d0b42", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498847, "uuid": "9701198a-52c9-461d-b8c5-f93192d2e34f", "comment": "Malware payload", "value": "fb45ea1bf19cab34ec464b97802f59b9b45073ec", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498847, "uuid": "551a50ab-0884-494f-85f3-689892ba7b42", "comment": "Malware payload", "value": "86418fbf70597f7a853484309a28b9297c71b003ceef4731dda7b2608fb7073c98a9a45a82d788b8bc556fabafd83772", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498847, "uuid": "2dde9b80-30e6-4ccb-ade1-95043d3f3cf7", "value": "T137F53311E3C1C909C52F43B2844B51972B35B65CD6E2BE3F493A148254F7BE8AA27DEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498847, "uuid": "9e856b8e-1637-49cf-8a89-1194346bb6cd", "value": "98304:UlrkoY6RaHiXnQz9raUy7m5qjosXjDExFDEyR:mRRnQtaUscsX/sF4yR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629498847, "uuid": "58f78c64-3001-45ce-afb3-d81ddb156764", "value": 3379230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629498847, "uuid": "36b0d35e-4ae5-430c-b55e-3d368b44db6a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498847, "uuid": "dc2f0491-a754-48b2-8cde-4f80ed1dc801", "value": "AndroidGuncelleme.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f498222c-016e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629433660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433660, "uuid": "dfbbba55-01b7-4c59-9846-b84e2c43ed11", "comment": "Malware payload (AgentTesla)", "value": "b090f8a4a227bdd483ed76e2def2b2e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433660, "uuid": "b8ae9f3a-5b85-45ab-9034-8aacc6e99cd4", "comment": "Malware payload (AgentTesla)", "value": "a6e67496c74390a42f6135405bfbfd7f6b222edc7948e9747c229593fe029865", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433660, "uuid": "bbcd246d-cd79-4d48-8646-904294383356", "comment": "Malware payload (AgentTesla)", "value": "d32b192047aecfcfee4c6fb9efe8b0c8c36d2988", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433660, "uuid": "869ac233-e3e4-4366-a5bc-8f9f491ac002", "comment": "Malware payload (AgentTesla)", "value": "86bb6884a41f0f87715a13a0617cc2c255ea523ba2cefe8cb3ea5d87403adb2ba5266fa76c5f153bc57deebb218fbda0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433660, "uuid": "41106018-46e6-4785-81a8-436822c8d1fa", "value": "T120A4F148B764B68FC42F8D3BC9611C509B30A5B7570BD383A85726EE494EBD6CF052A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433660, "uuid": "71313299-eb2a-4f96-aa4d-8b5fd956bd42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433660, "uuid": "005bd240-5d18-457b-a8a8-51eea8f40741", "value": "12288:OGDDzgQrxQBTg7HmQ4ZqExeSz1eUOW6NIamPY8KO/:OagQrWB876Z2SzEUQIVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629433660, "uuid": "eb62d19e-9da8-434b-bae4-a347294341cd", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629433660, "uuid": "0c0b687f-6b44-438b-a803-6b3af7f35a15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433660, "uuid": "da0e2c97-c586-4881-839a-083515870698", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33b1d67-01c8-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629472285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472285, "uuid": "1e89fa58-611a-48b2-b039-f452d81bd1ba", "comment": "Malware payload", "value": "b30eb2078e680812d1eb5bd1a733faba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472285, "uuid": "79e10925-4cf7-4367-a925-81f53562be9c", "comment": "Malware payload", "value": "a7187155498bd9a433e9205965ba3b0d06b04a587be99e5569cd61038e9414f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472285, "uuid": "076d465c-1e47-413a-b04b-5d2e0a36bb0c", "comment": "Malware payload", "value": "830acc64dbf2f024415bbb2ae4be820ddd959bc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472285, "uuid": "2fce1a74-7b8f-4847-9687-a3b50e058bca", "comment": "Malware payload", "value": "e2b0d00342a77af4c836425b90ac49d7e9a2b6e6e7299f52a77b534f1148ce6a3884e069b48f7f3535606f3e9252eaa8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472285, "uuid": "c5d03da6-209a-4dad-8ed1-3f844b9e8763", "value": "T16E817C723F122B81F412A9B83A5C0A0EA31DCA3930BDAD5768944478D524F68E4BCB2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472285, "uuid": "8d430eff-151a-42b0-b767-4bb53c685610", "value": "96:A4iZPaoUUW4Lyiyhl2ZqofwLyzyMt4cwpe1jTwhMUL6ZR:KXs4Lyi82so2yzXtb1MQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629472285, "uuid": "a6b6b094-086b-4ae8-9b80-282a0e9281fb", "value": 3864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629472285, "uuid": "830bd90f-abe5-4205-bb83-e580b8aaf433", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472285, "uuid": "df7e2302-0b4f-4210-a62d-2cba3d7c8c8f", "value": "SecuriteInfo.com.Trojan.GenericKD.34055387.20925.3671", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7aa4c57-0175-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629436618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629436618, "uuid": "9eafdc85-10ea-4e47-9ea4-4e4cff6afbd5", "comment": "Malware payload (AgentTesla)", "value": "fb9066b91579ca47c29242a8669ad6c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629436618, "uuid": "2bbefcbd-3687-43a8-8a7f-63aae916d067", "comment": "Malware payload (AgentTesla)", "value": "a7b266edf9abd1b58d82379aa2852e641022d390099cec092d4f94450a6116a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629436618, "uuid": "69c5b284-5f26-4f78-be36-48427175e724", "comment": "Malware payload (AgentTesla)", "value": "211210687bbd5f610e242bb136e8c5f3493f0341", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629436618, "uuid": "92be08a3-817d-482b-b1ca-20566b2bcf7a", "comment": "Malware payload (AgentTesla)", "value": "5d8783557a7ce8501435eadaf6ad8aa3f5d44fd91bf9da412315afaff2a477350557d084e82bfa6e166da5519ea39ee7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629436618, "uuid": "7d21d0ba-4581-48dd-a492-b597fed3af37", "value": "T1ABA402883715BA9FC55E8E37C9A62C20A671B477A70BD343788325DD594E7CE8E012E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629436618, "uuid": "42040472-c306-4182-a1e2-24d476cdcf2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629436618, "uuid": "9fb5ac5b-0807-4d6f-876c-c0f0a1c9b762", "value": "12288:oGU6a9uC2ribjCx9eKeG77mkxp+Aqu1wXRzI:oJ6ad2+bc9pea7bp+ADw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629436618, "uuid": "63436db8-aa9e-4037-b489-3da15b369277", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629436618, "uuid": "2cb245d2-6bf1-4c98-82e2-5a4045f50797", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629436618, "uuid": "5ac2fc62-e3b6-409e-8975-174484177b29", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39352f78-01f1-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629489610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489610, "uuid": "ba0f589c-d2a3-48ac-bc9c-447374b32e03", "comment": "Malware payload", "value": "7c6e0622a03d8f1d062757882987dd2d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489610, "uuid": "b3a95f9e-ea32-4a0d-87fe-0c5dbe1e0a5b", "comment": "Malware payload", "value": "a80e58ef1c5a06c712d21814ad9d003f6f9482f5e7375ec15e5d2363f99b7c12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489610, "uuid": "a89d4edb-a386-4ebc-b227-7691978fb884", "comment": "Malware payload", "value": "c504bac8828d13903df18976309c6366ab3a6580", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489610, "uuid": "ef35addd-be58-4d34-9609-22c6ad75c326", "comment": "Malware payload", "value": "e235f89171e87481d1607e764d9f60b5a8bd2259fef78791a841a130186221cb2acd0d7c568b66e4a77b5dd698df3a10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489610, "uuid": "1ac3f529-6303-428e-81fe-7bf30e6f5c97", "value": "T15EA5230D6B4FB8DBD4641E355AD8A1D2067DFF28E596052C30F59E3CBBCB9398908B90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489610, "uuid": "c72c9769-5a54-4753-8ba3-b4905ff3f1fb", "value": "49152:hV5KJYCc8uZ8yvbCUM6dbaZOs2REm/zHMHo9eG8FrwK8u:hVcYz8u2K1Vzs2HsHoARwfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629489610, "uuid": "27841cb0-3851-40eb-904b-8e9f747af2ef", "value": 2128384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629489610, "uuid": "556fb033-220b-4ad5-b206-dd4534a8193b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489610, "uuid": "2da34490-fee4-40d7-8a7e-53e6152f4476", "value": "7c6e0622a03d8f1d062757882987dd2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce61252-017a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629438828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438828, "uuid": "3c2606ec-7c98-4558-9ba1-d817f7a97199", "comment": "Malware payload (Loki)", "value": "566644f5d8a7898071b4a2db7bcd51d6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438828, "uuid": "32e49bb3-a2ee-40a5-847b-2d08301571d4", "comment": "Malware payload (Loki)", "value": "a8a07a351691341bf3ca27662067155efe6d60c81dcd96e768125598707594ea", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438828, "uuid": "57c6fb11-d158-41b3-b28f-0c8924d265d4", "comment": "Malware payload (Loki)", "value": "d7493b6df8a5a20c4345cce345e8c9ed92e04bcb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438828, "uuid": "f75a9bc7-a7c5-421f-97fa-3b3537c56de6", "comment": "Malware payload (Loki)", "value": "dbcc258214972b14225394596c1501deb2301e183a79de71f9a26583a406c04c585691e9cb3f82900d36f87ba0b8e24f", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438828, "uuid": "693749e6-d931-4358-b65f-da13a8a1c21d", "value": "T19645128C54FEDD2BF1A9BC7041D285F1416DBC6B2106D0427D16FA096233B2AE6B36ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438828, "uuid": "bb505f1b-936d-4094-a2a5-669340fd1f95", "value": "24576:B6Y2n9HXnFZ+ohb1npzgFxtzx2TLxUeSo+qbgSEf6yYpj:B6Y693FZpx1nFghzxqLxUtZ6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438828, "uuid": "c9179ff2-2a26-4b6e-9c4d-192f79c0637d", "value": 1216440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438828, "uuid": "8412183f-cc00-4e78-93fb-bfb849ca59f3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438828, "uuid": "f820ec96-3ec7-493e-b3c7-73265c8d0438", "value": "HBL NAA-2101013TA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da890d9-01ee-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Adware.FileTour)", "timestamp": 1629488463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488463, "uuid": "abb35618-4542-456a-8314-873b11875920", "comment": "Malware payload (Adware.FileTour)", "value": "c105d4787dde8f7183c57c1285e9f808", "object_relation": "md5", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488463, "uuid": "54ae1408-73a4-4263-8a25-8085f65490c4", "comment": "Malware payload (Adware.FileTour)", "value": "a8d8a6f9478a60a05d3b8c57a616da20c83b99bc7877c46163fcd126bbb25409", "object_relation": "sha256", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488463, "uuid": "e32c6436-02ca-498b-895b-e350b25188d6", "comment": "Malware payload (Adware.FileTour)", "value": "91111164eb5a8b996eefe72a6363bad3f1a858b0", "object_relation": "sha1", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488463, "uuid": "979e7335-b901-49a0-9619-b890fb714b04", "comment": "Malware payload (Adware.FileTour)", "value": "9e46f44367692a876c6055faa75dca75f7fed59f2250941b47454ef1891d0b8db2a890d2ac84c9981e526ca1cceba7c3", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.FileTour", "colour": "#E1F2FE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488463, "uuid": "652c802b-5a9c-4ddf-94c9-14f2c8866173", "value": "T14256331177D1D8F3DA07223483457B7580BD92A019AC21ABA3D09D6E7B794EED42FF28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488463, "uuid": "c3806726-1377-4efb-81a3-7ef9481003be", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488463, "uuid": "e6d32139-c3de-4476-97b2-f6ba6699dcf2", "value": "98304:x7CvLUBsg7C0ijhUYMUpUqOnvqpM2GSEw1kHyaNgUvI745IRZYriuyY7x77:xALUCg7Cj1DavBHyQgUQ7XYiuyY7xv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629488463, "uuid": "30428f84-8fbf-4ea7-aa1f-1deebe959703", "value": 6024291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629488463, "uuid": "7fbba148-5d5c-4c32-9e93-fba76f7c1055", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488463, "uuid": "9a08c1bd-3d3c-4a94-91ce-dff7fcc18f65", "value": "C105D4787DDE8F7183C57C1285E9F808.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796c5b5e-01be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629467813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467813, "uuid": "76ba9c24-cb60-4652-bd69-76422babc64d", "comment": "Malware payload (Formbook)", "value": "556ed2559ab158f47739dc1426dbb77b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467813, "uuid": "ae72932e-4671-4b43-9b48-ba176c2a06a6", "comment": "Malware payload (Formbook)", "value": "a95a1c04fce6b30cf856d6702e46cc99a74079c6c79575ffb6c2015f707ec9bf", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467813, "uuid": "d819aac1-547a-4032-88dc-2a9003d04ad6", "comment": "Malware payload (Formbook)", "value": "cb10bbb7a621ec6b33ff9a9594b109bf6d6abe29", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467813, "uuid": "13e18250-ab35-4ed4-b615-f93d1860fcb9", "comment": "Malware payload (Formbook)", "value": "91cf9df9c4a4137ee7413ac233aedf886d1873b16f816bd50a5bf1d300ba29cb72ab5800793f119defce4741aa9c71f4", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467813, "uuid": "1054b4e5-a8b3-4fdb-96d0-c5a9055b9154", "value": "T107451219E244AF1FD093A43B982EEC3941EF8E6D91A5D9C5EB39F3021E71B24B24153D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467813, "uuid": "685dcb7b-32ee-4204-b6bb-4c2c7774741f", "value": "24576:zSb6Rl+Y2wQfBJZ7aof30HuL3dXd5gPqzVbUn7vLtMkIM19Aj:emRgTkofdzdXdm6Un7TtMc4j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629467813, "uuid": "17f3e127-a41e-4e12-b2a1-b6f1d47778aa", "value": 1227032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629467813, "uuid": "87ad4c0c-fdd4-481a-baab-fb50c33485ca", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467813, "uuid": "57abf7f9-9113-4ccc-b7b7-f26c03cd93b4", "value": "PayeeAdvice_IN10163_Q0158315_41720.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee03b94c-01cc-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629474021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629474021, "uuid": "e0bb6d9e-5238-46b1-b3af-6efd10a4572a", "comment": "Malware payload (Formbook)", "value": "c19e67355e7333e2d68b904fdcfdceec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629474021, "uuid": "a7bac1b5-08bf-47ba-aaca-f8297cce5f27", "comment": "Malware payload (Formbook)", "value": "abb0ac59e0528e0323d12d411d508c2a2b1a9463f0c1036c382a1a8ee986bb2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629474021, "uuid": "9fb2b45b-a5bb-4c9a-b04c-02f5b6004fe8", "comment": "Malware payload (Formbook)", "value": "49836c3b69ba3633f3fab33662b52e1547a7d3ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629474021, "uuid": "eede01a7-64cc-4cb5-9919-d482b2305c34", "comment": "Malware payload (Formbook)", "value": "3c1c8a4dacc12156ad2f4e7f07d9f943929680d308027e8297345ca458c9554a8621e8708d55bfae70ea822eab9ad45c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629474021, "uuid": "85b9a356-b886-40c8-b8cb-b34606e9a092", "value": "T192C1B757E7E88B37ED6B0B325C73A31022B8FB5149438BAD3494511FAD172984A62F71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629474021, "uuid": "213f9df5-f0bf-49bf-accc-80cf7b2cb1d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629474021, "uuid": "0f3d6655-3b07-4255-8075-82fc64676dcf", "value": "96:2TuRXkLoN9c5t5GgNWjXZtJdqYmdESOzNt:MXoqn1Wjps1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629474021, "uuid": "92e33e70-a057-44c6-bc91-edfb7a2e76a0", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629474021, "uuid": "cad4e290-1801-4c82-8d67-c42b267ae4c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629474021, "uuid": "61880b54-087c-4308-a85c-616af6f5dcb7", "value": "c19e67355e7333e2d68b904fdcfdceec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad207316-01b7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629464893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629464893, "uuid": "2d3121b1-bb0f-4e76-93c5-e68d83561b12", "comment": "Malware payload", "value": "5830c793bf39663018a60668a098c623", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629464893, "uuid": "5ecf207c-4192-4fee-9d41-ace7bcbfb3c8", "comment": "Malware payload", "value": "ac5e6f8e646311bf3645ccdccf7119712ada6811d973444d3a763d17083ef028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629464893, "uuid": "501d9b5c-05ce-4696-8926-c213c9589917", "comment": "Malware payload", "value": "cbd988adbce3e58643aa115f58e7366add9ff7bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629464893, "uuid": "807e7571-3231-4827-a88f-83e2564f9040", "comment": "Malware payload", "value": "ed57d7fb7cce32b5e14a07916bbfedb031be282b0112bd6a0ec27e145c0f02a4ecc2d24e4ed039d61ae2ef6ae5c8f1d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629464893, "uuid": "b4934c07-6517-4eb5-a4da-f88ba28e6bb2", "value": "T14F4429F1A740C469D8A795B9843BDAA7A423B25E8D6C490D2C92FF0B7D733470027D9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629464893, "uuid": "4dd970ab-638d-449b-b7f1-238db0037d1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629464893, "uuid": "10789729-5691-4da5-8e7c-88664004a089", "value": "6144:jl3QFzxR7jChHnDCn1wbBI2j3lRzNiBDA8:pAVjSHnQa9I2j3l65A8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629464893, "uuid": "21b28b34-8cdd-4588-af67-b21e9422d7ca", "value": 266752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629464893, "uuid": "e0c36596-7807-4bc4-bf2f-1307210b636f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629464893, "uuid": "7ebd26f4-d3dd-4222-b6d1-40657d23e7ea", "value": "SecuriteInfo.com.Variant.Ransom.Ranion.1.27807.19923", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b50c96-01bd-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629467595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467595, "uuid": "8a8794a3-f700-4885-812d-202472ed295a", "comment": "Malware payload (AgentTesla)", "value": "ce35088dd1d44fa5d811ef40223c75e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467595, "uuid": "9335fb00-b18d-4c87-8b2f-ff3c31598fc1", "comment": "Malware payload (AgentTesla)", "value": "ac93fc8b7f3f7deb8d5cdfc5610d6685172ead7feaa67c48ece1e9310fb3ebc3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467595, "uuid": "652fc440-5fba-456a-9c80-3b23b007b878", "comment": "Malware payload (AgentTesla)", "value": "4751a50174003ba9fbf94b7e9d9bf152a76abdec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467595, "uuid": "d862488a-1c9e-47d7-8cb0-26efc260a6b6", "comment": "Malware payload (AgentTesla)", "value": "f7dde9cfd649b61fe95bb600fe13c9bd4f8595a578660e725c24b4009824d28d7409eba511ddfb15a3817d22baa0b7ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467595, "uuid": "d6360b16-8668-491b-a0be-d810a1843649", "value": "T1F394236E92CAB84E30600611FD7A00F5709C4E44D839F7B6A2B756125EBB1E3429FDED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467595, "uuid": "19a89d1d-7ecc-4a3b-a730-5f0338f0b73f", "value": "6144:mpF7IFPy8DKSzAZmSMigyrmUwpQBKD2OvCiG3/D4nf0FxvzQkwP5go/0d3lvLI:S9IDx5SMi/rmvpKCjS/0U7mg807vLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629467595, "uuid": "8e9b07fd-c848-483c-85b1-5a525b61c8fd", "value": 416712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629467595, "uuid": "3d95807a-0ef5-4d44-92ce-e6a92908c5f2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467595, "uuid": "ff0d8cd8-500b-41fa-9342-9747138c071a", "value": "TT COPY..rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14306276-0194-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AZORult)", "timestamp": 1629449604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449604, "uuid": "03543861-7f7d-4147-b0a3-aeaf7c926b29", "comment": "Malware payload (AZORult)", "value": "70ded05d874a95b1b3027c1e97b16287", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449604, "uuid": "ff3eb865-69be-4c49-a78c-8d7c93174eed", "comment": "Malware payload (AZORult)", "value": "aca7a7d812ac2192255aa3d47477f13b05963da0383e459d6b09d1630cd11aae", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449604, "uuid": "6615481d-9121-4ce0-83d4-54052eae28bf", "comment": "Malware payload (AZORult)", "value": "b12023392be69985ba2e2fdc3094e80baeca55c0", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449604, "uuid": "bad6e455-e661-450b-b5cc-8e682ce6863d", "comment": "Malware payload (AZORult)", "value": "8c1b6a33d521e2c42f2cc1c90b5b7afc6282e53d48243a8d0bc505ce35aa883fb1835da3041f5b2c18dac05c42a16c0a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449604, "uuid": "af7f772d-7e1f-4493-991a-b452a64fa3ba", "value": "T1CBB31A6EFBC18277D02408BDCD45A1B9907975302E391822F7E64F6CD9F96C26A6C2C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449604, "uuid": "48ec71f3-5fd7-4db7-83e6-fe0fbda34bfc", "value": "6d1f2b41411eacafcf447fc002d8cb00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449604, "uuid": "7a65487f-3a60-46d1-872d-151a5b2fb767", "value": "3072:KExRaQ6raoCoCyz6/mqv1JR+yBtGOeaeWgibq:faO1tme++wi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629449604, "uuid": "63f5fcb7-1e52-4ec5-acc8-d8a1239a74ed", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629449604, "uuid": "7c1c81c9-52d0-47eb-8370-3dcfaf6c686e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449604, "uuid": "319d7b2f-477b-4566-803b-53d830328455", "value": "eli.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75b00ae-01e2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629483406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483406, "uuid": "7fb67720-26a2-49bd-a320-cb163fa32376", "comment": "Malware payload", "value": "58f4449bd9ad73b187223d56d881e312", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483406, "uuid": "90006555-cdce-4425-a25d-7c2ea10af7da", "comment": "Malware payload", "value": "adad04b4a231a8d8ffc4e0363621fee90f507ceb96d6c7696f5d6a8329a1cf12", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483406, "uuid": "1c40401e-91fe-4f12-bc1b-5f8bb0484299", "comment": "Malware payload", "value": "cfac5a08430f713bd6276f840330e8bd3332a826", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629483406, "uuid": "ac534e37-d250-4964-8ee3-328ed8978d59", "comment": "Malware payload", "value": "ec9378db45467e5c1d6baaac415557802ae9da2c49e0e4da5a72eebce497b7b8e9fc09a05cd33c00e45a563560479a32", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483406, "uuid": "0e8b457b-8fdf-411f-a8fd-2d4252c549c1", "value": "T17225273D19B91637D1B5D375EBE49423F258985FB404EE69ACDE03A7030AA8734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483406, "uuid": "b80c49d2-3684-482f-8d56-efccfa8ec3a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483406, "uuid": "5967b544-bdc1-4209-8049-fc728eb2e5f1", "value": "24576:PvZQnb6KMUfstJ9n99L1j2R0+q9A7Ok8z6w:nZQnb6/cw9911ic9A7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629483406, "uuid": "8b9ed14c-22bd-4cf3-9759-e76ae64ccff0", "value": 1007104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629483406, "uuid": "58c8dead-1333-45d4-be41-4fa447125ef0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629483406, "uuid": "16eebb30-cf88-46f2-8d0d-978b7df0df25", "value": "Scan007proforma_inv_output5776467867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9ffdd2-016f-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RustyBuer)", "timestamp": 1629433969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433969, "uuid": "312c4598-092b-4432-9e34-bb1bf9b23466", "comment": "Malware payload (RustyBuer)", "value": "50097dcbf3f4071e621ebbf3911d6ed5", "object_relation": "md5", "Tag": [ { "name": "rustybuer", "colour": "#9300CF", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433969, "uuid": "dff17d59-4ce2-46da-b6a3-3d27ffbc1355", "comment": "Malware payload (RustyBuer)", "value": "adf1d9e22efc7d95a57aa8754fe5e489380c52de240167930f7043d079e34144", "object_relation": "sha256", "Tag": [ { "name": "rustybuer", "colour": "#9300CF", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433969, "uuid": "baf03370-5d4b-44d0-9e23-fdaa9ac02813", "comment": "Malware payload (RustyBuer)", "value": "eef3fad484c512b778a25d931edba6726d39f5f3", "object_relation": "sha1", "Tag": [ { "name": "rustybuer", "colour": "#9300CF", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433969, "uuid": "f7a2eb33-7181-4141-b809-67b05319311f", "comment": "Malware payload (RustyBuer)", "value": "206ed7339d3467298e9afa339fa24322bf0eed3e4770d6f5624d1b1c4315edcba5ed10019a37333f39c4bbe25645162f", "object_relation": "sha3-384", "Tag": [ { "name": "rustybuer", "colour": "#9300CF", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433969, "uuid": "20c8bfd7-66d8-4ef5-821f-8c258576b5fe", "value": "T16B33D01A5E150CB8C1A6C43CB9BE8813824D764EE9AFF5ADBCC8A79F5447684060FB4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433969, "uuid": "4a5bf640-48b4-407c-b2bf-728fc5d5e95f", "value": "1536:l4KAHoEBzQrVgRCsubuZOB/4JqpyOYVHf0T:l4LHjBM0CsZZOF4gpyF8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629433969, "uuid": "98371757-88fb-4d4a-b285-6f281ef284a6", "value": 54718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629433969, "uuid": "e3d904d4-d1bb-48c6-b253-9ff5fb1cc467", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433969, "uuid": "31b948f8-c22f-4c19-8de9-5891b851b563", "value": "document.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d660fd4e-0157-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629423731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423731, "uuid": "494d8c51-d586-4dfe-a1c1-1b2997ec0f2c", "comment": "Malware payload (Gafgyt)", "value": "95fa65bb1a785a179646b32f503a3bd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423731, "uuid": "9a91c661-bfae-4f2e-9aae-a6fdee46bcd7", "comment": "Malware payload (Gafgyt)", "value": "ae8800f62a907de72980dcec839a5136ece1c6802dc94bfe068635ed10fd886f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423731, "uuid": "a99afb80-dfdc-4ec8-b785-76686c513c38", "comment": "Malware payload (Gafgyt)", "value": "6f59bf1b74b1e897ebb07d5fa0466ca585a98e6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423731, "uuid": "181eeebb-da32-47d9-a3ae-c35f503a4c63", "comment": "Malware payload (Gafgyt)", "value": "daf79b95b5def8bded9eaa0fe861de2aab0eeb995123aa39ce118a55201474b919d3ec2024de678ce67a733891d59001", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423731, "uuid": "b4c602e5-ac73-4d6b-85cf-390b3de17222", "value": "T19AD329DB661C0783C49756B12D6737F1675CBBF021A262C1A81BEF800B77A743526FA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423731, "uuid": "6c3f800c-7639-42e3-9bf0-7221a1a421dd", "value": "3072:pXfIj0cMNSgnZQU5JmDb5hGvvptQnL0CDYxlQNU8:pX40cM0gnZQU5kDb5hGvvptQnL0CDYxW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629423731, "uuid": "758312d2-34ce-47cf-90f1-d8bf7b9dc098", "value": 137835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629423731, "uuid": "cb3df469-3738-4055-9bc5-de98294aec31", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423731, "uuid": "db607020-a8de-41e4-bed6-9c19fb9e3655", "value": "95fa65bb1a785a179646b32f503a3bd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdf31ce3-0193-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629449567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449567, "uuid": "663648aa-9714-43ad-a5e0-884530b7d1ac", "comment": "Malware payload (Formbook)", "value": "6d7edf1f66a4d43e76d1e47f400f97d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449567, "uuid": "3626a531-0c88-4931-b486-3e946ed2941e", "comment": "Malware payload (Formbook)", "value": "af0e9136ff8915ef261cd9068ddb08262cf0d034c52776854169f9f75ec13227", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449567, "uuid": "03c5f212-5619-4dc7-991d-4f5ed6e27b5e", "comment": "Malware payload (Formbook)", "value": "ab539904f069770509862d487f06ce545c771a99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629449567, "uuid": "1423032d-0bed-4662-bfa9-042f600b0d5b", "comment": "Malware payload (Formbook)", "value": "2558350b61dbbf05ee328ab3a8f203eaf6f14006e4fe53d1359cb653ed57f92eb8bd92a8eb40241703f6c2ddc8c7d6af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449567, "uuid": "670c0e48-9286-437b-8227-aff41c7f4832", "value": "T1F104AE32D642C031F2B251B5B67D0B7B893E0E343255A5E6A3E116E06FB54E6F42A31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449567, "uuid": "b2efa464-cd41-49aa-ba43-784574d26ea8", "value": "3072:KAkCv/Z8iADCn4YAkm5d8LFyLRG33MUI8k6iQxnsfFKt6n4Hx:7kFiuYJm5mLkL43lf00nnK4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629449567, "uuid": "1ab60250-1495-4b6a-9768-efabfe756cca", "value": 186368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629449567, "uuid": "561ddf2d-d27b-48a2-b1bb-7be933ffc826", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629449567, "uuid": "b66087d3-6110-4411-8390-3aeb3d5c2653", "value": "justin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412af19d-01ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629488764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488764, "uuid": "64dc8921-915a-4cff-964c-110e957b5cd1", "comment": "Malware payload (DiamondFox)", "value": "c0672ca6e505b76756ac421ef9d33409", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488764, "uuid": "b2a04c71-5c11-4d6f-a7cf-cdfa55430711", "comment": "Malware payload (DiamondFox)", "value": "b01b61c911a3b80d4f265e4915f9d62275efa34f84989f77be142f3f9e062f9b", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488764, "uuid": "b3b6479f-0630-40a3-8dde-5d3e52557a5c", "comment": "Malware payload (DiamondFox)", "value": "a773fe4c53105ae987d6c4cebaf3095102a6f103", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629488764, "uuid": "df99541a-884e-4e04-b36a-c9c367b86b20", "comment": "Malware payload (DiamondFox)", "value": "d8000214666bb3251f77cf8b525930f85751d708356e6a48ad6fe624afff899d6103a0ccc727a3389c51be489de50c07", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488764, "uuid": "503a4bf1-8246-4ad2-bb21-a9be0fc534e1", "value": "T102863351B9A5B5F1D1A11E70429CE7042B3C7C252A385E6B77D0BF6BEB340C2DA247A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488764, "uuid": "c2afaf7a-b4b5-46db-af3d-26c9901c4ea4", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488764, "uuid": "46295f5c-4d59-4d01-9144-3d33ea0c532f", "value": "196608:U+xH2WQ550oabSsdp9dQeCrENfZKSYE59:toK+udCENwvE59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629488764, "uuid": "c35e0e31-e676-4a73-b97d-9bad21946581", "value": 8296020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629488764, "uuid": "bdfef046-14ff-44dd-9996-ddb1505baee5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629488764, "uuid": "1bf5cfac-dc13-4653-a2c2-0481cf3176a9", "value": "C0672CA6E505B76756AC421EF9D33409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be3c451-01f7-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629492352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492352, "uuid": "e96997df-cb16-4cb6-8abd-d0dbf8e64daa", "comment": "Malware payload", "value": "8bf2f3ac90a9c00855cbbdff2c3a0f28", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492352, "uuid": "58abd907-afcd-4249-b841-66ace504d975", "comment": "Malware payload", "value": "b16b3243bc9a93df147b1a8e08e94800282a7eadf76269424ee890241e842401", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492352, "uuid": "5e87fece-57f3-47ef-ab65-28fd4f3b4326", "comment": "Malware payload", "value": "ae11797c3d9fa9d5b4d9b9fd74fda79e557ea82a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629492352, "uuid": "bc4bffd9-8e5a-4939-aea5-ff7256b549c9", "comment": "Malware payload", "value": "f931b0b6c397a3fe84f2c5f66f1530f523f8211bee3225556f93bb88f3447b36e0336fd9c7588dd02a21f9321b3eae53", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492352, "uuid": "72ed6e40-9970-42e8-b671-f1d56d0e723c", "value": "T186F533CEDE82C841DF86A8B5C38548DEE124899D4841E51F0F215A091DF6FE8BB47FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492352, "uuid": "6441c65e-60b5-42cb-a5b1-46e72b8e0443", "value": "98304:jxQVFvoFpultVMzLKXOQ+sSHO5WcROBCk6Pn:jxsFvZltKaXOJrHOAcRXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629492352, "uuid": "752b0042-074a-45ac-8375-c1ea4708d021", "value": 3504903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629492352, "uuid": "f2220d53-92e5-4a5f-8759-4066fda49bc4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629492352, "uuid": "341694c8-65ae-4d0a-89bb-9973457c63a6", "value": "01549_Video_Oynat\u0131c\u0131.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2515b36c-016e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629433312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433312, "uuid": "3399ce6f-d83f-43c0-b4fe-6c21df920c0a", "comment": "Malware payload", "value": "dba5ada57194375dea0850bb516cbd55", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433312, "uuid": "e0926256-5c22-42a7-9078-2ec127db7fdf", "comment": "Malware payload", "value": "b3fbdc7189905c18ba6cfe5785ccfd51fb0b63ab239de787612263a08047ba94", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433312, "uuid": "98509205-177e-4d69-aba5-415e23f1da9e", "comment": "Malware payload", "value": "8ae92df30e0b2e887248a14df9aed2c23b883821", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433312, "uuid": "e741b00a-a619-4734-b9bd-0352ea8bbfe5", "comment": "Malware payload", "value": "7c96482f4debb29d81c1639e1f3e689e1b9b378724951e528cd8c6345dec695bb0b027bed12a6290aa339265348d84e5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433312, "uuid": "6d24fcc9-b64d-4a0a-bcbe-35117d9d1a41", "value": "T148B14B34BEC7E968F71751B0C264C592F50401C6874EE9EE5E25A2DC0E82BE84B27DED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433312, "uuid": "08ef71f6-8f13-4ff9-bb0c-1d913a4bbc4a", "value": "96:peRCkd5tfhhEIRZmKS8TnVx52omBFfpWQwgNTSxrHCNsNpS1ru4K3y6Ic0vh9WDm:A8kd5PRmKVy/EQwaSxrFrb3c78qlNqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629433312, "uuid": "31d31831-809f-4ffb-804e-f1262f4e78ad", "value": 5538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629433312, "uuid": "9522a57e-d768-4eba-92fd-c5d1a259565b", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433312, "uuid": "eb0e96f0-dc7b-4979-8d9b-67007f6d6f0e", "value": "\u00dcber mich.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3738342b-01c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629470279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470279, "uuid": "1d4c2e24-439c-46d5-a855-4bd6bd91011c", "comment": "Malware payload (RedLineStealer)", "value": "82c0c2e4672fba954a0482ac24e02498", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470279, "uuid": "642e8d1c-3c07-4953-802b-4a507d7f1169", "comment": "Malware payload (RedLineStealer)", "value": "b46fa39b04cb5928c3dd9c1bbcbd9008401d98faff5e42115102b00c60fbd486", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470279, "uuid": "75d2d012-e8c6-470c-9b69-41b217ef6b6b", "comment": "Malware payload (RedLineStealer)", "value": "75e3c148d38cdb578efbf24ad574ac31300d190d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470279, "uuid": "ae031ec0-e24d-4d96-b9bb-66b46313a883", "comment": "Malware payload (RedLineStealer)", "value": "16ba608e77e830fe11608710bb2752c633d537ed7001905616433c5b7fda1fc4c3cd29c02b4e8622cf46c15d47077d08", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470279, "uuid": "1de79211-7c4e-4dcb-bc33-ef456ae895ba", "value": "T1AFE3BED175B1C4B3D09249314861CAF0663AF9636EA096433F5B235E1EB12D0DF2AFA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470279, "uuid": "550f04a4-08b8-4214-97a9-5fa16159e26f", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470279, "uuid": "011802ac-07aa-4286-9eb9-1a914dd7dcc7", "value": "1536:k0vfX+0b2D9hwdmF/I4d++wgz/zmXQj3bbidSRk1ZOQuye+03ZzABFnLFBMK486:OnTjsPaaXQXbNRk1ZOCvMZzgFnLmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629470279, "uuid": "0d61bc3a-c579-44c5-9c54-e1c4eaf5c8fa", "value": 154624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629470279, "uuid": "689b1133-b616-4bd6-97e0-9b77fff3700c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470279, "uuid": "cf01f0a9-f075-4e83-81f8-e1f0c510b31d", "value": "82c0c2e4672fba954a0482ac24e02498", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd49215-01f2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CoinMiner)", "timestamp": 1629490204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490204, "uuid": "52535267-61d4-4b24-b53f-53584a9e38bf", "comment": "Malware payload (CoinMiner)", "value": "9fa656e46f3e5936261d1c9ea1b4952f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490204, "uuid": "7c9771e7-daa5-4820-9a30-ed56fabf9916", "comment": "Malware payload (CoinMiner)", "value": "b55bf0c98c34bb3ca46a7bb08598ffc1a97c9ad7bb47191cd1280b609322267f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490204, "uuid": "25ebed5a-ad90-41f0-bcaa-7feaf2ae2656", "comment": "Malware payload (CoinMiner)", "value": "0d1519e028e96730706ba2f9980b384106ce924e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490204, "uuid": "cf3e090c-338d-4cde-b98f-680e2eddd878", "comment": "Malware payload (CoinMiner)", "value": "375d80844fe11829cc2ad0a8c3e88a8b66b6315914c24111e02814235594d3fddd0a2d8bcafe8a68b727212c0270a24a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490204, "uuid": "2d0cc1c7-3e99-4c6c-832d-4eb45f725ada", "value": "T16AA5231C6F8AF49AE8104E796462E9A3473D7FB4B4949B5D30D87E7EB7A9078C400BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490204, "uuid": "54fe6f66-a06c-405d-b9d9-01fa4e331655", "value": "49152:4Vmoa92mJxZp4VNx75x5nAGkr8LIBqXSwt3MMARzA8A51dUagYu:qqMs4bx18GrIBqiwt8Mr51dzgYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629490204, "uuid": "f32cad54-b049-4ba6-bf04-2d85961bb253", "value": 2241536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629490204, "uuid": "20e87fa7-d916-485b-a198-adedaa13c9a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490204, "uuid": "2a42f188-97e0-4d22-ba4b-d0cdb438915c", "value": "9fa656e46f3e5936261d1c9ea1b4952f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a169ab1-0162-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CryptBot)", "timestamp": 1629428327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428327, "uuid": "c2733fbc-0ef4-4bec-ad3c-6cf472e2aff8", "comment": "Malware payload (CryptBot)", "value": "7f1768f8d49b2339e0fb39e6cb19ed22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428327, "uuid": "8c372548-f1e8-4feb-b516-e20a81782ce9", "comment": "Malware payload (CryptBot)", "value": "b57b2c143036ce5ee287e63f717278933a2d9b64a9c85999343f715d91f2f6e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428327, "uuid": "62b1b5ce-2e2b-46d0-ab32-cae3d57db61e", "comment": "Malware payload (CryptBot)", "value": "9730e09f3c4548536180283b89f9046237a4c258", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428327, "uuid": "b9d585c6-755b-4635-9253-090b316dc727", "comment": "Malware payload (CryptBot)", "value": "e2487ef356f6c9c1d842c745c6ac8a4e52bb5d1eba714f7b68ba07432dfbe9bcbe4771e42050280f19b7c4ee518277d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428327, "uuid": "8f57f804-3a94-496b-885d-17ced73a4e05", "value": "T194D4E120B690C435E4A653F4697983AC7B29BDB45B2040EF73D536AE56382E4AC3137F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428327, "uuid": "81bc319a-75e4-435b-88ec-c735adc2e3a0", "value": "c373d93df8b60680e045175a45030767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428327, "uuid": "41d2b04a-78e0-46c7-acea-667d6aea20c4", "value": "12288:I0ICiL0j9l7ZMibYBS2hlt9t5t7Qt6HPfJpEy3tO7jHTj4nri4sy7I6:IT0j9l7H0lt26oy3tiHTj4ri4syM6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629428327, "uuid": "e6a4beac-802a-470a-9bfd-c91c5bc77e34", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629428327, "uuid": "5590efbc-84b5-46de-b616-524f25549e01", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428327, "uuid": "16838686-c621-4af4-8853-26d387601d7f", "value": "7f1768f8d49b2339e0fb39e6cb19ed22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d018a5-0180-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629441311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441311, "uuid": "c90897ea-c734-4089-becd-275f54c8fe28", "comment": "Malware payload (AgentTesla)", "value": "1c3c74169aecd364d818fcd621c0f79f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441311, "uuid": "999a49a5-0193-4d0f-bfe1-6228e3703382", "comment": "Malware payload (AgentTesla)", "value": "b66ed68c82ece47a67b72c1bf125a4f80a96c63692e392e0ee4a0fc05101de79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441311, "uuid": "b240a4aa-bf75-4723-94e1-c46567610708", "comment": "Malware payload (AgentTesla)", "value": "3db465ffb3872dc9ea0cde103f2163f34b136328", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441311, "uuid": "89eb5d81-7f5a-4103-b23e-2dee83f18400", "comment": "Malware payload (AgentTesla)", "value": "6eaac0844f15ac2a8922ae98d7a2d2107b893be235e233017268125e368582da8fb20d6f927cc798a440a7c55585df91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441311, "uuid": "ac902c7c-3bf4-4f99-8253-024e8be92497", "value": "T1D38422296F71CB77C8FF11750ED4F9500D67A9A29C631B4C98492A688793B822F336C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441311, "uuid": "9a1ae670-b1d4-4372-a844-192553f081be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441311, "uuid": "7fc3792f-e948-4c7c-b67f-f130152917b4", "value": "6144:v3Nf9TO2/sKxrk0Fq9+/DxY98vgOLdezuuk9a/fDejm33RryO7X:v3NJ/s6br1YTzuP9an/hryO7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441311, "uuid": "0202eecd-835c-43b4-9a5e-a558756f5e2c", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441311, "uuid": "b9e5ab7b-5a4f-4c4b-8e96-8ab5b2d4ccee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441311, "uuid": "3a13384e-f416-45ce-b56d-7b477a920c06", "value": "1c3c74169aecd364d818fcd621c0f79f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58e9dc2-01a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629458921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458921, "uuid": "047d4542-c508-481a-8994-a03864310483", "comment": "Malware payload (SnakeKeylogger)", "value": "c671cc3771d29bc565f1c82146a5fcb6", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458921, "uuid": "75e25504-9e56-41aa-aa00-6a8529a96c8d", "comment": "Malware payload (SnakeKeylogger)", "value": "b6b7981243263d06c00ea14a354c7c98ceedd46ddc15f688b8aa69811c57d7a4", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458921, "uuid": "3d6aded8-1f75-49aa-8725-566312656544", "comment": "Malware payload (SnakeKeylogger)", "value": "b65a9b6fb0bac011f8a15b8a5018a33ee24127a2", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458921, "uuid": "74d12cd8-e985-45e4-b8cc-fe5895d04d95", "comment": "Malware payload (SnakeKeylogger)", "value": "65ad611949b307e9a23f08c67a76997de604599b9e33e3d2d53411ab4da9fafe1842adbcd73afff11e16240a2458fd4a", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458921, "uuid": "aa002bd9-b91e-4ec9-b63a-b2dfa8fe88c0", "value": "T116F423006B6EBBC34292D69F12DB64B9D2DD9372849908AC7CCABED0FF50154D7D8D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458921, "uuid": "cb49e725-4050-411e-97df-32ecbf612d82", "value": "12288:ilL7a1L6P8rdJzk1KOa4yHYuUUy6mTo6gC2qMEEpt/QTAFLev/7XWWv2vny59DiO:ilL7gk8rTzk1/5bvTo6gCvPGQTAAv/75", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629458921, "uuid": "10c062a8-22d6-49e8-aa59-17546e95eccd", "value": 749712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629458921, "uuid": "692d4f3e-35cd-4102-af82-d95e6bb33015", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458921, "uuid": "6b94ff11-d334-4094-a5ec-5bd7a27e4dee", "value": "Halkbank 336,pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d09189-01ab-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629459643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459643, "uuid": "abae8c05-721e-462d-8fed-7424cbed8771", "comment": "Malware payload (RedLineStealer)", "value": "e77188581c0cb93c5821999d39d979e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459643, "uuid": "a20ee571-cb8b-47ef-bee0-6152650386a6", "comment": "Malware payload (RedLineStealer)", "value": "b817002c69c6315e116f14d6fe64151577999eb773842f052fb17d9a7413a53c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459643, "uuid": "7dc230a5-5482-443c-a0bb-11e083d78ddb", "comment": "Malware payload (RedLineStealer)", "value": "a11e5624e493ef524fffad14ec2488b00ff601c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459643, "uuid": "b47d82bc-ef99-4c72-a005-98fbd008934d", "comment": "Malware payload (RedLineStealer)", "value": "67c5198ba5efd0613d0e3087e748bc43aa6cfb3bc116e643c615d3b47a815948c524c2542f40732cb092797b16bf514b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459643, "uuid": "41ff59af-c80b-4e97-9ed1-8076f4311536", "value": "T12BE3BE1076F0C477D0524D3148508B9C567AFD622FB59A0B3EBBE36E6E312D0CA26F96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459643, "uuid": "4b7d029d-d487-4ea5-bcb0-13228555dad0", "value": "ca5ba0dfe6e58a229ea3afad859dcc2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459643, "uuid": "690377cf-ced7-49b6-b27c-fa7a9d75066c", "value": "1536:uGYdHWDB40C3ox5AUnLhhc8ezwThBbfRR1Ooe6zMf/J//HRzABFnLFBMK48o:hWce8T9FfRR1OoXqxBzgFnLmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629459643, "uuid": "f3381447-a87a-40e7-be20-06f553d9b48f", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629459643, "uuid": "b69a8bfe-b8ed-4a9d-b703-91e790e2197c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459643, "uuid": "dce6736b-afe8-443a-9ce0-e7110ffafd35", "value": "b817002c69c6315e116f14d6fe64151577999eb773842.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b5dcb2-01aa-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629459277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459277, "uuid": "4a2f6832-d4b4-4906-a633-2f57216cef83", "comment": "Malware payload (AgentTesla)", "value": "91a627bd3fcb5e4dd97ab8ad7cdeebef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459277, "uuid": "d149b790-ad3e-4f6a-b2a9-b2afd6cb9651", "comment": "Malware payload (AgentTesla)", "value": "b8b370db3545104cc81d838cc6c7020fa5ffa2b490df3f891311009c36220ee2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459277, "uuid": "d9765446-61ff-4f73-b81c-3050fd1352d1", "comment": "Malware payload (AgentTesla)", "value": "16477d3fc26bd4e05987edba9dafb3d3e90102a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629459277, "uuid": "70c79cc0-27c7-4f50-985d-a2765c72f797", "comment": "Malware payload (AgentTesla)", "value": "fb6659395a12337b68144f8d7483ab42fbcb45fb25688cb48a223992c2ecbb32f6723f57a7a3d021dee0bdf5065680fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459277, "uuid": "707b2349-acc1-4821-90da-898fdab5bac8", "value": "T17D052350DE33524043AD69DCA5CE72E2339CB205C369DE551FEF91A9B23EA7C92C618C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459277, "uuid": "7ee1c5a4-aa34-448e-a221-b9e80c904272", "value": "24576:dBbsb9JoT7v3DLbWUdOaPa42gTwsHMRfXgxM:dyHonDLbkHRgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629459277, "uuid": "536dae89-ff1f-44f3-aec7-fea3a3a765b6", "value": 855583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629459277, "uuid": "58bad734-dd64-42fa-9d87-ac378b7b8c61", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629459277, "uuid": "2512e31b-e341-40d8-b06f-26d771d91a2c", "value": "New Purchase Order - August 2021.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39df172-01c3-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629470058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470058, "uuid": "33fb1984-720a-4f78-9b73-f105d5548e13", "comment": "Malware payload", "value": "ec3921304077e2ac56d2f5060adab3d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470058, "uuid": "4f4563e7-b320-49c8-965c-c3f79af6bd34", "comment": "Malware payload", "value": "b8f88d0b48fbf8c1eac3d72272ddc48c723cbf8ba0527fdf42ad20cc5724ab9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470058, "uuid": "cf77c474-d941-468c-acb3-1b8a6d1d3e16", "comment": "Malware payload", "value": "923cf378ec34c6d660f88c7916c083bedb9378aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470058, "uuid": "d50fc814-c1d2-4389-9fa4-48d453cc115d", "comment": "Malware payload", "value": "aae6727dfa5f5f64210e554c0f564439371e4950df6e82c6a4f7767d0ededeb6bc6d6ea7b8882d5c5136e6ec4b91f329", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470058, "uuid": "f46644bd-fea6-4173-9e1d-a2ebe713233a", "value": "T110F38E7B3EB9C813C1191B79E8A15E1F6678DD340986F381F8867A898C393CC5DF9291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470058, "uuid": "1ca358d6-95b7-4d0a-ac24-ab599a70119f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470058, "uuid": "6dedbe8f-0a62-4f0e-a0b9-864d740d3d57", "value": "3072:T17+hYe5fY7GFGRGkhRFLRYXGd171jpxszmiGAGRC2:J7ii7R9FgGNHszmiGxRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629470058, "uuid": "9e85073d-d30d-49cb-b11e-d75b76ec111b", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629470058, "uuid": "9914f193-2d19-4e14-bb4a-13cd8e14587d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470058, "uuid": "69500c69-32f6-4a57-ac23-10502291f545", "value": "ec3921304077e2ac56d2f5060adab3d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371d33a2-017a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629438496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438496, "uuid": "70abab4d-9ea3-49f6-9567-fa49623c54a3", "comment": "Malware payload (Formbook)", "value": "9f2c6070165a1b85b5b246af991eff5d", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438496, "uuid": "6448d782-e6e7-4d33-8c4b-e6c1494231dd", "comment": "Malware payload (Formbook)", "value": "b90292213e9528cffa6e0b46964634139e5b575b84c07b4ddd33a9280ff0f279", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438496, "uuid": "ed06ad87-c363-460c-9095-a115b0720bac", "comment": "Malware payload (Formbook)", "value": "ce97cd6d99dd42e4c47e7364014145a19db41251", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438496, "uuid": "f8cc73eb-5427-4d12-a9ef-e31278c1052d", "comment": "Malware payload (Formbook)", "value": "78e52847ec0b7d723265b891ca44d0274e03f7ab1f7065412f63e42a8525d5683b5fe60b948b49f66af80e892c21062a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438496, "uuid": "d4e16e31-1342-4929-9095-fdf72a7b7875", "value": "T1CA9423B7346381B9D4193570E5DD48E8FED0D7BA01A617221C0CF8DE6A0BAB67815BCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438496, "uuid": "c5756f47-dc5d-4d70-b180-e86622278ab4", "value": "12288:8kko+YIlw+mXh9ZZJTVqW87AGZKdznuFSm:8boQlw+mjZ5Jzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438496, "uuid": "ba86e4bc-34d4-4070-a2be-97b0e675de5d", "value": 412507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438496, "uuid": "69dd84a9-eaf0-402e-b34b-72a04db39a8c", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438496, "uuid": "37607030-1dea-4de8-9b71-5ee4b46ee49e", "value": "PO.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8570fa8-0185-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629443437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443437, "uuid": "4c1e8cec-b846-48e0-890e-445d91b30356", "comment": "Malware payload (Formbook)", "value": "16893b49702338aaa8c043450d0f15f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443437, "uuid": "d6af0a56-800e-42b0-bb4d-36b2087b2613", "comment": "Malware payload (Formbook)", "value": "b91bc68553ee8ce92c9ab04875b8e21703aeb7c63d9f2fe67a73a940c8150d8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443437, "uuid": "e5601f8c-8f9d-4207-9f6e-94d2ca5c48eb", "comment": "Malware payload (Formbook)", "value": "675cee7e477263b8f5069e89b424daadd2f811a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443437, "uuid": "d92e9d65-0869-44ab-bf05-5cfe6934de10", "comment": "Malware payload (Formbook)", "value": "723f30baedf05b90a65fcaa595a929ca16467d06fb1b9bb5de8758fbd791a7bcb1e7e08a2ad6fa7b20830ec068ca4056", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443437, "uuid": "f0312269-bb5a-43c7-bd9b-4851b0b60ae0", "value": "T115F412247344AB4FC07F8E3A98511C00ABB0A5779607F7976CD716DC59CF6EE8E220A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443437, "uuid": "9b66f28f-8d55-4cdd-84b5-879505df76c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443437, "uuid": "5567990b-4780-4f9a-95b1-b3a67db9afa9", "value": "24576:ltQc4pRAz6QrSd/Ysq1bAAKddHpsUCbe:lGcyAmQK/6bhKddJ9Cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629443437, "uuid": "54accffa-1b6f-4fff-911b-2ddb6d67fe6f", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629443437, "uuid": "2c4cd2df-79f1-4117-9d3a-5486afbc84a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443437, "uuid": "275e1b44-6728-4a60-8d90-f8c072523d2d", "value": "16893b49702338aaa8c043450d0f15f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de3891f-01db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629480115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480115, "uuid": "ccade98a-262d-41fc-a90a-46ada53e400b", "comment": "Malware payload (Gafgyt)", "value": "621e02a5b494608858bf6280b84db881", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480115, "uuid": "5f04dcda-08fa-4b86-9a6f-83b7ea55e415", "comment": "Malware payload (Gafgyt)", "value": "b9ce1c8a7f38dedbccec0097fd0b13d57c52dfebec47478d7b739cb52115d8e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480115, "uuid": "03aebb25-5f7f-49f6-8fae-990c65b926e9", "comment": "Malware payload (Gafgyt)", "value": "7b5564abc23a4629a2528669b4d98e386210f7eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480115, "uuid": "5179fa16-f5ad-45e2-85fd-59db53c3ab1f", "comment": "Malware payload (Gafgyt)", "value": "ffcc711dfbf9f352ae981f171980da0a811f7c2d0373c683316ade1d5887028160c14b9d0f66076c758113de2b984024", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480115, "uuid": "549b9e84-68b7-409d-958a-b394e223cc9a", "value": "T17F23F1E15E2EB207D67E73B4F56E30C236A2DE4911900B1FAF2618B93C6878055C9EC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480115, "uuid": "56bf59ad-f8c3-4fe3-987b-02dffb675f6e", "value": "768:fyp3VJK2MjHkdF3cw7mvYZ6tevKlX0k2qJsjAFGqF+E33Et2KRYxkn9Dyc7A0:f0Vs7oF3cw+YMYClX0kvPkqvnEYKOxkl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629480115, "uuid": "549ecbdc-24bd-4b58-95d4-efa1f268d985", "value": 47720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629480115, "uuid": "9c55d490-207f-497f-819e-76112c21e301", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480115, "uuid": "8adcf263-7c83-4c62-8b72-7f7c157e4d23", "value": "621e02a5b494608858bf6280b84db881", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "891b5587-01b1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gozi)", "timestamp": 1629462256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462256, "uuid": "831ca0b3-5807-409c-8333-1d63985151c8", "comment": "Malware payload (Gozi)", "value": "ca06c200d84bb8ea8e69cee32afd030b", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462256, "uuid": "55933dfd-d348-42af-9b9e-5fb387831acc", "comment": "Malware payload (Gozi)", "value": "ba1edc8c1936030daef2dfaa0025300ad8ea190171c81c8f8a3c5469190d3916", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462256, "uuid": "7fa9fa82-b359-4d79-8076-30a25f30f5fb", "comment": "Malware payload (Gozi)", "value": "114b20b36152aee4d94cde975da2f5bd8ba96125", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462256, "uuid": "c742442a-a535-4fd9-aaee-c478e71f771b", "comment": "Malware payload (Gozi)", "value": "91b9b27fa733f32043d7e4875c43b7c005935ede056f28a38c797719645c48a2dbd1b09edd2337106e8adac0af046c7a", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462256, "uuid": "9331aa75-86e0-4c85-9c6e-a070a6bc2df1", "value": "T16C85514B9092A147B77B4763A48BA6E06657D23D946C23CE31B1CDB42278ECC48747EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462256, "uuid": "899ef2c0-4f67-4f84-937c-60d08648680d", "value": "12288:nnPSmSyh0csSl3/G9cHcxyT3w9NuUQ/ykOQIWl8XYbc2K2:LJfixyT3w9NuUQ6kRl22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629462256, "uuid": "ff67cd38-0cd4-4e33-9f22-c70e7acd8c09", "value": 1747766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629462256, "uuid": "319f3e44-2da1-4ce9-9a5e-1bc191a191bb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462256, "uuid": "53516fae-d1e7-419a-8b81-be17e4258fb0", "value": "2IO4LPc0RtZ7.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a5fa54-0180-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629441104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441104, "uuid": "424abb93-5192-4ad3-8ad9-2d5662961986", "comment": "Malware payload (Mirai)", "value": "9e7561ca4b36b095aa6cd0d59f8637d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441104, "uuid": "5e8e2ae4-aa33-43b3-bdcc-61164bde14a7", "comment": "Malware payload (Mirai)", "value": "ba36a070c5ac743243f89d41d1d72ec59cfb65dc07bb702a5765d9b635db1dbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441104, "uuid": "1e0e3f6e-ed70-4b82-af2d-ecae50cfc242", "comment": "Malware payload (Mirai)", "value": "4a34e85b09171afb4f17d7737942e216fd4b7854", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441104, "uuid": "914e277a-932b-44b3-851e-dc06865bbb8d", "comment": "Malware payload (Mirai)", "value": "65d16b33ccd74c68594ede518332b5dc8eeea8347e0cb991cf1266946c00160b318d6ef9c2249c2c77e440c5d9f6df34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441104, "uuid": "6575f231-6400-4fe9-8925-2d868204dac7", "value": "T1DE33F1B1F10BB657DA90503ADC3A8F5FAADA133D4A463001A356451C3A8BE6267E4CCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441104, "uuid": "9858d230-4fe8-47ef-81a8-a61bb1987389", "value": "1536:PFqgDpsULWXualbZWne2eENR+0biFWPuCLd:sgSULquGZWneFENU0puCLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441104, "uuid": "f84b57ad-b494-4476-80bc-a192bc36d6e4", "value": 51176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441104, "uuid": "17072a38-a54c-40e9-91df-9632b3adb8b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441104, "uuid": "e8720a75-a5ba-4f3c-9cea-f6e3e50e69f5", "value": "9e7561ca4b36b095aa6cd0d59f8637d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1e5726f-015a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629424985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424985, "uuid": "fa38dcb4-2807-4788-9839-319b70a9b96f", "comment": "Malware payload (Gafgyt)", "value": "6da6ad6e41a81bb8127a0f17d4c3881d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424985, "uuid": "746d3882-e483-457a-98bf-1cffe248f00b", "comment": "Malware payload (Gafgyt)", "value": "ba9dadaf4f6a828f29675bd672781d503a46b008f05aeb997d11bdb3b6025cf5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424985, "uuid": "a638305a-67ba-4c0c-a75d-43170f7898d6", "comment": "Malware payload (Gafgyt)", "value": "92ba8ba34c7cb5f4259703344d427a91b3484f22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424985, "uuid": "62492239-6624-4a5f-abbb-90ca39170632", "comment": "Malware payload (Gafgyt)", "value": "81b2d30e5ca4e8bb8c2d6ea2e7795525508f85ab7e40c98c9c56f67596e411a704e6d858e847935dfa34a6ac40a3d056", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424985, "uuid": "8bc60a9c-52f5-4a20-8699-a28a4d319d90", "value": "T1CDC34BD9E343C2F3C40306B2034FEA6B4A22B67B4A2E9E56F7583DB49B128D57114F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424985, "uuid": "953013dd-7f12-4026-860c-9cc241e2e955", "value": "3072:U3/jgdhgeRTFbKyxHYc5tzUFUCi05heWBwMSxXnI0/zJfNQQ2u:U3bgRFbK+i+Ci05heWBkXnI0/zJfNQQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424985, "uuid": "5c2d09da-eeda-4570-8b0f-e5d9b3849eab", "value": 124528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424985, "uuid": "708cd213-dcbd-4203-a5e1-215da85bd75b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424985, "uuid": "54bf6b5a-4168-4ad9-8bfa-093fcc9281c8", "value": "6da6ad6e41a81bb8127a0f17d4c3881d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a51291-017e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629440315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440315, "uuid": "e399481e-e03e-46d9-a196-3187c24b911f", "comment": "Malware payload", "value": "34b04f8fa2088198f665f98b5ff5a3ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440315, "uuid": "4c27bfdb-9d54-4b8b-8bf7-82aeefb2431d", "comment": "Malware payload", "value": "bb625cf5c8b53ebc7c2a59077937e1bd441f6ef6b2ed93dae21401da17871e85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440315, "uuid": "c207f829-c015-4057-bab8-104323bc28c6", "comment": "Malware payload", "value": "4212d54c974d1bc85054cba406d11176798c1258", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440315, "uuid": "a35a9ec0-61a9-4f0e-be7d-7e1c7cfeeff5", "comment": "Malware payload", "value": "6e8603f76aff6143d7140494209cfcbad68fb8086aa5681e7ee31dc35167d1c958e2d0269902d4af8b4cce4d40f484ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440315, "uuid": "09ee5b2d-4d42-4148-acb9-039d1a91ef42", "value": "T16C13F14E1D2665FDCE4B42F90BC50B882C101DABA9033C3FE668A74B0E1DA64B595FA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440315, "uuid": "117e1b6c-0ac7-4cb0-aa52-62e4905796c0", "value": "768:F10HSBo1T6nYnz7votIB3rKZPzJESXHarkWB/M5QmaeNBjJgGlzDpbuR1Je37ehk:F1yWaT6ncHw2Bu5zbLh5QmbFVJuO6h1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440315, "uuid": "48686009-cc1e-4026-a1bd-6376ed232a94", "value": 43972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440315, "uuid": "77d0db81-9a43-4f1e-8b1a-2f5e763ad1a6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440315, "uuid": "9469b929-5721-4fb3-8e5e-0cdff2462ceb", "value": "34b04f8fa2088198f665f98b5ff5a3ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960ead6c-01d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629476451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476451, "uuid": "5558b418-e6c6-4571-b484-dce60b7983d6", "comment": "Malware payload (RaccoonStealer)", "value": "bd69802d17c0495539e31d37cad0cbb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476451, "uuid": "83127005-4ca4-4bb1-9915-1c59241af7e4", "comment": "Malware payload (RaccoonStealer)", "value": "bbb1867666dcd3898495a36ebec4d9a00c5c4c519eab587f530f5f5c6d80cb32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476451, "uuid": "67b993df-0a18-41f4-b3c5-0cd91fe833a3", "comment": "Malware payload (RaccoonStealer)", "value": "5f162b385ea318e517a266af1f92a56e3b561eb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476451, "uuid": "23f513ed-29d9-45a3-a260-8d7fc09eae5e", "comment": "Malware payload (RaccoonStealer)", "value": "92c94673cb5533717a8c6b1d21e5005a6e0da9ed3a6b7463fd64734566c51385dc90bda98b478813bbe4fa0486124bf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476451, "uuid": "2070e48b-fbfc-4e3c-8628-43585bcedde9", "value": "T19BF533B488149A83E9F929F3DE1B52C71EB15C471530530B2B2665EF3E026EF168FB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476451, "uuid": "a4cba7a1-5925-4015-aab8-264ab42a7be2", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476451, "uuid": "2543bd7f-0432-4557-b617-765ae54efede", "value": "98304:y8s9pUMEDVqWVZ5aa3X4rCkCVIfORksx0H:yhUTXVdX42kAyLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629476451, "uuid": "79034a03-0bcf-4ebd-8209-cae972e8f94a", "value": 3594349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629476451, "uuid": "2ebc550b-e03e-4995-b5a0-aa74979edd65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476451, "uuid": "656a76a7-dc6a-4c8e-90f1-27ea958ad1d8", "value": "BD69802D17C0495539E31D37CAD0CBB9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ed6086-020a-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629500561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629500561, "uuid": "250391c0-2df2-4eb6-9b47-0b7fb0762816", "comment": "Malware payload", "value": "519f0bc90eedb594c23782c75e4202ff", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629500561, "uuid": "78c11c1c-c43f-4d51-aa78-e64bbc7e3d84", "comment": "Malware payload", "value": "bc61649b671b13be4daecea73167c0e6ed194dbc2e9f262033406cb2b73c89bb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629500561, "uuid": "245d1b89-8ab5-4209-bbca-37a5cf3339b6", "comment": "Malware payload", "value": "0b30a3cdfee9eb309238562b59f642e246fc6972", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629500561, "uuid": "e9ef2408-dc15-4c4f-afe2-4b0c3e94fe02", "comment": "Malware payload", "value": "0b001fed5174ce3718ede2b526d0f1aa59cb5522a04a8399554dab05c50b39736ce46e4c46daf3583ea1c474ebae2e16", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629500561, "uuid": "600e7e07-f7cd-41be-9feb-f3941ba898e0", "value": "T144E53359DB53A80CC83793B182776623776C369D44CDA17F8179401B28FBE848F2ACB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629500561, "uuid": "4ab29082-97db-4849-88b3-fe0b28d3bff2", "value": "49152:CZB9D1mDzMyqzwBOMszZkYpSE2SOcgHRhr6zjJjvGb3Y4c7RwUWN+4hdv+QfNnwm:akDzdqEsSETcUJDGbJm/WlhdmQlwp5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629500561, "uuid": "8fbb2e8e-18cb-4ac2-bb47-0fa9588e3e38", "value": 3298045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629500561, "uuid": "cd219050-b5b4-416e-8360-3cfbf3e9a8ec", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629500561, "uuid": "b571b98e-f553-49d8-b5dc-d271d1fe3083", "value": "Android build_obf.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "470b10e1-01fb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DiamondFox)", "timestamp": 1629493928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629493928, "uuid": "000feca6-8d55-41d6-ab4e-ff6dbc301f00", "comment": "Malware payload (DiamondFox)", "value": "2aedfa0dfb06ef02b268ec62486e6f80", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629493928, "uuid": "682f8f28-506c-4ccd-906c-5a526e2b96f7", "comment": "Malware payload (DiamondFox)", "value": "bd175fda8c98a44237f8da7e02e48f6aaf00365bec2e7e38b7b42414bd888d95", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629493928, "uuid": "cc03e226-3490-44d4-a9b2-d46fdf135d95", "comment": "Malware payload (DiamondFox)", "value": "0e998e4a93dd1fd666aece318b77d9f1756d9c17", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629493928, "uuid": "02f1a769-9f08-4bf6-ac75-f4c3a4a5ee92", "comment": "Malware payload (DiamondFox)", "value": "87a083690d8946a7b7eb91bf8516396395e2a88403a77f7d2d3237002d79b0fcaab05c2d53ae019d63c10722ca34cea3", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629493928, "uuid": "505e8f5a-c3ef-43c1-9a75-73870a5f8d88", "value": "T10116332114C0B7DAE87EE6F689F02B22A6F49C4D0D8459C757C4F48F5507EA428AFBC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629493928, "uuid": "8e56a227-cb47-4ef2-af29-fe18bd3b8638", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629493928, "uuid": "e80560a7-c7a3-47b6-8986-64e0237dd7b4", "value": "98304:y8DDoeOv58eCbmQKYSA/tEcDtXH0QdCbu1Vq7qd9tknkPzg:y8Poe6G0YSAzJBdCbCVqGntknE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629493928, "uuid": "7ff337a4-33f4-4354-9457-f3f9b932a6b2", "value": 4151689, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629493928, "uuid": "02e41188-9605-480d-bad8-7efdda15b092", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629493928, "uuid": "37583da0-197f-48cb-9b4f-8caaaf14f822", "value": "2AEDFA0DFB06EF02B268EC62486E6F80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba604db-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629471870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471870, "uuid": "16fd5579-d993-45d0-9cf5-43561cd09c24", "comment": "Malware payload (Formbook)", "value": "67d188abf0e0a7395a4f3eeb77a989a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471870, "uuid": "cfabd65d-b703-4f1c-b2ec-e65b628ddfab", "comment": "Malware payload (Formbook)", "value": "bd344e9b926eee15597f199bc4d8a8b368a881dd572ed2d8a57a1200c767b0fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471870, "uuid": "3a0566f7-0d3f-4c63-b636-f751be36387c", "comment": "Malware payload (Formbook)", "value": "c9d69772ebe9a3ba436a4cc4fd678b40d47df867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471870, "uuid": "7f5a3d24-f678-444e-b302-3595465ba343", "comment": "Malware payload (Formbook)", "value": "dcb6190125dd98fb680be184189cc228bd3834ebf28fb6ccda893e74caa18af1cd2aa044a4c17d4d409edb77f894a6ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471870, "uuid": "b24990a1-4af3-4630-bb09-d4233aa766bb", "value": "T10625283D19B91637D1B5D375EBE49423F258985FB404EE69ACDE03A7030AA8734C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471870, "uuid": "668c9540-fd2a-446c-a6a4-807717491d39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471870, "uuid": "f861c660-e620-436c-8bc2-a23afebcaefc", "value": "12288:wbzSZi970W7JlJw7rLlMYIk9hRWnJ/CKaSDhq9v3IzansiGBR6EswNd:wbGZ87Jzw3LlMYIGhRWcEDhq5I4ZGNd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471870, "uuid": "b2f6ded2-c3d6-4c90-84ef-afa07d8ad0c5", "value": 1041920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471870, "uuid": "881fc2f9-f854-4723-8a95-af8c4a4e799e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471870, "uuid": "a68f5704-0621-4fb4-8288-cc70788da360", "value": "67d188abf0e0a7395a4f3eeb77a989a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a94a066-0187-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629444058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444058, "uuid": "9c4c07cc-32da-45c4-9e75-487a5203a4e2", "comment": "Malware payload (RedLineStealer)", "value": "1aaa05c04ccb186b03c97e7b6ba7fc78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444058, "uuid": "6222e6b7-d2fd-4dc7-a407-bade6bdc5ae7", "comment": "Malware payload (RedLineStealer)", "value": "bd55b37d02325fbe745bb454882d40a77e5779529f70ac961370f7abb2bf6b68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444058, "uuid": "4afe2c6b-e755-4443-ad5f-83217b1db5ee", "comment": "Malware payload (RedLineStealer)", "value": "13d1c27c6789f3428e0e24c54d0b28619266985d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444058, "uuid": "271bf2ae-f11f-46f7-af96-342d0a37cc5e", "comment": "Malware payload (RedLineStealer)", "value": "770b310830d9d8413a2cea4a07196b422d62154012013dd13f753d92a6bd10614255cebcd493eeff82f60afe9bca0dd2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444058, "uuid": "b63d40b9-75d3-44a4-95d7-d2c690939f0b", "value": "T19544E13278B0C1B6C013557144DAC7E0297EFC218BA5924B3F57EF5E1F72281A626F9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444058, "uuid": "0bd013e5-8f74-4f7f-9682-7e5151d3e8a5", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444058, "uuid": "554f70ed-ca2f-4db9-a4ad-53fef4a2cee2", "value": "6144:sAvbk5+BRHurOAFOilFJFjUkzyhtpA7uFb7bvOiIRT46FgFnL:rvPO8c/VFypHbFIx46uZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444058, "uuid": "f59ff55f-38dd-4757-ac0d-1f1e304cd075", "value": 254464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444058, "uuid": "a7080881-387d-48d6-bdd3-fdcf8332dab5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444058, "uuid": "202f9b34-6afd-4f79-989b-516cb38656c9", "value": "1aaa05c04ccb186b03c97e7b6ba7fc78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a4f989-0184-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629442968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442968, "uuid": "19382295-b8ed-4cac-a293-9446789f3e9d", "comment": "Malware payload (Loki)", "value": "2b5346dcfa4f86d3ef68060c22e5a087", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442968, "uuid": "cbb8df06-9773-48b5-9ce4-cd9b8fb7f38a", "comment": "Malware payload (Loki)", "value": "be76239da7234a7e43d56d819e0558d91bdc872aef6e08db9f612ca30355bb9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442968, "uuid": "435c382f-948c-4f7f-8e24-439fb704822c", "comment": "Malware payload (Loki)", "value": "dd713cbfe8c52f82ce5dcbec198b9599e99bac5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442968, "uuid": "a58a4713-36f9-462f-881d-39435bb00b8d", "comment": "Malware payload (Loki)", "value": "d2ddeae7154ca06a66b7de303a997ff9a520e2acd50f8888c356a311b9e04af35d558336b43934a7075eb8e814e18904", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442968, "uuid": "5007cd6f-e377-4f8f-bfed-cb4888197465", "value": "T1D2B4C011B680C032C633383147B1E6F24E6D6C316D69DA8F53C829365FB4691EA36B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442968, "uuid": "79534e95-c771-4a70-94ea-1527e678ad55", "value": "4f489b335db6d5ec89d1f80710469941", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442968, "uuid": "aac66d52-35c5-4a37-ad05-451f6a6035a9", "value": "12288:bekuQ7HtohvcLYA7jEiB165kdQKC8dGJ2LBXLRYXvQKMgGrGtXi5J+GPR:bekuQ7DEiB1mkdQ4dGJ2LBXLRYXvQK9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629442968, "uuid": "e57f2f90-6ce7-48e5-894f-26b7b2617137", "value": 540022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629442968, "uuid": "1a0ba0ff-fd2c-4730-8e75-c82fb1abc560", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442968, "uuid": "0c377d0f-e6c3-4db1-b82e-d0e0b821129a", "value": "2b5346dcfa4f86d3ef68060c22e5a087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d09c4cff-017e-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629440471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440471, "uuid": "5579cb49-7d9b-4664-8ad1-758196aef47b", "comment": "Malware payload", "value": "5a2d3d65e8749dbe9c78938951728ac9", "object_relation": "md5", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440471, "uuid": "f5235e12-9e5b-4abb-83d6-38c0281cb744", "comment": "Malware payload", "value": "be8bc0c2c02d78d2f5cf167f8599340fff6f9935cdc8b4906b68d6b5b3302d51", "object_relation": "sha256", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440471, "uuid": "5735f9b3-ab1b-478b-a3c6-e73ecee42d41", "comment": "Malware payload", "value": "c4428268c7a34f7d8f657522bf38fd996b143bf3", "object_relation": "sha1", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440471, "uuid": "9c59d4aa-4138-4aa1-a8c5-35715d8dd023", "comment": "Malware payload", "value": "84bef5d3dce0eb7e893673bfdeede56fb6200d82c6f6395e0587b4359731d0426bdc382f672cbca604babc2dc9910930", "object_relation": "sha3-384", "Tag": [ { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440471, "uuid": "7ce1d5ea-566c-4b0c-a1ca-21c8174af2dd", "value": "T1D1513BA7F3AD541CD5B226FA65DFD619AB3E80DC22C1FB1F2040A10918235AA2D3A4A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440471, "uuid": "2acff218-bfba-449c-bbbf-0f51ce388a2c", "value": "48:90+bVURxqSwZM7FHqEBp8ArYuOdqv+STlL2ZkLBjmNyIXJrqK:u++3Hwu5KqCAbdlL7BjpIZrqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440471, "uuid": "70b0c409-ba2a-4560-870b-774574c0cc65", "value": 3117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440471, "uuid": "ae9d65ce-8d68-406b-890c-60857f1ab7be", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440471, "uuid": "9b594793-f676-4338-8af8-971aed70dcb4", "value": "Anfrage f\u00fcr ein Angebot.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d254c11-0151-11ec-8fa1-42010a9c0011", "comment": "Malware payload (NanoCore)", "timestamp": 1629420977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629420977, "uuid": "2b3416b7-42cf-4d44-a383-49f6ecd5edef", "comment": "Malware payload (NanoCore)", "value": "b69f9f9ba59d69679f57ba25975f7452", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629420977, "uuid": "2a6ccadb-2cfc-4ac8-8919-ce9dc5e5de31", "comment": "Malware payload (NanoCore)", "value": "bf003696ae885d67d876ef22374e7432623319a700c679afbabdf08c907a6737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629420977, "uuid": "bfe83d22-d606-4b4c-843e-cd62ee690323", "comment": "Malware payload (NanoCore)", "value": "0e0efc69b8ff05544bb749d507e655bbcf76ddd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629420977, "uuid": "8197a94d-6142-4c54-8b58-fc8af1722cb9", "comment": "Malware payload (NanoCore)", "value": "2da58c304f775269511fa929b5e5c7dadf03948727e2384e4d7ad9c6cd54b5e026c4c1b01052fb3a06d7153444aa265d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629420977, "uuid": "71977af6-86f2-46a0-a0ec-5d57b147bbd4", "value": "T1C3B4C010B980C032C67338704AB5D6B24D6EAD312D609A5F97DC3D366F74642E636B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629420977, "uuid": "685f172b-5f1a-4dc5-b005-48d5aa4f1e86", "value": "7e10d8f3c6a91a68257beb0c2e7d22cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629420977, "uuid": "98edef00-da12-4fdf-bea4-13475767d6b9", "value": "12288:XUgGN5bbCs0t0Eii1KWGV+Bc1ZMIpuygqvkomu1aEPyx:XUdEii1e+Bc1ZMSJZ9G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629420977, "uuid": "5bf519ce-291e-4d39-88bf-80986f57573a", "value": 538173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629420977, "uuid": "b2e3f1b5-4188-4ef4-88b7-1372ae792beb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629420977, "uuid": "d390f762-5968-445a-80ba-d4170b3420bf", "value": "MT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f44aa19-01ad-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RemcosRAT)", "timestamp": 1629460333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629460333, "uuid": "5e96113a-a026-4809-b726-2a852e7c9f2c", "comment": "Malware payload (RemcosRAT)", "value": "90d18e14ba0ddee3dd22598c8435c109", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629460333, "uuid": "a37c75e5-00dd-4c6f-af35-67b2ecfc34f2", "comment": "Malware payload (RemcosRAT)", "value": "bf0cc4fd655e77d8b634ad0f7de607e8bda88034910511e120dafc86d96fd8df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629460333, "uuid": "45f0215d-9ebc-4918-a6b5-d3412c618b6d", "comment": "Malware payload (RemcosRAT)", "value": "b8b473aa7cefe46e934bde3a5c89f7f96f197ed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629460333, "uuid": "f9774994-63bc-4552-bff2-ac7ecdb4bec7", "comment": "Malware payload (RemcosRAT)", "value": "0dd4647b1f3abc0e394a6aff78d2d7723eaea54e4e2d3a176d5cc018904c6225fc86e6aa2bf0f128b90df1e6ecd54ca6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629460333, "uuid": "6b1cbdc3-2361-4f4f-8c30-7aa47813350f", "value": "T19A358F31F2921837D6232539DD5BE7AA5B39EE40292CBDC62FA51C5C9F353803826367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629460333, "uuid": "905e6d55-b378-4fc3-b785-f27330e47a7c", "value": "61da5f388fb525c6541a6c21304d4040", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629460333, "uuid": "8fa51567-0e67-4412-a3ed-f1a36da6f5d3", "value": "12288:VnCFpZeB7uGHKKaWU8drn/1iNyhpyv0oM+6yRXOuDvrq8EU0th6gG1t:VnWpBGHK4Um1dXq0oXec959n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629460333, "uuid": "69ed4d68-7499-40c0-a059-d0b8c88b16e5", "value": 1089536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629460333, "uuid": "edfc2b14-19ed-4835-88dd-e09c5683923d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629460333, "uuid": "29af82eb-fcbf-4568-8cef-3039beb3ad8a", "value": "RFQ_EW14416 des neuen Auftrags,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f673bb-01da-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629479830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629479830, "uuid": "2010f68d-38ea-48a6-9afb-7fce8e4ee17e", "comment": "Malware payload (Mirai)", "value": "cb0591c29e8e60ca9dcbf952acdb479e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629479830, "uuid": "8036e55c-9a7a-4a9c-b09f-8933a23575bd", "comment": "Malware payload (Mirai)", "value": "bfa6a6f9bd1649add0980e2e1bc23bb05e5f74ec10a69b5394c802c3caf279bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629479830, "uuid": "f898920f-4a8e-4720-8688-23816c1ccd9f", "comment": "Malware payload (Mirai)", "value": "33af15fc98eb74141ad387720c2ad6ea2b1f839c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629479830, "uuid": "c0ab4b6f-51d9-44df-8f4c-86d75a24e1c1", "comment": "Malware payload (Mirai)", "value": "a0b806f360406584e923542631b4d4842a505bcb8bcf2d91f0448a8b26f8cee5aaf748fdfaa911de8eb77cd3d36edcbc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629479830, "uuid": "6284ea7b-b49c-48d8-8217-78b154ac2784", "value": "T1CE13F191D6532607F7104F76C890DFBAC1819E3AAEB89D88A5052B23B44C7D9B0CD7B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629479830, "uuid": "b52b5fa5-3768-485c-b0d4-fe0d346c7355", "value": "768:1urZo4wBVN4mgpGuTdnyCwAFcxD4WfepYWoJaOVp00k/50rmtivKOvNUN:LBVdgpGuZnVwMQD4WmpxOb01SnvFvaN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629479830, "uuid": "63c8db33-9a60-4703-807b-8f842186ae16", "value": 43536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629479830, "uuid": "a43b4784-5409-42b4-b0bf-0c8e8cbca815", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629479830, "uuid": "4e13c5a8-e55f-4445-80d1-1583305b25fe", "value": "cb0591c29e8e60ca9dcbf952acdb479e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5338b8-01a9-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629458855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458855, "uuid": "32b6a0a3-84ff-473f-9b0e-3fdf2b987f67", "comment": "Malware payload (AgentTesla)", "value": "f11bd5eaa48fcd4ff0f167f3ee940b8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458855, "uuid": "a545e01f-e3ad-40ab-a066-d2453469e753", "comment": "Malware payload (AgentTesla)", "value": "bfdad52028ed3ded1b8710776f11a6c4dc7fabc5f3eb226018df278acd2d22af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458855, "uuid": "d039a816-3979-4026-89d8-f25373242991", "comment": "Malware payload (AgentTesla)", "value": "cf9af66bcacfb28f79befedbb5ed8dd17b6b2191", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629458855, "uuid": "dc3d0771-7cb5-4517-915b-b5dd1e738402", "comment": "Malware payload (AgentTesla)", "value": "af5962459a07905033dbffe77c53c6ea9ad22ade6e81d9c8f8f136abb00990e16ca2f3c947c87d2436f1611effb12881", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458855, "uuid": "464648ef-32b2-4fb6-be2f-fa78800d01b8", "value": "T1F2F433059CBB44A2D19224FB7B7993C55B542B002D7DAB8AA2701FD3329C83DCA677E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458855, "uuid": "c8041e95-a3db-4a3c-b082-16b398d3332c", "value": "12288:wNUcGBXcov2GJHzIM+8zhFabSdVmrhCPyMVkMQZsq8isgnqqT/F5lmcGtLd26V:ZJlZe8N4OueQsqagnPScyJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629458855, "uuid": "833555ac-2a61-4e53-a6a8-0fa3478ba257", "value": 769833, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629458855, "uuid": "18fa6546-3bbc-4172-8b3e-3dbde0ccd116", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629458855, "uuid": "2cbfa11c-641c-4dbd-9627-2d5420edc22f", "value": "69000-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a93131b-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629424355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424355, "uuid": "34407def-98bb-4d90-a233-fe3482850afc", "comment": "Malware payload (Gafgyt)", "value": "530fb2854e4e9641f01892c043baa999", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424355, "uuid": "4b3d3f61-4a7a-4ff0-8a5f-340342ef5e95", "comment": "Malware payload (Gafgyt)", "value": "bffde790dea7665ab96b9ae8f80554922ddd2c9aba6913ff57693908fda1d30c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424355, "uuid": "b0fce636-ef55-479b-8399-2e59cd5a73ee", "comment": "Malware payload (Gafgyt)", "value": "afcbd6f9c4516efd0dd2788ce7d52507ee245978", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424355, "uuid": "c784da3c-fd84-4cdf-bb4b-83f36b3bcbd9", "comment": "Malware payload (Gafgyt)", "value": "45588c5b65b60cf7431c6b066255557dfe3069c554d9144296d38a0566b84c2cb954d39a55f6c6ca9a01be0c2243e6e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424355, "uuid": "86e38995-62fd-4e7e-85e0-b9041b062349", "value": "T12D045EAA77719EB7E80EDE7305DA151210CCD68642D97FAFB2A4C518E78B80F05E3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424355, "uuid": "9088f181-9b3d-4b86-94cd-a534ab4816fd", "value": "3072:8n/JH3ghkNpSNhQHlWEn5h7N8k1TdnxRxu6qb1cWgdh8:8n/JH3ghkCh8wEn5h7Nz/xRxu6qb1cWF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424355, "uuid": "a1720fb1-e629-471f-9dc4-b6d00c354125", "value": 187478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424355, "uuid": "972a45bd-5da7-4cd0-9afa-2038f0668542", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424355, "uuid": "a5a16def-e624-4cc2-921b-dbe8d2998e63", "value": "530fb2854e4e9641f01892c043baa999", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b9c8b8-0182-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629442035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442035, "uuid": "27f7234a-0509-4d3a-9746-05baa29645a4", "comment": "Malware payload (Smoke Loader)", "value": "18fe159521dfc20e70d85dde4bff470e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442035, "uuid": "4a1c963a-4c80-4077-9079-0c751ae6894f", "comment": "Malware payload (Smoke Loader)", "value": "c00e6419a2cd45d69f9398a32c1d83cbb0ddddd74b06288a23a48774f38d96b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442035, "uuid": "24fbf0cc-ee42-4838-85d8-8c86fbb4ea47", "comment": "Malware payload (Smoke Loader)", "value": "14cc4708d135281068ec074b9f514582f831c7f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442035, "uuid": "081f2b17-421d-4020-8fe5-f47f83a8a4d0", "comment": "Malware payload (Smoke Loader)", "value": "e8bd8a587cb4479b27cceaf19b2028c8a1b762c717d99da050976434d1d991cdcaf7fb0b61fe0144db85d345094be743", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442035, "uuid": "e4bddaf5-e3c7-4be8-b85b-6ca44a6a6ceb", "value": "T168547E10B6A0C035E4A613F569B983A86B28BDB45F2450DF62D63BDE27386D4DC3136F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442035, "uuid": "7a6207cd-b5d9-411c-bc59-2d8ae15a1a66", "value": "f29709d3d8fb23714c868be088ee3357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442035, "uuid": "a7daf993-dfbf-45e8-a7d6-efd2c89c6a39", "value": "6144:Ir9JextXy58GnoyADby8T8bywGyCxM3c6:+UxtXy8GJAXBTw+Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629442035, "uuid": "0bc849f4-186d-4158-9477-432df05bc7b5", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629442035, "uuid": "a78ffc9d-57ab-4df3-9e88-3d8fce19d940", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442035, "uuid": "fc9aba94-b187-40af-93a7-6c6c927b5eb9", "value": "18fe159521dfc20e70d85dde4bff470e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0397d366-01b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629463750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463750, "uuid": "9c14d492-43c8-4198-b0c1-f61ebadd46a5", "comment": "Malware payload (AgentTesla)", "value": "7ccbf16b9366b9a96c7dfaa974e1357d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463750, "uuid": "ccb44d18-a3de-4575-b838-555ed44bdb27", "comment": "Malware payload (AgentTesla)", "value": "c147939f30cd87fd5011cbe528c8e34fbdb94b4e478c1a80fb426b18327c1b7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463750, "uuid": "1173074c-bde9-4d51-8474-b1f09d67a995", "comment": "Malware payload (AgentTesla)", "value": "4aa1195a48373a56b1efdc36257f40d6008a481c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463750, "uuid": "8e9afa17-b76b-480e-952a-83c0d4d94982", "comment": "Malware payload (AgentTesla)", "value": "ddf7704f434d112e906e13d9cfb0cc376280b82c7f720e23b69d709fe465f4f02761b90e35029f2fdc36e6c803d5bf0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463750, "uuid": "22eb26dd-dc28-4d65-851d-e8cb15524588", "value": "T13635383D19B91637C1B5D375EBE48423F158985FB404EE6AACDE03A7031AA8734C726E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463750, "uuid": "11ddcf8c-1c58-47ff-a81b-2ebf91c2fbd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463750, "uuid": "3d86dd3a-57c3-468a-8da9-5856f9b4ba1c", "value": "12288:hq5f6e5lZi970dnQEX6Yab9So2UYCzI92A363LMblo+vbw/shI62Z/Ik:hk6e5lZ4isk3UdzI56Yu+cU26Pk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629463750, "uuid": "c963ced0-54f1-4201-9e6a-a51575cb1cd2", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629463750, "uuid": "482cfc8e-d1ea-4462-a68a-7eadf5e8048d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463750, "uuid": "15b59856-85a6-435a-98cb-d7655a44b565", "value": "PO No. SMC -201103-004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fbda6a-01de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629481739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481739, "uuid": "8fc5dcbf-7144-4f0a-9580-c03e3bc86b70", "comment": "Malware payload (AgentTesla)", "value": "9ec61bf027f53162062de6f0f17f4cae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481739, "uuid": "7625cf99-307e-45a2-a2f0-6f55bdff73a0", "comment": "Malware payload (AgentTesla)", "value": "c1fb7980cac15ed2d2836a61c62d16e88e6c507563cab6625be95b5a14cfb8af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481739, "uuid": "27aba526-5ab6-41d4-bb24-1670a7d0593b", "comment": "Malware payload (AgentTesla)", "value": "62831d764f71aa91be39bbfd7cdfaa6750261965", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481739, "uuid": "258cb912-d2ec-41c6-8df8-3f582e74360a", "comment": "Malware payload (AgentTesla)", "value": "d5dcd2274469545d6b78067180cba59050b9add5c1709cdcf5b82691e96e8b381fb6c95528d1747c336ba4ce394789b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481739, "uuid": "e5e30267-de16-4db6-9fa6-c0862eb07a2a", "value": "T1CC9423B205D1898B8F230A9C5EFD3D3A17D17BEB8A35CE98298B4D5F19F1EC95004663", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481739, "uuid": "2fddb9b2-96cd-4f1c-8319-2805479622b6", "value": "12288:hT4dvTnO2U0mdhmetoxUZl6vSDWzXTb1JAE27lDw:hTKbnOimdhExUfQSDWzvAE2W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629481739, "uuid": "067eb61f-54b9-4914-ace8-01cd49aa93fa", "value": 418821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629481739, "uuid": "e1763257-bffc-4901-94c4-cf5274b3d714", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481739, "uuid": "dfca3671-9923-47cd-bfa3-ccb6fe1a3746", "value": "EST P.D JKT - MASS - LAV.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f572317d-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424642, "uuid": "8ffea9fd-db16-4dea-970a-e330dcfc6ad9", "comment": "Malware payload (Mirai)", "value": "c8cd67452f58ff4f25f3c397b6b443cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424642, "uuid": "6e93b36b-362c-4968-9513-9d6928de505c", "comment": "Malware payload (Mirai)", "value": "c20cc0e686567e58dbf1ce32252d57659be712cc5f1fdeb97fef50e8ba6f4af5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424642, "uuid": "967878bf-40cd-42a8-875f-d18590baad8d", "comment": "Malware payload (Mirai)", "value": "9a443000f0b5648cbc2def68fe419d050816919b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424642, "uuid": "f9ddadef-630f-4366-a5c0-1f3a19428356", "comment": "Malware payload (Mirai)", "value": "91343770e32dc30e8087f0d3a690c04a58f4638139a6493eee58e92aafdc4605a3e7633f05f1e34ca768d838148b5e84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424642, "uuid": "fa3a9b57-98cb-4f0f-8067-8ad317b25fae", "value": "T11193A51A7E258FBCF799863507B78E22965837C62BF1C141E19CEA015EB024E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424642, "uuid": "6cee3a3a-223f-4934-a324-f2bd1b4dda9d", "value": "1536:AKzqmzfphPukFhyx2XgHw3eFz0HDDZ5KHZXvEY2QPMB:AKqYhueXWw3eFwHp5KHZXvEzIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424642, "uuid": "328b46b9-6c05-4a0c-829b-714936a7b663", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424642, "uuid": "701f4791-ab7a-460b-8c19-753c38b09d02", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424642, "uuid": "e06f3b54-9566-4c33-9584-6cc526ffd89a", "value": "c8cd67452f58ff4f25f3c397b6b443cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df507355-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424605, "uuid": "9b022f54-ee64-4409-b58c-193a2add7654", "comment": "Malware payload (Mirai)", "value": "243eee7f051dc31ec785b9eaa321d07c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424605, "uuid": "c907ea8f-6d24-47ed-8f6c-15609aef8f4c", "comment": "Malware payload (Mirai)", "value": "c20fc68d1052602103a820227cff3e04558993d915cd24860b79fe5416baa605", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424605, "uuid": "278d4429-b2a6-4260-8463-5e43d6ba44b5", "comment": "Malware payload (Mirai)", "value": "11b0eb256b988cafd0e4fc3c5fbad78a93fed3c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424605, "uuid": "aa1ff28a-ace5-4445-9e4c-1163068d5e29", "comment": "Malware payload (Mirai)", "value": "785440823670888830319a59d4725946a90857fcec9b434f81267eb511da0c685addbf67adba1b831b056f57dd898ce1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424605, "uuid": "aabd5589-656f-4a22-a5c2-01e9394b7c6d", "value": "T10E632995B4029F3CF84BD6BA94170E05B921638547C30F2BA6A6FDA37DF3054BE25D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424605, "uuid": "13f3d9c5-77ad-487f-bb29-612c705a7814", "value": "1536:SKYDydkSp1VoHCiI58Ok/Tgp+nJuRbPG7M:SKYD/S/VqCXM/xJwPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424605, "uuid": "98e36565-be2a-4f03-a558-adf28988446c", "value": 72332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424605, "uuid": "cdff526c-d171-42b1-89f4-85281770daaa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424605, "uuid": "3e576da4-9da6-43c4-ae20-a17900cea75b", "value": "243eee7f051dc31ec785b9eaa321d07c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "793afbc3-0181-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629441613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441613, "uuid": "5873fdab-0a7e-412e-891b-a482ea2e1acb", "comment": "Malware payload (SnakeKeylogger)", "value": "ec64f366ab9e10a8a8c9dc79c823991c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441613, "uuid": "ee75d2ae-9eff-4466-92ba-650893862963", "comment": "Malware payload (SnakeKeylogger)", "value": "c3008abf22d410317c895576bfd4a26663ac4a3dddd8b3319b96d58f43402e07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441613, "uuid": "80b20185-910a-4266-99bb-85a7ca8e568c", "comment": "Malware payload (SnakeKeylogger)", "value": "8522715a309a6d5e9509a8d8f908d6b124443ba0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441613, "uuid": "b30d98c2-8c77-4497-91b3-5a253dc4e33f", "comment": "Malware payload (SnakeKeylogger)", "value": "3911fbe655e4fb7cf2768313ed2cb36d9b572d6005c246b5ca2d889e2ccd0ec980276ae56ce972e97c705a8f04c529bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441613, "uuid": "d321e3c7-253d-4360-a29f-204a55c48125", "value": "T1D0E401247294FB8EC06F4E3B48A54C10D7F0A97A6743F7832CD366DD19CE6A98E22165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441613, "uuid": "40cc23ee-6fec-49a5-a120-077a3b7e3c62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441613, "uuid": "f25baa72-26a4-408f-ae4a-f7cc900113b1", "value": "12288:AQ/qahkCulerrsGpiAjFHXLs4U/vXF8XImfQzlXB0q32w77VUjTAoSC1:7/qCk7vGzF37U/vVcfUNmwlU3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441613, "uuid": "04cad422-2eed-447e-82a3-a4c5abd8d51f", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441613, "uuid": "0d797952-048c-4ce5-898d-812938fa9c34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441613, "uuid": "c876548c-fc5a-4a00-944e-932d7a8452cd", "value": "ec64f366ab9e10a8a8c9dc79c823991c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c1b3fd-01b0-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629461821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629461821, "uuid": "67e46259-0ef6-458c-b411-fb5a9360d7a1", "comment": "Malware payload (AgentTesla)", "value": "a26eb6a10802979326129de9ff369722", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629461821, "uuid": "e9970fc8-833f-4652-8dfd-cfe5087ad154", "comment": "Malware payload (AgentTesla)", "value": "c50dcc50595283892a2c186ab4686fc52666f2e9819239b44a2e44cde66a90f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629461821, "uuid": "93af7196-279c-4e04-8cd7-4e8432e6b6c4", "comment": "Malware payload (AgentTesla)", "value": "d50ad93de04f1f75070826210334b5eabd9e9bfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629461821, "uuid": "4c4554ca-0381-4ad9-bca6-6d13b675a23b", "comment": "Malware payload (AgentTesla)", "value": "30ec55a1aadf6176a4fc318fe8879387b83b793e4372e20a2b60c4eb831a17a12210a3a71891813af79ede926ca9a671", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629461821, "uuid": "6ab92eeb-df53-43d1-96da-1ab6596403ca", "value": "T11EA4F1983B54B69FC16FCE76C8661C60AB60B5B3A70BD247688335DD560D7CA8F012E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629461821, "uuid": "332625a6-955d-4f20-806c-e20d3a8ef33c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629461821, "uuid": "5d7b3955-a70d-463b-a4e0-3aff68b263ba", "value": "12288:Ex9EDCTa2YzN8vpJAAOu9SOsWcBDYAtTKHZ:EbEDWYzNHvu9SOsWcKO4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629461821, "uuid": "ce261bfa-3c5a-4e25-ab82-05d6f2af41b2", "value": 464896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629461821, "uuid": "9fa13d67-5170-4eea-9df3-923976950431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629461821, "uuid": "8635d380-f981-4669-97cf-2a6ca85bdf97", "value": "TT COPY..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb725847-015a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629425001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629425001, "uuid": "ea208743-e0cf-46f4-a64e-2e0b0a84d9ab", "comment": "Malware payload (Mirai)", "value": "05904cf56c020f600bdd633b845bbbbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629425001, "uuid": "06819382-fa41-4b05-943e-6af421e137d9", "comment": "Malware payload (Mirai)", "value": "c5497e219ee284defcbd26bd09b57661b26a876343c2ac7596aea509a5ec9a6c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629425001, "uuid": "40202e16-6061-43d0-bfda-36c0857b4d72", "comment": "Malware payload (Mirai)", "value": "e3b9455e0ff0a779979467cd3ea3d1b2876bc4d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629425001, "uuid": "c9837c23-5654-417a-b5b8-ccd58dbda90c", "comment": "Malware payload (Mirai)", "value": "85522af201be9c4202dbd502ebd9d5246f7fe6c4a908a8159a8320ad0da63559a8426a8a628e8bfbcaeee3de73989485", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629425001, "uuid": "3c0b17e7-0e45-4707-a09a-bf320537bb1f", "value": "T179736B31B8762A27C1D0A47A11F74B10B6E117CE3AE8C61E7E720E5EFF216506503EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629425001, "uuid": "a5ea1b62-f7ca-4170-bc6b-717c55c31090", "value": "768:Uoao+BTVXvoaRq9/ZPjrglLgABJ7fZo4lJLRmMLGBZSGizO+DksDQpG:3arBTVXvoaRS/ZPjrgtgg7fOMauupG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629425001, "uuid": "14ea2bee-e84f-43be-9495-2d6106d44e1e", "value": 76192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629425001, "uuid": "90f7db58-e3b0-44e5-91cd-f3e0caa95bc4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629425001, "uuid": "8aae8a32-a6da-4484-b0dd-538ec6b7a6f6", "value": "05904cf56c020f600bdd633b845bbbbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31f0b74e-0211-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629503341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629503341, "uuid": "9acba227-0823-4cab-809e-4ce66ca19a33", "comment": "Malware payload (AgentTesla)", "value": "13121acd87d9e253c7b3ce477af414e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629503341, "uuid": "de38eda8-83af-4757-8426-4679069c7580", "comment": "Malware payload (AgentTesla)", "value": "c59f80100a67cf258c41cae3caa566877028e533eee658c7708ceaf3c355408e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629503341, "uuid": "ba8fa79f-8ea2-4656-a325-f257294e36eb", "comment": "Malware payload (AgentTesla)", "value": "977acc909fa75fba7ce31a4e2b948b2dd461eb5e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629503341, "uuid": "78f360f1-2960-48a0-89e1-99a4af5a119c", "comment": "Malware payload (AgentTesla)", "value": "05c9b25b9bbb96ab1a5390f76efe2d0943e8c279d7c12abf5d801b910f03405abad39789bb3e84fab2669144d96afb40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629503341, "uuid": "c39e43ad-0a3a-41fb-a862-7f2995f6244b", "value": "T1ED642346EA2DEBC99C251E8D7C30932620D3DC174775DAC9883D92BB30B23971D62DC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629503341, "uuid": "c9b8a012-c5d0-4fa4-a65d-40040a6cad2b", "value": "6144:4me9CQm9HNWswF+Mo67VrtqcbN9vITUEMMa63OPo0xFvqZ1zh3zGb3/GXsYO7:Te96HNU/9qS9sUJ0OPo6FyZ10v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629503341, "uuid": "3c9345f0-dfb8-408a-af13-bda2973fce59", "value": 334671, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629503341, "uuid": "d5a5f5bb-4c3a-405d-907c-77c926189ca8", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629503341, "uuid": "ef9fb569-2871-4fdf-8cc3-ecaf8033ab71", "value": "dhl.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8d488f-017e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629440171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440171, "uuid": "ddd16447-4805-4f98-96c7-f96b6351624d", "comment": "Malware payload (AgentTesla)", "value": "d1ce5b7ddf8d49a2554281ffe4e14270", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440171, "uuid": "085de94b-0370-4603-8cda-4c62c977e691", "comment": "Malware payload (AgentTesla)", "value": "c5bdd34cb0ede7ee9fbd59dff5eb6389c567115923396e31921753ef49eeecf1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440171, "uuid": "63b22b96-83ef-4564-bf3b-fa8a0e958686", "comment": "Malware payload (AgentTesla)", "value": "1a19efb889c0cdab19fb322ade2bf14972f194fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440171, "uuid": "148fe7ae-e23c-49ab-ad04-00e57b7a0317", "comment": "Malware payload (AgentTesla)", "value": "f2b4ead1bdfa85bdea03915f65d2ccb9b3b5658041f1f5b9d828d62c109b27021267b40c31ea9552ef80ad9336cc6e65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pw 1", "colour": "#727E45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440171, "uuid": "f0b2afb9-2dbe-4af3-a1dd-df7d3c07e15f", "value": "T1712418166714D511CB5F417FC016C21831F1E707A72AE38F5AA6D8FA2F812CEF92A9E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440171, "uuid": "cf025b4f-ffe2-4545-a62c-2062d4d56007", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440171, "uuid": "00cb1bf1-9cd0-44e5-9c88-8f2ec367acd7", "value": "3072:5GWPfQVhptwtqTV6CePxg9hUiLEWftlsLbdjR7HgRleKjoLPHL9m4Un84BEPmPtx:5DCV6RSUq1lqBZieKAhZrOlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440171, "uuid": "c89f3a96-4d84-4998-a499-d2e13a166173", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440171, "uuid": "7c13f83c-18ed-4d6a-ba64-dbcd5f00c49a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440171, "uuid": "69571ee7-e09c-4448-82aa-27a8a694a879", "value": "n33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e755dd-019d-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629453526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453526, "uuid": "54fb822f-ae31-4cc7-bb7c-1c316e452b5a", "comment": "Malware payload", "value": "f108b8fcf5fa07d914b587c85b19b38b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453526, "uuid": "abc7abf3-e2b6-4bde-9179-47da953578c9", "comment": "Malware payload", "value": "c61437f734b20bd42d42819a521483df261067cb7b247cfc512e1fdd0189ca17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453526, "uuid": "c46175e1-0897-4761-8b4a-a7eea2a9c402", "comment": "Malware payload", "value": "dcaa7c171a5a53208e67f8a67c9bfcafaaef8aa1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629453526, "uuid": "46c9b273-733e-4412-8473-bdec3aa58f01", "comment": "Malware payload", "value": "d92021d38c15894e2214b02b5a50946503f5ae4cbb9418eff2ba74afe3a02367871079379dfa2ed7bd25eb068f2684a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453526, "uuid": "e520ed3f-ddb5-40ec-96af-f505a2142b79", "value": "T1A23529AD33407ACFC867CE36C9686C24EBA0B46B570FD203905712ED9A5DA97DF150E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453526, "uuid": "22161b6e-d2a1-44d9-8d54-c8c929c76519", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453526, "uuid": "ed4cf64a-a477-442c-ba89-317fd418c96a", "value": "12288:pna7gsDr7U0KPUWhLZZAdbAEyTvy8CBZLgIxXKDrvGn9R742U3K/M0T8sEvqd03m:pacsDr7UdMaZZAgItKHqb/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629453526, "uuid": "a59fdfc4-c1a0-42bc-a002-faa4451d0733", "value": 1079296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629453526, "uuid": "fbcae57e-5daa-4694-bf77-6891278a138b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629453526, "uuid": "6508d875-3afc-459b-9f0a-050620b15504", "value": "f108b8fcf5fa07d914b587c85b19b38b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864d8b0c-0184-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629442924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442924, "uuid": "c005eea9-9e9f-4d4a-8284-7ecc52d6a761", "comment": "Malware payload (Loki)", "value": "2d7c454c7dc1b5a3222cb313e46cb031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442924, "uuid": "41ec2513-354c-4bde-994c-d95581dcd867", "comment": "Malware payload (Loki)", "value": "c622aba165328306741f8878ecdaa1aadd9d1f0f3718c7211ea6bda2aba21dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442924, "uuid": "6fd59789-5ca7-4658-bee6-923f330c3d23", "comment": "Malware payload (Loki)", "value": "ac529d8d04a2e279dfe876b14e5de255b91da23e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629442924, "uuid": "e2e61792-1470-4862-8bbf-7bcd0775ba67", "comment": "Malware payload (Loki)", "value": "a8b8b154ea239b51e6eba682c6e99c40c537e4cfcd477ca4699b7ef36250110fdfde51496f287feb1e6918b9b7d6dddf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442924, "uuid": "8928faa9-a29f-40c4-a622-a9de8b4953a1", "value": "T10635283D1AB91637C5B9C375EBE59423F148985FB401EE696CDE03A7020BA8735C362E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442924, "uuid": "dc7a45b8-c608-488c-bdcd-f1ea6d4be7b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442924, "uuid": "8abd3669-db70-4d24-8b58-5afbf95c869f", "value": "24576:bM6gg2bW5O/YAROCEo/529JIaYVCZsGUya:pggiW5O3zl/dLViWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629442924, "uuid": "6e708100-644c-4511-a815-e253cbc6117a", "value": 1123840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629442924, "uuid": "4fb42008-ba42-45e3-ae2a-94c448c83197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629442924, "uuid": "4c4ec4ab-15d3-48fc-8b9d-1d015c2fb4a2", "value": "2d7c454c7dc1b5a3222cb313e46cb031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f739942-0187-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629444201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444201, "uuid": "2da6ea7a-d751-4135-9954-918f99cf75e7", "comment": "Malware payload (Mirai)", "value": "d383ed9cd4390346dd171d270ddc67d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444201, "uuid": "b48bb55f-fe37-477b-a4b1-216d54c2b939", "comment": "Malware payload (Mirai)", "value": "c83aae95c508e912f1496c8a395cfb02066312e2b81d119b2077b0986093f0b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444201, "uuid": "6b6908c4-8fd4-4489-8cc4-ae67442a5f31", "comment": "Malware payload (Mirai)", "value": "7983d5102151ae067bf0d62c9963066ac0acea15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444201, "uuid": "a043ec10-9de2-415b-982c-a1d7e7b70fcc", "comment": "Malware payload (Mirai)", "value": "ca45a5917402579a78b5d08348c8d1eccb925cc9ff323870131f22c3a007e388d3f4e4a8f5431f5b57151a911225405d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444201, "uuid": "794af359-2e45-418e-b470-7e81db88ba39", "value": "T14E439E65C9A89D64C21845B4B614C53DD323E404AAE33EF6CA46CA5AC06FFECF0997F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444201, "uuid": "cdb504f3-e566-4be0-98bb-52640f76feb4", "value": "1536:J/At4MX2Ma+Kb7gv7n2ppfs3Gd4o+kwfzPC3G2:JYtN7d0I7n2Tf+A4o+kwfzPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444201, "uuid": "5b83b867-ab91-472f-ab07-3994ddba157f", "value": 59644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444201, "uuid": "3edfd2df-c3ee-42a4-977d-7ac2b03e6abf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444201, "uuid": "7a8002cd-bc2b-4cb6-a9ec-32f8e175f4da", "value": "d383ed9cd4390346dd171d270ddc67d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31406a5e-01d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629476282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476282, "uuid": "937eeb2e-8dd8-4805-b994-12e6d7f75c0a", "comment": "Malware payload (Mirai)", "value": "9cd1824bf1568ac887f57fe0ff91ffed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476282, "uuid": "76f0a573-575d-48a2-98e7-1ee8a2269c4e", "comment": "Malware payload (Mirai)", "value": "c86216d87cbb3be2855c2062418c9ec19b9ff6b7ce9bc0cefa134a654f6942db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476282, "uuid": "cd516ff7-9674-4cd0-a9bd-c60163f49f4f", "comment": "Malware payload (Mirai)", "value": "8ec437d6be0b89f0d98c06c0f4939e164ef8df82", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476282, "uuid": "f6802ccc-cff3-4925-8a76-43905c2ec5e1", "comment": "Malware payload (Mirai)", "value": "b27f2270b8c162e00ca97b68ab6e5a892f4911754d05ae67e4776860983f00858609685e56d2ac1365c192b92b9f0c97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476282, "uuid": "ed491e3c-01f5-4e2a-bfcc-d0b7216f54b5", "value": "T14E634AC0B543E8F1DE1616742067FF335A3BF2F6112AE9CBD3E4A963AC42A41940769D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476282, "uuid": "75b3efa7-79fb-4aac-a704-37356bda732b", "value": "1536:yTmzDttn+ofhw63xq6m7zRRkyTQ2IwKTmChsUo6txAcAxyv/zXtGtoSYCjC6:Z3Tn+ofhw63AQvjTuUdRAcjkt5jj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629476282, "uuid": "fc4b9d80-ca71-41e2-ab8d-7f9d7217a28c", "value": 70416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629476282, "uuid": "8713e3ff-ab8c-44ee-b7bd-4ffdbd79af19", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476282, "uuid": "09cfa0b4-d4a9-4f1f-a718-97105aad145b", "value": "9cd1824bf1568ac887f57fe0ff91ffed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4771d04-01c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629470918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470918, "uuid": "4c0c352a-979a-4251-bcfb-22854280b6b0", "comment": "Malware payload (RedLineStealer)", "value": "83d48ceb05204219598796cf99ade13c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470918, "uuid": "b94d4575-b5c8-42bb-9bde-5756f5513cb4", "comment": "Malware payload (RedLineStealer)", "value": "c8c685962497719668e4755f90ec88274dc6091379b6c6c8bebff3ad3c089672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470918, "uuid": "99cde75e-d11a-4341-a800-4aca1f6c561b", "comment": "Malware payload (RedLineStealer)", "value": "4a0c8c188217da15ec37859e09f9ac8ad483faff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470918, "uuid": "b085962e-6982-448b-8bc6-6fde36fda5ae", "comment": "Malware payload (RedLineStealer)", "value": "9f1f215a52fa213ab0b79512657615edea0915cf21d6411c30a6952d909266441acdfe0bd4785cd3a460b69a4ac3d293", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470918, "uuid": "f78922ea-9a1d-4ac2-a7f4-33534192440b", "value": "T1BEC5124E2812EEDCFBC04A334787F10465B5AF24EBABEECD689537C95A70A905F121D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470918, "uuid": "d46da2bc-ecbe-4bd5-af07-7be81d1c0325", "value": "5cdfba68edbb115e7aa5ed6776bb6546", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470918, "uuid": "674732a7-e3a2-4d8c-93c7-96667d0f1abf", "value": "49152:p+tubxM5jdJgJ3d/aFXFn6tFYBMf5ObHiMlCqJ69tPwNhOdC1lTZDkU80:pBbO5jdeJ3IF16tFYBMfCvCw63PwDZ1v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629470918, "uuid": "1f7da816-3072-4165-aeb7-3fb9e755f1d5", "value": 2674196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629470918, "uuid": "deb401b8-4416-4c4d-a3c8-b79306193771", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470918, "uuid": "da0b05d0-e63d-4fe8-8066-ab18f3f80798", "value": "mosoxxxHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f107f4a0-0169-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629431506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431506, "uuid": "fcfee928-6763-419c-8940-3440cf9b1f64", "comment": "Malware payload (AgentTesla)", "value": "de3bd9843436560788e2019125f711a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431506, "uuid": "aa26285a-ed5f-4373-91a4-8475ff53ba14", "comment": "Malware payload (AgentTesla)", "value": "c964b5fa595339b7b0319fa865d7e1f68d0f63e2cf4c36e47bdaded829e4f78f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431506, "uuid": "658c586f-69d8-4725-ab63-665ffeadea6d", "comment": "Malware payload (AgentTesla)", "value": "e85c8d19151cf55c6795982184e238e1165cbb00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629431506, "uuid": "7513870b-a24c-4ddd-871b-fef778872e9c", "comment": "Malware payload (AgentTesla)", "value": "301734b5b6e249658f59152b7b6b37008fec9f3c665402c2afa765fd87ecdc812593e723757ad5c01fecdf60efda160b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431506, "uuid": "ded4d91f-4440-40cf-b315-bfb359c1c433", "value": "T173E4E020B642E5EFC95E8D318FAB5E3059B12D7E85D1C35F508A319E0B7B392A40A1DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431506, "uuid": "f8b1d8b3-101d-419d-898f-728d2b89154a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431506, "uuid": "0bdee26d-c45f-42c6-b49c-af3277c4fba2", "value": "12288:0r5/oC2O9NZ7niPeUezMGHUM1V6Vusjcy5KsVwdKuQdQVYJUEKl75jQWmc:0l4OR0eUezMG0MCV3jVKpQ2VYJUEKlCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629431506, "uuid": "3e9d9eb2-7d05-424c-80f6-ab0570cb9f7f", "value": 675328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629431506, "uuid": "1652985b-c24c-456a-b343-b24a07695e96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629431506, "uuid": "0efa5354-6af9-4eaa-8838-de10b0590d1c", "value": "overdue invoice pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5d72c4-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629424600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424600, "uuid": "79a9faa4-9f67-49af-9250-c1d6f7476901", "comment": "Malware payload (RaccoonStealer)", "value": "c360ec99206b42b6052b4010f1131eb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424600, "uuid": "e05e8d1a-e0c8-43d5-9f11-ca6cd4ee9fd3", "comment": "Malware payload (RaccoonStealer)", "value": "cb0431843a465580af16a0fd3eac32bab34c3e52ee3951a50ac3d4c0d709d730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424600, "uuid": "7b6c4026-10ef-44b4-987d-cb1f12254970", "comment": "Malware payload (RaccoonStealer)", "value": "2df7494f7264c7da4fa1013b46ce92ae556e0342", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424600, "uuid": "28030d95-a1bb-4bdf-91ac-47bd6ec9b24a", "comment": "Malware payload (RaccoonStealer)", "value": "e92ea6b0835ccf664883a9456aa2ed9262ed342c739332898c87aab66a87bd94c2b939a1f5ae0181626efe13659748dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424600, "uuid": "bd39a8e7-337b-4eae-9c3a-df567afc7403", "value": "T109941211B1F5CC32C15E00B09DA5CF90697EE9851DB613067EAB1A2E1EB12D0773AF6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424600, "uuid": "c8fb6f9f-b3bc-46a1-a508-d55795b8b7e7", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424600, "uuid": "5fd488ed-59f2-44f3-974d-6618b69e5afb", "value": "12288:95iIGBEQxVJJNziGSFP5lccvnuvtdKLcoZL:nigQxDL7SFPfccGBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424600, "uuid": "35e5cae1-155a-4fee-bc29-c60f73d9da6c", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424600, "uuid": "d6c22785-6d5d-4550-9671-95a1511634ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424600, "uuid": "ce387cae-144c-4ee9-8f86-296e902d2f7c", "value": "cb0431843a465580af16a0fd3eac32bab34c3e52ee395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebf6be7-01e6-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629485136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485136, "uuid": "276d2fe7-b9d3-406b-86b9-7aae6b2ca720", "comment": "Malware payload (RaccoonStealer)", "value": "787e8f19a911ce1f7fe5d7824451f697", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485136, "uuid": "41a56975-52d0-4b93-9144-cfc860114b3d", "comment": "Malware payload (RaccoonStealer)", "value": "cba27621d4b7c92fd50bf37135e150b45097ca9306061ed7049f802047bbd1b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485136, "uuid": "ac8785ed-c98b-40cf-bebc-e772064de60a", "comment": "Malware payload (RaccoonStealer)", "value": "f7f120d4c84a96e909f10b860b3131edfcd2eb46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485136, "uuid": "a1d1fb06-7410-44e6-ac51-71c6a3cd9069", "comment": "Malware payload (RaccoonStealer)", "value": "cbc59bee9789adb9eeafcdbfcd2967396f25757ed38c036d717a456638ca7b709141f9c0aeba0e5a6106f4cb017a3c16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485136, "uuid": "fbb8a211-127b-4dab-a54b-4c0543c865ac", "value": "T11CE3AE2135F1C0B2D06245318865CA90567EF9326FB495473FAB235F2E322D0DE2AFA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485136, "uuid": "2df8ab26-106c-4f87-8c49-81952f216509", "value": "d9ba9c76f1c1b9698712bcd1010ec021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485136, "uuid": "d21692cf-96de-4119-91fa-4ae91559d41d", "value": "3072:GGJvUx7w30+7AJwd0q4APR46ZmaTe48YzgFnLmF:XvUg0+7AJuSN6ZmavgFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629485136, "uuid": "808b52ba-9a8a-475d-9c98-2c9af51167f4", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629485136, "uuid": "88d6efee-b7b2-4834-adb0-df475a3de065", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485136, "uuid": "a8812d5a-a497-4500-8e28-c84587965f76", "value": "787e8f19a911ce1f7fe5d7824451f697.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f44de5-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (TrickBot)", "timestamp": 1629424649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424649, "uuid": "1c244f94-60fa-4ffc-b03c-34ffd6bf7ff9", "comment": "Malware payload (TrickBot)", "value": "8871814a59bff5b10453fb4537525be7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424649, "uuid": "1772f612-97a0-4a40-91a2-c4d36ce37854", "comment": "Malware payload (TrickBot)", "value": "cdea3bc26665eb9e8656cf107f611f5da08afa12dc9dae129696762d959eb6dc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424649, "uuid": "b124a85f-78eb-4311-aa75-16014f289427", "comment": "Malware payload (TrickBot)", "value": "26fa4dd1e880a8a7710177c85739c0c967e8062c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424649, "uuid": "07808d0d-729a-4a66-9164-834a3628adc5", "comment": "Malware payload (TrickBot)", "value": "0c5fe59d6066e018c77b410b022d2b21d0dc1ecc5a8b08fa9132cd0464ecef69d9eb5bbbd17a7d2a330db2e9f54cb6ae", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424649, "uuid": "9714a7a8-6a98-45f9-a9c7-362743904adb", "value": "T16E24126BA81206B7D3E322F6C4F7087D54681B984344A6E706E81ED45FE78E53E3AC53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424649, "uuid": "86be99bf-420f-46cf-8a85-6cfb68c95d42", "value": "1f6199c52a5d3ffac2a25f6b3601dd22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424649, "uuid": "8edc5abb-8a7e-41c3-b0bc-d4fbf1d4a3b2", "value": "6144:PWaOlBRTZp7dbuyQsacSebDUvg+XiwNSskRvM588aLi2:wBR1pRbGcSecICSskZM5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424649, "uuid": "e0124eb6-a6c5-45df-8946-d531eca1bab5", "value": 228050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424649, "uuid": "8946a4f3-8d46-4c2b-9d74-cb931d0a1d7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424649, "uuid": "ae3a4c97-1088-4831-a7ad-04f8decae424", "value": "trickBot_00DA0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a250a57-01de-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629481612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481612, "uuid": "ac83ef97-960a-42d7-854f-068247aa7fac", "comment": "Malware payload (RedLineStealer)", "value": "c459b05a242a81696cff6cde4bab7e9d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481612, "uuid": "35f82fd0-d539-47c8-9f26-cdce958e149c", "comment": "Malware payload (RedLineStealer)", "value": "d11dc3b2fc183936a38eaf82cf2d2aba72748f518b92cc722c56655de83ce4df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481612, "uuid": "bd68ff36-76ce-42a5-8fe7-25de8cdcc80b", "comment": "Malware payload (RedLineStealer)", "value": "569c33453aeafd8bc2d57de408a3f8af1342dda3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481612, "uuid": "09a61350-1c96-4e88-b625-050f3aad2ec1", "comment": "Malware payload (RedLineStealer)", "value": "60ee6268fbec031a283cb49b7236ffedf7f995058aea55e8f9cd1761750fe537f28f7fec2911750a14adb93601bf401f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481612, "uuid": "8a628980-497f-44cd-9dd9-c24d7fa198a1", "value": "T10665DF057F4489D2F29A1737C0DB161457B49C112BF3E72FA9B8326C4BB1352FD0AAA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481612, "uuid": "c889a222-2264-4780-9904-6458da384c70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481612, "uuid": "f1c9b008-1415-4eb2-bc67-81e1e8d9e740", "value": "24576:6o43J4rRMZMplhF1CdlK24zo+T6EatYiuHv9bBd+R35EYEgtc0:MARFF1oM2UxT6EquP9td+RpEotc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629481612, "uuid": "79fcec51-e990-4ad4-a039-d76c54be5cb0", "value": 1488896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629481612, "uuid": "713f9aef-4dba-44f2-ba27-88560c6e0cb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481612, "uuid": "18d7d0c5-9a6a-4c0f-88ee-a703d71d7ad7", "value": "C459B05A242A81696CFF6CDE4BAB7E9D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d977f57d-017e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629440486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440486, "uuid": "8bf91002-d946-4028-9273-7b2aee739f98", "comment": "Malware payload (AgentTesla)", "value": "65cc3eb6b84627ef45c8e6a0a83bfadc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440486, "uuid": "36310a99-7e0e-4f8a-bad4-be10a30af4b3", "comment": "Malware payload (AgentTesla)", "value": "d2bf22d4b1e3d33055ebe363a34dd8218c771bc616a08ffd9311a6d6f08e9da0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440486, "uuid": "963aed48-5e9b-400d-ac7a-f3b52fb0e573", "comment": "Malware payload (AgentTesla)", "value": "6cb108a067dbb020c834444d2b47fb317abb1c59", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440486, "uuid": "e4d7f8bd-d0f2-4b5c-b480-6609c8c296ae", "comment": "Malware payload (AgentTesla)", "value": "32b8d5ee79b51b41970397826f6b81ddcd75a350d4540c38343e454432f863653ec1c9f120d5d6676e7654c4a1da4fc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440486, "uuid": "5cdcd1eb-5ef2-4022-8815-44661ae6a52b", "value": "T13BF0DD00491748FD0634BAF69643046EAFA19B4EB17034FAB141F1061E3EE1B5A873E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440486, "uuid": "b2fc8e5f-f816-454a-89f6-ec82bd5fe92b", "value": "12:3kY1uoXBAkrlWHMnukVoU4+r0SCAXT+ey3wYvcQ27ebWn4TV:3xwKAyWHDR9+reAavpcSpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440486, "uuid": "b7a232c3-3872-447b-b1c9-8662911e0a38", "value": 638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440486, "uuid": "92a36a47-7d33-460c-98ca-93a891d8b3a1", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440486, "uuid": "dd70fc27-2e44-46a5-9801-0c6283dfd25a", "value": "sample list.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21284f0d-017a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629438459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438459, "uuid": "07137b74-8d88-418c-873a-bb27d7db7a04", "comment": "Malware payload (AgentTesla)", "value": "9c7bd9ce7a502034b599039a6662c1fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438459, "uuid": "d12773c3-4cac-456d-8079-8aa9fbb7765c", "comment": "Malware payload (AgentTesla)", "value": "d2cc0ca6f89a078868f0ec608fa19ac0da2937599100a53635feb23c900dc5ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438459, "uuid": "d21bc669-487d-4fdb-a374-460f36240d14", "comment": "Malware payload (AgentTesla)", "value": "68ae560d78758e5e626f8ff3916695ddbca56b97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438459, "uuid": "a648a61e-e125-4ca3-8777-72a86408ff75", "comment": "Malware payload (AgentTesla)", "value": "d4a59d789e389f517ed860e625b3ffda4a0e9cb7dc8d716dbd10dea006e5fc4f5761d36c1c58bb20ac95a8b319e5f0eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438459, "uuid": "59a81a9d-3fc3-4078-a93b-6e601565bea1", "value": "T12CF4237951B7BCAB0FDE160AA5272462CCFC182F4C09C5F4AC4D354259BA6236FC74BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438459, "uuid": "523d2312-9f41-4aa6-9d45-bbfb6a26bc8f", "value": "12288:hvi0tA/IjqzRr/SAoJT52GbiyV6gK5dEWrf3rCkzex6JJcZCSh7TkIislPHpfXXt:LtS5qdV6gKznrTXexYJcZC2Tk3kPH1Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438459, "uuid": "61774f1c-b68e-4814-b4a1-5b08da630e0c", "value": 776472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438459, "uuid": "4793ad32-ee77-499a-890d-f5d4355fa552", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438459, "uuid": "e9618d5e-8dac-4b7a-ba65-c9a79f9dcd26", "value": "Scan copy. PDF....................................................................................................gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a63a4bc-016d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629433025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433025, "uuid": "00aa09a0-5f2b-416d-830a-e3cae97f7102", "comment": "Malware payload (AgentTesla)", "value": "a0ee7a867261ce1dc90969a6608227be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433025, "uuid": "92df4432-8ed1-4db7-ac06-70e45e245b1b", "comment": "Malware payload (AgentTesla)", "value": "d35e955b81ef8f4ae3f3a0e1dde81c20c822d95b3551d11602f565efd0fd39da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433025, "uuid": "8032a7b0-0395-4c5d-b03b-4efca1737ef5", "comment": "Malware payload (AgentTesla)", "value": "67eb071204f7e0a2dcb587382ec2eebe1bfde484", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433025, "uuid": "b5953cb0-b19c-42ed-94b0-d566b4867450", "comment": "Malware payload (AgentTesla)", "value": "9d3cf79dff1a93bc9dfdff97226cf08431d535ff74835ba2b7abe775f00327414c3579bc9e171b0bee0e217b2a7f15d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433025, "uuid": "b9611a16-ef42-4af4-880f-370675d8e510", "value": "T172E433574CC68402A1425B2226C43DC34E69F981772A1D19F62B78BBDF9F09917AFD23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433025, "uuid": "988184b4-38de-484d-8392-94dbf23d2e0c", "value": "12288:mtg7nj2n9/slNohyhSeseASFCi86L8jeE5uMwGom4wJTLxhRDi:ygDy9/sHoYDASQh6L+IMWRwJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629433025, "uuid": "09f4c9bd-9cfc-4ffe-9384-c2dd6ee0f603", "value": 710202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629433025, "uuid": "ff4c553c-5a31-4ca6-8026-e55e208e889d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433025, "uuid": "4a9df2d7-e17b-47a8-812a-e6035c6cf7ff", "value": "DEBIT NOTE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd6d7e3-0179-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629438262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438262, "uuid": "6301a68d-c107-41f1-bcae-59b2c4b92a07", "comment": "Malware payload (Loki)", "value": "2926117f59ceb261c19e6c80a5951d91", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438262, "uuid": "917de824-adad-46ef-b1a5-a63efeda26bc", "comment": "Malware payload (Loki)", "value": "d3707dcf5c34bd9d4b45341568bfc7ef57f65987c6edf5f6a17bcca455490f73", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438262, "uuid": "87074a94-6803-439d-90f9-f354e925c3c6", "comment": "Malware payload (Loki)", "value": "75b647686ae012a0198e05eb1b2c9e59568e431e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438262, "uuid": "75174af6-3847-492c-b9c5-6a301384ccf8", "comment": "Malware payload (Loki)", "value": "5c5bac9fa21c3a4df6d6755d15df336726ad051605094cdf22ab8cadb588b560057f533030215739a2efe7830728192b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438262, "uuid": "cd0d05f5-eb40-4585-beef-89d0eaa1d1f5", "value": "T18EF423DF2B431C11AE8C1E13DBB9F21145A90DAD6A540DDAD2FEF64B66C31A478F80C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438262, "uuid": "b987b96c-b11a-4f9c-856a-1a3284ed83a4", "value": "12288:loO1SiBn1KDEyH57/gxQuy4C/gCfXVnlTjl4nD2uDIv16tOBjjpQb28:l9Syn1RyH5EY/gC/VnlTjl4D2dvYtajU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438262, "uuid": "f1206ee1-5d8a-4108-9730-87ac6bf11052", "value": 736974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438262, "uuid": "bf5f5d47-ac06-46b2-8091-4cf7f52d2b38", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438262, "uuid": "86016685-ba91-4102-a27f-608e9ee7ed8a", "value": "QUOTAION#323456.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd627706-0185-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629443446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443446, "uuid": "12814f6c-ac6a-4e01-8ffc-7060d1bc0909", "comment": "Malware payload (Formbook)", "value": "aa5894726fb68afeb60be8129b4930f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443446, "uuid": "41dfb2bc-bb42-44e9-b418-6fdf4b02db70", "comment": "Malware payload (Formbook)", "value": "d441b6262d1915e1c32e85775622b2f2e3b755279f1b536d5b10eb2f14678e10", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443446, "uuid": "c3334e29-b2ab-4ca0-bee6-9c1670023690", "comment": "Malware payload (Formbook)", "value": "d5553977f91b114199b26a432cccaa35ff40b61c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629443446, "uuid": "80603f73-5670-4b9b-9494-a7acd614c42c", "comment": "Malware payload (Formbook)", "value": "d66aaf11ebbe1d24a4a64d187428139615e0709925ce0dc9fe26fbf6bdb40a4dc9b76c24b79186b33d8b612ad69e3d3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443446, "uuid": "332b1413-35e6-4a6a-8481-508ec87263c4", "value": "T1B9F40121B350B70FC56F8E3599819C00ABF0A9774707F3877DE316ED988F6DA4A1219A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443446, "uuid": "fbe52ade-0949-4323-a43e-c51da6efd3f2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443446, "uuid": "c9193c4a-073f-4b5b-933f-d08b372cb5ef", "value": "12288:hQncP1YxIejdK0yg+wpdy9f3dptrP0nI3YJ1t1uA5hjpZPt7Z3QykXrb:gctYxIidK0y7IoeIIJr1tltD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629443446, "uuid": "190a02b1-a5a2-44a2-860e-6bbfc900f872", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629443446, "uuid": "b07a5228-7284-4a6f-b86f-69ad1bc3560e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629443446, "uuid": "e741025a-4835-45e1-b36b-78ef563ec00e", "value": "aa5894726fb68afeb60be8129b4930f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd64bb1-01db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629480142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480142, "uuid": "0b7a1c0e-0c1e-4709-b58e-4e8bc4ebc4b4", "comment": "Malware payload (Gafgyt)", "value": "060a3cbb5e38e44c0ce5f1f7d9cd8720", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480142, "uuid": "dd382568-6a26-4cb4-88de-5fbe43285044", "comment": "Malware payload (Gafgyt)", "value": "d4a9608e12f21fca73e990020ad3278c5fc7ff4396032a758def1c086c415ff6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480142, "uuid": "a06e06bc-fdb7-4453-a334-365815b470ee", "comment": "Malware payload (Gafgyt)", "value": "cdd82320ab568da4c2778b8bdb4c5b896e8d59d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480142, "uuid": "f760bd1c-c5d5-4ad3-9f55-6398a82122ca", "comment": "Malware payload (Gafgyt)", "value": "bf9a4c8c8a66b3b69c9f14fdce9dbca66d80b47c381e6b570b4d08d9342fdbc3f9b80a35b78a82372598adb47a1618d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480142, "uuid": "6d5237a7-5338-404f-9fb7-a7042cdaf2f0", "value": "T18913F163B5722CC2C8F40534A1DE563B710AEB2B787CCB27CF085E44BAB28295309B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480142, "uuid": "d85d47b9-f151-47fd-b4b6-ec772fe71b57", "value": "768:lxZWtrZr/6wZX2ft2gU4Sq6pyd/ViuMcMO2/hOorts8Bc:h+zpmft2TGQ9vnZOormkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629480142, "uuid": "24b8fb58-c888-4228-8494-67bccd51a982", "value": 41632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629480142, "uuid": "37b22381-d2f8-45aa-80db-294cb0e63820", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480142, "uuid": "faf2c02b-323f-419e-8bc7-d3e861acf81c", "value": "060a3cbb5e38e44c0ce5f1f7d9cd8720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89025b43-01be-11ec-8fa1-42010a9c0011", "comment": "Malware payload (a310Logger)", "timestamp": 1629467839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467839, "uuid": "d2cfbb1a-9181-4395-9bd4-04afe1600994", "comment": "Malware payload (a310Logger)", "value": "eb3091860ba7efbe6be1e50cb181b7e1", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467839, "uuid": "04ac97de-f0aa-4638-bc6e-8464d244f3a9", "comment": "Malware payload (a310Logger)", "value": "d6e8f4ec7ef85ceb30cad02668d6274ff193ff4967146c2cc6ee9807cbb18cfa", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467839, "uuid": "06eda04c-f86f-4980-b03d-4535e57f9a1a", "comment": "Malware payload (a310Logger)", "value": "ccdc0f92e55896022f7c061978e97293195d40cc", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629467839, "uuid": "44c7ed7d-f33f-4518-b40c-56e4e9ab71b2", "comment": "Malware payload (a310Logger)", "value": "7af822d727c4b52d42a090046332b1ec5f4e454290df76d4c387b095ac88dfa7664443aaf8ebcf12276e97df782dcc84", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467839, "uuid": "cb871bee-e48a-4fe0-89f8-8149b400ce78", "value": "T14F4512A9DBFA5E5BD20B4D785232E6A20344CF4693C63397611DB1010EF67227BE34E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467839, "uuid": "c304760f-decf-4828-ae1b-bf58d9b2859f", "value": "24576:LVa8evbzC+37CiiUtIw+VTR+ijOZeNC6tjypreGlkIa5+K7:M8ez1C2F+tjzg6tooB5+K7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629467839, "uuid": "039e4139-f727-42ed-a138-098285b37cce", "value": 1215704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629467839, "uuid": "c177c1d5-2247-42e9-90e9-70f57d7fd80e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629467839, "uuid": "e75e3c7c-becf-4793-8834-008a576cac8d", "value": "order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff469f4-0188-11ec-8fa1-42010a9c0011", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1629444524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444524, "uuid": "730fd814-8641-4867-9538-857a5850bd29", "comment": "Malware payload (ArkeiStealer)", "value": "5ea5c92ff73e8932ab97e4e285cb77a3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444524, "uuid": "fcff8e3b-ab38-4d70-9ec8-58c1cde35b03", "comment": "Malware payload (ArkeiStealer)", "value": "d775f62d097e069293b27267d7efd95862e55e7ecc5e23e9c3ea532c39321b0e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444524, "uuid": "538f17b0-b4ec-471e-9568-5507d698ea2c", "comment": "Malware payload (ArkeiStealer)", "value": "958dc010d1a66546eb60d38fd40d015e540babd8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444524, "uuid": "2f4abac4-8e9d-4b0d-bbff-59edd139ac1e", "comment": "Malware payload (ArkeiStealer)", "value": "ce1f2d30652267b09d5755944da75a3154f59189d07bd49290dc2f986009c01c65a77e1946573dd802b720c49de73370", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444524, "uuid": "f12b4187-dc06-4c52-b2f1-003ba55f1a90", "value": "T1B8E3BE2275F0C472C05F4A304825EA945A2DFD641EA442773EBB276E1F726C18A37FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444524, "uuid": "3e9f72a1-c353-4d58-992f-ee1e88e40e26", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444524, "uuid": "458303a8-fc48-4a84-a5f4-fac8c8a47faa", "value": "1536:wp1tHGVsC0TnYfkdwODWypAJWFhjUPbZZ7oU7pR4JATfvrLIS25hzABFnLFBMK46:wvYHCWyp3IxocpR4KTIS25hzgFnLm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444524, "uuid": "071392b7-dcf7-4caf-b9c6-d0f752ba9b7f", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444524, "uuid": "211d2ef3-e94d-4db4-a789-73a2e60dda65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444524, "uuid": "29763280-5330-403d-b622-8062957d1a03", "value": "5ea5c92ff73e8932ab97e4e285cb77a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08f58cc-0161-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Glupteba)", "timestamp": 1629428043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428043, "uuid": "9bd452f1-c9ba-4990-8bd1-af3fabd83c61", "comment": "Malware payload (Glupteba)", "value": "73781d290dbdc748a1e70889e145557c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428043, "uuid": "894c2ba9-855a-42d4-9343-d112bd4ff90f", "comment": "Malware payload (Glupteba)", "value": "d86aa13697e550f6e74a585167e0e5aae455a7a99284679f230fe1d96ff59d8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428043, "uuid": "19c33457-d390-4856-ae65-30a8a1ee5ab5", "comment": "Malware payload (Glupteba)", "value": "1485dfe4b06f51b4a805bce34c84bf45e78bad86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629428043, "uuid": "69b328f6-fb25-493f-8da6-13762f4445b0", "comment": "Malware payload (Glupteba)", "value": "00d8213e325aac1a8fa46dc81bfe81cd6d33e637929c48bb365a59fd0aeb3280eb2561c2386f9407938162a09fa0f001", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428043, "uuid": "27dcf706-2312-4827-8d28-9cbb12eae860", "value": "T18A263301B0F21937C238953771852DBA3832F98A1925672BAE5F1A0B7F13346D939E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428043, "uuid": "a99138a6-da8b-4bdb-9d17-9c1c9128975b", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428043, "uuid": "202f3f8b-d7f5-4ea3-9b94-925f01414bfa", "value": "98304:SvH5Ty4vqUb9LW+RTyqdkIS4yC9ynU1kei0YwOtitAGbn:SvHJvdhC+FJy+YirytGDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629428043, "uuid": "72171f11-a3c0-42e8-aa90-bb729f776d24", "value": 4558888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629428043, "uuid": "330600ab-c113-4e5e-9709-646576915378", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629428043, "uuid": "58b08659-c211-4ce2-b5d2-74a75e14c564", "value": "73781d290dbdc748a1e70889e145557c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4eeea3-0157-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629423715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423715, "uuid": "c2751ee8-5560-4db6-b737-6cbedc54fa3a", "comment": "Malware payload (Mirai)", "value": "f9cb11da9486a7e471c0cab9c241d233", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423715, "uuid": "1ab16198-41bc-4fe2-9bb5-23e88e7e1ce0", "comment": "Malware payload (Mirai)", "value": "d9c02dfe09fc6fb85c51ec09651ecb1d1cad00673037df2485637d76e6617240", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423715, "uuid": "492c37e9-d47d-4bbb-81f0-c8dffaafdb4b", "comment": "Malware payload (Mirai)", "value": "ebace0da782b79b083861238d3adc6d6ee0b9015", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423715, "uuid": "c9cd2a95-d76f-47c3-a3c7-9247126b7b1e", "comment": "Malware payload (Mirai)", "value": "2e743fe7d42710162023dd2df71aabfac0d61ac2b35ac9b95398658193d66ed96fc20fe85d02758b07f72bc6e70c3308", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423715, "uuid": "998f079f-dd2e-4ff9-affd-d8a0b058e2d4", "value": "T19B732896B8919A22C6D413BBFA6E41CD372163E8D2DF3207AD202F6477C681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423715, "uuid": "a54d256e-b3a4-438a-aba1-689b295474c5", "value": "1536:fpXcKpBUlet3DBboJubLCNQpRTdafkcahWMPdhB4g5W9/e35fEFn:fpXcKLU1cR8fkvhT1Qgt3eF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629423715, "uuid": "1e23b748-19c8-4411-a670-4cd2f6a38402", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629423715, "uuid": "b3807cda-57e3-4c93-86a5-8e4411bc9853", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423715, "uuid": "02464383-5583-44db-a302-bf368c270dcd", "value": "f9cb11da9486a7e471c0cab9c241d233", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdce3f10-01c5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629470961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470961, "uuid": "2813879f-d03e-4ddf-96da-f3df046e105e", "comment": "Malware payload (RedLineStealer)", "value": "98a3f87557025b5590afb134d8700256", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470961, "uuid": "ea8165fe-c628-4f30-84d2-244a295ea98b", "comment": "Malware payload (RedLineStealer)", "value": "da8a880952ddc6fbca575075f9bf8c41109201502c038aba9e7374cb04cab6a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470961, "uuid": "f6d08557-397c-4577-9ed4-566a5b934dec", "comment": "Malware payload (RedLineStealer)", "value": "b592579419806b694771213e964eed1af6cfed04", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470961, "uuid": "68ee9105-2709-45b8-9f07-9898325cbd5e", "comment": "Malware payload (RedLineStealer)", "value": "13124dcab8f42b0f8b34d1f703314bc653fcd83e327700e37c4969b89236e8923a6158bb33ca2b34815b0fae73b077d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470961, "uuid": "96bd48d7-9466-4a6a-993a-ee98c97cd705", "value": "T1EFD41018667FC016D1F7EAB12DDCA8BBD9A990E3640D793710A4633B4B51784EE0F0B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470961, "uuid": "bf7a2528-aa68-433b-b5f7-3bba92265b75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470961, "uuid": "f25f09f3-a8d4-41df-a6ac-74ba05811cf9", "value": "12288:WkPZC3hkiQ5eA1Go1yhC4BrC/qpy1UVScbO/4mMo3Wu/A:9q013qCfFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629470961, "uuid": "42296293-40a0-49b4-93df-d2ad08246d24", "value": 629120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629470961, "uuid": "a8e28853-0f79-492f-9423-2154f40a3e56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470961, "uuid": "9c2635f5-1426-467a-b913-2b826de9e159", "value": "Run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea5677c-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424335, "uuid": "faf64843-a9b8-44a6-ac83-500465a168b0", "comment": "Malware payload (Mirai)", "value": "29d55f8fc49f95a5e878febef566325f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424335, "uuid": "8f91e316-aab6-4ad3-8d4a-aadff71d537a", "comment": "Malware payload (Mirai)", "value": "dbe2d2bf04fd22c598f10c4137c704b0e908aa4b7f557d7e108f28c61cd5e690", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424335, "uuid": "15f9f076-44d9-450b-bd9c-c70db3135ef1", "comment": "Malware payload (Mirai)", "value": "2e0e01b1d8f3ad1b04eb919d961169df4de84414", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424335, "uuid": "d7800e3e-a9fb-4c7d-bb39-4f1cdbceaa35", "comment": "Malware payload (Mirai)", "value": "3dfa0f9c431de47f0774a4347a6a8c160077cddb957b65e847cc560b4d18355f696369c424402adf2fb00e4a48a3bcf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424335, "uuid": "863ddece-febd-489a-a910-81e65c7a3b8b", "value": "T1B4635C02B2280A47E5931AB4253F1FE057BFEAD025F0B689695FDB568635E371086FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424335, "uuid": "0fc8e90e-4756-4669-8e94-3257eb0501ce", "value": "768:hcM3+VHuQYRPbMlxkSC1yHyx4cDjPHb/1ZsV28uiFzhjl6HHleKnsbmqVr4sGZMB:uw+fYYC1yHya2z/KBkyVEsPkIOwDRU/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424335, "uuid": "61195ec9-1d1a-437a-a207-0141f552ff51", "value": 70744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424335, "uuid": "c252bfa7-f9f3-43de-b076-1bb14dadef88", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424335, "uuid": "1b35512a-0de2-4729-bf7e-c8f336bfce26", "value": "29d55f8fc49f95a5e878febef566325f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6355da60-019b-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629452743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629452743, "uuid": "955ef5cc-0280-4c6d-8754-ab62054fe1af", "comment": "Malware payload (RaccoonStealer)", "value": "f7fc0fc3fa38937e1b498dc4e4087659", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629452743, "uuid": "beec1ce8-e6a1-464c-a0d6-6d220988501c", "comment": "Malware payload (RaccoonStealer)", "value": "dca102c7e82eadf4ed9610081714bf04462e486ae00921d52acc850374aa4141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629452743, "uuid": "d00bec86-b1b0-4f9c-9543-f5fb528d35a4", "comment": "Malware payload (RaccoonStealer)", "value": "7734a22eaa356aa7165df7deefaec86bd411b95f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629452743, "uuid": "5bc88ca4-d220-49c7-81ab-4f9c2f73edb8", "comment": "Malware payload (RaccoonStealer)", "value": "c33006a0c17c1f0543027e79b672be6abce0f0d6a911561a7b933630ca60d16bc6b1775eeb547ee34cae45e7afbbcfc0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629452743, "uuid": "12b88252-5f18-4201-8600-64411be1776d", "value": "T115941221F970C873C08257714D25C6A1A67AA811FA60CE373E876A6E1E717908727F7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629452743, "uuid": "8e5c541a-5286-4217-9240-909e0752b28f", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629452743, "uuid": "901bee19-abab-4787-8b4d-65ff938815ec", "value": "12288:Kvf8R8wgJRBjRZnhGuqxbV5DQ0/G+XpZL:Kn8R8hjjRdhVMJ++f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629452743, "uuid": "535c622b-9d1f-4f21-94ee-2da6e335081b", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629452743, "uuid": "b51ceda6-8310-4418-9907-b7e5c7dc0906", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629452743, "uuid": "36a82a25-5ed7-4440-99bd-536b47821002", "value": "f7fc0fc3fa38937e1b498dc4e4087659.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4543084b-0164-11ec-8fa1-42010a9c0011", "comment": "Malware payload (DanaBot)", "timestamp": 1629429071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629429071, "uuid": "3f20dcae-f764-4a9f-a6b6-8ebd80870b0b", "comment": "Malware payload (DanaBot)", "value": "ea6726790536078f1519a965c44a11e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629429071, "uuid": "21f6264a-8d87-40c8-a6f0-594a157506b9", "comment": "Malware payload (DanaBot)", "value": "dceb5e72706fa58a20c908932dd9a5bd2445ea2c6e412f13253e7f8c2c51e655", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629429071, "uuid": "c104e1ea-39fc-40eb-b966-6d4e79747438", "comment": "Malware payload (DanaBot)", "value": "eb72a91a1ecc6b3fd5960d092d90de50ae502999", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629429071, "uuid": "75339842-5c46-434b-bdef-ac212c1d906b", "comment": "Malware payload (DanaBot)", "value": "df51da547889c35e29c79f850cd4e3cc955953763f2746e90b76994c98b482e7093f4442fa64c820141558e3439a85ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629429071, "uuid": "10b86abe-de40-4c1c-9ef9-23f0499cc326", "value": "T135352306FBA18CA7E6F35EF388A055938A23ED1026B487675703EEDF1234561CD217E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629429071, "uuid": "d98aa085-9ae4-4b1a-b732-817cc848c7e6", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629429071, "uuid": "eb82e6cb-3376-46a3-b482-8480b29c9ac8", "value": "24576:zLgG1Z5DpRkcBLahuWfsFddDz7YXQpwr7w2:P71ZTRk1h1A8XQpt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629429071, "uuid": "8c9fbf3b-2b5f-4c06-8e03-6e0a52227fcb", "value": 1153688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629429071, "uuid": "a802ba2b-a8f6-4849-b748-5004f0c6db21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629429071, "uuid": "bfdd1730-e3d5-43e9-9802-9e110c3b1eaa", "value": "ea6726790536078f1519a965c44a11e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87bba891-01e7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629485446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485446, "uuid": "0e7abdd5-82e3-4406-ac1f-a1ba581fe8d1", "comment": "Malware payload (RaccoonStealer)", "value": "49eadf247a319f1ed386288b2d7a4a74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485446, "uuid": "ef9631a1-c6c4-454c-a9ee-2f6e4d9ed36f", "comment": "Malware payload (RaccoonStealer)", "value": "dd78d58bf51e05510f783c4d1181c36efe85966a57a2aaa6acdf863f7cdb11e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485446, "uuid": "42db0f01-2c57-4a20-9d2d-811127a2e6ef", "comment": "Malware payload (RaccoonStealer)", "value": "543f40390319dbc47d25a08501bb8be1287f8d71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629485446, "uuid": "66e14754-ab45-4cb9-b331-a0e75f8e9f26", "comment": "Malware payload (RaccoonStealer)", "value": "d1916151a6f21008b000e671aafc6fe88903eea3dd33c01ef03d4da890ea080231970837b4ae0b6b1fc18c625d2bed1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485446, "uuid": "46e22b26-3b40-461f-8e92-15f0461a1f2c", "value": "T193447D20B690CC35E4E712F498B583A8A829BD705F6491CB62D727EF5B346E89CF0357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485446, "uuid": "e696e346-6e53-4cf1-87e4-07c7ece4ca57", "value": "7bb5fa0b8cc629bb852d76174c2fb878", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485446, "uuid": "4bdbf8d9-3517-4551-83ef-3fb53a10fee8", "value": "6144:rL6l/Yi9soUT7NrkHHQlykdUD2uvGefdnCy6D4:Kl/Go6NrGQckd07SZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629485446, "uuid": "b1203e45-95ec-430e-9fdb-a4a831dce319", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629485446, "uuid": "5943c7a7-2031-4c9f-89d7-a0a44c57ff1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629485446, "uuid": "98b45623-833f-4386-b116-db02c22a5781", "value": "543f40390319dbc47d25a08501bb8be1287f8d71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321bd0b1-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424314, "uuid": "03141aba-bfe8-4e49-9c16-e64c3882177e", "comment": "Malware payload (Mirai)", "value": "ecad52badc52ad369104d6f7dc0aebb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424314, "uuid": "203f41e3-1d55-42cb-acb8-a77cca25132e", "comment": "Malware payload (Mirai)", "value": "ddb344f332d4c0192d6d50a41f306e8f1fc1f15d582482ddf7a91fb5b9d529c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424314, "uuid": "69f09009-befc-4d5c-9ea5-7e62c9314281", "comment": "Malware payload (Mirai)", "value": "eccfc86c73de3e2bce3430a1f1f1e6d1cb2ccb58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424314, "uuid": "b1a3f23a-59c1-4607-944e-3ef28ea0270b", "comment": "Malware payload (Mirai)", "value": "4ba6b6fb2cdeb033f8ba5390e9e14087a20e08036ad960cbf479273f0d3c17e158ad0b82f4fd114b29c177e44a21c2fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424314, "uuid": "6ccf615c-1ad4-4684-8ff9-a933697e2ea7", "value": "T157639D3AE40A9DA4C0424634B0E5DE351FA3A9C443272DB6AFE446B61407EECB55DFF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424314, "uuid": "098650a6-9260-4252-9173-7c7f68183d13", "value": "1536:wam7dIbOF5lwtHUBpYvnJ4c/NrzHT21+hsCDq:wPubOPl0JjTg+hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424314, "uuid": "065bd0f5-8565-4375-9b9c-0c6404d9e3e5", "value": 66968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424314, "uuid": "a09fbe2b-2c0e-4197-a991-ed4ab02b8e4c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424314, "uuid": "5e13c31e-1478-457f-8fd9-5026a16114fa", "value": "ecad52badc52ad369104d6f7dc0aebb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46148a41-01c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Amadey)", "timestamp": 1629469015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469015, "uuid": "0995f265-72b1-4b27-b7ca-88660326e80e", "comment": "Malware payload (Amadey)", "value": "9450803dec42e41bd9b1495f9ff6d94f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469015, "uuid": "1077b96f-375b-48d8-8a38-1c2012e8d1f3", "comment": "Malware payload (Amadey)", "value": "df3a0c65840c01366c3d4ea8ca156476322a8e656ac3e11d71bbef5daf91640d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469015, "uuid": "3bafbd92-4c3f-4722-9936-d1532743f045", "comment": "Malware payload (Amadey)", "value": "2682c630b2fc0bfadb9f36c0c4bd2592b1a70816", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469015, "uuid": "6151e0a7-08a3-40f0-9b7e-b639feb1b764", "comment": "Malware payload (Amadey)", "value": "07d5534a72161b6fdacdafcf05647896be9376f07d6d2d1b4ad6458ec8a1367b1709c7497223e46c042c238b71c01c63", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469015, "uuid": "cf42ad71-8d9c-420d-b7db-cb1fd81593ca", "value": "T1EF24E03038B4C072C067DAF008F19794666EA9545760A14F3E972F1F9E733519A2AFEB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469015, "uuid": "cc19fc0c-b92d-4a5e-9dd7-ff91f424e659", "value": "9351114812ade0773cab5940b106fe09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469015, "uuid": "5ccfdfcd-3fc0-4aac-a03c-4c65ca5e9091", "value": "6144:NRayv7Ffd950+b3ZHmhWMEHPCfSetgFnL:DzxfB0+bxmhWMMBZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629469015, "uuid": "f9ec369f-c092-4cbf-8a9a-3ab3ff45d2e5", "value": 229888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629469015, "uuid": "2db773d5-3ad1-42b3-9859-63e3450da243", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469015, "uuid": "6b1319a7-752e-48c5-b8cd-c531e9770b11", "value": "9450803dec42e41bd9b1495f9ff6d94f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036b1fba-01b8-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629465038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465038, "uuid": "18533e23-8675-4303-99cb-d8ae8baba030", "comment": "Malware payload (RaccoonStealer)", "value": "b078e7d741ec323223e402ff27dac814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465038, "uuid": "b8f51c5a-2210-4a8b-9461-33eebaf0fba0", "comment": "Malware payload (RaccoonStealer)", "value": "e0c599b0dccc70c7a074b9f14f5da4b8503b87205ef9367a841f59e989d50e37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465038, "uuid": "26ee1fbd-9f05-4a46-8942-68cf9153dda8", "comment": "Malware payload (RaccoonStealer)", "value": "52f283103448e55d3aae8a71bda58a663f808544", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629465038, "uuid": "dbce067f-a06b-41fb-aed6-40be5ce754d0", "comment": "Malware payload (RaccoonStealer)", "value": "892ceb09abc7c217c7f2798af258c2a012c2eb2fb78e3c6ca38c6a102a0afdb57b4fb38b890f0276c6c548bf586b5680", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465038, "uuid": "a0834d89-bbf0-4b35-9a2e-b2a238759c0d", "value": "T12135341719237919EB8681F1B78EC8BB742A6E401F904CC3270F4916EE99F2987D6FD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465038, "uuid": "c7bdab97-b5be-4c08-a264-6ae259028e19", "value": "81c79ff1893a0715043138f6858d7a77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465038, "uuid": "3232b1b1-8a18-4677-bf95-ecebb1a15a68", "value": "24576:6OLb9ivWrXrrrBgMZneaXMkgeVBkl/rKp3w1I3BzyqmgvL4+UMr2Wqwz0Sy:Rbw2L6+UNnwz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629465038, "uuid": "590f7c52-8702-4f29-9aa8-6f38f751bc8e", "value": 1146044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629465038, "uuid": "618ed603-bdfd-40e0-b769-3bb37364dc99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629465038, "uuid": "7560af2b-add8-4e3a-b734-418d2c556e3b", "value": "E0C599B0DCCC70C7A074B9F14F5DA4B8503B87205EF93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94064110-01c4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629470435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470435, "uuid": "19f2d43c-6c50-4055-9b25-020de57abb1e", "comment": "Malware payload (RaccoonStealer)", "value": "b6b5f7d77441d6fcb774f616d2861372", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470435, "uuid": "56b9a734-5b9f-4679-bcd3-eb50a3c4708d", "comment": "Malware payload (RaccoonStealer)", "value": "e2cf4afbc68de96784c1de3623ec6a6eeb9a3a9886db3dc3eddb3e845151291b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470435, "uuid": "2f91c49d-8a8d-4c04-97b6-e5a0a62a89ee", "comment": "Malware payload (RaccoonStealer)", "value": "977f7c4175205a14b0964f7abf10ffbfcb8f18df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629470435, "uuid": "07035a63-f626-476e-b4d1-3cccf02e4e42", "comment": "Malware payload (RaccoonStealer)", "value": "9c95ed79b24c8bc4c13ea6335969cded786fbf5acf7dfc6aea20048f1fc0ae97fd99d185c71fbc3fa5a887a829c532b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470435, "uuid": "1e407b13-5ff1-4638-a4c3-f6865fd0b366", "value": "T146D49E2675729076F07240B0AE6CAB61167EFC7049354EAB73C9163D4FB15C29B22B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470435, "uuid": "c0bba84e-5985-447e-b935-47cf8a094c67", "value": "5bccc4ddaaaa65b3c4a43f5df51c1a02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470435, "uuid": "0101ccfd-6a68-443b-9ca6-762983e26387", "value": "12288:7RaXb/FXVHMBhx/D8WlhVe2f1yt0uWWgaRjUut26sFh3Gac5B8/e:7IXbzHMBhxbhrVeOlflo4/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629470435, "uuid": "d689cca4-552f-4447-8bdb-14bcae8a2ab6", "value": 597504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629470435, "uuid": "135dc7fb-66da-4c7a-9556-3f02e3326dab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629470435, "uuid": "2f23cdbf-f864-422f-8cdb-af5dfa0319e9", "value": "B6B5F7D77441D6FCB774F616D2861372.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e4384bc-01f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (njrat)", "timestamp": 1629490933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490933, "uuid": "5316f1f5-cffc-486c-b842-ef0cdd8d5cdf", "comment": "Malware payload (njrat)", "value": "20613fa6bbde3853807e944e7ab25d28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490933, "uuid": "0f075992-9e6a-446e-b738-f75839aef4f9", "comment": "Malware payload (njrat)", "value": "e31d4e1ec7e040af6d1964976234a3f8da61d12664fe4c85c768348fafcdb614", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490933, "uuid": "96fec28a-30bc-415c-8746-29cdba306581", "comment": "Malware payload (njrat)", "value": "91ad26948fa49144300c6175f9c1921644193fd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490933, "uuid": "0ca6a37e-de6f-4ba1-8fdb-be9fb34e2e1e", "comment": "Malware payload (njrat)", "value": "f0ba6575a1791421b609c0c9a067606d6927b920bd56dbaf649ddc4c5a25a91fffd4c8cc111ee6d905630f943034aa93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490933, "uuid": "86426cdf-8ea6-40ad-80bf-1804d03c30b0", "value": "T108E208067BE98215D6BC5AFC8CB313214772E3838532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490933, "uuid": "507707ec-c0fc-4a95-8a5d-e682f09e23de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490933, "uuid": "d7c0cf4d-b7de-45e6-9cd7-373cc6f99db3", "value": "384:C0bUe5XB4e0XMpOjfrw0Q0mS03AWTxtTUFQqzFWtObb9:bT9Budj855dMb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629490933, "uuid": "d9ae4b9e-8620-411c-a8f8-fb9d58db0586", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629490933, "uuid": "21652fc6-1e54-4b80-beea-065a569e6e4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490933, "uuid": "bcc4802c-4e80-4acc-8c68-66780e001be0", "value": "20613FA6BBDE3853807E944E7AB25D28.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30167d03-0167-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629430324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629430324, "uuid": "7115c04a-e97a-435e-9916-9d8ebd0c72bc", "comment": "Malware payload (Loki)", "value": "a0d7c028bb71809eadcb13bb04851c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629430324, "uuid": "ff395883-18dc-409b-ba9c-937181393f87", "comment": "Malware payload (Loki)", "value": "e394ca16835c98c38eef2c613122ea8304645155327bd920265bd796a0ebb071", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629430324, "uuid": "6e02b623-c7b7-4138-8fce-17d6ec12de6d", "comment": "Malware payload (Loki)", "value": "15ef855c5dfc1a940a9b3c713df104f4a08bc6f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629430324, "uuid": "50f89b25-219f-402b-9d7b-d761bfd98e39", "comment": "Malware payload (Loki)", "value": "5147c0e5e4088c605a0181217c85d5b22998c0e6530cffe9fe2699e85c913ceb3e86201d4297d461a0e1763cc15c22c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629430324, "uuid": "bd1bd1e7-bc9e-4b28-ad85-9f86fa795a59", "value": "T1E135D09D7310B6DEC82BCD32C5982C60EB6175AB870BC20BA06311ED9E1D997DF254F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629430324, "uuid": "8028bf10-4ad5-4ed9-b3d3-e321a757540c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629430324, "uuid": "03c7faea-90f4-40c9-8593-277833509eb8", "value": "24576:Igg6Kx091xSeItrvot+zhUkbe0Na8990cCZsGUyd:Igg6K6/lKjhtUkb+ciWU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629430324, "uuid": "5a4f9471-ca79-477f-bf63-8ebf5376a2a1", "value": 1085440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629430324, "uuid": "3128ee40-0874-4e87-8157-938a1b61b209", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629430324, "uuid": "68737d6e-4804-4a8d-b23f-0f3219cafef8", "value": "PO 60100073 & 60100493.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c421600f-0181-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Smoke Loader)", "timestamp": 1629441739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441739, "uuid": "83691a5d-a5ba-46c9-83ef-f30a7a342cfa", "comment": "Malware payload (Smoke Loader)", "value": "533735cfad32be5ce373af067b6b9159", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441739, "uuid": "9d9d0827-b920-4480-8024-b529169557f0", "comment": "Malware payload (Smoke Loader)", "value": "e3b8636fe3fc058a39c925f766557368a6f357353ff21d886a26f62eabb7988a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441739, "uuid": "6e3f430e-85b5-46ac-b73f-65a14e9eabc1", "comment": "Malware payload (Smoke Loader)", "value": "9422facbe4e2b3ac7919f81ba7811908baa77cfb", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629441739, "uuid": "8ea90fd8-2920-43e4-b4c4-adc4a2c9efe6", "comment": "Malware payload (Smoke Loader)", "value": "ee33cbfbb8d21259fb1700a158ed5d081f530716a45b8d605ed251c91ea42e5f29fcfa0925a570030272f9febfac5124", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441739, "uuid": "c0ed0be6-b136-497f-b262-790a59ae5342", "value": "T144548D20B6A0C035E4A613F499B983AC6B28BDB55B2450DF73D637EE57342E49C3126F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441739, "uuid": "ab16b445-44af-4a30-862c-1487cf92fa0b", "value": "c373d93df8b60680e045175a45030767", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441739, "uuid": "6c21561d-5441-4dbf-9c1a-846bfb5a86ca", "value": "6144:I5iZYtxQKCwvTo77l+GfrHetU6wjU3q9phkEddZanhM3c6:cG8xQhwvTo7cGfrHeC7jU3WLHZAp6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629441739, "uuid": "b0495ad0-380a-4ede-9e58-adff99ec393a", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629441739, "uuid": "96f56dd0-6b33-4d0d-8976-6417e1b4be6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629441739, "uuid": "426c5f94-e8da-43f4-bd71-6d4db314bcff", "value": "533735cfad32be5ce373af067b6b9159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b157243-01b4-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629463548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463548, "uuid": "d949bd96-fc14-4c14-a902-f80561df1315", "comment": "Malware payload (AgentTesla)", "value": "30bac0d23232b724de4b04c7b92ca6f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463548, "uuid": "277bc5a1-4fb3-4777-a6f9-e4cc89e770fa", "comment": "Malware payload (AgentTesla)", "value": "e4d2da009a40f7b1fbd7c9a488d521b5e035ebcd26ada683ea837aaf4b51a0d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463548, "uuid": "c63cdeb5-5ef6-4d81-8420-1301c996c86f", "comment": "Malware payload (AgentTesla)", "value": "327bec167a1d047bce9c51ceab01be3cd90f6b1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463548, "uuid": "2042f6ff-33c3-4eb3-ba4a-dad7c1c3893b", "comment": "Malware payload (AgentTesla)", "value": "0667415e33a3bfa141a87c2fb389d812029f5df8d4ae0ffff65a69af41e2ab5b1f35a97170fa019380f14d47c88e4809", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463548, "uuid": "176fa393-dcb3-4a52-b298-3e0093d9b70e", "value": "T19945493D19B91637C5B9C375EBE59523F248985FB500EE696CDE03A7030AA8335C362E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463548, "uuid": "74f424d4-d05f-41cb-956f-f6c9effd4aea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463548, "uuid": "5b148ce8-1eba-4e1f-8fc6-d1cf4084021d", "value": "24576:fZgg8PrcZ+u44JnpCkFJW99AQ24qEzH4Kp0CZsGUys:xgg8PgZ+u44HCA0yPTCSiWZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629463548, "uuid": "00dcda92-9490-44ab-b43e-edf172d98599", "value": 1235968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629463548, "uuid": "78c12d24-c6dd-457d-93c0-5609588b22ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463548, "uuid": "f848a93e-15eb-4355-afe8-ccc7f5d05509", "value": "RFQ SMK_BNLDU20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3339e73f-01db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629480151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480151, "uuid": "aeed16ea-c15f-4dda-933b-17a7b0370979", "comment": "Malware payload (Mirai)", "value": "6c85d9cbfef1ee88864895a414fbcecb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480151, "uuid": "2bb785d7-7603-4505-8594-1d9f33d4f005", "comment": "Malware payload (Mirai)", "value": "e4f1887cde8e750c7e86c6519a7aa9108776fd2328e7d6a2c0c07af6b56089e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480151, "uuid": "b07b1614-82c7-49ce-82e2-9f79d89db738", "comment": "Malware payload (Mirai)", "value": "749b77ffda220e7ed3c2168c17d1526e4bb657d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480151, "uuid": "7e264c6c-7b25-4c6f-820c-5a129e6847f8", "comment": "Malware payload (Mirai)", "value": "a3daf44143495ca8212c4b746c6198288dbc8cc2c9cb5eada5bcef4fb63251a85bc89f08875ba280a740dce380fa5450", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480151, "uuid": "9626c442-49cb-4611-a55e-70288dac5775", "value": "T11413F1BC3F01D25DDB2DA57E83E226123B54A454889F6F1B5CF2BFCE37492062156705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480151, "uuid": "d9d1aa3f-a96a-4db2-88bb-940f3b4dfd64", "value": "768:iUtAIbVY8U2k7kJ/x8DqaYSndtk0jT/3oG+jaN/ab4S194d5m+9khU:ftAIJyn7khxVNOGI/7+jy/abSU+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629480151, "uuid": "7ee6f6c4-c48d-4a99-8402-9d72bc36d4c8", "value": 43932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629480151, "uuid": "67d9677d-f65a-4bd4-b5d2-b0c54a3c3684", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480151, "uuid": "9f5de3a8-16c4-4b5f-a902-8e76eb0c629b", "value": "6c85d9cbfef1ee88864895a414fbcecb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a01a2e1-0179-11ec-8fa1-42010a9c0011", "comment": "Malware payload (CobaltStrike)", "timestamp": 1629438018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438018, "uuid": "ca22ba36-a3b6-4fa7-9ef2-5cbda60fb243", "comment": "Malware payload (CobaltStrike)", "value": "a844f1a1b48c8bc27eed0e478e4dfffc", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438018, "uuid": "512f653d-b093-4c92-b939-9625d9b1921c", "comment": "Malware payload (CobaltStrike)", "value": "e5053d8c35cab9f2788fd86e1d8b0cf3eba0ec32571cc56fba8e96dc1ca6f970", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438018, "uuid": "2a8562da-c626-4af4-a6d9-cfccc4c7b643", "comment": "Malware payload (CobaltStrike)", "value": "5ff585d7e3f73c65a7560d7f3a538f191b60d591", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438018, "uuid": "582dc4f0-f9a2-4627-94ba-a1e9cfca035b", "comment": "Malware payload (CobaltStrike)", "value": "908f1340704ccc3504924369926ca7a1fdcc2b820cf0f6a2d1c25e8fcea669eb15a8b42181b50d1886a3833d15ef0369", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438018, "uuid": "d6fc671c-832c-4262-91e6-d3f0b51d714b", "value": "T12E24DEF7057EAC21E66648326C89D8E11FABF093A60C7F3E21E59D55EE5ADF0C912201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438018, "uuid": "d7531b29-53b8-4344-8f98-83671b48c916", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438018, "uuid": "80439900-b8c2-4870-8c80-943a9d4470a3", "value": "3072:uh/WkHf96yZkpouCjOqn6W6qah40IShzQ8PvKV07XaORM4lfesLVDIGApohQpfkE:a/tckiSMh40E8N7Xaa5eiDIrpoCZksn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438018, "uuid": "0451028a-122e-48a9-b962-fa542b4724e3", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438018, "uuid": "3393b214-ed26-4123-bb11-3ffeac531ea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438018, "uuid": "79c68e7f-af5b-4c61-9be7-00456d13c1ea", "value": "a844f1a1b48c8bc27eed0e478e4dfffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d9cea4-017a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629438470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438470, "uuid": "6494e2bf-c78c-43ca-b823-5f0711afb82e", "comment": "Malware payload (AgentTesla)", "value": "c7c13ecd8e32ac86de234d404fcc10e1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438470, "uuid": "c08392ad-8922-44f0-984c-cd410075b4ec", "comment": "Malware payload (AgentTesla)", "value": "e675bbe5ec05274793503d47490dd35b0dafa84680a37452c40095e5c772320a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438470, "uuid": "31fd4860-8a57-4d5c-b3ba-fae6bdd59d28", "comment": "Malware payload (AgentTesla)", "value": "48a5eb088caba976ab15911a229718fa4f9939f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438470, "uuid": "19313501-a4d5-4d05-9c5f-7ba713ba5d62", "comment": "Malware payload (AgentTesla)", "value": "f890b1867d46ad13cd705dddbe955e92175a0733a4874220cd9d6e6414e18da800da810483108f680252ebd0d0952455", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438470, "uuid": "60d54b6f-b25a-4973-8982-518fbdc918a2", "value": "T135454A3D19B92633D5B9C335EBE59423F148985FB500EE696CDE03A7030AA8735C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438470, "uuid": "dc595589-2e24-474e-94e7-975072a70cdb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438470, "uuid": "0bc5b3ae-e70c-4242-a542-1dce2975919b", "value": "24576:QOggDit0JyRxIob9cINQbuo9BWTCZsGUy8:Lgge0JUb9cIitWTiWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438470, "uuid": "aef5b92c-0009-4113-88bb-1ee613fd69c1", "value": 1200128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438470, "uuid": "16c6e192-4e0b-40c2-818a-62b5105a04e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438470, "uuid": "1a82cb4f-0d4a-488a-83f9-2b0395c41d70", "value": "Scan copy. PDF.....................................................................................................exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5355fb-01ae-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629460763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629460763, "uuid": "51cc4f67-502f-4674-8c12-19a534484bb5", "comment": "Malware payload (AgentTesla)", "value": "b65683f61583532ca2de86c17ff8e501", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629460763, "uuid": "dab9fa2c-670c-4bb7-b058-d38ee06620e5", "comment": "Malware payload (AgentTesla)", "value": "e729a9475fc9de021d5f141593ef37a929ccc0e27ea00da8fb42ed856f6d4caf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629460763, "uuid": "dbc87408-2b62-4251-a0e5-3e5f7e7e7040", "comment": "Malware payload (AgentTesla)", "value": "2c2bd257425a75f4ed5c453b55f55553f6a74926", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629460763, "uuid": "ad76cee9-9d73-44a5-a839-8ed18afe117b", "comment": "Malware payload (AgentTesla)", "value": "2b4d6d4e0bb5aeac9801b657174363fc0576971b6d9e0cddc9dcebccd30dcb0f6d44d499f6681d67b784782937e4b958", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629460763, "uuid": "365c4ec5-cb64-459e-a2af-193e43983603", "value": "T1DB25163D19B91637C1B5D375EBE48523F258985FB404EE69ACDE03A7030AA8734C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629460763, "uuid": "ab8c5bae-420f-4088-89eb-4290e7336c1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629460763, "uuid": "3bb6eb67-d012-4763-bdc1-400b9259ef4f", "value": "24576:vkMpZtimcMWCps0r8+NWeAw0bjGuiorGqak:tZomcxCpFdWJxb9iB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629460763, "uuid": "e507f827-1296-4d40-9bca-d36351a4145c", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629460763, "uuid": "3dc37e18-a099-4a2c-8596-c6487956cbdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629460763, "uuid": "aa812a4d-da40-4818-ab61-2bef9c02ac13", "value": "RFQ NUWATER #3002020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18178162-01db-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Gafgyt)", "timestamp": 1629480105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480105, "uuid": "2122929e-2c4c-463c-ae80-0576e312abf2", "comment": "Malware payload (Gafgyt)", "value": "03118b8f3f8b65c411221f4c20c8d030", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480105, "uuid": "16a18e97-2cff-4dbc-81b2-53e8381ce625", "comment": "Malware payload (Gafgyt)", "value": "e9d712429fe1176e461f9ae421a289c884cb1db4965e29aea356f847b298478e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480105, "uuid": "3bc6e4cb-2251-409b-a757-2eefd92d58f8", "comment": "Malware payload (Gafgyt)", "value": "0e58093a325451a1b0644c29a2547224061d4570", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629480105, "uuid": "ca0847df-9ec3-4357-9b90-0f19ef169b6d", "comment": "Malware payload (Gafgyt)", "value": "c5a4ca71edb12fb3853394d1bfcfe73c5fb2633239eb53a7a2d460efd0a785a03ec933e25c9188c70add72988f63fd04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480105, "uuid": "7b3430e1-bbaf-4490-b490-48ff9d240602", "value": "T17F13F235865F17B1E631F9367F5A62403094F5BFE42AB10965C5CD80FAABCBC9A04C01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480105, "uuid": "c25414d2-4f1a-42ee-ab86-0b5f8c6d4c3a", "value": "768:oQwxsDMkoXBG3wj8lJwEG73wP4aKGxz93GiCw028prDG4WOj6QfT0REYv8e+l8tQ:oQEswkoxkwGeEG7u4aKgVG9wj8pS4T6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629480105, "uuid": "5b465d77-1ff5-41d5-b10b-48f3b8b86b61", "value": 42736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629480105, "uuid": "e71ecdc7-0b59-4e70-ab12-97a0fbf7eb5e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629480105, "uuid": "f7776b09-d1dd-49b7-a642-1c8d4128a129", "value": "03118b8f3f8b65c411221f4c20c8d030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72e504eb-01f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629490995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490995, "uuid": "238bcdf8-76c4-4514-9d44-3aac05b05c2e", "comment": "Malware payload", "value": "0e4f6a0903ba99d6595ba32ee172dad3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490995, "uuid": "a7cba641-2ae2-4cbd-8223-8f3d23c147ef", "comment": "Malware payload", "value": "e9d76237d04e6f4eb66425f26e6c8441effd2fbbc6cb29cd5d2a2605491c7502", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490995, "uuid": "2724c982-be0b-43db-84ee-d0df2ca71088", "comment": "Malware payload", "value": "fae70fdbf2872e09860a1f875c36a9229d52d03f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490995, "uuid": "3b9ae228-5364-4c93-9c82-fc1005a08fa6", "comment": "Malware payload", "value": "1e83cdbc918e8e9a80f19404850eceb3dd7329087a56456f8c44642cbf799f09c2fc32efee284e4d6e503cc0acc04493", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490995, "uuid": "aec026ac-2261-404f-a751-afce0a917a84", "value": "T10CF53387E793E544C1A702F3818BB2A3765C1039525BEF3D05BA80D6D8BBF644B49CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490995, "uuid": "dc4f27ea-885f-4b2c-9df6-1b35a2da2c80", "value": "49152:RfmKD7keCyZ4eBtW2hD07yzniXl8zzHUzy1vgqXppqj3FN3A89uKuzW5LnTnSkLQ:JkevZA2hl+Xezg0e3xuNW5jSkLneD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629490995, "uuid": "bd98f097-3ea7-4fd6-a11b-59681768036d", "value": 3429638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629490995, "uuid": "dea6fb8d-5487-456a-839a-fda1f3b1622d", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490995, "uuid": "eaa0ad4a-395e-466c-b199-599b35dd867e", "value": "Google_Play_Protect.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be2e0345-0167-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Pitou)", "timestamp": 1629430562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629430562, "uuid": "f768f812-0858-4339-9f7e-6070af6c435a", "comment": "Malware payload (Pitou)", "value": "59e5bbf171a43f714b392b3ab0a8bc34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629430562, "uuid": "ac5f3380-2aa9-4e30-8174-e1a46d19999e", "comment": "Malware payload (Pitou)", "value": "ea18828c0e85e693d40a12236ff340e3e48aa0bf0494af5ac4fe9619ba05049b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629430562, "uuid": "3db6b21d-780f-4edb-97c9-fd8ed0ee7f0f", "comment": "Malware payload (Pitou)", "value": "b5d902912bbbf81a1ef882e5ce6cc5003f96bbff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629430562, "uuid": "3695baf5-db5b-45e3-a95b-81ecc9c162e5", "comment": "Malware payload (Pitou)", "value": "365b0a38f7508fcab1c9483905484986d937bed91691942945afde8646847bc5f1533435637cccdfd5779597f9a058fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pitou", "colour": "#8FFFE9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629430562, "uuid": "10af3619-5a5d-419a-86b4-427cef1524ee", "value": "T1A6B402213971E132D44282B48A76CA644B7A6C701F6589073F8F972E7E713D0AF29F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629430562, "uuid": "0f94ccef-2764-4dbf-924d-0af5a431d37e", "value": "dded9f8a501932d43920d95856e3c15b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629430562, "uuid": "c7834911-803b-426c-8508-f73e3b302426", "value": "12288:SEdzKV2l8+gv73mxub7+CPAI2OBxOZTN/aWOyVZL:SEd2Ilr94+yAIlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629430562, "uuid": "3b2158a4-ec56-476f-b804-2eb6a70dd672", "value": 509952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629430562, "uuid": "163c78c2-e113-45e1-b7ba-5ea0068f3f0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629430562, "uuid": "3e6b5bbb-eca5-46e0-8404-8f266f40d283", "value": "59e5bbf171a43f714b392b3ab0a8bc34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cabdca39-017e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AsyncRAT)", "timestamp": 1629440462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440462, "uuid": "d8f7ef55-f986-43d5-b61a-b4b8d600f0af", "comment": "Malware payload (AsyncRAT)", "value": "1f3ac904c6fa529028fbb4f8efee7870", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440462, "uuid": "fcc6d562-eda5-473f-a5ed-b886e780b051", "comment": "Malware payload (AsyncRAT)", "value": "eac5c97779fa75a48ef1b573e8bf80b32900d45454b7cb71ee0008adb99022a3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440462, "uuid": "c85023be-7062-4733-b274-9d84e27b7f44", "comment": "Malware payload (AsyncRAT)", "value": "8921dad8921231ec59e258cce1ec1b1856a46c19", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440462, "uuid": "fbb318f7-4874-41ae-b313-23603a4d26f1", "comment": "Malware payload (AsyncRAT)", "value": "023a76f760a3d3bfa509936c434118509caff8461197d308c8d54f981659e101fa8fa9386394d738294411cad234dc7a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440462, "uuid": "dab72224-c526-486f-835b-2e153be73166", "value": "T19D319B24CF2EC4DE4A1161E13A8F9D134EA54F117BDCDB8A1480C904EB1E96D46FE633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440462, "uuid": "0071c485-23e5-4979-b2ce-14c3459b5d70", "value": "24:2d7ruiy39Kp9Wd3Geq5qHT3qiSeU0exege0eY0eqveWjPeVWeTy/eHnZy:O/ct1d3Geq5qz3S0exPf70ZvlAW8SE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440462, "uuid": "25aa6503-030e-43aa-b164-0512653829b0", "value": 1581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440462, "uuid": "8e4c1e93-8a08-4600-84b9-877a4d337848", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440462, "uuid": "b2752e49-11af-488b-a050-b356e0c1643f", "value": "DEJRP306.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e1fc73c-017e-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629440226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440226, "uuid": "355cc7e6-5895-413f-8d4d-566df29c626f", "comment": "Malware payload (AgentTesla)", "value": "18ea1339611bfb2e1cb067f6cdde25ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440226, "uuid": "7dca6634-f8de-4592-8c4f-202cbdb4717b", "comment": "Malware payload (AgentTesla)", "value": "eae70c96f0c423f62c8cc986cec7c1ff56ccd1eeaa3f89d66d339e669c4a438f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440226, "uuid": "bed66d5b-484d-493b-89e2-e1cbd588f43c", "comment": "Malware payload (AgentTesla)", "value": "7765d7e7f4f4b3a227ef6686ef9ef7fea0053491", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629440226, "uuid": "39a0fb1d-db6a-4450-9cce-3b2ec0ebae26", "comment": "Malware payload (AgentTesla)", "value": "104583bcb8e18263dfe3ee3e4434ddfb1be24ce4b91280449d1b63b461cdd8b6c2a6a2e9689e38041caedf0ca40690a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440226, "uuid": "7b7f056e-a668-42cf-bf5d-7eb5a6fb8b56", "value": "T1B845493D1AB91633D4B9C335EBE59413B258985FB500EE696CDE03A7030BA8735C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440226, "uuid": "3a4edc40-2ecd-4e82-a81e-687380233896", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440226, "uuid": "8a031d7f-f2c6-45e9-87d6-513188148f59", "value": "24576:PyKggkyeCGZbxV3pWws1poFjZ/5fFC7CICZsGUys:PggkfCGZDqroFjZhfFwxiWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629440226, "uuid": "0bf158a7-6a8f-4c74-8698-cb5f142745aa", "value": 1206784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629440226, "uuid": "a810eae0-23a2-485e-898b-6143438886aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629440226, "uuid": "d1df4def-89b3-41c0-a68b-67da3cc6c7ea", "value": "payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf7ac8b-01d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629477828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477828, "uuid": "72752f59-9850-46a6-8cd1-b41c6bf27c77", "comment": "Malware payload (AgentTesla)", "value": "57203d621bfc9cb7da4ba3654d769817", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477828, "uuid": "8c161027-00f6-4406-bab0-5ede91768c9e", "comment": "Malware payload (AgentTesla)", "value": "eb16482c486f7ecf2986e2454ada976f164f1c9f1185c47eb215a22b702e94c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477828, "uuid": "13804865-fbc5-4a2f-8945-e94bd9f302a5", "comment": "Malware payload (AgentTesla)", "value": "8491be67475922af956d2bb31f0723010d1663a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477828, "uuid": "1e9afefe-1bed-43b8-a4ee-cda7b6bcca6f", "comment": "Malware payload (AgentTesla)", "value": "de1a4e5ca78491bf8eb9134efef30277e6479bab13c6b7dc956dcc3f1f6ab0059ab82e69ebc7569027fc0762a8bfcab9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477828, "uuid": "cb52ce7b-c5c8-44d4-944c-4057c26ec60e", "value": "T1FAB423C0F6298C916C16F3CA48ABB7901885D17D42FFAB9CE993DA37F5728C19424573", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477828, "uuid": "67c1b2a8-8714-4364-8e9f-387099ba9976", "value": "12288:o6zDIF3o/JeQbbLH5OlYhKFA2LwtJwrP5VVK0yPVT/uiGYmGwHkHw/:o6zsZo/lrH5OlYhKF84L5GPImRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477828, "uuid": "25466b50-3c2c-45cb-8df1-6803136bfecb", "value": 534434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477828, "uuid": "8e9a91c2-488c-4c28-b5e0-5d51c83352ec", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477828, "uuid": "5200b353-cda1-45bc-9874-fb5852d90512", "value": "LINE UP BERTH-05 AUGUST 2021.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76b5238b-0206-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629498732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498732, "uuid": "62ea4ed9-9370-41b8-94b8-53db73342afc", "comment": "Malware payload", "value": "5f52cac5223bb5287577d2ae8b6ea844", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498732, "uuid": "df4a0846-637a-4d7e-be3f-c936a1ac1bc2", "comment": "Malware payload", "value": "ecc5143e8d99690b6a7e44ab0c936e29a7374416c1f46d211e587264e99aa3b4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498732, "uuid": "6929ec7c-324d-463e-abc9-c39570e869cb", "comment": "Malware payload", "value": "39a4ddd826d6af00e6566c9e258440dfff10ccb3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629498732, "uuid": "19a3e0f4-b23a-475b-8547-e94a9c9bf033", "comment": "Malware payload", "value": "c5fc625a9d9364aba73f65cd03e5068fb67a77208405d344af60da067bdb6d81335bf5221a855fe16a8e44a0ee9ce094", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498732, "uuid": "5c690a13-1eff-4f71-b3b3-3694bfddd346", "value": "T165F53349CB835849D5234632C1435317631631BC1A91BD3E3EBA60AA1CF7FACEB65C7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498732, "uuid": "7f0ee58c-9405-408b-929c-b708cee040ab", "value": "49152:Jrzz6GcZFzyRSGz4H6JiMyGwRkGNH1kj0AXQcsrDw46ivkPLuMVXnQXJaMo:cZF2RzHYzk0u4QQcMDw46Skj55IJaMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629498732, "uuid": "a444598b-6cb5-45c1-b7bf-f7c8332eda08", "value": 3323713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629498732, "uuid": "0a11450b-a865-444e-9362-965838fdfe98", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629498732, "uuid": "a2cd438b-31e0-4af2-bf40-d9fb8047e05a", "value": "Yerli_Gizli_Cekim_Ifsa_VIdeolar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5fb805-0159-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424306, "uuid": "cb46f70b-c4b6-41c3-9ddb-b4e5957ac476", "comment": "Malware payload (Mirai)", "value": "8ce518acdbd0581d29f595d6f9a09bf3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424306, "uuid": "9b5e26b9-23a0-4231-bae9-f0fe67041af8", "comment": "Malware payload (Mirai)", "value": "ed5aa1c2a48ad46562449bdb3bbe2dffd3a67a293ba25be3fc40bf3a0d3decd8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424306, "uuid": "5a4b08db-30ba-434e-b2a9-73a11a13270a", "comment": "Malware payload (Mirai)", "value": "1929325ff8727eb6cc62c73ee8f1d850d944b53d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424306, "uuid": "2ff9e801-9dfb-47ea-87f7-4e266248bc2e", "comment": "Malware payload (Mirai)", "value": "38d63ce49073b64c2332fb6af0d1110bd83214caf14cbecc605440f1df7cf0943434473fd496e3c42c058b3eff0e76da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424306, "uuid": "2ab8a5ef-123a-4f69-9229-2dbeb1b25e31", "value": "T1E633F861B8926A1BC6E0237AF9AE558D332063E8D2CF3217CD201B157BDA51F0D67F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424306, "uuid": "95a9788e-c973-41b4-b5ed-314ca3d6e7b8", "value": "1536:aymy2hHuA6bBvUImk2ifflvYU6Ioh+kWXXkQ:aymy2hOkdU6hhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424306, "uuid": "dea04b12-b876-428f-9c8e-44105d74d6bb", "value": 54652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424306, "uuid": "32ebd79a-bf1b-4389-b3a6-05bc87bd3992", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424306, "uuid": "aff3350d-b0cb-4133-bd22-8335a39d5e28", "value": "8ce518acdbd0581d29f595d6f9a09bf3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa2350b-0209-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629500135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629500135, "uuid": "6cc09ac3-a5fa-4686-ac45-1d5db6f0ff32", "comment": "Malware payload", "value": "563a2497068e9a97905eb8a46a3e59dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629500135, "uuid": "4ed48124-1ac4-449d-ae10-4f685b77ea97", "comment": "Malware payload", "value": "edc25ddb1c51dda43b911198204ef60e131d1090c82738324f3a4af6f7973888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629500135, "uuid": "1b13238a-c07a-4d1b-8f57-74c6abfe4ecf", "comment": "Malware payload", "value": "0ca7665ce7b50bab561e97ddd8ad42b122e522a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629500135, "uuid": "d1d3c72d-35b4-419d-976f-6c5700e91367", "comment": "Malware payload", "value": "2e06c35ee8c0ad3268d64fb397655a814cafb814c6ec1b9be060133e41bec5842614db49618a057b5b8354a5c27940a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629500135, "uuid": "c4c21691-5e73-4ad7-b95e-ea250ebe0aea", "value": "T1BE25E43D19F816E3D1B5C375AFE4B127B1589C5FB400AD556CCA63A7022AA8734F322E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629500135, "uuid": "fa9aca4f-2db7-43e4-a34f-8110f012af87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629500135, "uuid": "85e43808-61eb-4015-8f46-96d5d4335197", "value": "12288:NZi970ha8VjndqIsEGW2rr25EyDtPjIoUPMvasW3HxMtGg6KISZHbc:NZ7f0InB2ry7DVIoevHuog6KlFbc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629500135, "uuid": "560d0d26-b789-4fd9-a4cb-52d27362b5ad", "value": 1017344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629500135, "uuid": "c4d89892-346b-44fe-8a53-986d2c13b695", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629500135, "uuid": "53218468-b72c-4b06-b110-118a5ae1c0cf", "value": "Payment Advice - Advice Ref[GLV820648639.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "684755b3-01f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629490977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490977, "uuid": "2575400b-0f28-4851-a2ea-ffb0cada5396", "comment": "Malware payload", "value": "8d244ac025fb51c1348003dc9c3c3ea2", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490977, "uuid": "b0d6b7df-7bb9-4111-aa92-e4cfeff5b097", "comment": "Malware payload", "value": "ee5632e3c0717693c9ab993c2b0c5b6edb503383215895f99800d915d92d1b8e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490977, "uuid": "94f38ab9-2e71-43d5-9d9a-3d781a0e27a1", "comment": "Malware payload", "value": "fab5bd3e1504011efe253dfc344852f6b5c644a1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629490977, "uuid": "113f863c-6c17-4b55-af74-9612559e7d36", "comment": "Malware payload", "value": "b8e0d66977eaa492fb75ba37ec5e3cb11e207409d8c915bbe44016693c7ac32613074c23e98c736d837bc4a715b35615", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490977, "uuid": "b2f7638c-04e9-48a1-9ae9-944b7a10b34e", "value": "T199F5331ADB568C0CEA279A32808366C22755220906D3BDBF1A3654C1247FED5BB5FCE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490977, "uuid": "876c1d7f-c853-4c96-ba19-533d455e96f0", "value": "49152:771bqaWjVs+yld286HLJ9USJ1Wad4g7f/S6/LB+hYcx19CFMbDTt/u6DI6GHwZyM:WVsjl/UoSqaXqIF+kaDTQAyCjenE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629490977, "uuid": "ba5442fc-dead-417f-9f4d-f7a74fa2d769", "value": 3461547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629490977, "uuid": "93b21b14-2856-4149-8b7b-afad4a8aa84a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629490977, "uuid": "82fc1fa8-d922-4b4d-8a99-f67390f25f4d", "value": "Ifsa_Videosu.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b245efc-016d-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629433027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433027, "uuid": "ca2290c4-766d-4867-a176-7657c1383883", "comment": "Malware payload (Formbook)", "value": "1e0c47dbe4cc2b87f11194513339987f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433027, "uuid": "7776a63a-0974-4373-b5e2-deeac74d6345", "comment": "Malware payload (Formbook)", "value": "eeb09100ff7eb31eb91735290de6a3cfe364b50365f4713aef21f7cf3db5744d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433027, "uuid": "17a5eda0-cb9b-4bc0-9a0f-6c5c6a2a8e0e", "comment": "Malware payload (Formbook)", "value": "3c7f36df417b7fe9a5e788fae6a81f1d2bf98ffc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629433027, "uuid": "7665c451-bab3-4295-84ee-001c2fccf88f", "comment": "Malware payload (Formbook)", "value": "8ff885363e7c361caaf78464119b88af156a6fd52bb0e9a66fc79c05740549b7018e3b03d6f973375dd8d05dc95ecac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433027, "uuid": "788858ce-8e09-47cc-9197-af101422ea81", "value": "T1CE45393D2AB91623C5B9C375EBE59423F148985FB501DE696CDE03A7030BA8735C362E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433027, "uuid": "5546dc68-e8e3-415d-953c-1691581aadae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433027, "uuid": "6557e046-d011-4ba6-82a9-a8f88a077eda", "value": "24576:Uoggn+Sh6KKtDkCjvGOOcbnZZrjEeQnZcg9+mJt6UFCZsGUy3:lggnRgKrCzGO3bZZ/EeQJ9pJt6UFiWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629433027, "uuid": "9f73c650-41a3-4ff2-9f46-8d70fdf02a10", "value": 1186816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629433027, "uuid": "7208914e-f4c6-41b2-9c40-2ba6f59f56ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629433027, "uuid": "a0587ef3-66d5-4103-8c94-6123e7667dff", "value": "payment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5dd37c4-01c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629469605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469605, "uuid": "f0720aa0-1583-4c0d-8f59-e31b7dcd84b5", "comment": "Malware payload", "value": "2282e86b67fe683e0ec38ba590d8ddfd", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469605, "uuid": "77282b9a-82cd-4238-8cee-c73bc4f77a0a", "comment": "Malware payload", "value": "ef8ca5314afa8b6d25ec26cde55c317f9470ff4d8023248413e210da5cc7a205", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469605, "uuid": "0b5c5d23-163d-4cb3-ba2f-cc8454dc625a", "comment": "Malware payload", "value": "b8819235f7e963efc3b48f867da249e614fa1796", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469605, "uuid": "303fc156-73ef-4dea-84c0-2f1166bb56df", "comment": "Malware payload", "value": "4999d712113643343484936e04a9862ab2ce7db215d7ef10f8f530230de94509ce62052f5099551af71396ebfd08f1a4", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469605, "uuid": "871d806d-fdcd-496e-8692-3b56065d351f", "value": "T13FD4236241C226D963A3B9C272AFDBC513FC4F578797412041679F82388A98D397CBED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469605, "uuid": "0533f824-ad3d-4d8a-8b89-5e4b4f532560", "value": "12288:6hKDq8BO8RhcckO/uEXIEx1zfSECFnSJ4KT8BGv9Ouy+DQEq4hiowtq31y:/DqF8RhLB/uII4KEIns4i8sUaD3ie3Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629469605, "uuid": "7edd4fd2-0d23-4a5e-86cb-e4fc54f0690e", "value": 632431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629469605, "uuid": "74eb4dbc-4140-42ed-9888-09e2b7691228", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469605, "uuid": "a0a27ad9-e420-416b-84d7-833c641949c4", "value": "Payment_Advice.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7405135-0199-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629452106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629452106, "uuid": "da4ab5fe-0847-47f4-bb6e-9ca70da997ce", "comment": "Malware payload", "value": "8b7048c86ae28962e664fd49c4d13d12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629452106, "uuid": "e060ad52-f844-452c-8b5b-a37835994bb4", "comment": "Malware payload", "value": "f15224a9cc3713a1ffff26de7d7e962bafa436c98962d2f7cc2bbdcf47c977a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629452106, "uuid": "6eb2aa2e-af73-4f3b-b176-d13222355039", "comment": "Malware payload", "value": "73e2c22ab4169de99b28bc8be7ac84966c8985d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629452106, "uuid": "b40a3268-9fb6-4de9-9e31-e565563cf11d", "comment": "Malware payload", "value": "ba53f8964876d7049a98694aa32c23d5c08c3ae4e585cf91d8b7b4391d3a962e45b0a3cdbad087c1fe045c3cf752edb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629452106, "uuid": "fe8a3475-412e-40e0-8af0-301256076948", "value": "T17F25C48C5E89D2C9E1780B7985D9949887E95EF38B61C87EFCF033CBD178B64A50E112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629452106, "uuid": "0325a040-d831-4a46-8ff4-75d03c3fcad6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629452106, "uuid": "67e6b19a-a306-4fb0-878f-4dc5c74a2a02", "value": "12288:b3I80hn5AIAwQWE+EYVHM0kI3lm3Zuelf+fQjQilPTgK:mfX1NML0l5elGWlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629452106, "uuid": "7f62f99a-e9fb-4e8e-bd9d-9c795346876c", "value": 1005056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629452106, "uuid": "256a14e9-5e40-49cd-93bf-77a899027cb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629452106, "uuid": "851e4c1e-0d36-490f-ac51-f076aa760035", "value": "8b7048c86ae28962e664fd49c4d13d12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1abdc58-0157-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629423723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423723, "uuid": "1c302f30-dabd-48d8-9185-1adc5e8e7a65", "comment": "Malware payload (Mirai)", "value": "b378408bcf7282fa5eb1f027e5a79060", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423723, "uuid": "3c11a655-ac58-437b-a581-dd5046ab4238", "comment": "Malware payload (Mirai)", "value": "f218fc2f7b866e8aebe51ac2f57d5602c2c55badbfcd970f7d595538cf82143c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423723, "uuid": "88f186e2-bb69-4103-ab6c-a58ec39d8d00", "comment": "Malware payload (Mirai)", "value": "10332f6263b30e06e3fe791f902d2ae3df11bed9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629423723, "uuid": "110129f3-6597-4d8b-a1d2-d55d206cf8cf", "comment": "Malware payload (Mirai)", "value": "ddcb836317709caa53cbc5ad85e2593a3a22c226928726fab18fd420c70b66bc4410f211e424fd98ebea3eca2091604b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423723, "uuid": "fe54ab18-72c9-48ba-8788-73a8af77d951", "value": "T1366309DAA0014F6CFD8BD9F9A2214E09F520321146834B16B6B7FDD77FA21AD8D43D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423723, "uuid": "0e82046e-cbda-4053-a225-87dc749b71f3", "value": "1536:qyow3P9oBeJvBRATf7a7ZIyg1p1/LqY9Z6TLcI++lEV1o8h:qyvBSGILp1Q/FEH/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629423723, "uuid": "900cbe14-d6b8-4f3b-a66c-901f22535d01", "value": 72300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629423723, "uuid": "505737e4-8f40-4bfe-925c-d872cebe4f18", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629423723, "uuid": "f3a95b9a-a482-49be-8e82-9783dc089949", "value": "b378408bcf7282fa5eb1f027e5a79060", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8178fa-01f4-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629491041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491041, "uuid": "80526f5d-7a6e-4954-9493-ca6ea88d22df", "comment": "Malware payload", "value": "6e9b0ecc6282fca7a0c613ce0187b4ce", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491041, "uuid": "f1791b7f-d9cf-474b-b318-7018efd3ca0d", "comment": "Malware payload", "value": "f2270939b0523bb2c811395e618229efa658172b069023b0f520f7f0392c760e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491041, "uuid": "1ea51594-bc8a-4d22-8f1e-8294a5d2e9e0", "comment": "Malware payload", "value": "23be8de1cf2a790379ddbf6baae4b9bc70983a79", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491041, "uuid": "5184edd8-f844-4d79-987b-1e68c038bad9", "comment": "Malware payload", "value": "5dc0686627865be1fa1071e6435b396712dbe12e2f6926cd0c9d54d34a0b9ae77593fa0d4734fc6a87861ca88704db7e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491041, "uuid": "7e72bb68-c61f-48e9-ac5b-88dd77bb8f74", "value": "T164F533885783ED0EE41703B54D9363A97732241DC7A96CBF4839884B96EBDC42727CA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491041, "uuid": "9ba6552e-5597-41e6-a3ab-d917127e6be9", "value": "49152:YnZGPw7EsvVCsg2i0ndrfwJByd5CM5HjZGlCHvo/cVXLF09zayrgc6JPE0jXUu8l:YhEawz2DndrwJgdL5icT1eZshyL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629491041, "uuid": "b089b93e-1733-4935-a2ca-325cffe719d2", "value": 3453091, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629491041, "uuid": "f76cc8b0-9c74-42bd-8eac-20ed5d8d6e4a", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491041, "uuid": "8fe09181-7d23-404a-93e7-2f4245040b34", "value": "Yerli_Gizli_Cekim_Ifsa_VIdeolar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97c6ea67-01cb-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629473447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629473447, "uuid": "abeb968f-c4be-42e0-a9e7-dda0ad56b266", "comment": "Malware payload (RaccoonStealer)", "value": "8dd82541254d2f9140d8276fa29b0a70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629473447, "uuid": "acb76993-07c1-42e7-ad0a-ab8b26371d43", "comment": "Malware payload (RaccoonStealer)", "value": "f2dc381b529cbc75c03ca8bf1886b0ee6b1e2622f8918a27a876c50889e2ae7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629473447, "uuid": "81201894-ff4b-4e72-91e1-ef79fbe2d14d", "comment": "Malware payload (RaccoonStealer)", "value": "a1c20ce05f75c550eb588b14789f5302d3fc6989", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629473447, "uuid": "75c74d76-f5d2-49b0-bca0-ac3f93c5fb4c", "comment": "Malware payload (RaccoonStealer)", "value": "f5d9e762b3b1403891f8b9414d66a795130f765b7d1f67f38bc35697aa88dcdb6551fc508d9467e2312521832ba67802", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629473447, "uuid": "1802841f-80c8-4a9a-b59d-0287a66f6aee", "value": "T1CFE3AEE135B0C472C49149318851CAA0DA7EFC20AF659577FF5B125E2EBC2C09B2EF96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629473447, "uuid": "eed23d8e-b82a-4571-b0d4-2eb7802aefbe", "value": "d9ba9c76f1c1b9698712bcd1010ec021", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629473447, "uuid": "45aaea28-82bb-4d34-840a-617986ff6bcd", "value": "1536:4ohqjNdNMpj0O6pnboTArzUoJAjTd8le4RIgWebXPCMzABFnLFBMK48E:+kWb46UoOjTdB4RIsuMzgFnLmF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629473447, "uuid": "55f798b4-e723-4b5c-8dce-dad83590409d", "value": 153600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629473447, "uuid": "e788aa7b-746a-4e58-8ecb-834e4b0c2aed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629473447, "uuid": "94a3f684-2971-4aa1-a7de-188f2d207253", "value": "8dd82541254d2f9140d8276fa29b0a70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38074da8-01d2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629476293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476293, "uuid": "6df089f2-54b8-4413-a6fd-53862fc54afc", "comment": "Malware payload (RedLineStealer)", "value": "08b62c5bcbf205a2784ee149188e4f4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476293, "uuid": "4b4b460b-fa1d-4080-abdf-a45e4ff5a1f9", "comment": "Malware payload (RedLineStealer)", "value": "f378284aaae09e60e0d172bf1af0569759e8b8320a75fd7def22bf0a4173a406", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476293, "uuid": "175f2112-9026-472e-b7a8-e2ffce3eee6f", "comment": "Malware payload (RedLineStealer)", "value": "8f96e2c4fdd3bfaf2df68db9d180a3be6057351f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629476293, "uuid": "47795840-2c4f-4eab-8e16-07cdf931aa56", "comment": "Malware payload (RedLineStealer)", "value": "358c75747caa5496b88bf6631eebce42f3a6b664fbda6e830a5307f582c7dc2d61a09d4944ef2c84c3d918ae5abe895f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476293, "uuid": "8916d688-a896-4b92-8b65-bce1f4b03585", "value": "T18DE5238137BB6031E5BE46754F617B209E323C78AAD97316DE3BD12E0E781817530B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476293, "uuid": "f488ac0d-5b7b-43e1-9586-fd43c8f84f36", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476293, "uuid": "acfe0ca1-e32b-4e51-86cb-93d24d8b004b", "value": "98304:ADuGvb90UXXdMC1Jvv5F0496IY3UALBpX:AB50eXyCBFF6Iq3LDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629476293, "uuid": "0b769107-b4c0-4603-b0f7-7e8aff03b419", "value": 3299768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629476293, "uuid": "e9840d1a-49b2-4191-bfdb-336922476689", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629476293, "uuid": "d168f6ee-d27d-4bfa-88fd-44d20b7b329e", "value": "08b62c5bcbf205a2784ee149188e4f4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7151c450-01f5-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629491422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491422, "uuid": "2a12c5b3-9734-4849-9e28-ba71003d9990", "comment": "Malware payload", "value": "a2e3f134ebb2611e479e65b48640656a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491422, "uuid": "9b34ffd9-96a8-4dea-a4a3-65fc35905349", "comment": "Malware payload", "value": "f39adb513b813fed06d57d22116b3ba384e93a40c0247d798c46988777e67b5c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491422, "uuid": "4ad7f167-58c3-4477-83ce-0dc795531e3a", "comment": "Malware payload", "value": "f0d9cf5ac9f07c377e31c4f892a10ec57ec74583", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629491422, "uuid": "efe7b1b3-204e-4b69-bef1-df96a8ff0a2a", "comment": "Malware payload", "value": "2bd7c8aa8cc56446e7c47fdc9ea19d2f139bf70d98ba85f4fe76ba57bf0b9b71c15570c159e2fd50a529eae0dbac52e3", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491422, "uuid": "b4f09454-b915-4dc4-bd78-05d7abbc845d", "value": "T104D3014387A0117BD8AFBA35AADD93722B770BC0B7A2A7D3391090456C6635B0F89D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491422, "uuid": "9500a3f1-057f-4651-92f2-f01b6fd2869c", "value": "3072:3dujd1ddYUBN9KYD7Kh1IMN9UT0fuLuIQ2XzXcvW:3w51cU/YuGhqks0fovQ2jsvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629491422, "uuid": "1640350d-d59b-4498-af5f-8bfe1e1067a2", "value": 136621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629491422, "uuid": "2aaf4e0e-133b-4f06-8868-374114d83a6f", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629491422, "uuid": "51a5b6fb-0404-426e-a851-d6ef1828d709", "value": "playstore.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76384d65-0187-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629444185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444185, "uuid": "c824b352-b0a0-47f3-864c-2337e4c660dd", "comment": "Malware payload (Mirai)", "value": "4e97ea5e2c799d216206d0e2553efbee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444185, "uuid": "3c689c22-aa01-466c-9036-cc7249326d7b", "comment": "Malware payload (Mirai)", "value": "f4489ddae4283e6370fc7ef05b9d5ea2ae7054b22ec4356b8927177ce40849b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444185, "uuid": "f4125618-ca6e-4a96-a551-c6604f22e455", "comment": "Malware payload (Mirai)", "value": "f002a40686358be0cb676decf64261f74b702a0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629444185, "uuid": "70d0706d-d161-4d63-aa2c-9e48d76cc391", "comment": "Malware payload (Mirai)", "value": "623a4dfc297c82483c67aab58343bcdd2aeef1b29f20c57a99a23a9be391af878e15a65c6e6e20968cfa1cde3fa7f630", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444185, "uuid": "ca06c9ad-44f4-4309-a83a-5c063b01083d", "value": "T1B2D33B86FB409A13C0D61B77FA9F424933129B54E3DB73068D185FF43F86A9A4E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444185, "uuid": "ff31d1d3-c842-4b54-a9fb-b5470aebd24f", "value": "3072:53Auz6OTbehLh+BElUCpI3SQeTz+Z0IXuGYM/9gY457m:53AuzrTCh6CpI3SPT/IXu5M/9gY457m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629444185, "uuid": "26326347-b9f1-49de-9626-dd294dfd252d", "value": 138499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629444185, "uuid": "08eea5fc-6a44-4145-91a5-7e9f600b50e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629444185, "uuid": "9c8d6c36-3f61-4f01-affe-4a58a8caaaa2", "value": "4e97ea5e2c799d216206d0e2553efbee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858544ea-0165-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629429608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629429608, "uuid": "e8d704c4-8326-46bd-9a57-ec9e551d8d1f", "comment": "Malware payload (Loki)", "value": "de4864fb07cf56acc544dc56462c2243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629429608, "uuid": "8d0a21ce-831a-4033-bf8d-7dd0dd78d9d5", "comment": "Malware payload (Loki)", "value": "f4a13349af9fadfa63e888b2d7e03151aac194eb9190edfe0aedd272273f8b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629429608, "uuid": "358154c0-7965-4874-a071-973467e5ed23", "comment": "Malware payload (Loki)", "value": "520a11afb0bf7fc8eafa454d30c20984035b9d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629429608, "uuid": "5d3f1e4a-ddc3-413b-a9ad-cfd201a0b766", "comment": "Malware payload (Loki)", "value": "d07b46d62245168a4503c3c0c22be11a7ed9bcc1c3cc13decb5ce88b82abf332a07be577f0697ee5c49aa0d64e1d7f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629429608, "uuid": "e3ef566e-7fd7-4568-90f2-88d36b14f003", "value": "T1AF84F1487B50B69FC42FCE76C9A12C50A770A5B79707E38368872AED554D7CA8F402E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629429608, "uuid": "fb6e2e1f-8bf4-4073-b72b-b190e987f098", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629429608, "uuid": "758ed40a-bbe3-4edf-8154-e07119fe80c1", "value": "6144:WfHH8dFhreJSGghPZuZ7kyxP6sf68/bed/16CzjMqH2oezAHntaHiJs0hEIaH1Y:WPHAmQmZ7MsS8/id/16AM824iI81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629429608, "uuid": "514c9c53-99ef-4245-a267-45b09d3a21ce", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629429608, "uuid": "dd9ba3ba-1eda-4597-8d3b-dc84cd602bf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629429608, "uuid": "94264e35-c18c-4d8d-add8-87fba5175ad9", "value": "16wKmiVoPj05ynr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "843ac83d-01dd-11ec-8fa1-42010a9c0011", "comment": "Malware payload", "timestamp": 1629481145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481145, "uuid": "37ca15c8-c2c9-4108-bdd1-15d0278b0974", "comment": "Malware payload", "value": "be4ede5e88f7c98f1c00147019da42ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481145, "uuid": "267ba6ad-7123-48aa-9765-eafe8a2373c5", "comment": "Malware payload", "value": "f5c0f868f65d7cb5787eda39a880e5be884458f4d4ef560e6a119bf0640274c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481145, "uuid": "24f293e6-ecd3-4850-a1c1-f27f9dba905d", "comment": "Malware payload", "value": "46621b653521b697f125b9beec4dd4afbaa3eef5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629481145, "uuid": "149af21a-726e-40e0-93dc-5b20e01667d4", "comment": "Malware payload", "value": "6db2eb8e63edffcaaf00d82d52bc2cb12d1be194973ea8fb291c10681f5707c57393b392c169da8f039b10a2708f2097", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481145, "uuid": "6c4045ad-fc7e-4e17-8a28-d49ab5439698", "value": "T17D020922A7FCC776D6B60F364C6363840A78F7159C57DB5E6498100F9E323044AE2BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481145, "uuid": "e0121d05-66fc-4910-8552-205547722765", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481145, "uuid": "24b2445c-9019-4829-b6b0-b18bdf77811f", "value": "96:kOnhjiPyqSC+LSYoPm9yLH5B4stRekLuLW5vNoibrrpwv2qRv5M/BzNt:bRLbouQLZqK0kLuLW56ibrmv2qR2/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629481145, "uuid": "b1aabb56-070d-49c3-b837-8a7a11eda22b", "value": 8704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629481145, "uuid": "f73739a4-8040-43ee-aa77-3d453c2a51d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629481145, "uuid": "13c3a7e7-1306-4fde-aab8-ff6761a0b8b9", "value": "be4ede5e88f7c98f1c00147019da42ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81399f9e-01c7-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629471691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471691, "uuid": "fea8e1b3-e3b6-4d9e-a5c7-95376e1551e8", "comment": "Malware payload (RedLineStealer)", "value": "0bac14253d94be253c156c97155b6d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471691, "uuid": "ba654918-709b-4b75-a129-696cc516e1b2", "comment": "Malware payload (RedLineStealer)", "value": "f5cbd5b2ead7671d3b38fcdd59d46b1c5d66023630edf54c092f31ce988afa6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471691, "uuid": "58964502-1382-488c-8f7b-14b6ed6730d0", "comment": "Malware payload (RedLineStealer)", "value": "0b016d5f5bd51f87349e2d6fb242596af248c69c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629471691, "uuid": "a9fe0e15-3cde-4ac7-9d5f-3940d626bc20", "comment": "Malware payload (RedLineStealer)", "value": "215296d3cc08ac23293723575d5ca6e2da5120d6f3b999565873fc7ab5951dd28079af636ddc591934b249d5ef33682a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471691, "uuid": "796bd799-d924-4445-92ef-a64e05b9413d", "value": "T1D9C4121179728332C4C620301D16D7E0953FAC451A6451CBBE9BA6AF6F312E4DE36FBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471691, "uuid": "279ec110-b8ff-4c89-83ea-0b7712410636", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471691, "uuid": "44416ebf-f69a-4145-95b2-2ff20bd0e266", "value": "12288:fkm+5tDdFGRJ55lmtPkqn1pVrdMfK8W2H4ZLK:fkm+DdFGRJ5GkmxyAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629471691, "uuid": "b37d74ef-cb2c-43d1-8a8a-86f8d6ce30a7", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629471691, "uuid": "14b01d03-d7f3-454e-92a8-25012537e3c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629471691, "uuid": "7a4a65ce-a4f5-4c8b-89bd-3b014426019f", "value": "0bac14253d94be253c156c97155b6d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0befee-017a-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Loki)", "timestamp": 1629438716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438716, "uuid": "80189fda-dbfc-4b5c-a7c8-821bad43450e", "comment": "Malware payload (Loki)", "value": "977a54b4b75bbf17c434af699ab238d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438716, "uuid": "f9d0e75e-d53d-44b9-9404-4597a5b439b2", "comment": "Malware payload (Loki)", "value": "f6269231c3d91cd11c30077a051499f1240d239eeb11d883910e986adf462e24", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438716, "uuid": "7ca60ae0-ed47-4533-8935-6bc3ca9a3791", "comment": "Malware payload (Loki)", "value": "159d763b4e86cf37bc6108c8936e1b87133f73a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629438716, "uuid": "2775c5cb-285d-4284-8bbc-051185c2a02a", "comment": "Malware payload (Loki)", "value": "1fd5e1bc18c109e8182be498fa28c3af549ba9fcdad12afb33433621f5868e40b1c61bfb8bf227587fbbb4401e4c3fa6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438716, "uuid": "eb7e3fad-2908-4a24-a5eb-11231771694d", "value": "T1A435393D29B91237D5B9C335EBE59563B148985FB400DE6A6CDE03A7030BA8735C362E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438716, "uuid": "ae5c9c10-d667-4856-8cca-0abf1fb2c3a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438716, "uuid": "a3c7bb1c-0c5b-48c9-9a0a-bbbfb12019cb", "value": "24576:b0ggB+jVV70Cr/mPHcBqWcBpN7//N5oa8sCZsGUyy:gggBkV70CrePjpN7//NeZsiWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629438716, "uuid": "644cfe67-0f44-4d83-8bd8-2d10337119e0", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629438716, "uuid": "ce865d3c-d8aa-4cee-a278-045f03c69e62", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629438716, "uuid": "744bea4a-d0d8-4acd-a954-005b87f52d24", "value": "MAILINH SANLINJX GROUP OC2021000574 SWIFT_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c0e3c5-01ef-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629489040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489040, "uuid": "89fce3a9-eaa0-43e2-9744-acf7d2c80bbd", "comment": "Malware payload (RaccoonStealer)", "value": "01422262448b27babd6704091eef95ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489040, "uuid": "0223dc6f-c6dd-4e7d-b980-04af9aa3174d", "comment": "Malware payload (RaccoonStealer)", "value": "f6a8aa29264495625e7a74ada5f3a792c06c3f9ef472e01c4761bed7d1e4ff96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489040, "uuid": "692b615c-6ad9-4079-98b8-e8d99707acca", "comment": "Malware payload (RaccoonStealer)", "value": "ad336b735ad99c7566f461f94a83899ae3353f41", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629489040, "uuid": "eb174b86-f16d-4bba-b56d-356c4da864a9", "comment": "Malware payload (RaccoonStealer)", "value": "5f09816bbfb761f567b79819bbf6b9cacff3687f4d3e16d543b3a740a0ca1237b641463e79a21b99e80ac19d7b60ea1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489040, "uuid": "2723ace9-c14a-4aff-8a44-a0e528293b86", "value": "T10BE3AD2039F0E576C05DC4300855CAA156FEE8616EA586473FBB276E1F313D09F26FAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489040, "uuid": "d626c102-21fc-4371-a065-2e3ce65d2684", "value": "eff27d48d68df0af1612601744441acd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489040, "uuid": "de01167b-456b-42d2-844b-a2190bbfec75", "value": "3072:5DAJLBmMqNL0OT4iv5m/ddddJWrFZmedNizgFnLmG:2LBmb0OT85Wr7FNAgFnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629489040, "uuid": "83af07a9-0068-4b1d-a8f4-e4da25cfc7c0", "value": 153088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629489040, "uuid": "ad434aca-55d4-4896-ba38-cdc3c1e0d132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629489040, "uuid": "dbab32d1-3e98-4da2-90f7-43a93614188b", "value": "01422262448b27babd6704091eef95ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fb21440-01d5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1629477648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477648, "uuid": "c7d16a1a-c4cb-4b2b-a5fa-1ee2d8dd9f66", "comment": "Malware payload (RaccoonStealer)", "value": "19d6df371d1e1c98cc8e37053eb772b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477648, "uuid": "463dde05-500f-48e6-958c-eaa0aca60024", "comment": "Malware payload (RaccoonStealer)", "value": "f6fa1e0673d37677b081dfe83a4a693038ce0a68d7c4715a3ee8f2086e3b64c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477648, "uuid": "d4abdaff-2b67-43ea-a724-1ff1bde7eb75", "comment": "Malware payload (RaccoonStealer)", "value": "619309e7824a685125dd535769a2c6633d7e9382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629477648, "uuid": "b7c8be76-093c-47f9-b5d5-efde89d75e77", "comment": "Malware payload (RaccoonStealer)", "value": "bc3fca5cfdd3921b40946f49117d96f876df0c9c7b50b3ff0a160e6f02c1b09f2ebf73fd25266d80a9291f897c24ab7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477648, "uuid": "6d718273-c983-4148-be74-5babe0ba2983", "value": "T12694121278B1C232F0E2C4305E65CEE41676FDB11A6481473E97275E2EB16D0DF1AE7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477648, "uuid": "2179863e-41c2-4d1d-8373-907f13fc2fc8", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477648, "uuid": "b82f963b-d8c2-4c84-bfda-d5ac7195293e", "value": "6144:hQr3ByrNt7ObAt9aJxIxcIY34it6V6ul/8qO7iXgSDi8GDaywcd2jNvmkLNqgFnL:DlqAomxcJ35tc6vqO7OFlGD6umZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629477648, "uuid": "584a73f7-d44d-4979-932e-94322bc18557", "value": 441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629477648, "uuid": "89e7749b-9fc0-441f-a110-3de406c279fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629477648, "uuid": "90031272-8411-476c-9202-56196612a10a", "value": "f6fa1e0673d37677b081dfe83a4a693038ce0a68d7c47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd0eca6-01ca-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629472843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472843, "uuid": "7cf80780-35d8-4bf8-832e-a9585b9748ba", "comment": "Malware payload (AgentTesla)", "value": "ff9615f9cbf604281abf242763417207", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472843, "uuid": "b47a7a3a-efae-412a-82d3-6f63c10b065c", "comment": "Malware payload (AgentTesla)", "value": "f7bc62b2539ceb2b1364cd85ef6544c4063362fa8853c92d12bca41bc290b1d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472843, "uuid": "cc2ccdb3-962b-40bd-bb27-2c5a3bf2cc8e", "comment": "Malware payload (AgentTesla)", "value": "220daf43fba7876bce45fbe0e47a03359b15db43", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629472843, "uuid": "5f9c42b5-a7b8-4bf1-b369-c2ba8e13ebd1", "comment": "Malware payload (AgentTesla)", "value": "d5b019e8ce2c591d4df689828b8e7fddf500f03c923f8779d3fcfda416244cff771a9b5ae4f8e8b26d8231d08b4a6389", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472843, "uuid": "592cba8c-f0ca-4cb0-a645-c348c851fb6d", "value": "T1B945493D19B91637C4B9C375EBE58423B148985FB500EE6A6CDE03A7030BA9735C762E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472843, "uuid": "b54cc663-680f-4c1f-a047-e058d8b98291", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472843, "uuid": "acff9968-4119-48c9-8291-28db0199f811", "value": "24576:n+gg2Z8kIfd9GvgrQIkZph3Fl8CZsGUyg:+ggU8kI8ckDl8iWf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629472843, "uuid": "ab30de0c-f0c9-49f2-9c8c-f54e711fe85a", "value": 1216000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629472843, "uuid": "d4b18229-da3e-4830-ad6c-c74ced76c57a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629472843, "uuid": "a131db80-1627-4f07-a63b-c86b8121f7a3", "value": "PO_DEA83657-ARF-(QR - 0621).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b35785-01c2-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629469746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469746, "uuid": "f1661eff-cfe0-4ed1-91ad-0b7095250ded", "comment": "Malware payload (RedLineStealer)", "value": "fb05824f223c928ba39e91fe17364438", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469746, "uuid": "a0226e93-868f-4b00-b7b4-43ba17991079", "comment": "Malware payload (RedLineStealer)", "value": "fad0ca06bacf9f247ac03d9366abd3ac41415e56af0ea16bdff70f6ca77ed41a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469746, "uuid": "fa9eed28-0897-4eca-ba3e-89a6e6159761", "comment": "Malware payload (RedLineStealer)", "value": "88c1f712f00ab3bb533b2e9e3c778f50e2147204", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629469746, "uuid": "bb0561fa-a46f-4d27-9eef-f7931e192247", "comment": "Malware payload (RedLineStealer)", "value": "f2625a8f787eec353ba86f6225f4728e8a7bb521346c59b4d5f81c964d08d0fb498586ff7944f7c35672c7862eeec6fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469746, "uuid": "68ef8a21-a0db-49d7-8744-04ef6cdb52da", "value": "T13FB34C3263ACC619F7BE0E36647001258BF1E08F6411E75F5EC1B4EA1E767826648AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469746, "uuid": "f10686c0-2fc8-4686-a9fb-9d6d8e4e7054", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469746, "uuid": "8a2b9c65-b6b2-4ba5-a785-75d8cb96cda4", "value": "1536:eo6aGrKC0K6l3UDKGl9oZP1auBw9gbue7vLuBNyAsdeAetx5REfG6WAaoigAOUr:edxGCwEHfeZ3LubyddyNW1wOUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629469746, "uuid": "dbb85093-5673-49bc-afae-2014dc4b076e", "value": 107904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629469746, "uuid": "846d38ef-d324-4e1c-8f7a-5307c70ec786", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629469746, "uuid": "46f8f0a6-a186-4f2e-987d-809fbe84435a", "value": "fb05824f223c928ba39e91fe17364438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a96ecc-018c-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Formbook)", "timestamp": 1629446488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629446488, "uuid": "c786db15-7d98-4f02-abfb-876fc6df98cc", "comment": "Malware payload (Formbook)", "value": "88e6423178f564e85916e611a46c783a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629446488, "uuid": "42162735-459c-49b6-b099-0808fa3c65b4", "comment": "Malware payload (Formbook)", "value": "fafbf52647d3187d5d7fe79b130db1e72a327aef887ff42a283e4aa523a555f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629446488, "uuid": "21ccad14-5b0e-4081-af98-8a324455b79a", "comment": "Malware payload (Formbook)", "value": "2e96f3221e7d138df8485c0241d3897bb0f83d83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629446488, "uuid": "9fa202cc-4fd2-4881-aeaa-be9abcb72b9f", "comment": "Malware payload (Formbook)", "value": "8684d9d6d801e06aff5c7df6dca77ffb25552ea4ebb55b2304af396973c51eb0c9cb554963911e84839fa1bb63337b75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629446488, "uuid": "6e871748-ca1f-4a53-9ae2-50a20426db8f", "value": "T18225273C15B83627D1BAC366EBE18413B2A094AF7161ED59A8DE03A70747B4735C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629446488, "uuid": "50cfcacf-271f-41ee-9ae8-d65e9858cbb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629446488, "uuid": "f12ea390-2968-427f-972b-b768458f7eed", "value": "12288:iwcqOR0hsS+giiDc9F3nC0Py3gAhU5tyO1jEUhnxBYwjturq+3Y+WvNOc2CozTT3:iFfVz1jhhxSrbIx4c2rzTTyK6ei0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629446488, "uuid": "8473e76b-12f8-4494-89d2-79e9281283a2", "value": 1013760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629446488, "uuid": "0875c1e1-1ad4-4d12-9ee7-f7f269b038e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629446488, "uuid": "14d5999a-9ed3-4ff9-a4de-c389e9209295", "value": "88e6423178f564e85916e611a46c783a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0693e9ed-01b5-11ec-8fa1-42010a9c0011", "comment": "Malware payload (AgentTesla)", "timestamp": 1629463755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463755, "uuid": "97300a3c-55fd-43a9-b83f-3f4e84f5518a", "comment": "Malware payload (AgentTesla)", "value": "345a7f4a67f88c00d9d1d8f104cda9dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463755, "uuid": "575d7639-5af0-4a1f-b2d2-c0553f6ac950", "comment": "Malware payload (AgentTesla)", "value": "fbe16f2bac5edc34ba984eb6c7b5c05da6946a5f5394c3b06ef140fa842ca824", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463755, "uuid": "bc540327-a9bb-472b-8967-12dcc6ebce7e", "comment": "Malware payload (AgentTesla)", "value": "8e2d7d48ea4ce7a239a911556e23942d78275dfe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629463755, "uuid": "aa498a4a-c941-48a0-8791-ba2ce5ee55fa", "comment": "Malware payload (AgentTesla)", "value": "f1d27289e3bc65e5e9a84dfd44d6e3acbfa2c0929697faf3a661e08412597e8b31e353b275f15e73386f6d00e1d1e045", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463755, "uuid": "7784b5fe-7ec6-4d7a-9376-0b568a8d4a15", "value": "T11625173D19F91637D1B5D375EBE48423B158985FB404EE6AACDE03A7031AA8734C326E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463755, "uuid": "077ef254-76a3-427d-b6d2-86b1252affc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463755, "uuid": "dbebfd67-caa7-4dd5-8ca7-de301227daad", "value": "24576:givBl08ZZF5S4QHLaEak5ms43aDsHn8oM/5Mpw:FvlZZ/S4iLU3sLYHn8Vs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629463755, "uuid": "530e869f-2093-4ffa-8b26-21273f8ef54b", "value": 1023488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629463755, "uuid": "72d3dc93-d598-4791-9872-03e4a9c70f9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629463755, "uuid": "2c4814e3-ca58-4657-8abe-a7f6bbf7b2a0", "value": "PO No. SMC -201103-005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964b9252-0158-11ec-8fa1-42010a9c0011", "comment": "Malware payload (Mirai)", "timestamp": 1629424053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424053, "uuid": "a4d60522-ce4b-4875-9281-0a339651f72a", "comment": "Malware payload (Mirai)", "value": "bd5c1db142d6745b53f61d9a6246ddc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424053, "uuid": "2004a511-6a58-481e-a1b8-3cabc7692f3a", "comment": "Malware payload (Mirai)", "value": "fe0f6ec13dc4f37e2bac7c4f950b3686a65dd75aa7a685a05d073f6e52ed3afc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424053, "uuid": "f314f11e-9ca4-411a-855e-17dc3c9c6d87", "comment": "Malware payload (Mirai)", "value": "6919df9a9d6243c0dcedadac5255855f4eaf1f7f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629424053, "uuid": "1af1fa15-efb1-431f-9ec8-62fbd6c94dd0", "comment": "Malware payload (Mirai)", "value": "3ec4a8dd43f3f4ebc12bf0e7fce6979c98b7d5aadaf7d40c1fdfb834175e59142f5c974407f7aa7d2104eb3ebd27d277", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424053, "uuid": "e389db1b-a766-4dcf-bc8b-f04a79d20153", "value": "T1EEE2F22055044A60C6F43C7FB97E88D0282A6DE0C49D3DD798A4CFBE45DA0192FEB9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424053, "uuid": "6baf92a9-a919-4100-94c2-ef61d07fe943", "value": "768:OYFazlIwYO6bJD4sXKmrUv8t6hOrFS742MF9xZVLhO6M39q3UELOy:OYFaSwW9bRwv08KM43xZK6fLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629424053, "uuid": "feb45ac1-9d40-43a8-82b9-159dfd52d696", "value": 34176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629424053, "uuid": "4c57a470-f3de-41cd-90bf-9cf4bdc7f361", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629424053, "uuid": "09edf00b-43df-44c9-8c55-5703dc5135d4", "value": "bd5c1db142d6745b53f61d9a6246ddc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1579cef6-01b1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1629462062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462062, "uuid": "a12e1b3d-0c4d-4da5-b0ca-fcecaace8b4a", "comment": "Malware payload (SnakeKeylogger)", "value": "ac73429e80b4ea9c0b289775344d7872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462062, "uuid": "49788aa8-87ea-45fc-83d0-51d28a4708db", "comment": "Malware payload (SnakeKeylogger)", "value": "ffea4364dcea23a2fc5d64abcb4e4c83adcfdac7059105592afe13a40b7a4d07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462062, "uuid": "542f46d4-2db4-43d0-82a3-5cd89a972aa0", "comment": "Malware payload (SnakeKeylogger)", "value": "30776771ccc617f70bafb990c55552abdefbe4f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629462062, "uuid": "02c74478-d3f5-433f-9901-5cfe900794c2", "comment": "Malware payload (SnakeKeylogger)", "value": "876d7b6da2408631962b6e4c7d4160aeb9836febe9c9540d2e76993c30d30c04c4b9e7f27a8a9b4b0b4e115b1c7cba3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462062, "uuid": "a09bf79b-a32b-48b1-b2bc-1d2cc5f7138f", "value": "T17225163D19B91637D1B5D375EBE48423B258985FB404EE69ACDE03A7031BA8734C722E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462062, "uuid": "5ac3e1bc-1bb3-4206-8adc-5645fdaebea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462062, "uuid": "2a75cfd4-19c6-4600-b3d9-26104810eb41", "value": "12288:IOZi970a0tyN2SiGYhQ+ZtU0AwYs1crlYu1m1AgQhUpK6+HfQAnC0l:IOZltyN2S5WQ+vT9QlmHQhBHfJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629462062, "uuid": "270f7801-59cf-4e2d-8879-3985a815289a", "value": 983552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629462062, "uuid": "1221d577-1188-488b-9d15-1ed9e00f6926", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629462062, "uuid": "0c3a481d-66f7-4842-a288-974017977102", "value": "dOyPiM9RRRVOs66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "251a903f-01c1-11ec-8fa1-42010a9c0011", "comment": "Malware payload (RedLineStealer)", "timestamp": 1629468960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468960, "uuid": "4353838a-c23a-4abc-bf88-e66e8254bb21", "comment": "Malware payload (RedLineStealer)", "value": "4ad09c0ed70dbbc220d66da87d3dc5b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468960, "uuid": "bc1b6422-9cfa-4f92-9422-93e2232c20e0", "comment": "Malware payload (RedLineStealer)", "value": "ffebf01251d7696de69b50dbbe38c30f0fa936fa476fe35cfe79da64fb0a680c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468960, "uuid": "6d31cb4e-6552-4a24-a1b2-66d50bd580c7", "comment": "Malware payload (RedLineStealer)", "value": "426ea685c7eef7829540c39cee542d7b8f818a24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1629468960, "uuid": "54faf3fc-8075-441f-8d9b-1c2ab6eb1948", "comment": "Malware payload (RedLineStealer)", "value": "143c836e6b34e02c903ecc2383503a4c1b8ddcad38af9e1cc5ac714f8f9b262d1d99748be729b40467c3ace0f6331ced", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468960, "uuid": "ffbad89e-4998-4d12-b634-1e4dd37b0950", "value": "T145C41202B870C333D26211310678874F556EFE4A5A20528B3E476A6E7F626D49F37F69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468960, "uuid": "dd2460af-e5fa-42d6-af56-a22f2da93f7b", "value": "a84fa8c5c9d81b30cf439f0d2b7f422b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468960, "uuid": "fea717ad-2028-48d1-97ad-8ba96fec1b1f", "value": "12288:irGwrwU2UrNTt9eGCYSCm9OKKs6Z+mnKIj0WfaaHm4FBauWZLM:i7FrN59KQKKzaI4haHm4FIu+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1629468960, "uuid": "8d42fa72-bfa7-4f7a-8184-bcc028e8f441", "value": 558592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1629468960, "uuid": "36be7239-e85d-4aae-bcc6-e08b99028c2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1629468960, "uuid": "5469e887-6e80-40f2-9ce7-f04e5044e6f8", "value": "4ad09c0ed70dbbc220d66da87d3dc5b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }