{ "Event": { "published": true, "date": "2021-07-02", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-07-02", "timestamp": 1625270581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "dc5908c1-2896-4a65-b5c5-eddc4ddfc761", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b62dbc-db1b-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625219784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625219784, "uuid": "419b3af2-2c9a-480e-a5a6-9c5d4fb8e841", "comment": "Malware payload (RedLineStealer)", "value": "fd803562b06f6e1ae9e226d4753b4eb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625219784, "uuid": "1005fd78-fcc9-476e-b093-e205889f4be9", "comment": "Malware payload (RedLineStealer)", "value": "02f584407c459a4c6145d5b16be33264e7d7ec646285c14062e1f2318e0cd318", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625219784, "uuid": "4f5c7009-225d-41cc-908d-931157c586c3", "comment": "Malware payload (RedLineStealer)", "value": "4b9dbabf17cbd95c88554603ac42a5b5f698e4ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625219784, "uuid": "2528c39b-4c12-4637-8eeb-f083cc9b1ad3", "comment": "Malware payload (RedLineStealer)", "value": "58201ca098fd1afc3ba80b7e54738631db19098c759575e5093294d971049616afbf5cc6f41cc7efeb310d70e88655a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625219784, "uuid": "e0065b81-c1f3-4fc6-b612-50e37c6156e6", "value": "2D2633D4B1C340FAD5901434DAD86BBA7AFBD7280E3589D3E790CF4C5F35B12A22A964", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625219784, "uuid": "a3878578-38d4-49e2-bd95-23dad98bb1d8", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625219784, "uuid": "2e2d6148-b6f2-43e3-8188-a5214613b07b", "value": "98304:xdXxj+HYssq84pOoLZwzlxoKlk6wc9kVhe1BOwCvLUBsKt:xdXxj+HYHq8oLZEDXWc9k3eSNLUCKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625219784, "uuid": "c941eca3-a910-4d87-b571-453d01f6cb96", "value": 4720584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625219784, "uuid": "ed5f7876-3045-4ce3-b799-3384e17a6b8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625219784, "uuid": "59a163d1-920a-478d-a9db-b6acf7c576f6", "value": "FD803562B06F6E1AE9E226D4753B4EB4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764c6766-dad8-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625190879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190879, "uuid": "4f9a17d7-dd9d-405d-8e55-adb1cd448854", "comment": "Malware payload (Gafgyt)", "value": "1c72e3255dfa8e0da14afe123f54060b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190879, "uuid": "9f6d9da1-8c55-4c71-a4bb-f4e3ab3e34cf", "comment": "Malware payload (Gafgyt)", "value": "043ab294658cb535667d624456da63a07586b027b469c9a9ec635c11b70f1798", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190879, "uuid": "40bfb627-ec0f-46d9-9b90-fe4d134579b2", "comment": "Malware payload (Gafgyt)", "value": "704cd179a91041c5e9be3a1ad83ee22ccabf8ab6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190879, "uuid": "5b448800-ab05-44e1-8e51-681c8113b620", "comment": "Malware payload (Gafgyt)", "value": "cf11c1ea1cf2cfc02626486579652c7ca8d808770cccdd4aecdb4220fcdb97b9417facc2dc55d1ddc05437c234abbb5b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190879, "uuid": "5d917792-463a-4cf5-88b1-8485fd565554", "value": "2DB32801E4518727C1D2277AB79F865D37322BA493DB33215A347BF82BC279D1E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190879, "uuid": "d254377c-271b-4a16-b1c9-b95fba1bcc69", "value": "3072:MPkl1NaxGMgTt9Ov1/B+5BDoEwbmTQOWsXAOn:zl1NaxGMgTA+5BDAbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625190879, "uuid": "461cb001-3bb8-407f-b462-a18a8f0d70f8", "value": 115110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625190879, "uuid": "cfa90efc-3b17-46b4-9466-53a10a35320e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190879, "uuid": "611cc9bd-29b1-4ec1-93a9-a63c31496acf", "value": "1c72e3255dfa8e0da14afe123f54060b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb66d7c-dad8-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625190915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190915, "uuid": "d9b0720e-0953-45f0-b5ee-a3371ffa16ed", "comment": "Malware payload (Gafgyt)", "value": "5dfe2ba11ce023a25d36133da0709bbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190915, "uuid": "cfad96ec-ecc3-40c0-b276-f68a941d8088", "comment": "Malware payload (Gafgyt)", "value": "04594d5731c373924abf6ed0741ca75e704d51103a6a1e251a63d84e37884843", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190915, "uuid": "85fa0ee0-f5c1-4d5c-b6be-d0a3284b0f9a", "comment": "Malware payload (Gafgyt)", "value": "330c158325c9d9ac79efbb6f97ffb20f1e42bf5d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190915, "uuid": "852fa6a3-132c-4b75-967b-f41f7b0f7e0f", "comment": "Malware payload (Gafgyt)", "value": "3e2d951a5df9382ef7aa93610a5691df37d7566b6b26032d97b9b853949423873c8e5f76d0e49f3ee8b56d7885c79dad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190915, "uuid": "494e1a2a-b32d-498c-a178-d6e73a289170", "value": "EE1301F2F4850EAEE6FF6D705A925AC193B79E6D2EB85CC361CCBF41B4650315A084C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190915, "uuid": "62ac7bfa-bbf1-426d-8aab-0a293f62a08d", "value": "768:UtteW7UrO+TPb1uUAXWzeL4uVcqgw09ca6xwDkvYJZ:UONUld4u+qgw09ca6iDbD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625190915, "uuid": "175a337f-cc1b-411f-9b3d-6e6ccdfb2e04", "value": 42856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625190915, "uuid": "b6409d49-4509-4fc1-b276-8a0eabb935be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190915, "uuid": "4d1b37c5-cc5e-4cee-9e03-d3e46b285e36", "value": "5dfe2ba11ce023a25d36133da0709bbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fa3787-daea-11eb-875b-42010a9c0053", "comment": "Malware payload (PandaStealer)", "timestamp": 1625198496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625198496, "uuid": "e76f22e8-1980-43ba-8667-8a6faf22e795", "comment": "Malware payload (PandaStealer)", "value": "571d311fc434e77de22206602a9131d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625198496, "uuid": "dfea7daf-abbf-4eb0-97f0-3b7b692d4570", "comment": "Malware payload (PandaStealer)", "value": "04a3b0f970d1689d6c1d6859c81ef3f41f1a503baf4275188e848548b2669950", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625198496, "uuid": "3b20fc80-51ec-46c3-b343-71b4c82731a8", "comment": "Malware payload (PandaStealer)", "value": "9b661c437983b9f903bf1d388e1d789b405af238", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625198496, "uuid": "01e05dbf-a0d9-4115-8a54-eafb92873214", "comment": "Malware payload (PandaStealer)", "value": "274783c6541285a2fd9a29bda9911feb1e072cb6e24dcfb260f92ae6cfa4f6a8818ffd1024faf03c4c6ebe2ec2e33d6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PandaStealer", "colour": "#2D5791", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625198496, "uuid": "8766e600-3d26-4357-95da-ae1a9e2456bd", "value": "F55623734228060AE5E1CC7C863BBDF4B5F6030BCA81A47DA9EB7AC525A19F5D353943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625198496, "uuid": "efe6cb41-dfc4-4e6f-9cb4-c05f8b323032", "value": "b0a3c6817c3bc91463a81826e090915c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625198496, "uuid": "4f5216df-cc2c-491c-9659-439653e182b7", "value": "98304:u+F4gz3TK6AWl/7COZo5Bx66vH/6V/wsmgxBrEw1lhDJX6SWE9n4GT9xEr2Rh+e:u+FMWlzCD5npIhmaAUIJE9BTTGK+e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625198496, "uuid": "381c01ed-ec91-4a47-9b3e-023cce1f4ac9", "value": 5994496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625198496, "uuid": "e0669fdf-d8e9-42f0-8043-f635aa2ac1e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625198496, "uuid": "5ba6a67e-d19c-4281-b5fa-670055f79a17", "value": "571d311fc434e77de22206602a9131d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "961086dd-dada-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191792, "uuid": "3e9bcb9c-1d1a-4d9c-96e8-0bfe0f9f4e38", "comment": "Malware payload (Gafgyt)", "value": "a236c2101baa0681fd582db53f074d91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191792, "uuid": "386138da-8db3-4511-afcc-367c5c4824a4", "comment": "Malware payload (Gafgyt)", "value": "050efea6ff2994ed365af60367f37925880b1f4325c390b11e13cbf309fb785a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191792, "uuid": "c6e7470b-0a81-4296-913b-c481699bfe16", "comment": "Malware payload (Gafgyt)", "value": "31199fe3b2e225376d518deb7366b54c65c995df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191792, "uuid": "dddc648c-d8d8-47ec-a7d5-b4416a18c543", "comment": "Malware payload (Gafgyt)", "value": "ab6302c04bd860a21900f00dde8cc1f4b77844169d0b0971adaf6a4fbea12417b08604f44890e61c53923ba779289e91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191792, "uuid": "59daf66e-2dbe-465c-b2ff-8d645e10008b", "value": "6F130195DCC5D422F4C1A83393DE6C05419A1FAAF1AF717B86A05BBAFCC246700F85D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191792, "uuid": "7a8179f4-c606-49d5-a6e6-55ec2c52b8b0", "value": "768:AkafV1TBlbpIBGgHNtm98Qb6s3Uozm5QTKxubwhZE5dgIbIlr4h:AkaRRpMg8cznTgubcEPlMl8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191792, "uuid": "04b40c49-ff98-4306-a8fb-c3914f95acfb", "value": 44316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191792, "uuid": "a3ff3895-e646-464e-b225-483bb8124804", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191792, "uuid": "bc742d6d-f216-4ae4-a697-d9183668d21d", "value": "a236c2101baa0681fd582db53f074d91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d471e6-db70-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625256060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256060, "uuid": "bf51c3f4-8c9e-4565-862c-66a612ffd0b7", "comment": "Malware payload (DCRat)", "value": "63da235e38971ce7e32181efe6049ff4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256060, "uuid": "69d120a2-6abc-4ab4-ba8e-8c5f0219d1c2", "comment": "Malware payload (DCRat)", "value": "058bdc1f36ac732406b4533a07d81d9f90e7b4dc77b7ae26a0ae194d999cfb36", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256060, "uuid": "87208ad3-0119-4cb8-bf3b-031222f036f2", "comment": "Malware payload (DCRat)", "value": "bc2e628269236f2970d16cb66fcf43aeb5ef44e8", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256060, "uuid": "02a0ee56-ac78-445a-abf0-515127462260", "comment": "Malware payload (DCRat)", "value": "307bde085b862b373bae517d1fc06853bf4aadfb16b324ad6603c51b6efb532e8632fd15fa154b9a530dad290452b393", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256060, "uuid": "6020c731-95c7-42c6-9442-c0056feb3f35", "value": "BA76352074F260DCF1B1D36917EAB6E0C96FF62A767408D3440A3B9BD7A0656A433739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256060, "uuid": "6f31818d-8f8a-4107-a427-fbc42032bc2b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256060, "uuid": "a77f43d9-0868-4b06-b323-4898611e3062", "value": "1536:nMJgkAfoe6d2LnOzdUTsqHQaVRUHBW9DHcsnjQsWGObN7GND1Pf+Ag8y76rAGRDh:nmC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625256060, "uuid": "c0159668-a661-485e-b6a3-217ee73ade5f", "value": 7268864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625256060, "uuid": "e763f208-b933-47d8-a4d9-3d3cda3f344a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256060, "uuid": "17f7a545-dbf7-482c-b9b6-256e01fc8345", "value": "058BDC1F36AC732406B4533A07D81D9F90E7B4DC77B7A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a57473-db66-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625251917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625251917, "uuid": "3d96111b-3477-4b1a-99df-f059eb790980", "comment": "Malware payload", "value": "1fa2d8db24799c93d9b6aa37e05f5525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625251917, "uuid": "ed5bda7b-fbdf-4e41-80cb-a5122f156588", "comment": "Malware payload", "value": "073143c5d5589117612c308b01f84c5e5b024878e98b15021ca820458219a568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625251917, "uuid": "fadbdc5a-d63b-46f9-9107-717e1c7d8e17", "comment": "Malware payload", "value": "a4e79f386e275c345d3098a56c4269a6a8df209f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625251917, "uuid": "60a60c4a-69c8-423a-8fb1-b88bb57014c3", "comment": "Malware payload", "value": "004426cc73ef9511169e7a7863ddf785c3efc82cec0c9cc03cbdb5f42cc2024da0e3a67b25b4d94c22d871ba5c266378", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625251917, "uuid": "1601217c-ad08-449d-840e-cb675977f2bf", "value": "1874D621EEC5CFA7D0E30D311353D6E149F9CC661B01D6CA62A67682F0BAAB354D993C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625251917, "uuid": "b02b0f61-5f84-4d6e-ae99-b41c5f1ffe10", "value": "64f1814b769b7e8d7e61f45d0e9f5051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625251917, "uuid": "b3b9ed68-03b7-4c91-ac10-1f877e260c91", "value": "6144:v13nwMjsBt/xLRMf93cDv6x28TYfzCHkmGj8aOZL4AnLLO:d3wMsB7RMfFgsT4Ak8l43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625251917, "uuid": "82820946-f71b-4dad-a32b-4c71e0086f68", "value": 339112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625251917, "uuid": "389b679a-b5aa-4233-b6bc-c29914b9d355", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625251917, "uuid": "8c640380-b077-4694-9311-afd261ef172a", "value": "SecuriteInfo.com.Variant.Ulise.248204.21499.13114", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b27674-db3d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625234318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625234318, "uuid": "b237c2d6-4866-43d1-87ab-a4983fd84b7c", "comment": "Malware payload", "value": "b35f113ac3f89dc786064a81431ca438", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625234318, "uuid": "546e2485-32e0-4334-88f4-fcf9b53d29c6", "comment": "Malware payload", "value": "080ee6c068e95db7a776793e167fb4bb9ad0efcb424a400ed3efe697400fc73a", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625234318, "uuid": "7ba6990b-5b64-439e-b422-ceb3cf7cb6a2", "comment": "Malware payload", "value": "bd876ac81afbceaf4d4fc17e99c4f7012a92d4a4", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625234318, "uuid": "cfc1f6cc-df59-4e30-956a-937a0b1be4cb", "comment": "Malware payload", "value": "d0fa1de00dace5119851b3ad9483ef1951f2737e65527dad6d07b69c1b75c062d48e964cf17e69b1f927490a3311c9a9", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625234318, "uuid": "81b727cb-fd21-4106-891a-e01050e8d611", "value": "27E533B979E9AEBBEAF8077F130CA55C1BE380026A70E9C514385B5D881E27D7F4E150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625234318, "uuid": "d8dcc873-2d2a-475b-b66c-5cf3c7d6cde1", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625234318, "uuid": "f5f41c58-efdf-4172-810c-8dc604cd0475", "value": "49152:A2GDpPk//YleNlGvw0hJZBq4cJQznFUjDsFpOboifMjmAM0G+YUOdYwdFJnj3:4PKuWlGfZBqRJwIDsFpdiET386wdFlj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625234318, "uuid": "abfdba62-1acd-4681-aab7-5cb32082ff62", "value": 3271700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625234318, "uuid": "9f8e4a6e-c6d7-45b8-8f66-0e9f101bd96f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625234318, "uuid": "d080d214-cefc-4a23-9d9b-999b0b02264f", "value": "080ee6c068e95db7a776793e167fb4bb9ad0efcb424a400ed3efe697400fc73a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ece890-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191493, "uuid": "67ce2684-45e6-43dd-8203-0e9553ee41b0", "comment": "Malware payload (Gafgyt)", "value": "61db992c9c33381498c75db11d84b11a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191493, "uuid": "2b67fdf2-af4d-4be1-b388-d3b3332455c9", "comment": "Malware payload (Gafgyt)", "value": "0882f78d0fc112d6d99b17b8913eab4d28f6a3392aa6f9e84c235d556f1c50f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191493, "uuid": "abdea2bd-3c38-4753-9ee8-c45c524c2b56", "comment": "Malware payload (Gafgyt)", "value": "1bd15e57e2aee9511c45076cfeba349765ed6d80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191493, "uuid": "473b673e-1c7c-469d-b1f8-82a97be15550", "comment": "Malware payload (Gafgyt)", "value": "c4dce604b02ed5e51af81dea35b9472b5aa6a1d0033c4b5d705af3b5d9bad64b75c3475c975171d47a199157988e46ce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191493, "uuid": "0d0b2cad-10df-489e-9f34-ae1b286c8a05", "value": "A453F2F22245F887E7A01C35AF95C1CA78D5EFB8E15924970382E7B43543043B7BB859", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191493, "uuid": "bd1c8f91-2911-4dd6-93c5-ebc7d8b4b7b3", "value": "1536:Tffzbehsd69J96guZt2QPVtu3+XZXQLyPJNSw6747vhzOE70:LLyu69PryPVY3+X+LoBFzOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191493, "uuid": "fffee7d2-8b09-4fa6-80db-c1e43484142d", "value": 66680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191493, "uuid": "1f6b02cb-b15e-48ab-b8dd-32d46cc76c5a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191493, "uuid": "d2f92546-f16e-4041-b6f2-cca2da1baa71", "value": "61db992c9c33381498c75db11d84b11a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13f154da-db39-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625232375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232375, "uuid": "408ad547-30f5-400f-912f-e1b6b6932a1c", "comment": "Malware payload", "value": "f0535bce8d4936cf3c5d82231cf11465", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232375, "uuid": "ea8de0c7-19a8-4138-8ca4-55edcc9a6862", "comment": "Malware payload", "value": "09e27e5b6a2d77f8f6333a42b78558febd301da9c9ebabd392df9958a2eb9203", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232375, "uuid": "80c59505-d951-43e1-8b06-874212e21f09", "comment": "Malware payload", "value": "74650cca4ce4a067d1c421bb2b766f09f9064c41", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232375, "uuid": "785f1b7a-9b8e-413e-9b68-6b554869acd3", "comment": "Malware payload", "value": "5c591c664b388d17af497538c6d79b08d529f7758376b32e984d896d842429acfab67867c4c9c42e474f244f0c1d284f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232375, "uuid": "ccc14033-00c1-479d-8817-559f296af02f", "value": "2EB423B03886A2B318B857F7D07F9A84DEDDE98F59DE3990C8FD1F59A110F282817185", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232375, "uuid": "f5b20acd-d1a5-407a-b4a8-4089fc43056e", "value": "12288:u+lq6CQjbyaG1zOAh3hojNSq5TaIqlWK9UdEQtM:u+/CQjby/1zBgT52IqZAEoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625232375, "uuid": "acbd21cf-1a25-481a-8016-4dfb5669bb4a", "value": 524630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625232375, "uuid": "4bfccddd-0462-41b9-8d97-89e20e859f5b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232375, "uuid": "d3041448-dacf-40ce-914e-1287938c2717", "value": "SHIPPING DOCUMENT.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64d0c0e-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191523, "uuid": "6f5dbdd1-a096-4cb0-99a3-3fba6d412523", "comment": "Malware payload (Gafgyt)", "value": "c6be4b8fb8846ad2dc36740042faf0b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191523, "uuid": "a370ceb4-3253-4138-9205-63629b55c691", "comment": "Malware payload (Gafgyt)", "value": "0a6fdfd06650c130595d22ceb3c6038a5fd93fe8c8703cd62257571326adb654", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191523, "uuid": "a4e7b6e3-31f6-437d-8dca-c1ac30d43de9", "comment": "Malware payload (Gafgyt)", "value": "41f3a79426d44136def39333812d56bba9472bc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191523, "uuid": "f3591a5f-ec20-44d1-9cb5-6fc8ef9d0b57", "comment": "Malware payload (Gafgyt)", "value": "41a8bc23cea5a3cfebd86f6c6ff14a20cdaf61bbdc72c39b9b85706fffca67f698b2a4d697ff9b78e07b806c800ecee7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191523, "uuid": "53535d52-60a4-49f7-81a8-19109567e03a", "value": "8E33012D8241BDE4CA041138EC58894BC79A977CF6FF19215218095BFEC73A399FAF10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191523, "uuid": "83eab6d9-3ada-44c0-b4bc-f248eb3fb973", "value": "1536:EYJIN0cr72lMyWMNq3TwTMV2eg5gIu6yLL21q7ImORP/eSbET:EYJTcb5H3kTgOgI2L20kmODm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191523, "uuid": "77b23b0e-58a8-4db0-9c42-f4d108aed2a3", "value": 53644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191523, "uuid": "59a12d19-5e05-4677-9e5a-c45a6092ccc2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191523, "uuid": "27424109-7886-41bc-8176-b7fa610dd130", "value": "c6be4b8fb8846ad2dc36740042faf0b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dfb222-db12-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625215650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215650, "uuid": "59915336-4231-4741-82d4-328c0e6f6348", "comment": "Malware payload (SnakeKeylogger)", "value": "b398c55d7fe4315e5c6b1aab66e2db6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215650, "uuid": "92169f2f-6032-47af-af24-f9a1aba4ba43", "comment": "Malware payload (SnakeKeylogger)", "value": "0b3abca72eec5a73ed8e3b52ffb792361a246aee56b96ada5ddc702056b4e26f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215650, "uuid": "fc0835d3-fa2b-40a2-a57e-911f43fc9131", "comment": "Malware payload (SnakeKeylogger)", "value": "f855f573cad01f9f5a43aeb3f9eabea9e2be3960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215650, "uuid": "ced63826-fd2b-4837-9d4f-5fa273d6360e", "comment": "Malware payload (SnakeKeylogger)", "value": "de470c4ba35f3877f108e8d11638968357c2231728232f38870e78f53dc43b7db75082a5138e105c94f9be1e6286150c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215650, "uuid": "9800e4f1-0399-440c-b986-a43ee71444e8", "value": "1C15A59D366076DFC867C876CA981C64EAA0747B930BD203A06315EDEE4D99BDF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215650, "uuid": "3394cb6b-cc6f-4061-9470-cfebd6494b55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215650, "uuid": "169a52e2-3723-4edb-88dd-3e716bd3b6f1", "value": "12288:bwlcZ/O6RJ1qsDL4eMdhohOOnp420tBRTbIB236XqAXDVvO54pLRcOUmyVD0jF10:btVf30eMdhKnp4Hxb1QX5vbyfFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625215650, "uuid": "0c09295e-fc26-4e9b-a7e9-0125bbd32fde", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625215650, "uuid": "b5d27429-0a2a-494d-be06-73bd77750dbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215650, "uuid": "d3d5c482-64e8-415b-8674-025fac1cf054", "value": "SecuriteInfo.com.Trojan.Win32.Save.a.3886.15271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f72dcf5-db0b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625212692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212692, "uuid": "1088b9e4-d568-43e4-b915-0a3e179bdd31", "comment": "Malware payload", "value": "8309ef02bec30b1e69815b5134ee1f43", "object_relation": "md5", "Tag": [ { "name": "45.67.230.53", "colour": "#A87796", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212692, "uuid": "a45fc6ee-c2bc-4326-8c92-a63b105e25d3", "comment": "Malware payload", "value": "0bff46518b35ddfe37f4a7820286aab829d81f1480d9eeca5aaedc9ceda6724f", "object_relation": "sha256", "Tag": [ { "name": "45.67.230.53", "colour": "#A87796", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212692, "uuid": "681a88d0-6537-4d84-95c7-e1f433fb3920", "comment": "Malware payload", "value": "fa6a40d3fc5cd4d975a01e298179a0b36aa02d4e", "object_relation": "sha1", "Tag": [ { "name": "45.67.230.53", "colour": "#A87796", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212692, "uuid": "a46fa146-242e-4096-ba91-34871b570997", "comment": "Malware payload", "value": "56b1ccff61a7ca66078dc9d5c11bb079d8dd59e135b92b613cc99202163b215c8dadb8e946a6cfb1b5bd43cffa8653d7", "object_relation": "sha3-384", "Tag": [ { "name": "45.67.230.53", "colour": "#A87796", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212692, "uuid": "21ed4121-b7c2-4d97-9940-fffc591becc2", "value": "C0855C03BAA74CB9C4D2DEB4874BD373D93478554226293F3A89DA303E52E605F1EB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212692, "uuid": "64c7fe71-9db5-42db-bb8a-76852bd36891", "value": "24576:AXgsrCV6MYc9efNHn2WxeBTP1QMCrUm1as4Uyy:AWJKH2WxeB1QMCrjtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625212692, "uuid": "a6195326-2909-4de2-bafa-0cf6f09c82d8", "value": 1706936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625212692, "uuid": "1cd421db-6990-4782-a91e-b54ddb6e6eb1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212692, "uuid": "5449e58a-9965-4746-929c-25fd234e108c", "value": "0bff46518b35ddfe37f4a7820286aab829d81f1480d9eeca5aaedc9ceda6724f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09b141d7-db6b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625253833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253833, "uuid": "bcbec193-4b25-40ae-bad6-db46c6887cdb", "comment": "Malware payload", "value": "1d8909bf4bad3999a514a46ef7f6edbb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253833, "uuid": "c02a7e3f-48ec-4d12-823a-5c0a36b53eb2", "comment": "Malware payload", "value": "0c2fb19ab17b0a837a5a0aa838e40945d87d491d879787a754f159239fb06159", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253833, "uuid": "03ba96f3-c2ca-4815-a535-7fc40a2ee026", "comment": "Malware payload", "value": "f860e9f35199c5295c78584c6fc9cb817b7a59f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253833, "uuid": "af28fce4-093b-4562-bccf-5bed03f30cf0", "comment": "Malware payload", "value": "c0daa93b835eafcaa4e1eb8e5c521fffd55b71adce3094b1fdf559070b2e4ecfa826bcee42f7819e053dcbd08d57dc38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253833, "uuid": "46ac3218-cc6b-4abd-8794-36d193aec900", "value": "B714CF07B0243DB1D4A7E5F650607127F8653AE72E4EEFB5D87AC61BE0225B18723B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253833, "uuid": "4a651ded-7524-48e6-8908-3c1ef849b5b7", "value": "12e30a4970af4cc77d5c6e2437bc7800", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253833, "uuid": "f08a302d-2ab3-4836-a23b-8df42055db52", "value": "3072:Ht1lNCvWNelQk0wvfKG+wiDYdgmoZQBmPjcicIPcXpzpx/ttr1A:Ht1/IcwdTiDYdgSUPQicIIpzpxFtr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253833, "uuid": "24cef876-8a2d-43e5-abf6-2304db9bf18e", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253833, "uuid": "d527c653-d9e6-4b7f-970f-4debe6281e9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253833, "uuid": "bf372207-2ba1-4f3e-a897-50e8887c1fdb", "value": "1d8909bf4bad3999a514a46ef7f6edbb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafd612b-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191531, "uuid": "7339de92-7601-41d1-b658-9a4e9a3c9673", "comment": "Malware payload (Gafgyt)", "value": "99f1d0aada47db98c0f3b2fc8804c094", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191531, "uuid": "2b563d84-3dc8-4987-a592-9614481d86dd", "comment": "Malware payload (Gafgyt)", "value": "0dcee8d61d0c779681398ff76ac7256d81bef80f16add487f1cecc15c386acf1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191531, "uuid": "99d5ea0e-7b71-4e67-a283-8051fb397079", "comment": "Malware payload (Gafgyt)", "value": "dbe5476008338772b0f6179cdc4d8b4dc8f45bac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191531, "uuid": "e6ae6960-b0f4-454d-9489-fe4b78e77386", "comment": "Malware payload (Gafgyt)", "value": "3715735c5275f7890324255223d8aead2227bfdae50d72cce4dead34fd231c12a1de4f1f5ba10cb914ed845eab6bfbb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191531, "uuid": "2227c628-9ff3-4c21-855e-3688118f0a8c", "value": "7A13F153A0D5035DC47F8A341707FB4A0370ABF8429885A5AFE878627792EE97E0CF91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191531, "uuid": "c00c21cf-b4b9-4014-a793-f3d7894ecef5", "value": "768:8jNzO+jcUXrudShiEH0m2uqxBzYptN4HRNJ0YQ4nbcuyD7UHQRjH5saxJzbqLXf4:8ZzO+j3rudSUO0m7IMjNSJQ4nouy8HyJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191531, "uuid": "4e1c75c0-461a-4094-a7ab-e9aa8d04afbd", "value": 43672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191531, "uuid": "dcc520fa-8835-4212-83e6-138e75e73da4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191531, "uuid": "2e2af9b4-8534-4ee8-ba0c-e3dbd182497e", "value": "99f1d0aada47db98c0f3b2fc8804c094", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a7ce31-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1625227030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227030, "uuid": "cddefe76-ac14-4141-b6ed-7f76e7bc264b", "comment": "Malware payload (Heodo)", "value": "073c7c40ef1ca687c594f7f0ed733aa1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227030, "uuid": "6cdfc0ef-705b-47b0-a635-6ae7b8c1ec7d", "comment": "Malware payload (Heodo)", "value": "0eb1e1f5843484155b9c61f1f92a9828c53275fbecb3947c723e4a1e25c07bc5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227030, "uuid": "49cd94cb-4655-40f7-9ef6-f33a72f0aff9", "comment": "Malware payload (Heodo)", "value": "816e38fed31113c90bfe92707305043d27a1788c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227030, "uuid": "85d9c156-3a96-430d-8726-b8580b6aa958", "comment": "Malware payload (Heodo)", "value": "3698fc4f50912a148d4dbcddbcb47683b733374f4ef56949701162a8325ad322af3494a2b577fec49fc17637721916bb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227030, "uuid": "713a1ada-6d64-4c04-bfff-6271e5efadcd", "value": "4274129070A9CDABE9FE83FB5883E0250773AC246164D6CC69487CDB79F2B034B4650B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227030, "uuid": "989abfdb-bbe0-4eb0-9260-53bbb016d2cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227030, "uuid": "559f6e80-480b-4989-98ac-97bb2f8b8755", "value": "6144:rHhdEOCtVzWvwtcxLfNm1lmOWGa2rlLBH2l75MT/W3g5q2mTxaRaD0Q8DRWHqOw:bLEFVzMF1IlKGDFBH2PMT/W3d2eoaCRp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227030, "uuid": "5f3d8651-ee4f-441c-8bf2-59aa67411333", "value": 367616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227030, "uuid": "2b6f1440-f6f2-423f-b07e-7264330b31fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227030, "uuid": "72ac62a0-da0d-46bd-980e-729235b7af82", "value": "1.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da4c208f-db77-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1625259337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259337, "uuid": "495e1224-258b-4b1c-99d0-a1bb52c44868", "comment": "Malware payload (CryptBot)", "value": "7084966d9a406d1719dbb913004ce10d", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259337, "uuid": "09466af9-5419-4a08-b839-056bb8ce5fbc", "comment": "Malware payload (CryptBot)", "value": "0ffa9641556c11890735aba122f4ebf94370fb4aab8c613f5025df7559214f51", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259337, "uuid": "d40621e4-73c9-470e-a067-9a02a099f010", "comment": "Malware payload (CryptBot)", "value": "5d95878467c589fb25d101d38922b3fd3f8d170f", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259337, "uuid": "f0d6b01e-e1b3-43cf-a35f-d2910f938be6", "comment": "Malware payload (CryptBot)", "value": "ec27c3866726607781fe45b411b997a0abef2665eecbb1f9297ac9da369950fa048f0995559fc6b5369a4029a11b1d83", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259337, "uuid": "f0e490ac-cad3-4d84-b0b2-f7bb21888519", "value": "A6949D10B691C035F5B212F88A7AE7BC653D7AE05B2450CB62D4FAEE5A346E1EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259337, "uuid": "aa5a59bf-14e9-442b-95f6-f917abc558aa", "value": "d610ab0a9dc87feb2ab95c8f8bf96e81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259337, "uuid": "236d0c9b-7281-41af-bbad-2112fc7b5fc9", "value": "6144:V+n85Hu3WW7P4FK1Kdwzchx8cb+0AG4ZNQFCrCB24kvibAbUrtalDnbZNaxGZ:VLsPv1Kdwz4xh+g4ZHCk7icbUkF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625259337, "uuid": "55ff11da-4fd6-4a4e-a51a-1198698d71bb", "value": 412160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625259337, "uuid": "56795cf9-98f0-4e41-bb07-45461202c8b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259337, "uuid": "e386011a-1c9b-4201-be8e-224b6efdade0", "value": "7084966D9A406D1719DBB913004CE10D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3acce52-db4c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625240884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240884, "uuid": "83a522f3-2d94-4244-870c-d5deff3d9555", "comment": "Malware payload", "value": "b018f2519897f7994bd5354e19af33a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240884, "uuid": "bab23490-1984-4520-9106-f0a3dac2baa0", "comment": "Malware payload", "value": "11a5e063d4c121371a3de04d5b32352cc86d65f51b42b5437c1e5f7e17498fbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240884, "uuid": "454cb906-d020-4e0d-a125-e22b1cb2d913", "comment": "Malware payload", "value": "b681a1d83cc4f51a34b237c23341303e89da5e5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240884, "uuid": "7a711ae4-1be6-4277-93e7-ddf32fb5baab", "comment": "Malware payload", "value": "e3c666f59582f17eb5bbe9870645dd345feb9430d8d1982ad59c619edf41d97fd2b23ad83501ba09a28c7918391dcdb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240884, "uuid": "484290d5-143c-4d0c-98f1-bf1f73f8d962", "value": "46135BDEC96F48C2D43FF931C7D13A059326917E2A0D816F40B558C6C8237E6EBE916A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240884, "uuid": "c99ccb10-a469-4afc-8593-46f9a1efb955", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240884, "uuid": "dd990f5c-8373-477b-9bb8-4d8ea6568da9", "value": "768:LL3Ownzluv5hbDzQGflCd0Sl88Fzx3Z2iKxuhZb:X3Hzluv/bQl8QVYiKxyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625240884, "uuid": "c88dbe90-b84f-45dc-8164-a6a718d03248", "value": 41960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625240884, "uuid": "b1c6af74-e9bb-46d0-9638-92e6338cc375", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240884, "uuid": "eecee4b4-1367-4595-a6ff-949aac9bc6e3", "value": "b018f2519897f7994bd5354e19af33a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d9e919-db62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625250094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250094, "uuid": "44b9a0f1-4b9e-4d6f-adad-b5a79c4c726a", "comment": "Malware payload", "value": "a9e0c72e025228d193ecd7e68cf9b554", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250094, "uuid": "538cfca1-8751-48ac-aa64-2c2ea4683669", "comment": "Malware payload", "value": "11bdb70d639f192f07b63ae2a67809a264189bfa26101804d59407db56a14632", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250094, "uuid": "4be90b63-ba61-4d98-97a4-a9482fa17e5c", "comment": "Malware payload", "value": "7650ff2961c8cb8da1346322012d9bb18916e7e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250094, "uuid": "295337a1-bbd5-4fd7-bb84-25b4b5067f84", "comment": "Malware payload", "value": "e0f01ec5b98748d38509752f61f57e9497aeb6e495e91c4c40febd2640c5437c65a5a4a1519a719863ffd27f34b23233", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250094, "uuid": "f03ed536-57a1-4c34-a8db-2dfdb929b91f", "value": "4303F121C56C21F2CDA24179D36D4207336479B3E0DE715823620AF8FDB9987BEA8276", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250094, "uuid": "b212e84a-49b0-4660-b192-27d8cbb91ce5", "value": "384:EF5tfrIlTDfPj+YVWsvx3CzDbt11P+NAidvo4rHSnPeSrCdBIujmdGUPLlTlpfx3:EF5tMNwspyztXP47o4mPeZ13UDZTyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250094, "uuid": "ae06e21c-8a88-4271-b838-1f72d157daef", "value": 37748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250094, "uuid": "cf37bf6a-ddf1-4e2b-abf8-725d7384ad76", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250094, "uuid": "fac126d1-93ad-4e86-b6a6-b026f6a28c51", "value": "a9e0c72e025228d193ecd7e68cf9b554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc2cda9-db87-11eb-875b-42010a9c0053", "comment": "Malware payload (Vjw0rm)", "timestamp": 1625265943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625265943, "uuid": "845d33b3-364c-41fe-b01c-403ebf97ff33", "comment": "Malware payload (Vjw0rm)", "value": "ef849493ac1e9a1f1487587e41116213", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625265943, "uuid": "2bfacf37-a36e-4e1b-a5da-3ac056d6d7f7", "comment": "Malware payload (Vjw0rm)", "value": "121bab9bea6af0c05ebc9169a51c8a80cc2746222a6fa23b011aa1786f7945ef", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625265943, "uuid": "bbe0b139-330e-473a-9df9-6fef04ec47cf", "comment": "Malware payload (Vjw0rm)", "value": "99e54e130df13f72230d76209977cc744b24000e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625265943, "uuid": "a0b1276d-cd01-4391-bdc6-53bbd66da7a1", "comment": "Malware payload (Vjw0rm)", "value": "670ec8189c58fd090ec681c2ef50919792308143df658e31adac20c49001d4cdf2e352d77227dd1461edb3d8c01b6600", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625265943, "uuid": "560b60ff-f1a0-462b-8637-c8d791f567e1", "value": "04811E9C284BC62C53963B8A802ED148CDF548B47F28D2B5148CDAC5360E97987B59BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625265943, "uuid": "4935e5a5-e6b4-4e0d-b1fd-e1598e4bb0c8", "value": "96:SABNo5D2k2c24ZRMHXE6/BIf+Ys+fJvDdQqR7bJyKhNOS4UK:zSP2c24ZRMlBIGYs+fJLfRfKp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625265943, "uuid": "f069cc9c-7819-4b05-a13d-535905f162f2", "value": 3879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625265943, "uuid": "6166e1ae-88d7-429b-acf0-2c4ef5a3e5eb", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625265943, "uuid": "f252d2ec-756e-470b-a254-4208de814c78", "value": "Receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0171a730-db63-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625250383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250383, "uuid": "63077d25-2dc8-480d-b79c-60dc34ef3eb8", "comment": "Malware payload", "value": "e0513f716e306b59a649633d475f7cf5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250383, "uuid": "a280a835-8686-47a7-bafc-d1c76c436620", "comment": "Malware payload", "value": "12cc920331db35825bf378300a03e8fae705812f531a0d5523eec58e1752e081", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250383, "uuid": "bac0e10f-fc68-4538-849b-46e2c5c79725", "comment": "Malware payload", "value": "374bf90337351ea293bfa6315ae20662555b704b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250383, "uuid": "148d1ae7-7123-4f6d-843e-593727410d4c", "comment": "Malware payload", "value": "ce0e5ec6d8f6a7d683455f546b0581396bc0eeb791352f8388d55db13b710a21dea9a12c5809cd16bc362e1724343997", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250383, "uuid": "914f5ac9-6838-404b-906d-0aea78b125af", "value": "D403F1BC1A0B9BDDEA6E78B6A36547470AF10FF49163D8032261741B4D442ADBA12EA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250383, "uuid": "e361a6f3-c13f-4478-9aee-da372af24312", "value": "768:h9N+KujAM9D9xqGh4IjXaC9y958aynOzjZjJgGlzDpxYshX3NRJ:h9NFM9DiGhdjZ9yXzlZVrYUNRJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250383, "uuid": "c3303979-7b57-4224-807f-d92cc16d9531", "value": 37996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250383, "uuid": "8d2fa34a-2aab-402e-bab6-6b9e62b402a6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250383, "uuid": "77f9cb36-51c2-434b-a4a9-7159923d57cd", "value": "e0513f716e306b59a649633d475f7cf5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0dd0aa5-db0c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625213338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213338, "uuid": "b43ec182-279d-47a4-badd-a61e32da8bce", "comment": "Malware payload", "value": "a8400c378950084fc8ab80b8bb4e5b18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213338, "uuid": "0dfbbbb1-5b7a-460e-80bb-a368dc3fc8ea", "comment": "Malware payload", "value": "12e03ce4f6abfcb43412cb9949d1b6001caf101e4d66b52008531332baf84b02", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213338, "uuid": "47389d52-2e17-41b9-ad91-f0c7700b06c2", "comment": "Malware payload", "value": "b34b9c84bde0d6ec237d94d72c1350a00d3329ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213338, "uuid": "d4370714-a3de-4afb-bb52-c5ffbc0db22c", "comment": "Malware payload", "value": "b094a31aa4ad2ec058c1c6fb54cb4b0e0464af8da2566a860c79650aa2161e151973ff0d86322caeddeacfafa09d8d55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213338, "uuid": "ad265bec-eed0-45a9-ab78-2dbff82d1e92", "value": "96655B13CEAAE013F6F5CD35162A97325F769A6BB45448A33ADD9E2381050878DBC1FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213338, "uuid": "62fe64b4-8511-4170-b570-ae1759970e6d", "value": "12288:gXDdvhflV6jJ9/dYxl0E4qqetASE1yHSEJcQaAhlVfa8ZwMAV5PHNCzyse/ZLDTM:gYWuyyEmQIIzNELXZkuObmgw5WZOvxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625213338, "uuid": "a5d91152-04ef-4ca6-a20a-21a5facf021b", "value": 1434740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625213338, "uuid": "947dff43-4b91-4a30-a6eb-b2e2aaa6fa8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213338, "uuid": "7c138ca1-4193-4e47-bf2c-cdabd2421963", "value": "12e03ce4f6abfcb43412cb9949d1b6001caf101e4d66b52008531332baf84b02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dee5453-dafd-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625206757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206757, "uuid": "39fcef3f-7d64-4210-8182-db6c940ed476", "comment": "Malware payload (AsyncRAT)", "value": "4a1acd13dde9292ae8acd90b418015d3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206757, "uuid": "e0b8b19f-6015-4bfa-b3eb-acc7a3427922", "comment": "Malware payload (AsyncRAT)", "value": "14f109ed18495264a10aa101b259dce54eea0a2f7df8818452b42a446cd6864c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206757, "uuid": "4a87b88a-88ba-4700-a997-812b1f55e399", "comment": "Malware payload (AsyncRAT)", "value": "5617437dc86d846a118fe92d7120485c96ba9daf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206757, "uuid": "57310f26-a95b-47bf-b8ca-66f9d9e0c5c3", "comment": "Malware payload (AsyncRAT)", "value": "0d19714d75ec9a440faccb2fd6bf109f140165b4068df3ea0b1d62b1952d60c3d10164339f68e6cd42d2b972eba27b48", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206757, "uuid": "ecc5cc54-a71c-454a-b542-c24e71516634", "value": "51218C4A1A2462E53F8F8A93166B6CC7D96688AE18C5E103D022FDC4FDD0E01EC17738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206757, "uuid": "620788ac-e371-4cec-aa90-46da19e94e91", "value": "24:fZEDCwxukQ9OiRVP6wtozVH7V8J73FZncb3fJGQQHocC2a4GY+aW+:iDLj/kJftoZ2Jx+hjcC/4GYJ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206757, "uuid": "14c6bf4b-b7bc-477a-875d-333a09085f72", "value": 1116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206757, "uuid": "3b6f3a73-86da-407e-8f1f-87f08f000214", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206757, "uuid": "3c64e35e-54e0-488b-83bc-93585e208138", "value": "Statement-ID4766080425543.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b198d1-db61-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625249795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249795, "uuid": "12e6ed48-1273-47d0-8c2b-2d006f1c0491", "comment": "Malware payload", "value": "b68ef75002c402c3860d434b82c47d53", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249795, "uuid": "7839d9ea-2e4d-40ea-b904-41a0090d8b4f", "comment": "Malware payload", "value": "17abd6f977b3cc1b4b30ea40f7d71e4a88a8d2a279f6c0c99d9a8ec361eeb279", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249795, "uuid": "c6c731d2-b7dc-4d84-8301-3b1984b2ad29", "comment": "Malware payload", "value": "9229554dc044e56a25935b9592348fe8b3160eb9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249795, "uuid": "01347ae1-0daa-4426-b77d-487d5f1eb7b4", "comment": "Malware payload", "value": "4f76cd87f06243728dfa86dfa7c57ff430ed5caef914a8ec28a8f0b0ba85b9e2923ec9464a42750b1a3c9336b24bdb47", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249795, "uuid": "c6950887-43fd-4899-b484-e279ef60c059", "value": "5874E001F2D100E9D2D995382A6F3731AA3FE985CBE40BD3EF7CFA9E58125429876351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249795, "uuid": "8e63c7bc-8bb6-47af-ba96-0c6d87dbdc5b", "value": "a2293d617a2d42d810e0f0af44350ce7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249795, "uuid": "4ff8c49f-089a-46d7-ad10-11ac1c1ae252", "value": "6144:F62tjX2wCx8GcDdbVRvCdEnjzOWy24Qm4:JPNvCUSW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625249795, "uuid": "17fc4481-a78b-4e2d-b881-a7eedb5ebcba", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625249795, "uuid": "42a90773-5b0e-4089-a2a9-389ed73a8a52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249795, "uuid": "6ae23e52-fed8-4d97-8437-f248b90fe8c3", "value": "17abd6f977b3cc1b4b30ea40f7d71e4a88a8d2a279f6c0c99d9a8ec361eeb279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44277e90-db21-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625222148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222148, "uuid": "c511b496-24c1-4b03-bdd1-fa9a3d9dfe1f", "comment": "Malware payload (BitRAT)", "value": "b34687c70e976de965c38cc371c3cca2", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222148, "uuid": "1652c118-4ca4-4033-8970-49a4248f1078", "comment": "Malware payload (BitRAT)", "value": "199e38e42c8f696aae3f72a0e17bfaf68aa858314452e215e29153c5630990d3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222148, "uuid": "b4a9c991-3a6b-45a2-a068-21e6e843f44e", "comment": "Malware payload (BitRAT)", "value": "3f9ce884c3e0e8105443c0bab1e46c3efa515381", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222148, "uuid": "2a29dd32-4dee-4c31-9d2e-3781447f20a3", "comment": "Malware payload (BitRAT)", "value": "e6150b036d5e8559752e7ffd6948b845d940cbd5722c1fa1e73afde87f346f3cbecfacd58252d5c5be634d912df35a30", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222148, "uuid": "83b1ca04-7a5e-4d37-b22f-70800ccae0c1", "value": "B32151B42DE2C039E403D83473B3A27E8B22246C4B2D290707942965E7158E84A75EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222148, "uuid": "862b2d8b-4558-45ad-afd7-40e27859127f", "value": "24:9qGtFq3IHOtaANmSJawc9Mra7LrtiBAEyeYdHx6/RoseRV+T5y5xv1Fn:9Vtg3IHwaoJrmL0BATeAw+Iy5xvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222148, "uuid": "77276de4-57d8-4d25-8ae8-7af259ddaa6f", "value": 1277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222148, "uuid": "58e16874-c02b-43af-9e42-dc2f3e7236db", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222148, "uuid": "c8965e14-7ab4-45dd-9357-0b0603ceb586", "value": "UPS_Doc203139.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f42797a-db1c-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1625220073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220073, "uuid": "92fee1b8-0b41-4bbe-b374-148135db299d", "comment": "Malware payload (FickerStealer)", "value": "ff6066894b993a333a798d53d427d468", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220073, "uuid": "8dd3796b-ee45-4ed1-8a83-c57184f085bb", "comment": "Malware payload (FickerStealer)", "value": "1a1d8823b35b8c0d8dfcebe065520a07fe105589893262976fce4122317c55b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220073, "uuid": "4d708acf-aef7-4940-82c5-9bc500053305", "comment": "Malware payload (FickerStealer)", "value": "37175e6aa423c244e6354d7c971c512c0f2815d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220073, "uuid": "63bb9fa5-b39c-44a3-ab4a-dc99579cdfb2", "comment": "Malware payload (FickerStealer)", "value": "58813c536d3758f4a4c5d789860338d43b627a7a1f34c883562eeadbeb4ac8b6f3dbd52f9e40342f63404357888a3cce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220073, "uuid": "d140e74d-e5af-4e5e-964b-f9d972227366", "value": "2AF48E10B793E071D8A204F559BDBE6A543C7D1407389FEBA3D83E2C49791C25A32E9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220073, "uuid": "8b8e729f-85f3-4cf7-8a7e-e5b59ccfa9e7", "value": "9b239827ad94cf9e43aed2c8aec6e783", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220073, "uuid": "ba522227-2639-44ac-b760-9c6002e79de6", "value": "24576:uuqjXxOa5kaA9Wip4fdRHTuEa3kugTwy0K3q:zQxRG6E49TH0Sq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220073, "uuid": "1908755b-801e-4336-91aa-47fad08923f1", "value": 792064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220073, "uuid": "0c395b92-517d-4b81-a4e7-6b838725e98e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220073, "uuid": "defa8551-df3b-4939-a4a1-8b9ed44bd8a6", "value": "FF6066894B993A333A798D53D427D468.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc20ca6-db11-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625215262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215262, "uuid": "95bcfc18-a2f2-4a90-8e3c-9a4fe16fc51f", "comment": "Malware payload (SnakeKeylogger)", "value": "c98746731e3cc7d4b33089fdc891ec74", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215262, "uuid": "82b4859f-a3ba-4f12-888a-1e8a5dc9b0a4", "comment": "Malware payload (SnakeKeylogger)", "value": "1a9f582caaf734e55f3ff8fec08fb5cabf0fd8b60f9a498f6002229f21467442", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215262, "uuid": "64c78103-ff5d-4ff0-9be9-f5f00539c2b1", "comment": "Malware payload (SnakeKeylogger)", "value": "c1f2ff3dc17ef63486cb7f08045b8e981126daf1", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215262, "uuid": "8456a6cd-4479-40f1-a22c-987730fa397a", "comment": "Malware payload (SnakeKeylogger)", "value": "aa47aac7c033a106251c5350cc4d70d42c2805dfe01d5af43da835e86be010d9ef183944d89a0e39cfa0bf9589a143c0", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215262, "uuid": "9ee3c8a5-1740-4deb-a629-9f949ae227d5", "value": "355509683A9070AED4B7CA77CAAB2C58EAB9B437571B550B601702DDCB0D943DE700B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215262, "uuid": "e07e85e5-de7a-4ed6-b4ef-d220765e8775", "value": "12288:4ml5MOXSx4x3p4H0WlomgKzhyZtoSHarka2dZEniI/fEzJ9mXrQu1uKT35x45H7l:n0nrg6hD6/AnEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625215262, "uuid": "881003b9-eec5-4136-b1d4-09a69eff2571", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625215262, "uuid": "89c3aa9b-ee65-4447-a3de-33ed95c873db", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215262, "uuid": "d3dfd8f6-4e5f-4a11-a081-7e799edec5b2", "value": "RFQ - FLOWLINE MATERIALS - NORTH KUWAIT.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3bcf34-db1e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625220872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220872, "uuid": "761acd50-f6e0-47ca-a4b3-785fa5faf7d9", "comment": "Malware payload (Loki)", "value": "a61eb0d04d5d774fdffa7055c1a79dc1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220872, "uuid": "c50263c7-f9b9-46d0-a679-2df91f796dbb", "comment": "Malware payload (Loki)", "value": "1b9854c7241ca543cd2c30fcf5d2cd9948da9eca6693430b12fa1d923301f2a9", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220872, "uuid": "94dabf82-e38f-4e45-98b0-20dbe26f14fd", "comment": "Malware payload (Loki)", "value": "4d0159f8f5e8957685fa291306a883d44982e929", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220872, "uuid": "d9579918-2ae0-4382-a939-25cc9b5cbd4e", "comment": "Malware payload (Loki)", "value": "f5ddbc6ad7ba442dd5e513ed8e57d07f27b18067b93910636b6649d2a5d8cfd7761c341f5bb6f161059ff1485b14cc29", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220872, "uuid": "9204e4c9-2392-40f8-b530-c2b2e0cf77d7", "value": "B63501E0F6C45B60DF22187B2212E17B1F34BD392B768742A3DA7BE1F0B25B0C1A6555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220872, "uuid": "060732cd-8f8c-4a18-8356-34d09f971d7d", "value": "24576:oeD7nQEqeipF+B+ZPr6rMUgrHi2wEzZY+oi+00HtYYA4c:HnMeEF+BST6rMbrC2bzZY+oi+00NrA4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220872, "uuid": "71384a38-33c5-4b9c-9dde-8eeb13114554", "value": 1163000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220872, "uuid": "89dc16b3-e79e-4258-b685-8f6f34eb82d3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220872, "uuid": "af34b1ca-4dd9-476f-81be-7bb5b87439a2", "value": "SWIFT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b0918b-db66-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625251919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625251919, "uuid": "5c1d4777-bf49-428a-b262-10b855de2aa0", "comment": "Malware payload", "value": "ac34aeef6269a81bbf30358a50b4d8ea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625251919, "uuid": "85d41e73-9bcc-4e58-b6ad-5c3a82247f30", "comment": "Malware payload", "value": "1b9f7bc405caf49359189d0ff88232f318ba950b42b9aa480267adf3b14d8a84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625251919, "uuid": "e9a51132-fda7-443f-bb93-32ffe87fe9cd", "comment": "Malware payload", "value": "445eb957a14a551c9497e471b76d3b1c4523f6c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625251919, "uuid": "b92808ef-75d4-403c-8ebe-21957005c18b", "comment": "Malware payload", "value": "ce8416dea76820741a05fe7a25caa2331eeddd9bbd5dbbea712abb351c85e0b4a040144063622a84790baaf58c032cb1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625251919, "uuid": "c8d0d7c3-c48e-4acf-a147-8e5b3e333e1d", "value": "7614CF07B0243DB1D4A7E5F650607127F8653AE72E4EEFB5D87AC61BE0225B18723B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625251919, "uuid": "3f7a97bf-ce97-47da-9f41-628d450bc7ff", "value": "12e30a4970af4cc77d5c6e2437bc7800", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625251919, "uuid": "8b077219-f7cf-41b1-9c32-4189adc1b11b", "value": "3072:Tt1lNCvWNelQk0wvfKG+wiDYdgmoZQBmPjcicIPcXpzpx/ttr1A:Tt1/IcwdTiDYdgSUPQicIIpzpxFtr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625251919, "uuid": "6d83a79d-0724-4539-abb9-b8c558e9c7b2", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625251919, "uuid": "6ed9f417-3181-488d-89b6-269de16eb43d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625251919, "uuid": "d0200287-121f-4424-b799-4232c972a760", "value": "SecuriteInfo.com.W32.AIDetect.malware1.32028.15084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f063d75d-daf5-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625203539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203539, "uuid": "df079ce8-2680-4363-9fc6-bf8686bae071", "comment": "Malware payload (CobaltStrike)", "value": "8d8bfabbba66b38ce2c61e405885952b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203539, "uuid": "2ad57456-92ff-415e-aa00-b82e009de2bb", "comment": "Malware payload (CobaltStrike)", "value": "1c5198e6e4f9eb17e35ac43f1554cf88a1602c1fa6afa61ee9c0b845329dec99", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203539, "uuid": "e1d725df-ad75-45bf-8c58-6480233b8091", "comment": "Malware payload (CobaltStrike)", "value": "d3f08b2f33edab951494658806a7904b7dd5438e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203539, "uuid": "1beab001-5677-40eb-9f8e-bd59ec9e9896", "comment": "Malware payload (CobaltStrike)", "value": "083ad1eabe6d025d4380f9141ea7145bfbe92a80d341103abb91df1fc17b14476aaf882b2654bbc66f05bd6e80d92b83", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203539, "uuid": "be49cdd8-2d2a-42ab-a2b8-198efda22800", "value": "D424F0FA0D12B9B3C4426F35F0DF24B51CB290CB4D584AE5B5B6B98AE93703F9849C60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203539, "uuid": "054485dc-4223-418b-8a2b-f64d71c235d6", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203539, "uuid": "6808c7cd-ff46-4391-a6c9-284493a9ca47", "value": "6144:v1l2yOxbqtE5sDIq5iVJ7vbA5wFZ/6BzIoqV8uh:ve0K5kIXVl6Tqph", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625203539, "uuid": "9fa22c39-9308-48dd-8b02-c4d975407282", "value": 224256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625203539, "uuid": "0879be34-e5fc-42fb-a00c-fc2c5c33080d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203539, "uuid": "3093ec4e-6c43-4ed7-94ae-54bb16f1f03a", "value": "8d8bfabbba66b38ce2c61e405885952b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14b5250-db26-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625224452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224452, "uuid": "4bdcff9c-7414-4de2-85a9-2681c85d85d9", "comment": "Malware payload", "value": "0f4dd44174516703ee52802eec6f49fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224452, "uuid": "ae0481cf-2513-4c56-aef4-d8e2af762a52", "comment": "Malware payload", "value": "1e5559caf020549f18b27ca5dcb9087b2d1f922b3de747d82b5503b89a849b95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224452, "uuid": "4b98a763-0f55-4c09-8e13-b0fbcce4224d", "comment": "Malware payload", "value": "56b2b8bd9bf43a11319facddfe68d40e7dfb85c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224452, "uuid": "832337d6-8855-4f94-841a-ebb50221b584", "comment": "Malware payload", "value": "c92703dc978bbb66e5c879ccf61eaa3d7472b18943f05a39a5044be1991a6ff7dd8ba0bc33b19f024e1936752f1803a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224452, "uuid": "64d3e473-1b38-4213-897e-5682158ff740", "value": "AF563361B4C0C1FBC222427581DBD2BAB13E672C593E558FB3ED0E28EDB314636355A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224452, "uuid": "0755bb89-455b-459c-af22-dea1ba87c06d", "value": "c9adc83b45e363b21cd6b11b5da0501f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224452, "uuid": "44d31896-41eb-454e-882b-c62b07e846f4", "value": "98304:MAI+MPp9Ix03E0ApRFSEqN/AJAk7LlUtPU+6d8CLPzqsoeaDwVBdSoijeIGxDzW0:btCDT3bSVAWlUtPU+rCbOve5zdSdCRDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625224452, "uuid": "55fdecca-5ee8-4531-bef9-b9167aee15b7", "value": 6277196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625224452, "uuid": "c0e780bc-f4e9-4582-afb1-8ccf35ad7c81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224452, "uuid": "6fd918ca-d2f4-4662-bf81-f0391796201f", "value": "0f4dd44174516703ee52802eec6f49fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c0b168-db3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625233820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233820, "uuid": "1412257b-46e8-4242-ac2b-29e5079a94f4", "comment": "Malware payload (Mirai)", "value": "a00b49f35925cfc774de5de5f48820ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233820, "uuid": "862e3f42-f80e-4564-955f-f0ce9d529d34", "comment": "Malware payload (Mirai)", "value": "2147f8bf8bfa92a5c1a5472b722ae0a4c0e966b18886957d79ba853821d0b462", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233820, "uuid": "0f25bcf3-4f04-4dd1-b95f-2af7b0451e91", "comment": "Malware payload (Mirai)", "value": "c6075e3a6b49ca77a09acd11c9db892ab8564c0b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233820, "uuid": "ba2e424b-c771-4744-a545-0aa9e1edad1c", "comment": "Malware payload (Mirai)", "value": "586b129228b3d2c97f8ccb211f85c42b502b4266515a9dd115f6003dadf9e870611c950e25ac018d0413b072617f99c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233820, "uuid": "913c1c12-1120-448b-8f7b-fb34aec8f80e", "value": "6193734D3E219F7DFFAC823887B75A21A64823DA66E1C585D05CFA021E7034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233820, "uuid": "310c047e-fc73-45be-8565-5ab463cf14a3", "value": "1536:1YRdsnDd6C6gb/ZVyDYjMbwqZ9f0vfwW9ufY1C+KBtyRirfXDOiOz3J:CHsnD8/gb/zyDv9f0HD9FC+KBtyR6/D4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233820, "uuid": "22a6dc2f-e097-4460-b02d-da65d2ce6e81", "value": 89332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233820, "uuid": "3a6b92d1-776f-4250-9d6d-82745fe8bf2c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233820, "uuid": "6f2a629d-3814-4261-8400-668b2b4b1a96", "value": "a00b49f35925cfc774de5de5f48820ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3da001-dade-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625193384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193384, "uuid": "52e8d6d2-6e4c-46a9-a1d4-8f29aab8eefd", "comment": "Malware payload (Loki)", "value": "b873c82e12948c5c4e0f169d108deae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193384, "uuid": "0c149a57-66dd-4bad-80e1-6f3922f7946a", "comment": "Malware payload (Loki)", "value": "214d14f1ae59a57c5d1a7b0c21abd6c62ef5180d9c6b55b61ad3ae099ff2d911", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193384, "uuid": "ef4ab3f3-3289-4585-8c90-f3736f77d422", "comment": "Malware payload (Loki)", "value": "fbb4dfdb00f91e016c48fa96f1ccde04113c10ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193384, "uuid": "b9ca98da-7faa-4c4e-b220-10b2749da082", "comment": "Malware payload (Loki)", "value": "8e0df16e1714892093df469269f40b9acc6125603d37c48547782034b88c4b9cb773c4ed83e530f1f82ccf0d1ee32cda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193384, "uuid": "7810ea21-63fc-49d4-b55f-b489250bb1db", "value": "20841202B7E4C557C8EA93F95CB7D5C506316E047860EA8838857F8F38F2B4699A3F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193384, "uuid": "363c8336-82f2-4dba-b0fe-304a261192db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193384, "uuid": "0986d6bb-7bdf-47a4-a984-a786ce448e19", "value": "6144:SnetzXSbC/dIVYS1VyfnMuKveBoUNkNqgSC79jQ4GB1zfb0mP56qyYf7fh9MKphn:vpGC/dIVYS1OMuKvUkPSC79jQ465f4m5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625193384, "uuid": "9380d26d-34d6-4fa0-a434-514fe1d0cf75", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625193384, "uuid": "741f7afd-297e-4645-866a-147624b64c29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193384, "uuid": "01b189b7-c986-428c-8b56-0597cfa170e2", "value": "B873C82E12948C5C4E0F169D108DEAE3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfd86896-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625233550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233550, "uuid": "be576354-2219-4b39-bcbd-b0b93f988c8b", "comment": "Malware payload (Mirai)", "value": "473aa033b879156e4792b57ada0a1c79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233550, "uuid": "405c7c9c-53f7-491a-b14b-1aad2f1d127e", "comment": "Malware payload (Mirai)", "value": "21ab7e2a12e20a0bf216ea76ab37fc8cf3307209acf20ba5cc13ff1e3d8a11ba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233550, "uuid": "cadb4d0d-fd64-45d6-a121-f06fd98f3d1f", "comment": "Malware payload (Mirai)", "value": "e4e532e4d0a1ccd14fa7643290bd37d230b29126", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233550, "uuid": "c189ef1f-9f2f-4a16-9950-a6ee6da9e968", "comment": "Malware payload (Mirai)", "value": "f9dcf3bdb649fd219e12b4878c3afaf11ee6d538cb43b8d9a194da6c6c7fdd1a893a4a99b10bb71834fcbb335ae25016", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233550, "uuid": "5bdcfeec-ca7c-4056-9ad6-c54fb6a591d5", "value": "9B6319817C80AA26C7D0177BFA9F108E3314ABD8E1DB73478C141F95769A81F0D6BB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233550, "uuid": "0139fecc-da9f-4065-8cba-7dba553d40c9", "value": "1536:GbtexU5L9XouIRhb96pUQzXtwavaJ3V8OHxouJeZWDFI8EM:GbtexU0r8QCKw2Fbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233550, "uuid": "0f565f10-2e3c-4dee-a5cd-6bf1766279a4", "value": 71864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233550, "uuid": "e7db0013-b943-4a70-9103-06ec5e74a2cf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233550, "uuid": "d9fb13b1-2e85-4f7d-917d-a2e68b9fae6c", "value": "473aa033b879156e4792b57ada0a1c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cc091b-db2e-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625227646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227646, "uuid": "12e17333-c3b2-42f0-910d-991a17a626fd", "comment": "Malware payload (Hancitor)", "value": "00be0dadc6df1fa49368d38bebae513a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227646, "uuid": "f76c0729-3f85-4a3a-96cd-93970c49156b", "comment": "Malware payload (Hancitor)", "value": "21c9472e24da9f476eafe7f8435e93657a9fffed15b75e56f7d45d12f9f1eb86", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227646, "uuid": "2c87753f-37f4-4ec5-8113-5185650b9ea2", "comment": "Malware payload (Hancitor)", "value": "787f05d1977300fecc8bc9b1ecc16bc441abe2c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227646, "uuid": "6fd669e3-795a-4b0c-8030-b21bc3ec61a4", "comment": "Malware payload (Hancitor)", "value": "c1d3754c3bb72e0cb351fe050469666dba3729fe286301d245428f2b382ff4e159197d369b5f45c7dcef4fd4a464e4a1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227646, "uuid": "1c785c2e-60b9-41ce-85e8-f38ee4dccf7a", "value": "55B46D23F2914837D13766799D5B92AC9C2ABE007D24BC4B2BD42F4C6F39781792B253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227646, "uuid": "f6390b16-a7a2-418e-9e32-e9b046d3ea48", "value": "d71cd63d35a7301b9b592007d038621f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227646, "uuid": "8053bf02-266e-4d52-b444-6c567f5fe33d", "value": "12288:Kf5NGH5+nA+R7L05les5ZlUEKoQNme3De0:2wZ+V7w5lesFUsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227646, "uuid": "b97b5e1f-70a9-4ad3-81dd-53e315936764", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227646, "uuid": "9316091d-b77b-44d0-a386-b31ef5eaa37b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227646, "uuid": "46879c79-379d-4fa6-8c18-90982f1a818c", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0f1a21-dafd-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625206784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206784, "uuid": "3dd4ea0d-8893-4dbe-87f3-532da0e14d28", "comment": "Malware payload (AsyncRAT)", "value": "251f8a91c9251af65bb29e7ed949dbe4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206784, "uuid": "5a83237e-fb39-4468-a6aa-bc5f432340da", "comment": "Malware payload (AsyncRAT)", "value": "21f89fb726830fab495538d34cb609d691fbc6b80135cfdb1428a0795dc1c696", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206784, "uuid": "88c6f8a3-7ee9-46f8-82fc-ef870f803a09", "comment": "Malware payload (AsyncRAT)", "value": "6dfdeff9df1b7501cc9e83d11e3c51f19c6c4340", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206784, "uuid": "c84700cf-a4e5-4694-9461-9a9807edb341", "comment": "Malware payload (AsyncRAT)", "value": "62ae7e07dd627c427df62149a773e6341c1a76bcc4ae487d0b303dc660ac821d0bed3157159c4db301be076b2d168832", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206784, "uuid": "0b8ad3bb-b287-4ded-b70d-e9442cccb7c5", "value": "E12137083E54ADED674E2B7375FF6085DD9EACC918E4C858892CA485FC94902DCC7237", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206784, "uuid": "bc63459f-ac1e-49b1-8e02-dd57dadc6ce7", "value": "24:HTr+kRXqJGx3vLy9cv/ejFGuFSX9uTGyhW0vsrfvjTZuELSy:HTrHXT20ejFGf90Mlww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206784, "uuid": "8c4977a2-5288-494d-944a-dc259942c2a4", "value": 1221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206784, "uuid": "7bf2cd03-46e1-4bc4-81c2-d77ff569f4cd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206784, "uuid": "73bbd984-0520-41e3-a29f-758fcb7524d8", "value": "Statement-ID2627923785981214.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a9cbabf-dad8-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625190886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190886, "uuid": "3764a021-bc86-4dcb-a5dd-8dd0d8dacda2", "comment": "Malware payload (Gafgyt)", "value": "bd105f06a66e1df31053415962a1689a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190886, "uuid": "c2bd69e6-9450-478b-813f-ea9569da57d0", "comment": "Malware payload (Gafgyt)", "value": "22b292ef06846b228d4cf535f024f6a2e454030d290f7b6b3f98ec98465bee18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190886, "uuid": "3696a0de-bbfa-49a3-992d-a74419708d80", "comment": "Malware payload (Gafgyt)", "value": "13e77b7a1ca6952d80204c27444d19696eb42731", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190886, "uuid": "66ecd474-bf41-40db-8f21-78a1cd9cbf4f", "comment": "Malware payload (Gafgyt)", "value": "49f2e9e40ae4c4a191dc2f4e16cf3039210feeb0176a2692a022fc4339ce146bce447bcbc4a2a32eb667725374b77368", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190886, "uuid": "fc0339ec-52be-40a2-b2b8-365031d17b04", "value": "3AA30901F9418727C2D327BAE7CF479D3B355AA497E733016A357EB02BC27892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190886, "uuid": "06910c4f-e2e1-43e2-ab10-bb95bbf6b90f", "value": "3072:s4OJYQTfYIMnPnuuEZFKmCVrQAFiOXkYe:CJYQUIMnPeKmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625190886, "uuid": "45313a41-d2c3-4715-b460-f63858002d06", "value": 99992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625190886, "uuid": "dba847ca-8fde-477f-abd7-5511b8ca3afb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190886, "uuid": "4e7a1d87-a6c4-4ea1-bbfe-4ee0e12262ae", "value": "bd105f06a66e1df31053415962a1689a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff23202-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625227161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227161, "uuid": "4134d0c3-d33a-4117-9ccc-a929e4a2c025", "comment": "Malware payload (AgentTesla)", "value": "104adec18013b544dfbf200023630eb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227161, "uuid": "ed9d986a-24c2-4a9e-80f4-0af6614f79c6", "comment": "Malware payload (AgentTesla)", "value": "2557ba12dac37a8da096798d3ff01fce387d75dd34a048b2878f79d2981ad7dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227161, "uuid": "452913c0-e505-464c-9644-93d3d8416943", "comment": "Malware payload (AgentTesla)", "value": "d2e75b263aa77b60a2ea924d1cef9cd0f401c2e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227161, "uuid": "62aba7cd-7b59-449e-b9d0-6a7befa0beec", "comment": "Malware payload (AgentTesla)", "value": "749c17d48cff9991eecda62c922380f463c9d2350b154cd2400611eb7102a75515da5ce9c7d45e01edd01da145ff656f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227161, "uuid": "40c422da-f774-41ff-9e91-82a016a0e078", "value": "FC053BA8369070AED4B7CA77CAAB6C68E7B9B437570B550B601302DD4B0E943DE701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227161, "uuid": "13613a01-cf62-4730-a240-954da676472f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227161, "uuid": "c5e96b50-62bc-4a26-8a99-ae2123cbfca6", "value": "12288:TmNbsJhMCIuDppgx2TlMsYSBMB5iH3z1V7lWXeXaqvQQjYjujiweZt67v/9OOtzu:6e5TlJYSMiTBCqrYyYsM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227161, "uuid": "51428559-c6f6-4736-a4cb-80a2c84fd5aa", "value": 829952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227161, "uuid": "3d1990bb-5008-428d-9147-41c61b6946f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227161, "uuid": "46748401-97af-4918-a6f2-a8b6462095a8", "value": "104adec18013b544dfbf200023630eb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f004d8ca-daff-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625207834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207834, "uuid": "499e266c-91e7-45b5-ac2c-156dfaf65059", "comment": "Malware payload (Loki)", "value": "fd5d6e191aa190b435c360ad0190984d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207834, "uuid": "15cc07ab-1f08-4fdb-816c-3f1c74589921", "comment": "Malware payload (Loki)", "value": "259cf108583b14b0a55566c39d81a5cece6f0f149919aa80556e6a07803e629d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207834, "uuid": "a18cc1d2-8790-4b2e-a794-62031541d43b", "comment": "Malware payload (Loki)", "value": "75b69e51693c4995cea0903267dce7baf57e0a7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207834, "uuid": "0aab9274-1b8c-4aea-9b09-05730eb863ba", "comment": "Malware payload (Loki)", "value": "36bb0de6aeec9cb1325980ffed974460eed5da7efad96e0a7308424116b11ec399b4d8d605297399d3248adde3a38667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207834, "uuid": "ef1a4d84-d08c-4b08-a69b-e481dda46db2", "value": "C315A49D326076DFC867C876DAA81C64EAA0747B831B9203941316EDEE4D99BDF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207834, "uuid": "2533e0f2-5a13-4689-975b-ffead47201e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207834, "uuid": "c7a0e449-09ec-423a-9ef1-9ae7d5130ce9", "value": "12288:rGp2IMYMCSc88Oz+edEwYKgEmAaDS+sws+hA6Sjw0PLv6AhLmKGCvwqspNImh8Rm:ro+YMCuz5gEM++sit3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625207834, "uuid": "1e5dc2ef-302a-4006-952d-e35d28dec578", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625207834, "uuid": "b46f5b0c-8a37-4d9e-a3cd-cd9f9604a3e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207834, "uuid": "3ea32e41-29df-488d-92d0-ec61ef463607", "value": "\uacac\uc801\uc758\ub8b0\uc11c_PO20210702.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f70b3ff-db1e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625220825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220825, "uuid": "8805ca10-4352-4bba-a381-8252d8784119", "comment": "Malware payload (AgentTesla)", "value": "46c7249ad41dd940cf6534bb1a3a3295", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220825, "uuid": "6ea8e59a-204b-41fd-9625-a646b0d3aa03", "comment": "Malware payload (AgentTesla)", "value": "26fd96b69cef89cae30544b46147ec088128d4189bc78c3ce35198832bbf8ce6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220825, "uuid": "cc838df3-14b4-4388-a93d-11e3af662d85", "comment": "Malware payload (AgentTesla)", "value": "36ba4d8d762627b3481a2879e33a6fb8e279f9ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220825, "uuid": "2be6fe78-d8a4-4827-a0e6-05bd5d541492", "comment": "Malware payload (AgentTesla)", "value": "15ff902955c744fb37cd033dc146035ce560d6d886fa96c83dc748ded47bca7a37a397b5229c9152b1de34d227ef203c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220825, "uuid": "1fe80625-f324-43ed-b584-48c72db2efc9", "value": "4391837407381843CE5681B1E4B9FE9B45D6F27B84CB0B81737EFAA21F273661629091", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220825, "uuid": "a8ea2add-3879-46aa-909d-936d8b1ec6c4", "value": "96:e8kdXmKOiuH+Rn3/DSXb1tZpgNT8qnQCTHLdqOEYXk8DZbeyKak:CdXXhgJ1qQiXEYXkgZbeVak", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220825, "uuid": "da0bc048-eb72-4a74-8a08-2ca05641a402", "value": 4408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220825, "uuid": "0445c8b3-719c-4b64-987a-f369543cdc48", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220825, "uuid": "a71165c5-318f-4fb1-9493-c67117f3a34f", "value": "RFQ-MELTOR_MACH3001-072021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed1035c-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226810, "uuid": "d4fdf923-48f6-49db-a0fd-2875c3ee5536", "comment": "Malware payload (AgentTesla)", "value": "7092ce6487d5b89554d2a87bf5afa273", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226810, "uuid": "801ede13-36f5-4ebc-9882-1ebf636df45c", "comment": "Malware payload (AgentTesla)", "value": "287560a61ca6e1a2793213f2633f6d10c0870926b0b0bf4478f66a9d407ef613", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226810, "uuid": "33de7554-1ee7-480f-989f-600ab2052fe4", "comment": "Malware payload (AgentTesla)", "value": "5cb6c78665c655d9cc3dd202b4bf88880d918a32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226810, "uuid": "1c574a9e-3716-41d3-b999-81ddbf72d4d6", "comment": "Malware payload (AgentTesla)", "value": "c59652e00ad44c79855ca83c8c02716bece05199700d93493d5035a028442fcf7d10a640c916b82c61398751211e6c65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226810, "uuid": "f785c30e-a9b5-4136-86d1-20f7b16ba150", "value": "BF052A6836A470AED4B7CA77CAAB2C58EBB9B037571B550B601302DD4B0E943DF601B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226810, "uuid": "7b6b9b2b-d6c6-4524-928a-81642322ab88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226810, "uuid": "6953f492-13aa-4225-8d6e-0385f9afc48f", "value": "12288:kUKH/clKZ+VZpfUnENyIKq7ZpgJC1I7LzsNMUPP/uR85jLbCcbt1JbYM/a36SC3x:R8ENy3GIngyUPPWR85/me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226810, "uuid": "0b516f1f-23af-442f-bb17-43f2bcce66e8", "value": 795136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226810, "uuid": "ab2f2c60-4326-4672-b4ca-6e303b63e7ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226810, "uuid": "5bf07906-2377-498e-9fea-d5ef57deb77f", "value": "7092ce6487d5b89554d2a87bf5afa273.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7d2677-db2e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625227670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227670, "uuid": "38e99e69-5e7f-4314-bd48-86f8f016c622", "comment": "Malware payload (Loki)", "value": "6cbddc18edfa157f41997ac52fe66abb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227670, "uuid": "48693ebb-6e5a-49c0-b364-dfada695c332", "comment": "Malware payload (Loki)", "value": "295962c0e6b38d7e1cde167e3c8479ab2332ab5c136076c3e537316283f28007", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227670, "uuid": "bf3f6d0e-0298-4075-b23e-a27909412e1d", "comment": "Malware payload (Loki)", "value": "c612f1eee1229be78e0110b09829a10747ad851e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227670, "uuid": "9437f604-c5e7-403c-88a3-4e0e116207f3", "comment": "Malware payload (Loki)", "value": "aacf7fe6be6d9415640d2a99f341bb3ad567376e71a92b7f1d38dcb8d21020431828f43f059b22c44915a695756c3efe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227670, "uuid": "c8a50a0c-9495-48b7-bf7d-aca7f40e9e46", "value": "A3A4F19909ED5269F16502B71C59F2318FB50EAA58E0D3DCFBC8B363DE723E50217922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227670, "uuid": "bb2d74af-d77d-42c0-8c08-840855094a37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227670, "uuid": "ec375082-7385-4433-9e74-61135cd2618f", "value": "12288:NpF7gNulbZtFLQS/d8XpXBGFzKoxanFuAgB:l7gNufFL3YpxMHxa8AgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227670, "uuid": "c1d7a4a2-55e6-43e9-b06f-8f19d366d551", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227670, "uuid": "78001884-84f6-4aba-a8a8-0442012a8859", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227670, "uuid": "3deae890-b197-430c-9c08-e81466c9ac47", "value": "4160120_BS02_20210701045009951_001.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bfc978-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625191442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191442, "uuid": "5066d931-289d-4ac6-a58b-50ecf7e6677e", "comment": "Malware payload (NanoCore)", "value": "f934817e21fa287c6dd60f1eb1bcbbe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191442, "uuid": "6504fdd1-3032-4a29-8ce3-4cde8af3f14a", "comment": "Malware payload (NanoCore)", "value": "2af6f37a02bc512145fe57de3bb9b8a334267f927bb2c9032485717829861ea7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191442, "uuid": "bd1b7db7-d7c3-4e29-ae09-26b9dd211b91", "comment": "Malware payload (NanoCore)", "value": "14bce7d6c27d203709b0917c15bc35421b1c8813", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191442, "uuid": "8c5c499d-ba35-4efb-897a-6611357c6d74", "comment": "Malware payload (NanoCore)", "value": "c7de5fd76f571e81105d187c4b0c3dc8ca81c65b0d50e3ed8378f83c4e19341e1370b6c8c59c04f8be773f367870d629", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191442, "uuid": "8d24a817-5434-4e2f-acbf-ae4cd62cdce3", "value": "2FB4028A12E442A2E1524E7674EEE400CF76AF876D90D10DF49DB6231FB33D6125BD2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191442, "uuid": "e059ae1e-a07f-4d2d-825b-d55571c268ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191442, "uuid": "9a338389-fdee-44e7-987f-e231233c08a2", "value": "12288:njopFr4g7s9PeStHAmhEVeAdqvCTEytOxyKOn+Cl8goMuPReYnghAHu:njKr48s9rmVVDdc84PJgoh5ebUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191442, "uuid": "381f581e-8440-4386-ab76-b9a4eee1d65d", "value": 503600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191442, "uuid": "36324985-2d73-4d9b-85de-532b2b450a57", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191442, "uuid": "f33303a0-c4f3-429f-8b22-911853f914a5", "value": "Ekstroms 4041.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21246902-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625233257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233257, "uuid": "0732f7c1-1221-4aca-b2b6-86f4d733b2c7", "comment": "Malware payload", "value": "f003077ebea7209f21cfc3ba4c39e440", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233257, "uuid": "29197b9e-9777-4e58-9d12-3f94d977a638", "comment": "Malware payload", "value": "2b221b70583f7219b903e930616a503250240876e30c7fb53a5bff7d8bdbc2ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233257, "uuid": "195d8694-d57d-4876-9b47-5183fa365675", "comment": "Malware payload", "value": "561014df19a911d2bbaa1f6fbf321c763ab44c2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233257, "uuid": "8d96fbdc-65ae-4a1a-87da-db290906153a", "comment": "Malware payload", "value": "fb258bad3440ac1e11a3719783448b4ed5b81d3ef2a960caf1f4317d0b885e836aadaf4c8caed63942d4f9df822fa87d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233257, "uuid": "039da8c3-1a0f-4f0c-834f-11fb7777a779", "value": "7DC33AD39640C4B3D00219F212ABB7514163FEBF488795D2EBAD7CB49E308867269FD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233257, "uuid": "4c1b9ee5-5701-4e99-9878-fdadf7868d7b", "value": "3072:2iN+k3lMxu9v06OR6mXKetJ8add9QzTs/xApt47KcX6GcgqBK:tHcKDW6m6etJ8addQOApt47KcXJcgqBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233257, "uuid": "5e5c6e9e-9428-4959-9042-93a8b6552aca", "value": 129390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233257, "uuid": "d98072b5-9efe-48f9-acbd-25182c88a8df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233257, "uuid": "088226ac-ec9c-4487-9d04-26010c4026eb", "value": "f003077ebea7209f21cfc3ba4c39e440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7085fabb-db1c-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625220075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220075, "uuid": "c6add1ad-3462-4e48-8213-f1cbd266d5c2", "comment": "Malware payload (RedLineStealer)", "value": "417d7e10f1998c4b6e563320f820571c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220075, "uuid": "18b5efa3-c677-4dcf-b6ac-bc99de00469a", "comment": "Malware payload (RedLineStealer)", "value": "2b22da43ac64d6b8410941622f910268ced4cd4856393bda2c30c6dc1a99a8a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220075, "uuid": "58b084ea-246b-4eef-a5b3-aef780a1bd31", "comment": "Malware payload (RedLineStealer)", "value": "8e1b4964e1f3007d532849a2dcc24f3e2d58097f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220075, "uuid": "709c53e6-e744-475b-91c3-5eb0e5e0e413", "comment": "Malware payload (RedLineStealer)", "value": "f008e0bb650965a3f73e2d9f6b34836247c0e3fbace5db8358798326008ce7af16024729704202e6c8190289fd3a86f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220075, "uuid": "127b3326-46dc-45e6-acb4-a815014f27ea", "value": "BB74252864BFC05985E3EEA12EDCA8FBD99A55E3640C743301B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220075, "uuid": "4f27d8c2-4147-4845-aa8f-6a5376459ac9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220075, "uuid": "0d8ca388-e191-4813-a47d-7c0322aaa476", "value": "6144:jZG5YqofbuLy1ntB9ag62LL1f6Tv/3RrD+f:Q5Y3fbuLydtB9ag6AL1f6Tv/3RrD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220075, "uuid": "172065b4-4e70-4f9b-bd19-74d28be31ae4", "value": 370688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220075, "uuid": "e7020ff6-4920-4464-9177-d52c107f4b3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220075, "uuid": "cc9fa02c-e90f-48dc-9e72-3d39c4a3b125", "value": "2b22da43ac64d6b8410941622f910268ced4cd4856393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7ae83e-db49-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625239238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239238, "uuid": "67732086-8efa-4c54-9d97-d8f2c065f67f", "comment": "Malware payload (RedLineStealer)", "value": "c6779dadc266f59d284e7ccdd23c9ed6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239238, "uuid": "d6fe4d77-f9f9-4acd-9659-25117766b5bf", "comment": "Malware payload (RedLineStealer)", "value": "2ca9ea6c431b505e8058e89e63d9d3fa49a29756f41032fb310542e9375dcec2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239238, "uuid": "fa0dd89f-b430-4303-ac00-43163766b02e", "comment": "Malware payload (RedLineStealer)", "value": "ace1f2d9210e7330c3d1bc534beb13312faa1a91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239238, "uuid": "3b6a2f43-3c4a-42c1-bb6b-4467077ef9c4", "comment": "Malware payload (RedLineStealer)", "value": "4592291ca5c26e11ed97bdb936b45972cee9e4264618f19917ea819262c70f7a8fdbcfb0fe24a6b6fe0764d1b0284731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239238, "uuid": "79197c85-9ca4-40e7-b121-8fa4898d5f66", "value": "8C05BF413184DCDAE05B2AF644AF84209378795FC255CB0E3BC2BB6E59E7712249B78F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239238, "uuid": "b440cf4f-2c77-4143-a8ee-2b3e15853199", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239238, "uuid": "8c82c074-67cf-4e19-8e97-90eae39c7732", "value": "24576:ejJv6gmjMM1ULRqnCE7ChMw7S4Hbh8d8:+JPmYmjlH4Hbh8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239238, "uuid": "80a04338-7523-4098-bd49-371ff68a7774", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239238, "uuid": "261dac38-e84a-4a57-9a61-b4d0086bd2ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239238, "uuid": "456d83c9-28b7-45d3-a42f-70d7dd04944d", "value": "PPGMB QUOTE09227384012PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e6e8e9-db4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239788, "uuid": "de0b27bb-3a3e-4c83-9925-7c2df2b387f0", "comment": "Malware payload", "value": "9ad19ac4ef166fbd4f64efe0e54cfaf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239788, "uuid": "7a7fe2b8-564e-4f92-9543-fcb6c1d27dc3", "comment": "Malware payload", "value": "2ddb73abe6955d959884683ce713d06a8a33ae5ca1ddbaef50b5ce0660659bd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239788, "uuid": "8d19cc5a-0afd-4754-a24e-5df8ca57044f", "comment": "Malware payload", "value": "a6662467fcecfc23ad925c7a42c5133cf55cb696", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239788, "uuid": "40d2fc90-5481-4f4c-8836-c8e01f474963", "comment": "Malware payload", "value": "4bc87fba14dd50977179f70eaa9fc2f12d283bf9e7b0ef20b28277caf00a7d6a6275f9eda799a5718b5737f297f30976", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239788, "uuid": "a815fc5a-7769-4e8b-bf5b-1c2490b7d305", "value": "4D531893F501EFAAF40E963A44C74724B270BE564E935A21B3177DA69A333C83867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239788, "uuid": "dc5f02ea-978f-4a9e-bb08-295861def487", "value": "1536:H5JLS4zazUHHb2M8WORBwP4ojHImK4yn7ZX:H5JLS4ze0nAwg6HXPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239788, "uuid": "7e59bbda-86e1-4c11-815d-d4e6c78a7af1", "value": 62732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239788, "uuid": "4fe2bca9-cc12-4afd-aea2-9852bf0331fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239788, "uuid": "ccdc1f05-9c8f-4035-8b63-0cb0a5999306", "value": "9ad19ac4ef166fbd4f64efe0e54cfaf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e1b93e-daf5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625203518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203518, "uuid": "b31bd296-1004-45e6-9f82-2d718764575c", "comment": "Malware payload (Formbook)", "value": "16e6493f749c66b3d546d0b8aa8ceee6", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203518, "uuid": "144dc561-4ed1-4082-ae53-db0410a87034", "comment": "Malware payload (Formbook)", "value": "2e2be015ab552c5d15996192a744001e9733e7cd2e4b2925c39188e26e5870d5", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203518, "uuid": "01d7daab-6c6a-4265-b762-28fab8d882a8", "comment": "Malware payload (Formbook)", "value": "ed96c72d3ccfa04bcfbb63a3f95503021574c239", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203518, "uuid": "47a03911-5c7e-4020-a2c5-582d3eca8d84", "comment": "Malware payload (Formbook)", "value": "3487a353de9e007e4cee828d6a085e538a583181db578788e0de58b4e67c691adcb8344325e9e7166dac75d0b4e36602", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203518, "uuid": "793590dd-d898-4c38-b04c-a7cebc4e5eae", "value": "369302D0ED7CA69D692A37026192B67FE838315192B3DDCBA4639B1914E2CF33D11E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203518, "uuid": "42e71759-4e04-484a-a4da-a8560f230f5f", "value": "1536:UYLTr7uK81BFx/gXZD3G5bJoRDgCLpwwdaCmPs+C83epEYVyCdI9TviNBgRcGIAU:Us7363/6D3GHo1LpwwovEhEYVyCwTvij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625203518, "uuid": "83f9d188-3766-424e-be6d-8140830df96c", "value": 93040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625203518, "uuid": "f648ade6-64ae-45ab-baae-2d7ffee3c871", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203518, "uuid": "bee397d3-fec3-4112-997d-e07f2c0cfb9f", "value": "NL 2P PURCHASE ORDER.ARJ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77d679f-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625227147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227147, "uuid": "39583632-49de-4276-aaad-b298cc87ad83", "comment": "Malware payload (Formbook)", "value": "c93b130e8d98db2a9b6fa38fc7cf55d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227147, "uuid": "035daa77-4d5a-4929-8fe5-ea8c4e2aab48", "comment": "Malware payload (Formbook)", "value": "2e5af3b0bd1c32642bc80b4d3852c93a2a9d81a10c2f80e8968667667b357954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227147, "uuid": "37b9d694-75e3-4950-82b8-153c8b3b467d", "comment": "Malware payload (Formbook)", "value": "dedfb2fdb4dd2969e636830c35289349deec151c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227147, "uuid": "2ee60127-a12c-4477-8a58-2d42508baa74", "comment": "Malware payload (Formbook)", "value": "e4a9099b24b5544ae778b02e10806880f131f4b4b920441333ddfb1b5525572691987c5e02dc0ff5341877342523d95e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227147, "uuid": "19720539-010c-432a-9053-bd00387e3554", "value": "3F053AA8369470AED4B7DA77CAAB2C68EBB8B437571B550B601302D94B0D943DF700B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227147, "uuid": "9032487f-8561-43bd-b5ea-e7ca9971a062", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227147, "uuid": "f3ffd068-6328-455a-bd1b-70097d1570cc", "value": "12288:tnATfBpESoL+pml/1j34dQDg7SbFK1eB02K1KaxYU1jm+pHjt62l/GeITIqsAETM:5L/1T4QDLbgIB02IK0YK6+pDt62l+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227147, "uuid": "1050ba05-7a9b-4eb0-9e57-ee4cd8e42d83", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227147, "uuid": "8ad9c03c-e8ea-4304-8b31-2040ea34e024", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227147, "uuid": "c6fe9322-2a36-4bb9-9be3-a522122d2ebc", "value": "Payment_Breakdown_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8bba5d9-db1f-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625221566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625221566, "uuid": "0e3bba4b-6bbf-4663-a620-21ad7e8145b9", "comment": "Malware payload (AgentTesla)", "value": "86274c61a447aefed3ae6d22c2f2475e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625221566, "uuid": "2e35620f-7031-4940-9a43-f6686299a558", "comment": "Malware payload (AgentTesla)", "value": "2e94c50b0716c6de07a873e1d8eb04429982ba64bab54d6bf951e11bdbfb3488", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625221566, "uuid": "e25c25a8-f5c4-4d64-ad41-f34945be978b", "comment": "Malware payload (AgentTesla)", "value": "088bd3386fd735fa6f87e4d4b164aad9900746ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625221566, "uuid": "8fe9bd22-9a83-4adc-86c0-e24dc77db932", "comment": "Malware payload (AgentTesla)", "value": "7008631a471f9514b51350bcaed88b26dbfaa4c90024ba481d8965ccc1182d78322a6426de8e4405c7d076c68e760f4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625221566, "uuid": "6b0b7ce0-6fb6-4ca7-8735-f775938a2660", "value": "AC15BE242EEA5126F5B65F7D89B06041567DFE232F17C87D28B532C91733A42CAB027E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625221566, "uuid": "bb0a0916-dd41-4416-98fd-bfe67e339bb0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625221566, "uuid": "3fabbed7-2fea-4798-9e05-0e53c1c95879", "value": "24576:cCGv2C653ff6mPRQv89uX8eB2Emvf1In5oV+OK+:cdYlrP9S5IEm8CK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625221566, "uuid": "d72b6f0c-50b2-4892-80ae-f3acdc4a48b1", "value": 917504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625221566, "uuid": "45342700-8be0-40c4-b5b1-673928af1550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625221566, "uuid": "de772f12-157e-43c6-b174-bd242592b087", "value": "pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25da8319-db2e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625227681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227681, "uuid": "a91f24eb-9ef7-4e33-99a6-17767338af10", "comment": "Malware payload", "value": "ecd5a29a9980a3d07a3d7ed1dd801a10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227681, "uuid": "56a7588d-695e-420f-a3cf-4ad45e1d6291", "comment": "Malware payload", "value": "2f7d4cae829b1a44e8611849e9ac7ca840733da39a590b25ad2dcbb7bfe71f4e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227681, "uuid": "0901a380-5008-4974-ad3e-9d0c4022408c", "comment": "Malware payload", "value": "9452909406c97b6cc85de70bcc8bd569d8f0721a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227681, "uuid": "1c8048e4-ff29-4bd4-926a-165e561e5952", "comment": "Malware payload", "value": "d7eb759fe59af35629bf9c63f43ae44976e770a5419bb9380ed39b516c8e2763d3065f05798ae459bc6240e3a8df5585", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227681, "uuid": "998e52a0-c710-4c2b-ac57-292efa093f84", "value": "40052968369070AED4B7DA77CAAB2C68E6B8B4375B1B550B601302DD4B0E943DF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227681, "uuid": "2101cbfc-2ee4-463e-beb1-3d8873664ec4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227681, "uuid": "174f5ce5-2859-4254-93c6-f3ab3efa4dd9", "value": "12288:F6E+eItzcQLup77udepjF9uHzX6aXKJQsoYvO0FpHpbnkUZa+V6ZuLoyoWoaMCrC:s7cMX4JQFYvO0/HpTkULU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227681, "uuid": "c200124f-fef6-40de-844c-aa8887a0598c", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227681, "uuid": "9f41aeb6-8473-4c3a-9d06-aa754683791d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227681, "uuid": "c96cd6c4-7980-4d29-8a3b-bdf211fb8894", "value": "#0120210623ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6754db13-db62-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625250125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250125, "uuid": "2923bf5b-43d0-475c-bbac-f1062af3449f", "comment": "Malware payload (Mirai)", "value": "ff98919256f5fcfae08d81d11f3df7a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250125, "uuid": "e9d672af-46de-411a-8cae-b33bec5ce54d", "comment": "Malware payload (Mirai)", "value": "30159103689955a336b49e4664a284567b3e3a5342018393af5e33ae3b4e7f2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250125, "uuid": "5e9363e7-f4d9-44c5-ad9b-da3fbaf4d5b0", "comment": "Malware payload (Mirai)", "value": "6856e7d67c23f4e879ba3acd9ab0c6e12cd92e72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250125, "uuid": "e5d5118b-c753-47bc-8835-3e57b94d9a4e", "comment": "Malware payload (Mirai)", "value": "8af7a37a29c9a478c2bc6e04d49f4723b542bc61e421b8f7c16fc25d8920dda1e8222c31b4fee3baab680e959eb58ee0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250125, "uuid": "56441b93-e3f6-45f3-ba67-a0b8bed2bc62", "value": "5493960E2E258F7CFBA8953887B38E119658339A36D1D585D15CEA022E7074F341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250125, "uuid": "9f5b70f1-db37-4c4b-b133-bf09cdb71187", "value": "1536:EadUQpjvkcvk4N0o9c+9GUaWj1HglDcPWfovc9PP3a10c3V+m:NRvnvX9ckj1HglDcPvvc93W7l+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250125, "uuid": "fa1aad42-c5a7-4db2-a1b7-2207b8baba5a", "value": 90848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250125, "uuid": "d057f4dd-5ecc-433e-88b9-70440e3d4d4f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250125, "uuid": "e40166c0-79ce-407c-b4d6-1d5ed6cb28dd", "value": "ff98919256f5fcfae08d81d11f3df7a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde7f30f-db2d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625227614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227614, "uuid": "9a76e1cc-927a-4d68-9231-9e2a11e360d0", "comment": "Malware payload", "value": "73dea2992305472953f55173a8df4e97", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227614, "uuid": "21751ad7-8f21-4c45-a447-68e2aa6217a6", "comment": "Malware payload", "value": "30b4227e51c4964d07a5246cdab168f465790dd8846dac5e8376c2afed5a1485", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227614, "uuid": "dec5b929-61ab-48dc-a4e4-b19c8459272b", "comment": "Malware payload", "value": "c793820db2776f423bca9a7bf517a38a735f3bee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227614, "uuid": "7c6dd78f-cdc8-4b5c-ad51-5b19771e12c5", "comment": "Malware payload", "value": "22cb77ff9e173dca5f6161a4d62218dcc47b5bf0a83d11008e97756059f04463d21dfa9c9dd3028937ec0cdc090dcc95", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227614, "uuid": "1f575591-05cb-429b-ac05-a91b0a7720fd", "value": "DB94E1226641C871D18B11399A7297755EAEBC129BB065CB2FE03EBF6F247C1CF35206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227614, "uuid": "255f209b-4f68-4fd9-9175-7cec923b6d17", "value": "9c7729e7e6125436737710b1ba737d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227614, "uuid": "0605fd3b-6ab8-400b-bf07-8f63b6e4ebea", "value": "6144:54Gp1gZmFlZKmP4jrc9/5fS9XJqLSYmHiNKhV5T:JrgZm7ZKmP4jrGg9XKg6Kt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227614, "uuid": "865a89b3-897d-4183-89e4-4b395fe17fba", "value": 413311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227614, "uuid": "e4f622e1-654a-4bae-97d4-c65b82e96bf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227614, "uuid": "a46aba1c-e0bd-4366-bb7d-610eb57e3adb", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19dc8e1a-db39-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625232385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232385, "uuid": "8119ea34-6c43-4b7f-96c8-19e48bc1bedc", "comment": "Malware payload", "value": "57dbe4796ac898164842404ce420987f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232385, "uuid": "1be40e8a-f81f-40ff-80bf-afe7fe1444ac", "comment": "Malware payload", "value": "310b0037e8395eafa4f15bf3c09983052f68fa5490bb0670562f71f426002bb4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232385, "uuid": "5c1021d9-df78-4efe-8e0d-0f8c76b476cb", "comment": "Malware payload", "value": "8711b13b2733ed0cad88502e2851c2844f4f1ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232385, "uuid": "deb4ed9e-97c1-482e-b182-3e057e444459", "comment": "Malware payload", "value": "ac668e794ddf523a3f93a22261e6940826177b86ac62881352bff82c21aaae0cb2a77aff10e0b2d106528e152e849282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232385, "uuid": "d10554cb-00ee-479d-8561-9980b6012472", "value": "C8F429683A9470AED4B7DA77CAAB2C68EAB9B437571B550B601302DD4B0D943DF700B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232385, "uuid": "6ce4a133-8617-4445-a7b2-1109faca7fc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232385, "uuid": "f45fd86c-5ce0-43b2-92c8-181ea792b8b1", "value": "12288:D6lVxabWBwB1pk5YuQ40fnXT+pyj1P1I6lIiLEKtoGi740aoDZBynDsDpqXC44Mh:eHP++pyj19xIioCoz4DoNwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625232385, "uuid": "73d86610-6368-404a-8e16-90d8aeffa119", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625232385, "uuid": "c7fd576b-d515-4a2d-b19e-b26b7bb0e8fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232385, "uuid": "f7c083ae-5d6c-4f17-b77a-0e41e27afeca", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c8f29f-db3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625233808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233808, "uuid": "2f21b5cc-1618-4abe-a61b-219b12b25600", "comment": "Malware payload (Mirai)", "value": "d0f22f3af81b14c1fb08ce5e6692427e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233808, "uuid": "ae6f0a6c-3f8f-477a-b490-f87df148a2bf", "comment": "Malware payload (Mirai)", "value": "341c5495155f13e6f0520bd71db6b01ba55e988e1290a14ca374bc489f5ae438", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233808, "uuid": "bbeed75f-2e99-41f5-87c2-bfcbabaf6c0a", "comment": "Malware payload (Mirai)", "value": "3e9384cf86e0600fcc8d1c37c26e12b98bde18aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233808, "uuid": "527548ab-b269-4f09-9a6b-1b6088faee46", "comment": "Malware payload (Mirai)", "value": "dff90b21897a16946763cf7334d0f973917232395f12ce43b8e91d78ba6a7be68fe1058ca3cbefb001fc59fd231b8301", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233808, "uuid": "dd2c4274-fe77-484e-9ecd-5d9f3bb72d51", "value": "B7534B0277684F07FAE61AF4243F1BE483BEED8025E4B588690FC7424635E334999E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233808, "uuid": "2acb9522-a64b-470a-ae5a-410d997cecc7", "value": "768:Sr5Eg6nb5usRVQq8WTUqYhcBJcIGsllk5M9Bv6GG4TlW2c5sjgi+DDiZ/vQBbsVf:2KbpuqJlzk5xGpJgbDOZ/vQuN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233808, "uuid": "0c8ca9e5-5cbc-4ce8-9d0d-02c37b0af9da", "value": 66468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233808, "uuid": "0842c3b2-0f12-4467-ab5f-751999cc87e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233808, "uuid": "e97ec947-0701-4a18-9c9b-a947d92e5c61", "value": "d0f22f3af81b14c1fb08ce5e6692427e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a98dcce-db2e-11eb-875b-42010a9c0053", "comment": "Malware payload (Hancitor)", "timestamp": 1625227662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227662, "uuid": "3876d088-bc82-438f-bca8-67aab60911b5", "comment": "Malware payload (Hancitor)", "value": "c181d20af08c0c630fa5e2a7b3d564e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227662, "uuid": "8f20fbd8-0b6c-47fc-b711-782c7533c79a", "comment": "Malware payload (Hancitor)", "value": "344563d0d00d4d81f219a96cea0f87bc2b11f8cedb4ab7ff130a4f0fae42baa5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227662, "uuid": "d0a87438-c3c6-4e94-8872-65fb87cc886f", "comment": "Malware payload (Hancitor)", "value": "794eb9a69b1c059d94895dfbba6fa6bdbfb9e336", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227662, "uuid": "2c1a4cd9-f4cb-4663-b217-e2d6e4df587a", "comment": "Malware payload (Hancitor)", "value": "0a1c9e4184fb32ed2f987084b3d36b51e8082d8545d49acfb8df0aec66a3833a2f854a8e87f8edd0643c0766cdb43f43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227662, "uuid": "7fd05a2a-caac-44a0-8e44-99d187b6cffc", "value": "5EB46D23F2914837D13766799D5B92AC9C2ABE007D24BC4B2BD42F4C6F39781792B253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227662, "uuid": "ee97db97-6e51-4b0f-a5a8-4ce8f151a33d", "value": "d71cd63d35a7301b9b592007d038621f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227662, "uuid": "4f66d6b3-3f46-448c-944e-7601c5a8f481", "value": "12288:Kf5NGH5+nA+R7L05les5ZlUEKoQNfe3De0:2wZ+V7w5lesFUsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227662, "uuid": "87e0a1cb-dd70-429c-af2d-59d7ae4cbb72", "value": 498176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227662, "uuid": "e1534343-111f-4962-9b80-c1a97de3991a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227662, "uuid": "0ee877c6-9f50-4807-af82-a7f3c7cac01a", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7350423-db62-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625250366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250366, "uuid": "484abc6d-3410-4c86-a936-81d90cb3f571", "comment": "Malware payload (Mirai)", "value": "7d1c338657821b0bbe52aa5b736876a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250366, "uuid": "66f22e6d-c1cd-4a35-b8a1-81747c639007", "comment": "Malware payload (Mirai)", "value": "36584594e31abfc67696089b9e34d20fe8d937b5ca6eb8c8841bc512ad91eaeb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250366, "uuid": "3cdd4211-1043-4c45-be1e-6a5fd8b207ad", "comment": "Malware payload (Mirai)", "value": "65d71ccca3979863fbd6594530797c2e77251e4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250366, "uuid": "8e6a9385-2180-4d13-a210-834257437e4f", "comment": "Malware payload (Mirai)", "value": "2e69be5578c74df136ed6e4a1c1d49e33017de6f77461526ddaf9e77da03ea56dd7b383c744c3ba3fa6e8d8dae7b23ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250366, "uuid": "f5eb527c-7da4-4c73-995b-f6f45c607459", "value": "98832846B9818E15C9D423BEFA2E118D331657A8E2DFB223DD105F2177CA92F0E77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250366, "uuid": "096ac9ce-f347-4604-8675-68cff3b15f32", "value": "1536:Tknsaem0I4L8tHWP0s/NCJZ4RIS+DAl6nBe/1Q9C1DN1Al+h0Q1JMEiekCqSis20:LamL0Ho0aNCZEIxD4/WC1DN2lEkCqSiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250366, "uuid": "bf8bf20f-82c2-4614-9197-674809f57dff", "value": 84540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250366, "uuid": "eba10f21-bbec-4ec4-9e7e-38b4577a2d3c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250366, "uuid": "17557fa6-2a53-4724-bd66-b9ab9c167319", "value": "7d1c338657821b0bbe52aa5b736876a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729e033f-db6f-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625255727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625255727, "uuid": "123c4440-0f4b-4d6f-b008-f52ec620a83c", "comment": "Malware payload (RedLineStealer)", "value": "64b002bfeb466d35bef2021f2ee33546", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625255727, "uuid": "596d1daf-42e3-41f1-a481-ab0e667eb577", "comment": "Malware payload (RedLineStealer)", "value": "3666dd8e3ce14a3b7273c405f7318402f3c2d203104966f326c3d93ee0d0570a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625255727, "uuid": "7cf1cbf0-733c-4979-bf78-9f53a9c27c90", "comment": "Malware payload (RedLineStealer)", "value": "09635d9579441e78917198f05d04ee3621c40d2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625255727, "uuid": "ee732fc2-c4d3-465b-9d6b-b239394f6155", "comment": "Malware payload (RedLineStealer)", "value": "486ed6df22f3722578279c4f063fc099f828c09e7b663bd8840b5383698b0c39e63908a6c18f8d6b7dd69eceb1364899", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625255727, "uuid": "7d0523d3-7f07-4fd2-a7df-c101c0e50b91", "value": "2C74D0617681C077D262123448A6E7704BAABDA117738B43EBC56E6F6F333C35AE1247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625255727, "uuid": "75a6a65c-3e10-439c-aca8-d38f496861e6", "value": "6c85a344bbe73254bc54e901b7fa4065", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625255727, "uuid": "c81ca2ff-c9d2-4c79-bb7d-7f9610888555", "value": "3072:PMKt5MlAYDOoaw1djFiVmdl+pp8Hc3/zSTqSjBte73MQ+05lQcpcGzFbXx:BHMlAY6oar4l+pp8HGbiqSjM8jYQc5B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625255727, "uuid": "56e1f93a-275c-42f9-a691-463fedfcb1b5", "value": 358912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625255727, "uuid": "cab1d421-29d7-42c1-9a0a-f79c6b57f503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625255727, "uuid": "2d7fd1aa-c3af-477d-8504-3a9daaf9d5f4", "value": "64B002BFEB466D35BEF2021F2EE33546.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a7d5b3b-db6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625253566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253566, "uuid": "d4ebd568-3cd0-405c-b960-059406b35910", "comment": "Malware payload (Mirai)", "value": "1a51e2d1ea31dada98f165d72b2140ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253566, "uuid": "f432fe86-b527-42a0-a8ff-5f10c602379c", "comment": "Malware payload (Mirai)", "value": "36c1c88773c57cbb789e4bc7d4220622aa124ca6ebf49d498beaf4f955cb3db9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253566, "uuid": "17588d18-298b-429d-898a-509c2f5d6618", "comment": "Malware payload (Mirai)", "value": "715b00e74d753fc2c43a5af01bd70171029fe128", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253566, "uuid": "026a587c-05d5-4c71-90b2-e8b2f8adbbbd", "comment": "Malware payload (Mirai)", "value": "619acea6ed625d448960340ad544dd8d43ccf147e125ca6d5ca89bb6986ceb9a6c26ab502801a575d15a09dbe4c205ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253566, "uuid": "6e4f5c2f-5822-464a-abaf-0c3e480bbd34", "value": "9CB2E131101AAC62C2910D75DBAEC7CBFF550FF899E9232B18710284AAE856B59F4197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253566, "uuid": "84d27626-c2cf-489a-bbef-b1f446f86c18", "value": "384:rZ0X9nxn8o9ir/nSdoiVPAQ0cVIs8n6/8exXYtjWp5GoUH/U9KIriGJkcD9hymdc:aX9nxn8o9wnB/Q+sisXmzdGJns3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253566, "uuid": "1d349750-375b-48f7-8245-5b9af5f6caba", "value": 24996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253566, "uuid": "d88e6f63-c0d3-4d4f-83ab-89057ce49cfe", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253566, "uuid": "3472193c-a5a9-4422-a7b7-65676d71618c", "value": "1a51e2d1ea31dada98f165d72b2140ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bcbc40-db0c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625213343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213343, "uuid": "d1c162c3-548f-4fab-87e1-198a486ee8a9", "comment": "Malware payload", "value": "654656293bde59416863437ad7751f77", "object_relation": "md5", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213343, "uuid": "f64c61af-a4a3-485a-b647-075d93f7869f", "comment": "Malware payload", "value": "36f6a3edad1cca7190b7f392dfbd5f3e386e8b99c331db692f8d20a90dc0118d", "object_relation": "sha256", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213343, "uuid": "e0324c5e-bdd0-43b2-9fb4-084e11f49098", "comment": "Malware payload", "value": "0ec20081848c3571873c4e2662938ab4fdc5d78f", "object_relation": "sha1", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213343, "uuid": "85465f1b-5ba7-4cb0-96db-4d27412c7313", "comment": "Malware payload", "value": "e8b0cb9da0505a810c59b2e27ac67662b74ccaa88f10a7daf072817d4e5c50b7980b0d48f0658165fcb731ac5e174010", "object_relation": "sha3-384", "Tag": [ { "name": "gzip", "colour": "#4EA7B6", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213343, "uuid": "f0c5212c-fc68-433e-9f29-d90d53e59ed5", "value": "0B73122AA6E3193D211F3D790380DAC0486A4594D869DDAEB5B57E471E2DD63C01FCCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213343, "uuid": "ca5ba5dc-63a7-4e38-8318-84e4ff976cfc", "value": "1536:WXkdVI/i4GDoMg/uoEU9tKM+G1shvUUY6FTBHIw6Rt:Hjdwzb9tKM+4cvTY6FTKLRt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625213343, "uuid": "43574949-5cae-4566-a7b4-61fca29cc852", "value": 76610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625213343, "uuid": "c71c6641-9da0-4b7b-8d61-cb8bd66e7a29", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213343, "uuid": "33c018f1-e632-4686-aa62-c5f4b2d6bb01", "value": "36f6a3edad1cca7190b7f392dfbd5f3e386e8b99c331db692f8d20a90dc0118d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e24252d7-db7c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625261498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625261498, "uuid": "af801dad-626e-47fe-9c68-1225c3cf0c9b", "comment": "Malware payload", "value": "d83c2c4caf2fa8d32233d0cbc4322782", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625261498, "uuid": "a9755249-a147-4cbd-b6cb-eb317c96c696", "comment": "Malware payload", "value": "371721d174fb4da7167a64d2469b8b9c4f9c4da386a7ef3a2d9da94b771755c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625261498, "uuid": "edbd76b5-a418-401c-b360-fd2f700b3645", "comment": "Malware payload", "value": "35f910390782d0d30b6045d42e78d51804f89b58", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625261498, "uuid": "4cb642b5-3af6-463f-ac90-2ce71e761802", "comment": "Malware payload", "value": "a0238eda79564f47f8e349c3835183e7b1846e3cc9d6a552418ad0686a86b44a3807b1a5655d2567a6a294950e3df798", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625261498, "uuid": "8e4a0258-8ab4-4328-949c-cf3ed652c673", "value": "DE53E4ADBA5C00AEE33FF670C7E13D0593A2553E240D852F14B66DC2D8867C6E7D621A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625261498, "uuid": "e87249c7-c47f-4c20-9589-b8ff1c7efa10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625261498, "uuid": "8bb0d04d-242c-4fe0-8161-8f0c5b3ad647", "value": "1536:kPyiaKt76CYnXw6/cVkpOih1fcQJHH9sj5KGtRsc4L0u:oZYnXos1fci9skK/4L0u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625261498, "uuid": "74e7aec7-867a-46d4-a2a6-277d757d54d0", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625261498, "uuid": "17b538a6-ac0a-47ad-8893-20a062d8f894", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625261498, "uuid": "2e41e665-a618-4c74-95df-ee9bdd97489c", "value": "d83c2c4caf2fa8d32233d0cbc4322782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7360fbb-db2e-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625227925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227925, "uuid": "065b6d6b-d75e-414f-911c-64a76e49183d", "comment": "Malware payload (BitRAT)", "value": "52a8e5e135451380f7da3416b7e65b17", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227925, "uuid": "7712cd67-8c86-489b-a6f2-9b686782bd4f", "comment": "Malware payload (BitRAT)", "value": "384d681454e7869310689fa3082928ee2a06a7c2eb02771538243045395ea3f0", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227925, "uuid": "79577e12-a090-4d46-8efb-9b6f29e7815e", "comment": "Malware payload (BitRAT)", "value": "3c4b16bd7eb839b37f57a425530f965bad8f6c28", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227925, "uuid": "913a6c83-70cf-4780-b53e-6165fcb738c2", "comment": "Malware payload (BitRAT)", "value": "d53c087ea65f9968a816fda340ca50810b016c5b979bfeefa28b78e50def74eb0c99f117ef4eed279a6da0c305d62dad", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227925, "uuid": "5288aec2-d18c-41a3-a49b-60b00ef82350", "value": "6D459FE3B14098BFE2713A787C2B91C25406FD111E881A013EDB7F9D9F3A252A9275D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227925, "uuid": "1bc4c40e-6aa6-476b-a8b5-e37768e6660d", "value": "6144:1+8BzA7T3dMUA53bQu6YufA7dkVyOZHzMJEVBe1Lawpir9cdMzqdUFcDUKNu:48BzA6F3MZeCzHIP1+P9RXcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227925, "uuid": "95916bb0-e5d2-4c2f-899e-9c0aeaaf6fe0", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227925, "uuid": "391fab3a-ae74-4720-92c8-199cd73f98b6", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227925, "uuid": "a1794293-f617-4926-97cc-4cdfc51e3f3f", "value": "DHL files.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6ee264-db54-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625244197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625244197, "uuid": "2283b854-0bb1-4288-9f3a-56fef716b694", "comment": "Malware payload (Formbook)", "value": "779b7483a9fbbb243ed630439ccd9c16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625244197, "uuid": "8222e580-b9ec-4489-a629-e87f9064bcd5", "comment": "Malware payload (Formbook)", "value": "387b9e0f0b986a3a114ce5c9ddc33f6b0679b527b257326891d8d1c595109b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625244197, "uuid": "09d7726d-5415-4602-a9ff-98b56ba872d2", "comment": "Malware payload (Formbook)", "value": "8e85ce9d7939ca1363c06bec7f75008a72fcd615", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625244197, "uuid": "9bf9e4ac-e8ac-41d7-b3df-961ae761d6a7", "comment": "Malware payload (Formbook)", "value": "f9edb80840bc81cac5afec1de0458a5f47f046332b4904dbeb9bc44059a2d4ad5be82d767bab9b7e0f6d103640fee624", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625244197, "uuid": "0b9346d0-b68b-4de1-9451-1ae18636ff99", "value": "E115BE84E69449A4DC2EAB755576CC3083337EB9A935E60D2DCD3EAB3FBB7928011017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625244197, "uuid": "73461b0d-6df2-4279-abbd-f2361c6fc27a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625244197, "uuid": "6c218593-ddb3-439f-bd8e-4e174b03be9b", "value": "24576:YjgeVAkYhKGK4XZLCDc1liyiNnAk+761q:cgCAkYZSNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625244197, "uuid": "cd4a0711-bffa-4fd4-8d5d-0d0d16c70d12", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625244197, "uuid": "b0bf8dc2-a767-4ee4-8d2e-0026a60886f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625244197, "uuid": "231f0da4-8cc2-4b37-9148-684958d73988", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9f65ff-daf5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625203508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203508, "uuid": "12809d0c-5b16-41ca-8a48-daa0d971297d", "comment": "Malware payload (Formbook)", "value": "2a167d01bb2bffb6c8e684c617af84e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203508, "uuid": "e6b7439b-349f-4000-9b24-215582a44445", "comment": "Malware payload (Formbook)", "value": "3979a76f278cc417a50932f048516b0168237b6b4ca108ef779fec69b1bc0c0d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203508, "uuid": "7e7c6513-cdf0-4e76-901d-f6e71834c29f", "comment": "Malware payload (Formbook)", "value": "933ecb7d9bb41896b8478f2ebcb4e6c93b338c7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203508, "uuid": "81f8895f-92ef-40f1-8d8c-32e404c7ffd2", "comment": "Malware payload (Formbook)", "value": "42c33c5b8a69ee500881b0a4586ca061cabd0f556e4cdfd0b5eabda12f812db5703dfc59cadebac5f5ada8a68f81d433", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203508, "uuid": "93404f5a-9475-4aa7-9d27-b04e6c4e146c", "value": "F6543BCDB5CBECB8F4A838357911C264068B6D091A59283A7D77F74E5273E44AB7CB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203508, "uuid": "edc0ea31-0ca9-4668-80e4-ac63ed01b13c", "value": "23a43c6518c8f031e32b203009216485", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203508, "uuid": "690cbf33-81d4-46f1-b82d-7eb990366d7c", "value": "3072:9bb+vfqg7VoT/kMp0Ye7HWOiJPfVL/LiMzq67sX30FrQcF+VyW9CrmctTaNhiy:9bb+vfn6T+ckMzqdUFcDE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625203508, "uuid": "cb5d1d67-c156-4fe4-b068-5d85483247b0", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625203508, "uuid": "0bd2b97c-b725-4224-9f70-70ae9ed87f17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203508, "uuid": "070401d6-ba58-41e8-b609-656e1fb45944", "value": "NL PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c66d0b5-dafb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625205895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205895, "uuid": "ea3a6fb7-5a16-4a30-97f2-988892728a2c", "comment": "Malware payload", "value": "70a5ea4a350d4e74cbf3a1ba4bfad098", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205895, "uuid": "48e1adc4-484c-426c-bd68-0c9f64d65638", "comment": "Malware payload", "value": "39ce7b1e2dc1d4fe3bee24a9be8bea52bcb9028b50090731e5fff586106c264f", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205895, "uuid": "f1e9a2b3-2b52-4808-916f-f2eca8ef957a", "comment": "Malware payload", "value": "f78001bcbce3b201ec6bb8c319015d9dd594293e", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205895, "uuid": "b7c8abd3-aae2-413d-94c0-81c3f5bd5aa4", "comment": "Malware payload", "value": "89f6f90897071ef29a72f78cb0ff799eaca11fa78d47845e3445eebceafc42d2441a19d21b5982db37b1aa44a96cd2cc", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205895, "uuid": "f953d797-325c-47bd-827d-4bb2576eff84", "value": "C315335C5510A3A84BA437DCC917BF0F2B2C0094A2CEF7B6A463D499B1F974AADF7901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205895, "uuid": "a5f6c48d-261b-433d-aae5-ba11020a9c7e", "value": "12288:OoT2dLjDtHZOJCDhkJ+Wy8mlAT+yu40OGCXXg+jWphEA9lf8aPHAqyelpp+qkqN6:Oe2xDtomhkJR9az9LeQ+uEraPg34bCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625205895, "uuid": "e7cf8580-aced-4b29-9aa6-5c20a2248625", "value": 913278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625205895, "uuid": "8adea5a1-23f8-4550-9ec7-ead32c1a6468", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205895, "uuid": "7d6921e9-6a8c-4829-8991-ec2a1e07d8f0", "value": "COMPROBANTE.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9492029d-db5c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625247624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625247624, "uuid": "cd04a4a7-7a77-40a8-bf4a-99516d7cf816", "comment": "Malware payload", "value": "edf9df34d548e518d290968ecd5263da", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625247624, "uuid": "a89b39ee-2aeb-4528-9505-7f105b84448c", "comment": "Malware payload", "value": "3a9f27c7ea68e0827a4ab1e49585926f3ff5e3c3486b1e578a4b0513dd05e2ba", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625247624, "uuid": "ba986391-e5a6-40ee-af9d-1407155de3a9", "comment": "Malware payload", "value": "242f0dccada01d34cbc1bd82479682b408641c61", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625247624, "uuid": "0c98fdb5-875a-4c68-80b2-2c7f07da8fe1", "comment": "Malware payload", "value": "a2a4b5405e9a6af32095c6a74a7e75e4ce3cb80300d89f90887bab3231bbd87d5e39fbcb8073e8cdf2f82ad75df5694b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625247624, "uuid": "3c061450-d780-4d89-b8ac-119a46e1233a", "value": "8CC20EE7B6D6AC45CE59037948A783A06717FC215BA7838B3389F7161FB1AC08D0361B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625247624, "uuid": "5aafbb03-ce65-404e-9d34-18ae6455f8eb", "value": "768:lPpRk3hbdlylKsgqopeJBWhZFGkE+cL2NdAJH/JETS:Nrk3hbdlylKsgqopeJBWhZFGkE+cL2Nw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625247624, "uuid": "38c5ff6c-e2a0-4a3d-bbf4-b4c167cdd128", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625247624, "uuid": "159c44af-36ff-4e16-9cb1-6fe32a018aba", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625247624, "uuid": "9dc23b88-aed3-48b9-a0f1-6614aa663b20", "value": "SecuriteInfo.com.Trojan.Malware.121218.susgen.15116.15608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d25fefd-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625233250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233250, "uuid": "8b1571a2-432d-4ea1-a2b4-9cf3d40677a7", "comment": "Malware payload", "value": "b022672b993f358cb71adde69299858b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233250, "uuid": "aca14e08-17f1-4484-aa65-9bedf452d32e", "comment": "Malware payload", "value": "3c745f103e1b9e2ec39d5bc6ed1d49f98a9c19b90d0a802e8eef9139f49b1a02", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233250, "uuid": "36ce27b5-1520-44aa-ad77-6430d17d4899", "comment": "Malware payload", "value": "46daa0d6596a681cb3fa239acc574d94a06c6c22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233250, "uuid": "cbf691a6-782a-43e3-bccd-cd26832d7a26", "comment": "Malware payload", "value": "5e42c211608f97e576b910c75bf50fa27c1b98c7c9f755aff369e49cf52cc7681af3f8e28fc138c018b75d94579367d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233250, "uuid": "e6d283ab-2734-455c-a126-f7da8e03933a", "value": "B104B56A3E21AB7EE124867107F76F70C39529E726C19352E26CEA045F7134D186FBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233250, "uuid": "28b85198-9e2f-4a13-9ef2-215db1a619ac", "value": "3072:8U+9tDp2gKJ+5feketJ8add9QzhskEKgdT2dfi+8qLw/i+L9k:X+fDpN3tZetJ8addQpEgdfi+8qLwa+Ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233250, "uuid": "afd4bfa0-4410-4f1d-b8be-3526e5941398", "value": 186998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233250, "uuid": "e13660fa-6b2d-4a71-b157-611831c18e06", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233250, "uuid": "a84e3e3a-9ce6-485d-b8fc-bed9951bf20d", "value": "b022672b993f358cb71adde69299858b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a844a848-db36-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625231336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625231336, "uuid": "0dd0006d-28bd-4255-8077-cf145e9972a2", "comment": "Malware payload (BitRAT)", "value": "428687522dd0cd2318e36b46396af8a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625231336, "uuid": "3632393b-1d15-4d1e-ab51-f38e57ccbb61", "comment": "Malware payload (BitRAT)", "value": "3d63c22ce814418819c6a1783e542bd75a23ca4321f49208391f18dd781b27e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625231336, "uuid": "34565feb-d19f-4a3c-adde-39b413bd8625", "comment": "Malware payload (BitRAT)", "value": "e38736404551974b5c37ac0548bcbffc57425417", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625231336, "uuid": "d1306c97-bac2-4836-8a50-0dd599a752ff", "comment": "Malware payload (BitRAT)", "value": "fe8bde9a1fab2c9653ce65c296f003ae295ad43753dcfd339879ca841b5f9f88bf52a5b7d8e7b2d6f0604dc60f48c638", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625231336, "uuid": "504f20ae-7c7d-429a-bae1-5bac9fe6b8f5", "value": "D2A5D0A8369470AED4B7CA77CAAB2C68E7B8B437571B550B601302D94B0E943DF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625231336, "uuid": "e9b40636-be82-4d03-b67c-af9f5ff982ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625231336, "uuid": "1dede51c-c02a-4ddd-b1a3-c9eaac8458a4", "value": "49152:aF5+EB4nxROg3GMUkiIBVPGA0ejn1J4bnzLRoL:aF0lUg3GMUJI7P7jnj4bnnRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625231336, "uuid": "10863b48-0aae-449e-a5e0-1f4cf0a36593", "value": 2222592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625231336, "uuid": "ddcb72ff-e14b-4312-a16a-5b4437498d68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625231336, "uuid": "679eff1d-2589-4cba-bd34-eb62cbf2a7e6", "value": "428687522dd0cd2318e36b46396af8a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cd5941-db3c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625233803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233803, "uuid": "b47fdf01-4391-474c-99c0-7fe7040e8311", "comment": "Malware payload", "value": "672c3de73c1f32dafd45290f55489c22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233803, "uuid": "b937d43d-934a-4f71-bb12-2a2a77a1eeba", "comment": "Malware payload", "value": "40131571bb0809c2a98b74ea9a35ba29a35a4676e316bbe97d9f8938b5fb2f97", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233803, "uuid": "8cd152de-b7dc-448f-8b38-1e54c75cb9c6", "comment": "Malware payload", "value": "cff00c9c25f0b5f97647d15a864ac2e5c5bba799", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233803, "uuid": "f24e28b4-33e8-4cf7-959f-5aa7bbc03f07", "comment": "Malware payload", "value": "c46ced94f3a725cd8abce68bc47d0aed2c1cc3933b9afbf68be4f72038fa1992bb5de4a54f07d8a9a7b36b54107b2873", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233803, "uuid": "2c8e729f-0e47-4e45-a7e5-23cdea4071dc", "value": "BFE30897B400CF61F40A8A7205E75721B6B1EFBA0D831976A2177D62AE321D63677FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233803, "uuid": "4dbf661b-b5ab-4d65-b7e9-e8e60952bb14", "value": "3072:mLZvUpS2+IMSTaFrHmq6IyQ4k94/GRZgq329UwVXlCA4mMUKQi7GngBZk:mNPVQTaFrHmmyQvy/GRZgqoXlCmMUKQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233803, "uuid": "6685dc39-5df3-4e5d-861e-64bbf1b28271", "value": 148622, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233803, "uuid": "256968df-4a8b-4801-a49a-7306e5e5b799", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233803, "uuid": "fbd7218a-7379-4dde-a5f7-6e9c39fa64f6", "value": "672c3de73c1f32dafd45290f55489c22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80c9d5c2-db82-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625263911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625263911, "uuid": "04a09e11-c8bb-4ad7-9a37-d72966f7d01b", "comment": "Malware payload", "value": "50d1c63760b18fb3025f961489629110", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625263911, "uuid": "de872625-a1d0-4361-be68-6ee9d2686312", "comment": "Malware payload", "value": "40964fa1b1131e8d33e4b454d4823c2e37d4a2be24678b91c34470c22fbb350e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625263911, "uuid": "aa6ee944-af23-444d-8828-ddfea561afcb", "comment": "Malware payload", "value": "b950be5b21c1055120429dd25cc054777ec2ebe5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625263911, "uuid": "2ff06922-1251-4b5a-820f-0027a58a0df5", "comment": "Malware payload", "value": "4d1ef1cc794fda3e9a4a0ec6a77dfc54d9e1cc6d7eee30ac9da59ac9e5e460467c337d3d39b405e31b766be15c136e57", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625263911, "uuid": "ba94ebfa-900d-4dcb-9f74-524e62514cd2", "value": "8374E001F2D100E9D2D995382A6F3731AA3FE985CBE40BD3EF7CFA9E58125429876351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625263911, "uuid": "80d97224-8c5e-4cb9-a5dd-a18a3dab3848", "value": "a2293d617a2d42d810e0f0af44350ce7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625263911, "uuid": "bd5573a0-a1e6-42ee-a4f6-df6f5c74c0c4", "value": "6144:F62tjX2wwx8GcDdbVRvCdEnjzOWy24Qm4:JBNvCUSW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625263911, "uuid": "cd8e012b-72d1-4b3b-a174-f3dd2bf76e5b", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625263911, "uuid": "6e186d54-c944-4db8-8ea7-58c1137a2185", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625263911, "uuid": "5b5ef4e7-6ea0-4d33-b74a-bf68f792d2db", "value": "40964fa1b1131e8d33e4b454d4823c2e37d4a2be24678b91c34470c22fbb350e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592ae123-db62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625250101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250101, "uuid": "b1d0eb3a-fa3f-41a8-8722-dc21e6f83e17", "comment": "Malware payload", "value": "11d275ea34a4fe10358f6e71ea4d79fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250101, "uuid": "88700f67-1780-4a58-801a-84f0135e3feb", "comment": "Malware payload", "value": "4135a31375b3a9c19d0d870fccd85cf0e9eca7ebc8d04119f7c00a7c2520cc4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250101, "uuid": "9c0f3664-ba4e-43f2-b2be-dabfd078384b", "comment": "Malware payload", "value": "7c30f79bda95318d90e33a586c21af771529ccbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250101, "uuid": "4ecbb6d0-a15a-4f98-b00b-ea60cbc838e9", "comment": "Malware payload", "value": "06875f24dff3a77eebe61bcf3c328a2015550e5b14c85a926ad5e5875734000deb564fac5a1c940798a472c4200209c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250101, "uuid": "77379915-74a9-4d0f-8a27-bedb54df301a", "value": "B1130242F1435DF0ADE11631FC3C16222A2D6F95E1B6B2D53945C1CA2A933DFB3B9892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250101, "uuid": "e4816610-4ba1-44b0-b472-4114617e3312", "value": "768:EApmvSxsAPGW7OPkmdnEmUCfOEWW+RhaRT9hfsgMno08q3U7ediNWdkgjB7:XsvdAb7wnEm/OEWWogT9hf+FgYgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250101, "uuid": "a1a3882c-fc4b-4eb5-9b65-bc9023d591da", "value": 43784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250101, "uuid": "6089e758-5318-402d-b446-6a6115c13362", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250101, "uuid": "327e462e-0c05-49b6-8a6a-448c149b5d40", "value": "11d275ea34a4fe10358f6e71ea4d79fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771a9618-db25-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625223952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625223952, "uuid": "76d214bf-9e2f-434e-a31e-051786388493", "comment": "Malware payload (Loki)", "value": "a69e00f1df3970199e8e29efcafbe878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625223952, "uuid": "5fb72115-b3f6-4d6d-aed7-285eb2690268", "comment": "Malware payload (Loki)", "value": "4318044e17b19c7191f76b5cfa585526b1293161c5fc9b613f431981b3e54210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625223952, "uuid": "fae949af-7ce1-49bc-be70-186ee7fe8385", "comment": "Malware payload (Loki)", "value": "39bd484c81ad09ae7e3dac4700a95d7ab473344d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625223952, "uuid": "f1fcfc92-851f-42b7-a9a5-7733db8498c1", "comment": "Malware payload (Loki)", "value": "58e9468eb3af19146a0b359539d846343594980f1af22a72571d47ad5e25964d7c14bcb047de37ebea704b7e49eb67d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625223952, "uuid": "df25a5db-9926-4874-ae19-2eb379886f19", "value": "69F429A8369470EED4B7CA77CAAB2C68EAB9B437571B550B601301DD4B0E943DE700B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625223952, "uuid": "fecb41ed-1d1f-4cd5-bcfb-50da7974e224", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625223952, "uuid": "25653e48-61e5-4525-8f6d-21f6f282e14e", "value": "12288:L5qy927MmeQSNp2Y5YYj6KMeyUO29rk0kgyOcFbe3dPlYf1Xe0pLgMukkpro7GJc:tzjnVO2ndv4ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625223952, "uuid": "422092ad-f4e9-49e8-ae13-b854754777a2", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625223952, "uuid": "2907ec2e-cea8-4a67-afdf-0b1b80666c6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625223952, "uuid": "33c66db5-f124-452f-990d-2bec8ab4f52c", "value": "a69e00f1df3970199e8e29efcafbe878.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48c000f-dafc-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625206499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206499, "uuid": "a52ffeed-cac0-456b-aa48-e923b4c2eac3", "comment": "Malware payload (Loki)", "value": "83b7ba34e336b22c5666afc04d333b98", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206499, "uuid": "4fc8049f-d82b-4416-a7e2-b69481c4eeee", "comment": "Malware payload (Loki)", "value": "4399d22b39963d505e42e5914d49b85d16fa1ec97f127feac18e0e83b390cea1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206499, "uuid": "11ddd696-83fc-40b6-a314-ad39ac057490", "comment": "Malware payload (Loki)", "value": "51541b4e5250faf09b79af7b95e5b83f60d9526a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206499, "uuid": "2188687e-53b3-4829-80d0-d462e09843e2", "comment": "Malware payload (Loki)", "value": "94ba4c6af51e378aaeac6f98bca9a4c6fc43ab7e7e6c66f5dbe6447b52093c274b93eae9c1974fd9ebcbd8b40c41cac8", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206499, "uuid": "ad275cb0-42c1-49db-b0ce-fca86fb3582f", "value": "B53523F27DF99A1FCC8393771D518B3288A91C97CB11B24E43A87B1954305B78EAB50B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206499, "uuid": "6aa64114-5f8d-422d-8019-f726778f6ac0", "value": "24576:QA5ZZ7UeYKnLtnNnMxTNuI8NqsoSsbqc5Cjd8rcNkejm9wCU2mt4:QsZ1UetnLtNMx5BsoS+q7jd8rZeDw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206499, "uuid": "92fea2fb-8a6c-43ea-974e-4a7326fdc478", "value": 1157784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206499, "uuid": "c4b9d549-a82c-4836-822b-58a3080b9dd3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206499, "uuid": "a7d16c97-712e-457a-9e5e-c8c43fd07557", "value": "Arrival Notice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a6dbca9-db22-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625222508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222508, "uuid": "29d14c41-2547-498c-908f-d8b6ed127419", "comment": "Malware payload (NanoCore)", "value": "1601adf87809b57343a81396916b21ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222508, "uuid": "0f78bc87-a11d-4bff-8dbc-2adca2474e6f", "comment": "Malware payload (NanoCore)", "value": "43ee89c14274dbfb7cc6c39fffcc59ffdc08c5581450928c7420570bd74bffbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222508, "uuid": "79f2ca57-08ff-459b-b972-29395f5fd408", "comment": "Malware payload (NanoCore)", "value": "dda83933b39f5b9628f0e7ae568ccf72332f271a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222508, "uuid": "ef48355d-fb7a-46c3-9dbe-248c3267af7e", "comment": "Malware payload (NanoCore)", "value": "81b9f34218797e9f4de130f1bc6425c2d5f2638aef3c5fcae77c1f7cbd184e118154393b0a2a01c406f1f69ddb72fe88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222508, "uuid": "2de629e7-df46-40b5-89c0-a5c1e95c75e9", "value": "270317DD8A6C06D6C23FF530DBE036434721617E6A0C896F54B689D3C846BC1ABD516F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222508, "uuid": "82f77e99-371a-4fd0-818d-60df047f9048", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222508, "uuid": "707b7ae8-095e-4b94-9ecf-a4dc8c3d7713", "value": "768:PE5dDnYg7Ic0/goIWODEKxc4B3GflCt82F/5w3i22HIeCEZhF:s5BYg73woA2c4BkgwSjIXEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222508, "uuid": "866e31fa-4831-4509-8c96-95c6959c06c5", "value": 38248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222508, "uuid": "16ce9b8c-2043-47f4-91ad-6ead00cd6561", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222508, "uuid": "969eef37-e447-4076-9ad3-ae3e2b231b7d", "value": "1601adf87809b57343a81396916b21ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9a8fc6-db3c-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625233813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233813, "uuid": "4c842903-21d3-4f43-ad66-78426941e0ca", "comment": "Malware payload (Mirai)", "value": "a8a19521c666d8448b775af94d0563a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233813, "uuid": "18488ce1-6ada-4e60-9a9c-8f7ef4765229", "comment": "Malware payload (Mirai)", "value": "4525f3d0bbaf69ac2e161128f16df3d8413e8fa5617252e361344142c0bd5349", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233813, "uuid": "b44e5edf-1773-4a53-9a18-3864347599c7", "comment": "Malware payload (Mirai)", "value": "979559f428957d90c9cee310e98a8674d9ed466a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233813, "uuid": "f20e32d3-ce7a-48c6-8ba5-a492b5e34947", "comment": "Malware payload (Mirai)", "value": "a526cce53b360210b9db626cba54bf5274a8f74f194096570ded0d9685b8cb66bc79d4b55751284a58e25da5b9321ce9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233813, "uuid": "8b5d63e6-5377-46c4-a4f9-875dee31290b", "value": "CF5329C8A593F8F5DC140978307ABB66AEB3F13B7135E99BC3D82927A841702D10669D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233813, "uuid": "434fd54c-06e3-47f6-bc37-ca51ba49642f", "value": "1536:IoRC9170vwHbQXZ5+qXDEuXi90dSW7V/DjObeFt6PuQ4ZR:PC917iwHbQXZ5+qXA594SWZ/XObeb6G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233813, "uuid": "6b528572-21c9-44b3-94f5-93da006a8ed4", "value": 66136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233813, "uuid": "e81581c8-2063-42dc-ab80-c09e28578dfc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233813, "uuid": "28cbd454-d907-4a6a-9677-5c497020066b", "value": "a8a19521c666d8448b775af94d0563a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c7b6e5-dafb-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625206092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206092, "uuid": "6646ec4c-2d04-4962-8494-eb40499e9939", "comment": "Malware payload (AgentTesla)", "value": "ac8866044cc591802c362ea0c64b2e67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206092, "uuid": "ec434ba2-1bf9-4d35-8788-50e5a641b3b2", "comment": "Malware payload (AgentTesla)", "value": "45b88a718ddb3b2fc26604437e848ffde80be232ffc50b8426d93097cb122d88", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206092, "uuid": "33cd9d92-e34c-4949-a062-9a0eb298c68b", "comment": "Malware payload (AgentTesla)", "value": "19c5c99f30965f112deb66b99b401643c5ddb1d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206092, "uuid": "d6c42b54-4be4-4c32-a79f-9a32c0cea1d7", "comment": "Malware payload (AgentTesla)", "value": "9008fabe79e4af5fc0ef62007a1c3e73c4f3840cda42bfc1d0432fa38b82edbf52f405a0d00f8ca7ea0ee250e8a090d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206092, "uuid": "0d5bb451-d2bc-41fb-8030-070217378b0a", "value": "38325D56761AD068D33D207EB440200597D03EA5878FBF47B630E8247AABEDF77165CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206092, "uuid": "8daabe3a-733f-4b52-8ee5-7c614c686279", "value": "192:9+mw1ZOOV8vdQjmtN11IA1VhJlrG1zaHIYuzPV3dx2idDhah62DYtGD:95w1t8qmtN1iCJl0OJuzNR0qtGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206092, "uuid": "071700c9-fc70-4446-80ad-cfffa1e51fa6", "value": 11391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206092, "uuid": "eb5128c5-3e80-476f-b78d-c138a18f82d3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206092, "uuid": "c314dbf2-55b0-4ed6-9e72-94cc197399ce", "value": "SOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01885302-db22-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1625222466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222466, "uuid": "f514ac17-ea13-42ca-b1e9-25720b4703cd", "comment": "Malware payload (LimeRAT)", "value": "7f0c2d486aa38ea14d95f6130554fc5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222466, "uuid": "f2eada75-79fa-4773-b022-ec7fdb5e71c8", "comment": "Malware payload (LimeRAT)", "value": "463f7c4188aeeeea4da33b41fb0c420a3e9a7855e8e2a139add7d255153ea7ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222466, "uuid": "ad4053c7-cb3d-467e-81ba-d510293c1018", "comment": "Malware payload (LimeRAT)", "value": "87b668b3656d55251784d280ef3680c0c341e19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222466, "uuid": "e4f0660a-078f-452f-901b-033e47c798f7", "comment": "Malware payload (LimeRAT)", "value": "db584a7abe05de932442d31a373f03ea83022e7814d023184425804efa1e7f6dff4636ccaa57db460fbed1777df98fd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222466, "uuid": "72391041-936e-4224-a22b-57fda1ae2f48", "value": "7BA4025936E9B1BFD477EE3AA9E43C90EE2971733707611B1043064A460DE83CF926B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222466, "uuid": "8a91ac8c-6597-43be-93d7-4f2e3e5a8929", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222466, "uuid": "6f297599-17fa-45f2-b086-9c8e4243e84a", "value": "12288:+poAe8jzOBlAHFXRmz841iqpMcTfdGAJ+:2oA7nOUDmwlqpHTf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222466, "uuid": "8e75b5b7-ecc2-4943-8921-bbb10c72fc23", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222466, "uuid": "1a133b08-ac85-40d1-971a-439f368af37d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222466, "uuid": "e9ed976a-da2d-4aac-a1f5-672567ce0a83", "value": "7f0c2d486aa38ea14d95f6130554fc5d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cb1e8e4-db30-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625228659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228659, "uuid": "5ca1bd98-4508-4ade-9129-fb2c852a4d2b", "comment": "Malware payload (RemcosRAT)", "value": "b02b4f32f76a54f61df4de733d2cd6ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228659, "uuid": "85717a28-f8c4-4d67-9c98-1889f789f2f9", "comment": "Malware payload (RemcosRAT)", "value": "4687822138634f2bc1f49fb34cb97e37a37c397c0f76d2acd88b70672e321405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228659, "uuid": "7b30cb8e-85df-4025-89cc-b91fa716286e", "comment": "Malware payload (RemcosRAT)", "value": "269f35330984fde6e748702f25762cac7b0602f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228659, "uuid": "cb7ab569-4415-4b8f-9937-783b03778aac", "comment": "Malware payload (RemcosRAT)", "value": "ea1b94519973dc6b351b4ae16622abe634c14ee0a9326d91f93592af27c689ca0e68b41b0756a8a4849f265cdc930dc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228659, "uuid": "cd9d0903-d1af-4d21-b5dd-7363d9d6a871", "value": "8205236836EDB06FD473CA7A4AD53C92B6597332270B521E10E3078E1D1FED2DEA0925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228659, "uuid": "aa76fc25-3cd6-46be-9d20-9c01cd892d82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228659, "uuid": "1cb41724-1bbe-463e-9fdd-61dd35ddcd24", "value": "12288:VdTKwEz/8Oxa1mozwhiVkOHgl/zQKCG3TrxlAH9LggKppHFZmIU10:Vs7/8pjriOAlEu3562gQHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625228659, "uuid": "1f10c111-3155-4c46-b4bb-c1f4c64e7cd9", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625228659, "uuid": "44ec10c9-d404-4dae-977b-b05e4fc04169", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228659, "uuid": "87474cb7-61f9-4ffa-8464-66a1d7ab9d6a", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf08c65-dafc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625206483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206483, "uuid": "edebb9c6-adad-447d-ab1c-2f6f380b0c92", "comment": "Malware payload", "value": "43253387e0a98fa08b07bfb06f1dfffc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206483, "uuid": "1833b61e-af31-4eb8-ae95-4424f7c9b8e8", "comment": "Malware payload", "value": "487ae97354d7cb7c4667700cc7a94fe0df615f93b258a26bedafa8b4dd475f86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206483, "uuid": "43fec5f0-6c0c-4fce-85b9-a5e9b72c4139", "comment": "Malware payload", "value": "81f8e89d1f11e26db0367485dd7fef35b047709c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206483, "uuid": "fa95a109-58f2-40cf-97d8-313073642ad7", "comment": "Malware payload", "value": "9effb0ed82d4130a2ff547f533ca0b9cd9861ae574cd189089ce200b4091d181e8b0105c1546be80db8a7762cbecf625", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206483, "uuid": "2f82ad26-e546-4b54-932f-c5cfcda8ad0e", "value": "9205ACCC9C410019CF1F82303DA675AE3B5466A3C3151CB3EBD2564FA9727EAE50DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206483, "uuid": "d4145e17-565a-449e-8cbb-a0f649103c5a", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206483, "uuid": "fd38f8e9-c0fe-4e3e-b17c-058bf2efa018", "value": "24576:QCRhPN9b3wnpoa3XDkQ/VLBsY7dajVi6ZIbvCq1g2:RpNpAniaHf/9eYwxigevn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206483, "uuid": "42a34694-9172-45ba-ad34-e7bf5b822e31", "value": 856975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206483, "uuid": "3dd22e46-c39a-4623-a57b-2cf26da44e3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206483, "uuid": "1ad70850-d5dd-4513-b605-9489d3494ed9", "value": "Dhl 2341567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254ac670-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226821, "uuid": "35171a94-46dd-4c40-8b1f-a530d40cb9c1", "comment": "Malware payload (AgentTesla)", "value": "d6f3ec9f9650c5a9f881e76c16115315", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226821, "uuid": "eb2c084a-7b06-43a8-bed5-75f53c7870de", "comment": "Malware payload (AgentTesla)", "value": "49b9631169ec5fb8c29e44bfc11d0b8724e86051a7270faaf1d5293f2e68a596", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226821, "uuid": "cda83699-4bfd-48cd-8954-4f6b17430725", "comment": "Malware payload (AgentTesla)", "value": "f73a236ea6b861dd319c2caab709d68c039afd29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226821, "uuid": "1e2af985-9e9f-4b90-bd13-f51c26cd7065", "comment": "Malware payload (AgentTesla)", "value": "7ecf99b0476203a1132e67b95f117f714f64eb9283aaaaf92ab181d292d662e49c5dc8ca91071943b246c3bf14f2b343", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226821, "uuid": "4fcfc2dc-7720-47cd-8271-fb1b58c1b19b", "value": "DDF48E352BA85A26E0B65FBDC5A1109297FDF623AF03DC1C78B511C50752E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226821, "uuid": "53bd9e14-f257-4734-8d36-8b7d63a88003", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226821, "uuid": "e6d1534d-35ca-4785-9c26-34e67d7a2834", "value": "12288:penOqwIBbX5TyAUtcT6zC9g2WJUDHgZlrjGGNfruAOd0dmNGjM:penOqZw2s7nOgZlrjGkfruDD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226821, "uuid": "9ba0eeb6-e3e3-4c9e-9176-7d398fc66691", "value": 732160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226821, "uuid": "714f62c7-f472-47ff-be67-6be23ccd9994", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226821, "uuid": "52de5ce1-367a-44d1-9706-3733e412d321", "value": "d6f3ec9f9650c5a9f881e76c16115315.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8bf53d-db0c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625213333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213333, "uuid": "f8dd98ef-3f27-412d-824f-5c6617af51ac", "comment": "Malware payload", "value": "d8d99786c3cd74d865d90d931a825dc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213333, "uuid": "f148521a-ef42-4dd3-bfc9-3c6854ee4001", "comment": "Malware payload", "value": "4a6f8ca85ac6e056c7b373e73a387d91e038b20774fc0bc4c2792cd0deceac43", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213333, "uuid": "c809ef89-7caa-4e36-9039-2696dafe34ac", "comment": "Malware payload", "value": "e7c78baad07cd851f9426ebdd475b8dbd96053fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213333, "uuid": "f0bf487a-f2ba-485c-9403-c857dccee04e", "comment": "Malware payload", "value": "2e7204e60d39f029579954b3eb8ce7145ccb6eb3523f8a68c0a3ec422b99703f479552da962f448de3ed8a1d5f2aa90c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213333, "uuid": "1fb1bfc9-04d2-45c6-b5de-b37595886e14", "value": "1E254A23DDAAE013F5A9CD35163987721A364A7EA5944CA33AEE9D32C5014878DFC1FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213333, "uuid": "29fc665d-ef9b-4359-8569-b921207cc3cc", "value": "12288:4njKlBVy76gE/JsHzyse/ZLDTZgzf79U6oG8PSzpGeGBuLbb9tCX0xOYVjw5WZ2a:4KSzNELXZkuObmgw5WZOvxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625213333, "uuid": "157eae25-81e6-4d1b-8631-93b0ae2f46d1", "value": 963276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625213333, "uuid": "9456542c-50b6-4dda-9897-7ca1d2341b33", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213333, "uuid": "b34323b8-0dab-4e96-91c4-03e82c5ebfea", "value": "4a6f8ca85ac6e056c7b373e73a387d91e038b20774fc0bc4c2792cd0deceac43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924b79a5-db6b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625254062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625254062, "uuid": "fe42b537-dfbe-42d4-bff0-cf9cb74f6989", "comment": "Malware payload", "value": "c7a592e62fb6a5741c38a31b2fcee21b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625254062, "uuid": "2d138f31-48d7-45b9-a5de-ed1b81e2c57c", "comment": "Malware payload", "value": "4d8eaf37de32a6ff36c965b6e616e2085e2d1bd46e75344ca1fea59178c19f15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625254062, "uuid": "da1fc04d-0297-40b5-a257-724903fb5204", "comment": "Malware payload", "value": "545c919239b5d7a2e7d398a0c6317d355a0062f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625254062, "uuid": "ecde8fb7-991a-451e-8bb7-2847726980c7", "comment": "Malware payload", "value": "2175fa0877bfc9da83bce6fbace515e3ba9e5b72dc35b9f44574590472e1f6f04e2d986cb98c8f38915334c3a7860f8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625254062, "uuid": "5d24fe6a-7c9e-4333-beb4-3f7fa47e49e1", "value": "E90316DD8AAC09D2E07FF9B8D7E036064730557E2508866F54B688D6CD42BC2EBD816E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625254062, "uuid": "ee6d8752-ee60-4cc7-be0a-15275a2e3097", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625254062, "uuid": "7d0bd1f7-b8c1-45d7-8a2e-b9433568856c", "value": "768:q6XafEqnwgyDJnilc0kW2dGflfIubwC3pJvU7j1RgpMb88Ihl:bafJwgJcz7MpJijW8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625254062, "uuid": "6ec64a49-39ed-460f-ade8-6eabe0b08296", "value": 38288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625254062, "uuid": "3fe580f7-1613-489b-8db1-e4412602dee1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625254062, "uuid": "8669b9c3-cef8-4f16-ae03-a29a06dc0067", "value": "c7a592e62fb6a5741c38a31b2fcee21b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2f546d-daf9-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625204901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625204901, "uuid": "1a87f069-7cb7-4802-a0bb-8127179c5fa7", "comment": "Malware payload", "value": "ed264b18307a53686d070d6ca77b2ca9", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625204901, "uuid": "e6c981b7-acde-4ed6-bc0b-5c342bde9737", "comment": "Malware payload", "value": "4fafaff6ecca088a902870977158f6037a3dba53891c48608708ff8011ef091b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625204901, "uuid": "a6a29f52-98a2-4e4d-ba1d-991bb259e8c4", "comment": "Malware payload", "value": "47f6180ba6d6be2cf5000e8b4db22e56e8a7482a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625204901, "uuid": "6980b578-7684-427b-8709-e454809039d3", "comment": "Malware payload", "value": "af4e00d62c37d2f4a97f109308bf3cfb1bf97ecb2e60dfd6b5cdaeed9ca9d07078b598788d1b1fd03d1dc0b3099274fd", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625204901, "uuid": "7784ea65-b350-4dee-8eb9-ecb302503823", "value": "C544131774953404D55EE2FED63ABF0A91170B4B71C2F8B65838E4C73AD0BACB9512A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625204901, "uuid": "39b12e2c-410b-4094-83bc-a83c9cf37864", "value": "6144:sDmd54HXPLlq+uIi/F9PEnib8WfVJHiVg9NIHfr2xePEnib8WdbI3xHC9Xw:sDWyH/mI6F9PEnibJV9iVgDIzDPEnibI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625204901, "uuid": "558aee65-1d73-42b7-8b43-c010b34a66fa", "value": 264423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625204901, "uuid": "9d904aad-71a0-4145-89b9-2e4a1987b2ef", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625204901, "uuid": "e092f1ef-a233-437c-a1b9-30cbe6c12833", "value": "x.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf00bde-db30-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625228631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228631, "uuid": "b99138e4-5522-4e58-9026-3ab00b3ac17e", "comment": "Malware payload (AgentTesla)", "value": "c434a5c320bd394c2bdebee782534e8a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228631, "uuid": "f1bd8d8b-63f2-404c-9a1b-e88cedb0db47", "comment": "Malware payload (AgentTesla)", "value": "516608516257a2aef2e7984dbda4bc1fdaa7136aea1cd1252b98236febf26e98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228631, "uuid": "5653b3fb-5538-47d7-91d6-c22531db4c2e", "comment": "Malware payload (AgentTesla)", "value": "637005725b68c8c6a04e0e8fc0f2964ed1d36848", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228631, "uuid": "006f9fe7-2dea-4843-b039-75104d01202c", "comment": "Malware payload (AgentTesla)", "value": "63c8ed92e9f1c6ebd069484f83d87b62400e72605e9bddd7e9b7ea1afe887e415057b9dcd8c795c3896f400663e1f450", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228631, "uuid": "0cdaff0f-65e6-43aa-bfdc-dfe28f012d2d", "value": "2CD4122C35EDF06ED573DE7955D43C58EA69B2737706920F20A3029B8A0ED42CDA1A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228631, "uuid": "078e84a8-435d-411b-b743-b426ca915004", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228631, "uuid": "63457841-5546-46a7-a953-ffa5c7b9d483", "value": "12288:QCipzBPVzd8/CUSR6b7n2/LOV0bnbXBvW5NDEAx:DwBPYCUA6b7n2/paN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625228631, "uuid": "6deffd6c-9d15-4ce2-8ef8-7b8c83fd60e3", "value": 611328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625228631, "uuid": "7e4a93dd-275b-4ca1-80eb-36605c1f25b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228631, "uuid": "6e0615d1-7466-4e2e-95fe-d167ea2d99f5", "value": "CONFIRMATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00c74ac0-dafd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625206573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206573, "uuid": "014bef4b-6df5-49ff-a8cb-f6ec36ffe948", "comment": "Malware payload (Loki)", "value": "204566bba2d065d50a33ec4aa7f624ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206573, "uuid": "c4f4f888-181c-47ad-b9b8-39f4557f5963", "comment": "Malware payload (Loki)", "value": "517d6d3f48b9669667f28aed097da5beea8790170b52d5788880e0ec07e0d25c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206573, "uuid": "0dc442d4-4def-43cc-9008-f84bd7f9e8c8", "comment": "Malware payload (Loki)", "value": "29cc1fc488ff5df11512f24bd387234746088329", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206573, "uuid": "72e4ed1d-970f-448c-b318-d95f5f35d2b2", "comment": "Malware payload (Loki)", "value": "7a78b59839060e533d9f4af5929375aa5d01c03d4ca1624e960ae4ae7058d2e0378ef8122016f81611bb7407cad8326f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206573, "uuid": "424671a0-d1a6-46e8-b71f-0b4fa9c0d405", "value": "11F41AA8369070EED4B7CA67CAAB6C68EAB9B437570B550B601302DD4B0D943DF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206573, "uuid": "f960ee5a-ab60-4e14-ad66-558e7b39f601", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206573, "uuid": "d0903563-b694-493b-b21f-ee3bd8f92c2c", "value": "12288:6HVtvJCQZf0ItGpmRCBK/P1kLIHYRtva3tC1HKJOwnvKF8S0cY8u1om+Xud1K57H:oVtHC0/PiU4Xa3tC1KE5FldY32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206573, "uuid": "2b651925-a0e7-4c9b-8427-b54fc306d302", "value": 742400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206573, "uuid": "3faacfd4-52d8-4e85-a243-5264d6974270", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206573, "uuid": "79f8da72-6f2f-41ac-94c0-c34e05de95eb", "value": "4c43a4b3e24ea869ab7ab38b09c7a4e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df30deda-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191485, "uuid": "1153d174-b383-4dfe-9deb-d87d5d460445", "comment": "Malware payload (Gafgyt)", "value": "3a13173c6777fb6d5ef1a9b435966e0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191485, "uuid": "7d44bcb5-f7b9-430a-a721-cd35760ff839", "comment": "Malware payload (Gafgyt)", "value": "539301082d8bf064628e2ab5755fc726a2c1d2b704a39e66c4b4a42a0dba89e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191485, "uuid": "9dcb7519-46ba-4e5a-9d6a-44ba83df695f", "comment": "Malware payload (Gafgyt)", "value": "9358a6f6b838de75a3800dc89c39b4f5d47b8af5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191485, "uuid": "94190bb9-a650-48a1-9cf3-6f91a4b0b141", "comment": "Malware payload (Gafgyt)", "value": "cf76cbeb20f448232d6d9f16abb79e5db3a79ce7f12f6173f84b0530ce7e5384beb2b1fbf962267b9001c455dd4a1395", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191485, "uuid": "538432e2-89bb-446b-8038-7c547301bcfe", "value": "37833B13B71D0B53C49B69F029FB3BF18769B5E123A26180B11ABFD44773AB02512F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191485, "uuid": "b3c735b5-0c84-4d1c-8e94-f05204621a1d", "value": "1536:EQpFOADppqlDZHWwc31dW3ISvRd4bq3drhEmQ9VqXjtWf2Xe:ESVDu1Hc31dW3FoqNtEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191485, "uuid": "8e4d73f8-4985-4a3b-ba83-367ec0d295f8", "value": 88786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191485, "uuid": "3c23a8ad-01cb-4141-9a9a-7ff214ec3b6b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191485, "uuid": "e9f0f488-49f6-45b9-8124-fbc6a296eef5", "value": "3a13173c6777fb6d5ef1a9b435966e0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042d0db2-dafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Bandook)", "timestamp": 1625205720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205720, "uuid": "513fc41a-a824-430e-8af5-241830cc207e", "comment": "Malware payload (Bandook)", "value": "e65b1008653984079b9fd5ff4bae89a0", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205720, "uuid": "184cbe01-8f9e-455a-97cf-385d98aef9dc", "comment": "Malware payload (Bandook)", "value": "561cb93118fef1966a3233ae7ffd31017823dd5aaad5dc1b2542e717055c197a", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205720, "uuid": "0d6e314a-03bd-4a8a-9848-04eebc9222a5", "comment": "Malware payload (Bandook)", "value": "85b964fe88f0546aa56396c588fb85aa2760d56c", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205720, "uuid": "1308e775-22b3-42e6-bf2b-f72728e8783e", "comment": "Malware payload (Bandook)", "value": "0d17a9d6688e936b0c6098ee8d5bb4b267b2b14afcbc1e43d5f6b550311c85ef2ca5b79112a344be4d95261e5050b42e", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PoisonIvy", "colour": "#A4531C", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205720, "uuid": "02da4c1b-a830-48f3-b2dc-8bbbb5898fca", "value": "3E55F222B7E14837C12366759D1B53ACB43ABF102D29659B3BE82E4C6F3D381352B197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205720, "uuid": "a7512d24-2ec8-4d1b-9fee-73e982f824f5", "value": "deed24d19db8f2102db84df7f8719d6b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205720, "uuid": "3f4fa75e-5d36-4050-8359-67713cf79b2d", "value": "24576:1KW2vBF/HlUQopxIpMPKqW9O7x3AqbKzxBtcZKDjY5RJG:14BHpMSH2NbUQ5RA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625205720, "uuid": "8e6cc635-394c-4961-8d3e-b813d020ecc6", "value": 1391616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625205720, "uuid": "3c482c99-ff89-43d5-a85e-ed42cb8d87a3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205720, "uuid": "e74665cf-2d84-4d91-a192-edcb5e9f0171", "value": "COTIZACION 21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a26c09a-db4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239821, "uuid": "493e6f33-dd2d-4c1c-aed3-821ffd9d84bc", "comment": "Malware payload", "value": "87d4b10ba7dd4a34a7461400f8f3af6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239821, "uuid": "41098d3c-9469-46d1-b9b7-a75500a9c95d", "comment": "Malware payload", "value": "58c0c0013ac1adb68e886a81a1821b26eceefc24f98e3730f969cbb6bbc618ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239821, "uuid": "5619ba4b-b0a3-4aff-9263-1cf3b20946d7", "comment": "Malware payload", "value": "24291f7503deab7bc2ba67e9fadd6d3217f4be8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239821, "uuid": "80b7ec3b-9a9f-4f36-8e10-4365c10d1660", "comment": "Malware payload", "value": "a35bad79af27858cf4c80465544f19e03dc0a0cf63010789682e21b84fd7bf3244d19ba125f09682c948037ca7f08441", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239821, "uuid": "0bb42b61-3731-468d-a814-99843dc5fc3f", "value": "6F73D63B37671A63C0C9557116E30335B7F5DE1938B94387A8D17EA82F3AA8438163E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239821, "uuid": "05310552-5ec7-4352-8eb7-0db32186e72d", "value": "768:NUSl2lCJCKDCuTa0tZbwZoWwr24HI166lO+okEATHLtxvtE/lGNQou8pKSwnbHqz:Dd17tZbwZoUEwoZATrt9tE85wnbH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239821, "uuid": "235977b3-c457-42eb-9ca9-e7d7d3c116c3", "value": 76886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239821, "uuid": "a6aaf420-06f9-4a00-b1bd-afa19fc71031", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239821, "uuid": "c3e7580a-9258-423d-93ec-eb3d32354494", "value": "87d4b10ba7dd4a34a7461400f8f3af6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1ac43d-db18-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625218268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218268, "uuid": "c4154b12-4257-45bb-b27a-e4e6acc2b57e", "comment": "Malware payload (AgentTesla)", "value": "806a27b1d03e3a4c62d0a8bd3ef064a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218268, "uuid": "d00416cb-2a9f-428a-b7fc-3b29ce3f979d", "comment": "Malware payload (AgentTesla)", "value": "58ffdf4c2657e864ffdf4167663c55610e9be10becc21c0596e194a5d179fa67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218268, "uuid": "92113c64-50bf-4247-80c5-3522bca512aa", "comment": "Malware payload (AgentTesla)", "value": "2f165724bb88104354f323cb86c09bafef701edb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218268, "uuid": "1ec0c546-936e-499a-b3cc-84ef73e3b9f6", "comment": "Malware payload (AgentTesla)", "value": "3e5d6389d265c5927eedff8f8d579165fef8ffd87981b8f6443c6cd2f24f41f2c74c59cbd5e5d7c11835b2b5df89a6a8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218268, "uuid": "f201db82-3f82-4373-8f16-3025cc9cdc67", "value": "3ED4121C3AAA71EED077EB7A5ED43CE4D92972736707420B10C34289071EE96DEE1636", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218268, "uuid": "855bb8b3-e634-4a44-b3c8-2fe963ffc502", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218268, "uuid": "654cb0a9-80f5-4de8-a9f4-db974839d782", "value": "12288:zt0DuvJuugmSoivlQ/aizdE406tqQQL4QSUocEnlniVgF2JQDy:p0C4jmG8Rf068SFlYgF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625218268, "uuid": "b9f43b84-1195-4878-bd60-d039f124c8e0", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625218268, "uuid": "ab07ee7a-910e-4f90-8ff2-46dfae817b58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218268, "uuid": "2f168539-d97f-40f7-8a94-579498635f4a", "value": "sale order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9f4781e-db61-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625249807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249807, "uuid": "f6be3154-0cef-487d-aad9-ce1c3069768c", "comment": "Malware payload (Mirai)", "value": "905d3d558b7b2ae6aee561d09e526af4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249807, "uuid": "f6c13c0a-c2d7-4073-a97c-4beb29443c05", "comment": "Malware payload (Mirai)", "value": "59778015ddd2fdad94bb52b2b43cf82af5dd2e2526e8036211c0e92e2c8da1a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249807, "uuid": "17d78e19-526f-41db-86ae-9d84ae0596a4", "comment": "Malware payload (Mirai)", "value": "ca945334f40527d6cd499ee2ea29cfb331291ccd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249807, "uuid": "fbf73f96-cde1-43a6-82aa-9118bca131f8", "comment": "Malware payload (Mirai)", "value": "907f4043d1d0548055a3045890b7fdfa46205ef65b12e64c496f74124f20b41301914c49638944eab95f6460a5187d8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249807, "uuid": "58d28040-bb58-483c-8b05-2dd293c381dc", "value": "8343088964012E2CE9D758FD94669F0EEE551301A0A30B0FA7EFFD832D73239AF65154", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249807, "uuid": "90195e19-1eea-4189-8f7e-7bf3bbea0b36", "value": "768:8n7bHiKqMMa5urOu8gefBz0IG6Htz+Hbh+03WW05bnMs+oQLD4evKmNu:67bBbMWurOu7SzZMsELNnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625249807, "uuid": "6719ec71-1929-4343-9d82-31f5264be88f", "value": 55420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625249807, "uuid": "4daa3e22-4fe1-47a7-bf66-18466bebb3d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249807, "uuid": "ae2d47f9-e770-4379-bcf0-83752dca4b2c", "value": "905d3d558b7b2ae6aee561d09e526af4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304244d8-db40-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625235429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235429, "uuid": "28dbb77c-4e8a-449d-b91a-1f9f8cea1671", "comment": "Malware payload (NanoCore)", "value": "7a73362ffc54c2eebde127d65143bae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235429, "uuid": "e3087a07-5ed8-45b7-90d6-c56f869bf9f5", "comment": "Malware payload (NanoCore)", "value": "5acdcb8735f961014ceee591dabbe6807f7c01c9643c3f54ce70cd4994f3aace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235429, "uuid": "2d82296d-4d81-4357-9526-e64155f3f1e6", "comment": "Malware payload (NanoCore)", "value": "2006131b6f04b6b37b219dd3ef2b9e39bd17274a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235429, "uuid": "22ac7383-298a-4633-b356-de82331e8675", "comment": "Malware payload (NanoCore)", "value": "52c840abc977d8de6093fb0bfb957e1f203eacad5aa27f7bfea34212917a6fdadf84f62c28dc58791cbf6861ce7137ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235429, "uuid": "5bd31dd1-04bf-4630-adb4-d4e500bb4bba", "value": "7CB402959A980593D0175BF53898E502EF729FDB18B4C04DB46ABD232FB33921627C37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235429, "uuid": "dbf05f7e-50d4-49f8-9436-30ac5f2982e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235429, "uuid": "14c4524a-b444-4b95-91a9-67762db1a131", "value": "12288:NGpFVgITfsKdMIKZRKcDp1Q5eHiJwEov17M7Ithl2FLB:NYB7sKd3KZ33Q5pJwB1Q7IXwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625235429, "uuid": "79d0f819-e878-40ff-bb39-1521e83287a8", "value": 504112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625235429, "uuid": "a5dcdc2c-6aa2-4b5a-b1cc-9f193480645d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235429, "uuid": "f40c4e8a-263c-4b8a-8f30-ffade28bf784", "value": "INV_YT8930Z.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b36035c8-daf6-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625203867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203867, "uuid": "a6e4e3c3-f130-4d17-b0a2-bd3bc93b48e9", "comment": "Malware payload (BitRAT)", "value": "413e9b9beaf8267a1249b9e8f3de8f4c", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203867, "uuid": "b4f624ae-e5e9-4d99-9445-143d819f5024", "comment": "Malware payload (BitRAT)", "value": "5bef9e74939b0f612706898f0d77a7e79b01f3b55f73ce8f73f3e1a1cdc8fcd0", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203867, "uuid": "a305580f-79ae-44a2-93bb-9a40b7ab3cbb", "comment": "Malware payload (BitRAT)", "value": "6c565579e5b3c409307a7536d1ba6d1edcb68fb2", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203867, "uuid": "69f35a65-686c-435b-a71e-8c99abf1d209", "comment": "Malware payload (BitRAT)", "value": "8ef9f116af8380bb29acab17634275dbabf312db54be7087d88bbb2856d2c123e1ceb4b1c71e83423d4b7ad4a3dd26a7", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203867, "uuid": "dbb5475f-84e5-4b02-848a-668cc9eae6c7", "value": "8CC49FE3B1409CBFE2713A787C2B91C25406FD111E881A012EE77F9D9F3A252A9275D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203867, "uuid": "d465eca5-4d1a-4247-bd48-1d78f46179e1", "value": "adf45a21f22a163a3d7196819e1740be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203867, "uuid": "8697a127-067b-4617-9e59-0e8056ba9101", "value": "6144:v+8BzA7T3dMUA53bQu6YufA7dkVyOZHzMJEVBe1Lawpir9cdMzqdUFcDUKNu:28BzA6F3MZeCzHIP1+P9RXcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625203867, "uuid": "fc89a42d-3096-4cdf-8cf7-1915a63915ef", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625203867, "uuid": "18d94958-50a6-40e5-8016-77a13b76af55", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203867, "uuid": "8a7fc99c-92ef-4f15-957a-ba0d1331f214", "value": "Chkpmobmlxsjfxoesjjatsqpvetypduyjt (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766deefc-dae9-11eb-875b-42010a9c0053", "comment": "Malware payload (Glupteba)", "timestamp": 1625198181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625198181, "uuid": "de78f6ea-8e79-404d-84f9-39b7b2b5fbc2", "comment": "Malware payload (Glupteba)", "value": "13b753f9c80fc833e02928b47248b7b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625198181, "uuid": "def39136-2114-45e3-be2e-b929fba89536", "comment": "Malware payload (Glupteba)", "value": "5befb90b9e363ee7a3c80607b83247dee8d21267f5923345119c07ac22f0bdef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625198181, "uuid": "32d2cb0f-54a7-4cc2-bb74-6f78e9a5f1c5", "comment": "Malware payload (Glupteba)", "value": "c221047f96a5c84e00455959b79607d0191b37db", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625198181, "uuid": "ff535aaa-366e-458b-821c-c89ee50fa95d", "comment": "Malware payload (Glupteba)", "value": "88e1e1ef36f42dd6537b09b01024f2757ecaf22da83e628d6a8828fbaecd7de7235548cfce204a104e39bdc204449790", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625198181, "uuid": "5550dd43-9e78-4b4b-a0dd-0360525df77e", "value": "412633917745E931D9C28631EE81EBB89A313F159D38AF177FA005CA2AB16D2D7343C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625198181, "uuid": "f5f57b7e-e66f-43bc-97eb-91c2c9a27a0f", "value": "55a0c8c10bcaf6d6f8dc3c2058f9e5a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625198181, "uuid": "f89f1beb-41c5-4d1d-bde8-333c21c61678", "value": "98304:oE8bMJXipnwojOrysBEkK8Ob1R1jolRCr3R1KmcNVdE//KM:BCwXipnXsekKX5R1IR7XdASM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625198181, "uuid": "554a006b-100e-45b7-bdc2-98f4f210cac2", "value": 4607016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625198181, "uuid": "1830cf14-48ad-47f2-a551-8b328111b44d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625198181, "uuid": "fceefa91-64be-4218-86a6-c73732538172", "value": "13b753f9c80fc833e02928b47248b7b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30899bf4-db1e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625220827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220827, "uuid": "75d15977-bd2c-4797-8dd0-201b2c520977", "comment": "Malware payload (AgentTesla)", "value": "55d2b6cbbab43093214d72e7a0e9b8c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220827, "uuid": "7a365f1e-969d-4c8f-b01e-7c23305410cf", "comment": "Malware payload (AgentTesla)", "value": "5ce7bbe9a4eb6a3174ea9478adf2d767e64a473b1f67587053c18ff36cbc65a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220827, "uuid": "33f62127-e490-4fc8-a5fa-14053968b7d3", "comment": "Malware payload (AgentTesla)", "value": "6033859e7237d51d2906664a222e9a4b1b19c58f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220827, "uuid": "332ebd55-4a49-4bd8-8a0b-d5378892dc07", "comment": "Malware payload (AgentTesla)", "value": "9bf254d348b9f4670ffcca62dff1d06977f0f8e9f71466843007eb0905a421cbf524775fc4758a461f1f6a061cf6d624", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220827, "uuid": "4ed6e04a-5704-4a66-9879-e4a8a50f9ab2", "value": "B391E861576C2A83CE13A4F1D670FF5604E3FA6686DB1B80336DF9B00F1F3266525981", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220827, "uuid": "a3456852-510a-479c-965b-de92c9f2bc40", "value": "96:ctlipl/eBBshXhL2dg+H4554MRlFrl1AVlSqP:CUD/hxUYqVlSqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220827, "uuid": "7b63a5dc-de69-4808-81c1-830e126f72d9", "value": 4449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220827, "uuid": "39532e31-1f2c-4490-89ab-592ee3d10a40", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220827, "uuid": "12d4e5e1-467c-43de-983e-e9d1cbe705ad", "value": "DOC.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2715ce00-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Keksec)", "timestamp": 1625191176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191176, "uuid": "7f9f7a64-3ea4-46b9-b1da-7a141b801f1a", "comment": "Malware payload (Keksec)", "value": "2e4f5bdcd268ae8630a3e4cf3d71dd36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191176, "uuid": "b095a433-4802-470a-bc33-43a7cb6cb72f", "comment": "Malware payload (Keksec)", "value": "5de552fe6fa692ef3be849973d5f5798412ce5836d27be18572f0172dd25f96a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191176, "uuid": "b669edcf-81fb-43ab-810e-a34c27b21f9b", "comment": "Malware payload (Keksec)", "value": "0668464aa8abf90c0a642b1c06910b4082b58f39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191176, "uuid": "0227f0a6-714b-470c-86f3-b906e2166ffc", "comment": "Malware payload (Keksec)", "value": "7f51eac2b8e601f1bfd63ecde925db5bd167163db581101d9a67c5c59dd3997641a8e61d3122be290fa96f7bbac1bc7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191176, "uuid": "c21d1716-7c4a-4918-ad21-4995c9d3a6bc", "value": "C423028E99B83904C66D88F2A98947FC60403A9621571F4D77F15EC99F5CF1FA00717B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191176, "uuid": "7a1ea72d-a2b2-41e9-b8d9-7ff5f5d540ed", "value": "768:x6+qXZb0LZb1umPk0ZlUgSwVz1xhlU41vgGAYVWeYaVI+TupBTCY1XLcK+Aw:x6+gN0x1umPkQlUgSMlU41vgGjrW13Bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191176, "uuid": "8cce6dd2-4e95-4499-aeb0-2c3155978b3b", "value": 47384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191176, "uuid": "cdc01d11-d194-4bce-ac7a-9f2b13d22144", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191176, "uuid": "e221a2f7-fc64-4eba-a283-ffca82cd7fbb", "value": "2e4f5bdcd268ae8630a3e4cf3d71dd36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dcae4d6-dad8-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625190892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190892, "uuid": "51958ebf-481f-43b3-85ef-7385b60a9eca", "comment": "Malware payload (Gafgyt)", "value": "18e4777ff8c08ef37b0868fe801aa882", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190892, "uuid": "33d3e507-a5f0-4320-b2da-67442f4ff779", "comment": "Malware payload (Gafgyt)", "value": "5e1503681c18abd1a20f4849192419984c3804ac5090c5e2af24fb4e12fff414", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190892, "uuid": "aa4544b8-52bd-466d-9a96-eacfa15c19c4", "comment": "Malware payload (Gafgyt)", "value": "ddc503c5fd1ecc89a81b2e45f5c66f621c4d6397", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190892, "uuid": "90d77b96-e77f-465e-83e5-e68ec521c2a6", "comment": "Malware payload (Gafgyt)", "value": "9035aae6656baeca5eeb180def9f061e84c43878af5aecca67a707e6c0b49d60fb55885b7f262a65637bf770f4153b9c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190892, "uuid": "ead563e3-95ea-4798-bb90-5d03da1b80c7", "value": "CB734A02FB43C7B3C4930AB6029BEB5A0931B9AA5F179F45F32C7DB46B124C87216B55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190892, "uuid": "b0c835b5-554b-43c8-b29f-7da69daf3c6e", "value": "1536:xTqiVwv/WXKG01KNw7XsCtGV+7ConcmLI2VOCjXUfJRk:YiVwG6ZKNw7sCQv7mU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625190892, "uuid": "e588c90b-7306-4928-b2ab-0813a10485dd", "value": 76737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625190892, "uuid": "62f95881-5e54-4aba-8da4-d22cbc7ab5f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190892, "uuid": "9b24e1d2-8958-4cc0-8f72-c99ae69e0c9d", "value": "18e4777ff8c08ef37b0868fe801aa882", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44bd3c9c-dafb-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625205828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205828, "uuid": "84a7ca94-c60d-4aec-a95d-67307bc75a3b", "comment": "Malware payload", "value": "2c182c48da297dcee3c7cafab4e46161", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205828, "uuid": "62836673-608d-4104-b2f3-2cae92d90a35", "comment": "Malware payload", "value": "5eaa1f5305f4c25292dff29257cd3e14ba3f956f6f8ddb206c0ee3e09af8244e", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205828, "uuid": "8057cae5-6cff-41c0-81fc-1c7ad9e7a8ea", "comment": "Malware payload", "value": "d031305516b4791ec52a2bd03450d185c16e8dd0", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205828, "uuid": "4d9e4e0e-aacc-4468-abcf-27cfce3bcdbb", "comment": "Malware payload", "value": "035969e754a7f951da98e6410a3a649ca34baeca71ea113e5c18a2257e36f5eab436fc2259dd48b76e1216f0958dfc44", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205828, "uuid": "2dfe089a-3328-4063-8e26-39d533b61815", "value": "79E2BFDDE125DC9826461980B78C45EA42CE80D79E0A292F7E4C8E928B01FD3F1667E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205828, "uuid": "85c98c14-dbb6-424f-894a-37947e283939", "value": "768:cgK1kRQok8Qs7KYEPfOzFpC/dR9DGHg8sxhkbLlif7:cgoQEmS/d3T8/lo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625205828, "uuid": "229569c4-de50-4b3f-8cc8-677f0935b732", "value": 31276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625205828, "uuid": "5d52157b-9089-45cf-ab31-1982564eedee", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205828, "uuid": "de245359-d347-41d6-885c-c0705e7b372c", "value": "comprobante de pago corporacion alfeca, c.a..pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ec245d-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625233270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233270, "uuid": "c1afe252-174e-4107-8ae3-15cffeae0d61", "comment": "Malware payload", "value": "89a22b74a0378bf1aa4c46191ea1be33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233270, "uuid": "55f17d4d-8cab-424a-b0c8-9b12524ddaed", "comment": "Malware payload", "value": "613d268441e7f2c4d1b89ce514d3df952b863f1eb2f784fc1529fcbfa2c9203b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233270, "uuid": "3906a7af-f0fa-435b-b3e6-8ec101f17a39", "comment": "Malware payload", "value": "8973db0c024fa74f476c617c60a363a1c69026cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233270, "uuid": "433f8c13-a76c-4bd4-b24d-0b762b2a777b", "comment": "Malware payload", "value": "e0d5b8ff60d6e49c82aaf3471c65d7abb5ebb7d9ba6a15c8f71b5e0cd755a2cb899e35ab3a61b47cd854a7e3743e9549", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233270, "uuid": "538d0166-da06-41ab-be1b-ebe9bc755fa8", "value": "3DD30A4749208DB3C002AD72367722645797BE760F8F1696FA2DB9A04B3B4CE651FBD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233270, "uuid": "789e7878-4f95-4181-8c62-247fcd8fe0a7", "value": "3072:cHA4vY/n/8ofOkrrCaBDnQQte5etJ8add9QzhsL2xVdFydKQ5uGBgBwU:4A4vU8ofhtnQSYetJ8addQhHFydKQ5NI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233270, "uuid": "69cb757b-4106-41e5-938f-393aa4fea31f", "value": 138242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233270, "uuid": "b029e171-9294-4bbc-8274-f0f5a4eb8ffa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233270, "uuid": "d9969077-b857-468d-b5ea-cad752cdd560", "value": "89a22b74a0378bf1aa4c46191ea1be33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87cf68d5-db21-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625222262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222262, "uuid": "e40799ce-c895-4929-8fa3-1df775d28d3e", "comment": "Malware payload (AsyncRAT)", "value": "b16770011d5c096eabce6e04b1d91c4d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222262, "uuid": "f5159bdc-d086-4ce5-ba1f-8eec65c35621", "comment": "Malware payload (AsyncRAT)", "value": "614e92ab55c4fcf9cf18f02e5ba1d0108ba2e755ae6d0348aabe596cbcdd1d13", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222262, "uuid": "1a2064c0-e073-4241-89de-c7afec773f0f", "comment": "Malware payload (AsyncRAT)", "value": "c1f0fcbcc1a75e95b54ede7e038e26a806e225a6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222262, "uuid": "752a9cc0-7aff-4712-b79b-e130ae9e48aa", "comment": "Malware payload (AsyncRAT)", "value": "816fac32aec6b72364d481aff4b80770c1b7a0f14be4f7d5657442468aea3bbc2ce2eadef75e81da6ce984d5aa7b2efe", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222262, "uuid": "7b779b90-e463-48c1-9146-e191599526fc", "value": "BF219B5D2D5C737443DFC3532F3A00C2E45AE85A29EC9882E062F4F67628928C991B34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222262, "uuid": "87883a13-f19c-41fc-bb30-ce2aff471f1b", "value": "24:mOgAOxmMJVy0m6X2XqV/7dO2NGuQ5ffxRbc3j+Xqtm/:BgAYSp6X2XMO28uWfrbYoqto", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222262, "uuid": "85845569-9f46-4da3-bd40-ae4b98d09c7e", "value": 1156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222262, "uuid": "984bd244-e561-4cf8-8e30-41f4a7f45805", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222262, "uuid": "61d3f962-f0ff-42fc-9248-f055be172718", "value": "Statement-ID2729051060262217.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5e8640-dafe-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625207188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207188, "uuid": "44405fbb-c3b6-4569-8c06-866981b6dcc1", "comment": "Malware payload (Loki)", "value": "724deff3a2fb5549ad1f95fba056b5b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207188, "uuid": "e6b4794d-982a-40f6-b239-5cf254157e1c", "comment": "Malware payload (Loki)", "value": "61c61db5ebc4d0c1bea4504adc9462abd0d100e3b3e468a3e5381193d1d6aae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207188, "uuid": "7c7e8b82-eb97-40ee-aafc-0328289531c3", "comment": "Malware payload (Loki)", "value": "6258b280bd55cec6caa0cf77a62c2ce3c49234c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207188, "uuid": "756da9d8-db7d-419e-bbe0-69ab9dfb9661", "comment": "Malware payload (Loki)", "value": "726f39b4945da7753cc009c18c818964059b82241ad82af02ab3388bb0832a381055b54156ba1dec7e838c5994042f81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207188, "uuid": "8c1fb8f6-4381-44e9-914f-3890327cde2d", "value": "EE15A49D366076DFC867C876DA681C64EAA0757B830B9203902316EDEE4D99BDF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207188, "uuid": "caabe814-ddb4-4f92-b219-78edd5dc8a23", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207188, "uuid": "6299fc25-63dc-4c93-956c-ad4fa9048983", "value": "12288:FQkyStx87X5+GwATylx9dYTzlAdJ77FymkN4cO8oYWUGyoHiEGBb46O7DHGGjkCM:rypr5zox9dYTzlS77QmsplB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625207188, "uuid": "6070eb1b-0ac0-42c9-9fc9-c7db2aee75e1", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625207188, "uuid": "7b85970c-e7c8-410f-9ecc-75ed29a31536", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207188, "uuid": "6f090676-7e4a-4bd2-9caa-ea66b677c3c4", "value": "SCAN20210702074628711.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81e4be2f-db14-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625216669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625216669, "uuid": "ed86a6e6-48ff-4382-9e94-edf05a6fab33", "comment": "Malware payload (AgentTesla)", "value": "09851b9cf170c7ce15dbbfc963727ebc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625216669, "uuid": "e1a3fa41-7828-4fda-b032-881f6be29255", "comment": "Malware payload (AgentTesla)", "value": "6207ef2afeb35589b4c9f58ac7557ffb9670c81376f436b149ad8ca45a7630f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625216669, "uuid": "0dafe05b-61fa-4b0d-99ae-b87a71fc52fc", "comment": "Malware payload (AgentTesla)", "value": "e2f03d4114187d6801fc9c7a20f5be615f92fad0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625216669, "uuid": "25dc8297-11b3-4f69-bc30-d13b8dac528a", "comment": "Malware payload (AgentTesla)", "value": "c2c1721821f1c0c255c325285e4e76787c3212c8ddcfaf9214f95f9404198fbfe77f34ef888f8b0180c70c4b966415ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625216669, "uuid": "fac59240-61df-4dc5-a1b9-8507456f4688", "value": "A22412BE3360D4B3D79506B10B795315EFE1EE0810F1860FB7588FEE7D1A6838A1A592", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625216669, "uuid": "da8f72d7-292a-428c-9763-ddce23e44314", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625216669, "uuid": "eb6da035-152a-49b4-8f8c-dcd4d4a9359f", "value": "3072:iBkfJpRXATwMdFCcGbwehpQMd/hEUnwKcemivoMLadtk69GDzlxthfwOrfG4BP2T:iqjIKXhuPKcvArtvjrfGcP2jzxGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625216669, "uuid": "be76242e-18ea-4812-9e80-b59e8945472c", "value": 217991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625216669, "uuid": "33ac62cb-dc4e-4817-a16c-58a44f9b1e5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625216669, "uuid": "8aa80507-3478-4ecf-a931-09d45487613a", "value": "booking41023290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd181da-db21-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625222245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222245, "uuid": "7f7926db-2fcc-42b9-b999-7c1f77a766d6", "comment": "Malware payload (AsyncRAT)", "value": "284b50e25ce876080019c904a82d8801", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222245, "uuid": "df5460f4-7357-4ad5-980a-e16ed881508f", "comment": "Malware payload (AsyncRAT)", "value": "630d28404908012817da185f9a98caed780277ce397a45be3012e18fbb7563ff", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222245, "uuid": "beb44393-d790-4cb7-97d4-2bb37df4af4b", "comment": "Malware payload (AsyncRAT)", "value": "ff8b0af04b10b2dbfdd6ba5e299895910f75b8a6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222245, "uuid": "4d910a2a-376b-45a4-a429-040c0c33a25f", "comment": "Malware payload (AsyncRAT)", "value": "7a50d9474311486097b43d3680b8799a9d915b4a2dcf708f74cdbd6b4d578d43abab1eabcb71a486d346b0541efa9e73", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222245, "uuid": "afe0c953-f92b-4f01-92fc-af2416865110", "value": "262168042D541694335B07DB3E3B35C9FCAC948D78DB84538615ACEA7868C229AA6F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222245, "uuid": "6703286e-4b98-4100-a342-f5538462c113", "value": "24:ENsJ6JVMgARR5GC8QSQUUo44oqy2rHPxouZhjRjwSW00rbEE:gshgARR5PTSQUUo44oqy2rvxouZUl0Sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222245, "uuid": "8c576838-2763-40d4-a019-bae54befdb0a", "value": 1326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222245, "uuid": "9c955ab7-20c6-454d-ae6f-7395383c5c02", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222245, "uuid": "4a1b3bae-16a7-491f-9598-cf7b9b34d4a9", "value": "2-JulyStatement_ID1310710101531837.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecd08b5d-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191508, "uuid": "f3d487d1-f880-4a31-86c6-39a840796d61", "comment": "Malware payload (Gafgyt)", "value": "a15f8c1d1605ae3deee57599ae3d5709", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191508, "uuid": "0951d80e-213d-45f7-ab8e-8379df57d23b", "comment": "Malware payload (Gafgyt)", "value": "63a8bdb1bf0197aa610a9760733cd518c13d60d05f7db78672050bd07f97d4f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191508, "uuid": "205507db-6c6e-4992-bceb-fce9376f290c", "comment": "Malware payload (Gafgyt)", "value": "0de10d031f0351d50396b858deedcf15bfc784a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191508, "uuid": "825a69f0-fc4b-4368-b9ea-8e1870d5554d", "comment": "Malware payload (Gafgyt)", "value": "368fd5ca6eb315359b9d5d32f7843bc0854fe353e4c4d4ddf7bbcd5a09b4337ed261d48f19be2f6a4a8e91f506b569b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191508, "uuid": "61c28c1b-bf60-4a36-a133-539ef5401e84", "value": "4F23023A83EF713681B910BB72BCC4E92305E7A60297717444554B8832B76CF1AF395E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191508, "uuid": "c5b79fc4-faec-4835-ac75-a9cb9114a69e", "value": "768:7b8tBLJzbznoCvLu4ITGj/2Ts9sCNNlU5s3Uoz/GkwKds2cSHFrTy:7QtRJbznoCDu4EI+EsCNNlTz5wKdsEl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191508, "uuid": "aaaaca39-2ea8-4225-a30b-90b8f4aa9c31", "value": 46568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191508, "uuid": "3d001074-136f-4bdd-8e12-18bf02818d41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191508, "uuid": "e9c0e280-9f98-450b-b47b-381dbe3c323b", "value": "a15f8c1d1605ae3deee57599ae3d5709", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ad21d9-db6b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625253823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253823, "uuid": "798a2997-246b-45ad-92db-3c78070399b7", "comment": "Malware payload (Mirai)", "value": "0e22487383ecba42ced420e8de580e90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253823, "uuid": "b4b0975f-2339-4f02-a721-d61927f16643", "comment": "Malware payload (Mirai)", "value": "65951acdeeb48430f9c11585162ef8f73f0d406bd8073efd707073ed50447a5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253823, "uuid": "7e398792-b7ae-4d8c-8a9b-ff84b331cd38", "comment": "Malware payload (Mirai)", "value": "7d9d78925f1752801d28e5a1056686804f6ce1f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253823, "uuid": "1dd48ce0-6af2-4f8a-b5af-914c3d670167", "comment": "Malware payload (Mirai)", "value": "367b1129a47ec2970840fdcd9f006939fc7bee9b2db81f85171fed3a1189b74c69ba5014a712aa694aabe3d6998a5ee0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253823, "uuid": "332430d1-f366-412b-8ac8-51dcd7bd2477", "value": "7BD2E163E06BD471E16107BAE02386DB4319AEFCE0F3757B224856AC9CDBCA546744C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253823, "uuid": "c7ac9433-0bcc-4a67-9d9c-6c61428cb915", "value": "768:eusHfRaDk1yS3eJiv4D4FyFRM9q3UEL7B:IRQS3eQADM8HL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253823, "uuid": "6897b98b-d8d8-406d-8de7-689f4b423d54", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253823, "uuid": "3de9a410-88c2-4882-8457-8ee65eb5c435", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253823, "uuid": "5c799863-16b7-470e-8d25-7561a8b3fa24", "value": "0e22487383ecba42ced420e8de580e90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "386bc9d0-daf4-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625202801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625202801, "uuid": "fd0c0a79-6652-46e5-8e49-366e01b52db3", "comment": "Malware payload (Loki)", "value": "27362ac34d4a9dc03cf8ebbbbb5b2dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625202801, "uuid": "97ca5d24-d432-4a8d-b7aa-680478084483", "comment": "Malware payload (Loki)", "value": "667250857f2b30a82d4dd701c3f54c1fa47b033546b20082ae19fc779a526b65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625202801, "uuid": "6017aa85-0e07-41a8-aa71-0fe461d6bf90", "comment": "Malware payload (Loki)", "value": "17a6650260700116a12c852a239632f465b8305d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625202801, "uuid": "16d38caa-06da-4735-9a43-869d558995df", "comment": "Malware payload (Loki)", "value": "dd38efea13c15f9195323711aef897d70106a15106bbdea0e5c3ea490597df4e28a85c2a7342150eab819d5c3eed60d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625202801, "uuid": "897460f9-a2ec-4525-9b0f-3c66247651f4", "value": "18F42968369470AED4B7CA77CAAB6C68EAB9B437570B550B601302DD4B0E943DF700B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625202801, "uuid": "6f268bdb-879f-4856-90b8-0f2bcbb64f0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625202801, "uuid": "cd3d894a-cb74-431b-9d29-5bcbb593f4e3", "value": "12288:U4Z8kKOk5PMGpEGyWCA1953r1D0P/OCBRi8qI8tPHg4hqu3U+oIEpbrIVooDdGz8:pGNLD0P/OBFNHg4Mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625202801, "uuid": "afbb988b-8892-49ae-a2d6-37b073537bf5", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625202801, "uuid": "8c7f0a63-7b2a-437d-9f7b-a121f5c0fbe4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625202801, "uuid": "b6351a2c-8da8-4a86-9406-3fbf2995307e", "value": "svch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06f26329-db85-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625264995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625264995, "uuid": "082e0c9f-79e5-4507-9b52-b5237923fab4", "comment": "Malware payload (Mirai)", "value": "335d75077676cc8a3be1dd2a67338a2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625264995, "uuid": "f72268fc-3fb7-430b-ad95-09535f21522f", "comment": "Malware payload (Mirai)", "value": "66d870b9db3a6b21378490bc312b7d1b3ae7ebcd4b63255406252effe8445ad5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625264995, "uuid": "a03ab8e9-41ad-4d17-978f-392f9db31323", "comment": "Malware payload (Mirai)", "value": "12bd3a32114ba7236dee1b6d2641c9cd653fa834", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625264995, "uuid": "d81a35ba-9dd1-4724-b925-67c557c60ff2", "comment": "Malware payload (Mirai)", "value": "ed0223e35fb7547823e004e4a03d8e8ca5a48636cf41a916c1add51be37953dc8b89638b333618d85c44de5aecb012d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625264995, "uuid": "26e979d6-7539-45fa-9d43-a74e576c3f83", "value": "D3E2F281C2CD9D31E1D1453AFCBE0986779EB9B184F746193B914078BFF2420AD8AB13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625264995, "uuid": "e2b672a4-ecc7-4672-af06-d1cdb7336172", "value": "768:U4qNHVP+wlAQQ2fD4Ls+qObMY1f2RSahfnwmf3UF:bqNyqDOwY1+AaRnwmI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625264995, "uuid": "12e0ae18-f6da-4094-972a-6b509721bf39", "value": 31888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625264995, "uuid": "75f5eee4-af43-4215-8ce9-f2fb9d452749", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625264995, "uuid": "8382f4ae-321f-4bf9-a969-062153a11316", "value": "335d75077676cc8a3be1dd2a67338a2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06d0a53d-db6b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625253828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253828, "uuid": "576fbc3f-cc2e-4b4a-b8b4-1fd9a1461a4c", "comment": "Malware payload", "value": "a42a70615e6802d47ccf18858932bed8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253828, "uuid": "163b8e96-3ddd-48c0-9dfb-2e4ae23c2e6a", "comment": "Malware payload", "value": "6785c64a1bdc72a4c27cf21a478807dac184463945dbec21b3593577335d050c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253828, "uuid": "b51ec024-7278-4cda-a4a5-4ef0b473654b", "comment": "Malware payload", "value": "f8bcbd556ac051b933ee19ed61774fc5a4ee1ebf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253828, "uuid": "e8dfc6dd-4798-4f06-b0b2-18a2061374c4", "comment": "Malware payload", "value": "99d686db856d14390c10ce79891578d2f1b50861e56654f54980d37ac9c10b239ee75f0df1121dad2a947e81634ad18b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253828, "uuid": "46b6b2c5-2862-4354-acb9-6da32d186c17", "value": "FD14CF07B0243DB1D4A7E5F650607127F8653AE72E4EEFB5D87AC61BE0225B18723B84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253828, "uuid": "4c814e57-1637-465c-9249-608e548b10ac", "value": "12e30a4970af4cc77d5c6e2437bc7800", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253828, "uuid": "265939ee-0513-49d3-8203-b0cea9d68669", "value": "3072:Mt1lNCvWNelQk0wvfKG+wiDYdgmoZQBmPjcicIPcXpzpx/ttr1A:Mt1/IcwdTiDYdgSUPQicIIpzpxFtr1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253828, "uuid": "4e2521cf-0b12-40e9-ae23-c8511d5ac230", "value": 193024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253828, "uuid": "e40fd95b-e653-4cd2-92bd-0db6103976c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253828, "uuid": "60aa96c1-d5b3-43c7-8ac4-aed7b4ca4dd1", "value": "a42a70615e6802d47ccf18858932bed8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc7d1450-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625233571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233571, "uuid": "de85317e-98b1-48f7-89ef-22a1dd0e91a5", "comment": "Malware payload", "value": "6b23a29ed3e70a02385d7109fd00d01c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233571, "uuid": "3d1f3801-b43e-476d-859b-a0e0054a941e", "comment": "Malware payload", "value": "67d13a0aa248aa4745732701d8abf4af69ceb847e9fba2c3ed502021b6a92bad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233571, "uuid": "08890a68-258c-4959-ae89-fa78db33737c", "comment": "Malware payload", "value": "4da51a1106231373582db4a54cc9030362234974", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233571, "uuid": "62f78a00-7159-4c8b-a63e-52de16bd20e0", "comment": "Malware payload", "value": "da1a9e9e3acd815bedf81fc06da64888dee52d9abc7c5acceb62a409962e8c791172c6ae8902511a57afd25b06486732", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233571, "uuid": "75563858-d7b1-42a8-9703-a40da786749a", "value": "57F31906F8004767C2C26BF7B35B138D77625FAA5BC73341DA297DB02BE07991A39690", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233571, "uuid": "824370f1-264e-43cc-9817-1c8325d8e351", "value": "3072:eDBC+5idXDblhY0YbWJds1hbLtuMetJ8add9Qzhs3Ifn7pj6KXLqCQSUfWvQdok:erW7chbpBetJ8addQyIfnlRXLqCQSUOa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233571, "uuid": "ed3010f2-6cce-4d7b-b037-4c6dff8bbda4", "value": 158068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233571, "uuid": "abbde8ce-96f3-4e2d-a011-9e6d8da8715c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233571, "uuid": "9a4f872e-e115-4d37-8aae-edd9d50ad048", "value": "6b23a29ed3e70a02385d7109fd00d01c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf0fb7f-dafd-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625206673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206673, "uuid": "21a2dc57-8275-4dcd-9fde-c4e19b1e1367", "comment": "Malware payload (AsyncRAT)", "value": "4084a9e3f2a763e4d0e9f8bff3ed604c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206673, "uuid": "6972701f-a6b0-4798-9774-c34402de6630", "comment": "Malware payload (AsyncRAT)", "value": "68db8304172db901c1d2230b2d956df99fd2e3dfc761ccfab2fea0ddff011e38", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206673, "uuid": "9a22220b-59aa-48c8-8af2-248f6b006d6a", "comment": "Malware payload (AsyncRAT)", "value": "d820feb03aaf2ae0c33eec72b496dabef894f8bf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206673, "uuid": "4e71d168-8d30-4034-a579-1ac0c494f3a8", "comment": "Malware payload (AsyncRAT)", "value": "a2d91a773aec494413bf750176c2603f1a8f8a938ea500b132f922a9f911fe536d7cb3aa8c9816dda3a302462ff96151", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206673, "uuid": "8da415b4-baad-4360-ad0d-05bf82392f6b", "value": "6021AF4A1DF836F6B39243B2E83228D6FA65F4590CC7484AC32580E97DB6482CD63F35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206673, "uuid": "0b553c9f-79ce-493a-917e-ce7ea84a6588", "value": "24:eLQSmChpjERDv6qUcx20R1v6qSIsBpZfEtOpcysNhWY5eL/hc0r:eLQSm+pGDiqU+N1iqTsfZfMYcjNsfhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206673, "uuid": "c8494dbb-0d81-422e-831b-78bf4c88d2dd", "value": 1291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206673, "uuid": "d1e8c25d-d84b-4cc8-aa78-674900a6723f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206673, "uuid": "e33eddd1-7b33-4073-b6a7-beec5fa358a3", "value": "2-JulyStatement_ID010710101531837.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cd551b-dafd-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625206600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206600, "uuid": "fdd6d8b2-9512-4b61-a50c-4734a3ed0644", "comment": "Malware payload (SnakeKeylogger)", "value": "7ed7e61b3898ae0651d5ec333b122fcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206600, "uuid": "3ab0e0de-101e-446a-9600-f0910e1d8ef9", "comment": "Malware payload (SnakeKeylogger)", "value": "693e26fb8be2758c08b451cff9b6f61ac60f203060454fc09be91c493fe81345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206600, "uuid": "c59fb21f-2299-4d9d-9a23-b1b6372e81b0", "comment": "Malware payload (SnakeKeylogger)", "value": "1051173cf48aebc7e1252c1b90436168ea51ff5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206600, "uuid": "2f41d027-e263-4d65-a5db-63af28db4529", "comment": "Malware payload (SnakeKeylogger)", "value": "9114b6735296ff33eb5e4fc3e65ceccbf8b9203fa651709b364684ab3c25df0a0d2b9ca3cfc8b4536f70ce9622048565", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206600, "uuid": "dbb4a440-b4df-45fe-adda-8eb42953b658", "value": "A0E48D213FE44525E4B69F7BC6A76A0057BFBE336F17E50E284132C90773642C97262A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206600, "uuid": "5f14d6fc-0134-48c7-bc09-2e120d3eda21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206600, "uuid": "a42f3541-8795-4004-b116-a3e3c31260a7", "value": "12288:NYs2DJ1EOGQyfbWTX/4aYQ1sJa8EByxQIC8p6/CZdyLNmeeK:N0TjN/Byo66/Gyoee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206600, "uuid": "af44e99e-66bc-42e9-9f7a-06afb1ecd817", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206600, "uuid": "34f9f13f-7b53-45fd-9edc-2f8704421a4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206600, "uuid": "c1f34388-9c23-4602-82de-8034233c935e", "value": "uWN5X51RAlU0UO2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb21ffa-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625233276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233276, "uuid": "35933c69-3f02-4c06-ac95-d754d4cc4ae9", "comment": "Malware payload", "value": "00bd3371bec1d391c1cf481c8a48d697", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233276, "uuid": "8bbbd260-fa50-440f-aeaa-f816bbf79e21", "comment": "Malware payload", "value": "6a9bf5cb1e435d77072ded829d7928f9151546b49d6e1c836c2331cede92ee6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233276, "uuid": "dbe51a12-13b5-47f7-9139-b378e29c18ea", "comment": "Malware payload", "value": "dbd9e2922a7a3a8c3a1f3644162c9edf0252f3b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233276, "uuid": "6965759d-ad28-4056-bce2-676ac24213fe", "comment": "Malware payload", "value": "5595eae7e0e7301867052e857e365bd8e7ae937f0929fc3e9af2d4680e949806d4e49426226015ca7b9e093dceb08522", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233276, "uuid": "95f8e706-664e-46c1-8837-ee40b77cdf90", "value": "3804B81B77619DB7E81ECD3301965601108DDD6B05DD2BAFB2B9EA28E76A84F01E3DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233276, "uuid": "764c77b3-2159-4b00-9ac6-9857e2620c4d", "value": "3072:Dls/lPhHDtsXbeketJ8add9QzhsoewS3jdfi+8qLw/i+L9k:Du/llDiLZetJ8addQlexzdfi+8qLwa+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233276, "uuid": "d1fc91f9-8c8e-4dc8-8baa-a3ec06091aa6", "value": 186998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233276, "uuid": "7f0c3c72-ee9a-4917-9046-b3c4c46b6a9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233276, "uuid": "5de14f3a-e802-4c55-85d0-5af45aa4fd32", "value": "00bd3371bec1d391c1cf481c8a48d697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e59a716b-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625227144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227144, "uuid": "f937b13e-baf7-4b8a-a4d7-de8f389cdfbd", "comment": "Malware payload", "value": "46ad2980c5c0a22c927e227242d56dbf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227144, "uuid": "cf7e6af6-8f88-4707-8930-a133af767238", "comment": "Malware payload", "value": "6a9f389d3c7a07993f81b708ccc645db64e47080e04d23636de5e80968172d10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227144, "uuid": "f7089b46-8a1b-4d83-a63a-d7da9e063711", "comment": "Malware payload", "value": "f9485d836f3f2f67fc38c63cebe21b16d1e434ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227144, "uuid": "8b574384-c608-4d60-89cd-a9bdd36780e9", "comment": "Malware payload", "value": "042c1739310e648b8a82792bfef1db32b17328dd1e2d04a35120a89ad8beafbcab998e03058078c6ba7546b88ade6a6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227144, "uuid": "81b1d612-b8b1-4845-8854-186bd1a8436d", "value": "3E054BA8369470AED4B7CA77CAAB6C68E6B8B437571B5507601302DD4B0E983DF700B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227144, "uuid": "921b3453-189f-4292-943a-57763ffe51d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227144, "uuid": "71dffa3b-8b19-4e96-9f69-566447762cd2", "value": "12288:dxZw4OiYRnUdpY0lSQ7QSKBXY7/BJH8pOgMQOVmAvs6Wnn5CdnkSjY8V/de82euw:H9IvBo7jcsgMQO0V+kSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227144, "uuid": "7bbbf147-2c2f-43bc-8114-4e085dd68ec7", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227144, "uuid": "82935b6f-0d86-40f7-ba55-75aabd1adb03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227144, "uuid": "f6f3b894-5033-406c-94e9-6653cb506ff8", "value": "46ad2980c5c0a22c927e227242d56dbf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba41ce07-db17-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625218052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218052, "uuid": "9f98b4d7-c961-4dab-a2bf-a2cfde161f06", "comment": "Malware payload", "value": "2f49215b1984212fe4465288bda6a8a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218052, "uuid": "8e5b608f-c2ba-4f88-ba44-c4ef11716507", "comment": "Malware payload", "value": "6aae470221ba1879a26af8172df018f07eafa1f26857a8b33092b7da5582317c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218052, "uuid": "732a3486-fe35-454f-90e8-757fea1c5a86", "comment": "Malware payload", "value": "128b5625c29559cf78caf7cb17dbce55ac6c9cba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218052, "uuid": "a487c84b-e55b-4042-93ae-04de85dbadcb", "comment": "Malware payload", "value": "7d3341d29a02f1d616313525bc1986d92ef512313fc65286bf63d858ef00a357bedd3b937e6f42c6bd488270fb29935b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218052, "uuid": "8453f8ee-8d5d-47a6-8c03-ff5ffa8146ad", "value": "04063351BE862673D621293B4A18AB55643DBE301F10CFF76BD4669CE4311E2F338B62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218052, "uuid": "482b613e-3104-4238-8fec-122907da4875", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218052, "uuid": "f9a64320-b865-476f-a33c-523b68175492", "value": "98304:JLHchkUPVFHe69tey0rXFb0R+BXTz767WDb/8XHyohl:21VFHe69t90r1wMV/66P0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625218052, "uuid": "521d75a0-7236-4fb4-af60-690b6449dfb0", "value": 3817748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625218052, "uuid": "b446a1c1-f17a-43cd-8cb9-b4b634815b17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218052, "uuid": "4b3f5f0d-29e0-4d9f-9159-f85c87159db5", "value": "2f49215b1984212fe4465288bda6a8a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f1d1ea-db0c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625213395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213395, "uuid": "cbf28695-bf79-48d3-b67d-9808a428407e", "comment": "Malware payload", "value": "5f3e66414edf1e0d359baf6f48b2679c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213395, "uuid": "3695a2be-455c-4706-ae56-8ed2fce54a87", "comment": "Malware payload", "value": "6b246c2f756f7e603722a254e3e582dafa2a8fb8b398c4b66ebbf5af87926c77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213395, "uuid": "03ea81e0-004c-4373-8595-d6f10f669eb2", "comment": "Malware payload", "value": "d9dd625badf2ab6999530a5b36c30344f0c40839", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213395, "uuid": "272acf04-ef7a-4c0c-abd9-6b8b4f8be110", "comment": "Malware payload", "value": "9e4b8006dd520c93de5e4e492efdc26da723f783dd8aa6a7aef508f9a4f062056732b879875d59b332f44b7dffef08a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213395, "uuid": "59a43dfa-ff98-4879-9032-679eaa2683fa", "value": "6014B62DA360F573E05300714586C6A661216F70B00B9C6BB6CA1ABFE6787E6D327737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213395, "uuid": "7ac252bb-84b6-4606-83f3-f69e432ca887", "value": "6144:3PXxJXb//HLvcnV4zpCHGfohkxzb0INhhHq3lGvyjYnmz2NV0vhKLHYn8XZ:3PXXXb//HLvcnV4zpCHGfohkxX0INjHT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625213395, "uuid": "753f39da-83ef-4022-aaae-1fb7d6b72448", "value": 198740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625213395, "uuid": "cdf3564b-b839-4646-9d08-fc47a51945a6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213395, "uuid": "60febc45-84b9-47ae-9a5a-14da8226d89b", "value": "s", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d54d4a2-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226969, "uuid": "8207a1e0-c4bd-4221-945a-65551b1b976b", "comment": "Malware payload (AgentTesla)", "value": "8ebc020b149eb9d1b9334e5738e162ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226969, "uuid": "7f9f150e-7557-4cf2-b568-3bd611cc4db1", "comment": "Malware payload (AgentTesla)", "value": "6bf069abd9545acb9c28ea325847c2c00cb8eaf93b6ebacf06b0d38d363573ba", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226969, "uuid": "8833dfb4-efb6-40e6-8023-dff8419b2c59", "comment": "Malware payload (AgentTesla)", "value": "8c0f5d7294c0b4771874a62a2add9b1101d1fe4d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226969, "uuid": "aa6dd044-1f8b-4b19-93b3-4e548be36dc9", "comment": "Malware payload (AgentTesla)", "value": "59a8fe6dc1f5359d88da3acf41d99870c8bfc8509ca5eec063d4e7fbf096530ad6ad83d65f8952779b6424364f0f4776", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226969, "uuid": "4d4e6697-7f04-4ef3-b3bb-c48a12eea97c", "value": "2AE47D351BE85A35F0BA9FBDD5A120819BEDF6236F03D85D78B502C50712E82C9F162E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226969, "uuid": "07311079-ce26-4eb2-a111-6cd23a5587c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226969, "uuid": "842be5bf-1852-4fc4-b67f-b3f595e47b3b", "value": "12288:C0jDzrFwLwlaBbX5Tym1uXpoYUq/IeWf28832O7e8huslEF:C0jDzrFaQaxuXyYUq/IY88/7/huSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226969, "uuid": "99d055ce-ff7d-4acf-a2a6-6dc463ff843b", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226969, "uuid": "ac7865c7-185f-4060-aabf-7efdd6cc30ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226969, "uuid": "cfbeaed8-2e4e-47b5-ba1a-6054bd45f5ec", "value": "8ebc020b149eb9d1b9334e5738e162ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd417b9d-dafd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625206917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206917, "uuid": "8ded3c9d-b484-4684-ad85-ff0d3760bb09", "comment": "Malware payload (AgentTesla)", "value": "d481eba2608544d38d7ffd868cbd29b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206917, "uuid": "d068c401-7977-42e0-81b1-5b09c82c56c1", "comment": "Malware payload (AgentTesla)", "value": "6d329ad21fe8d102658fda10f85e24e2d5c829fb89962ef3de75a57b8f145718", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206917, "uuid": "5286dcfc-bb02-4bb1-b448-35e7eac6e803", "comment": "Malware payload (AgentTesla)", "value": "8f0f801c9c958438f56333870f2fa11829fd8f8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206917, "uuid": "a4b56810-6f12-403c-8a38-fc8146ddf7fc", "comment": "Malware payload (AgentTesla)", "value": "0cb236b3550973fe722e33a53ec001bbfaffd20f4c5e038313a24fbbb62431f91280bcdf2790648e1cf86ebfe66dcdc8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206917, "uuid": "555e04d8-39cd-43c6-87f4-cf94b5a860b7", "value": "91C4126932E970EFD033EEB5DAD83CA9EB68B1732707545E1097028A071ADC2CFA1575", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206917, "uuid": "df7a852a-6671-4cb4-aa62-253e6ead6fd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206917, "uuid": "b794312c-1830-421c-a848-c77a53c04f25", "value": "12288:xoW9C3D0DHAmIN4wi0aGvcbR9+jNzGmdvtX+vsXHSM:GNzfyV5GvxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206917, "uuid": "3edf7312-7814-452f-961e-0e4d63419a30", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206917, "uuid": "fee16889-2190-4818-9a4f-c9e1068af146", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206917, "uuid": "1a2da4ac-a58f-4995-86a4-9a647dc04688", "value": "gkwxP0eS1pS1Jl1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83792998-dad8-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625190901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190901, "uuid": "f2b8f79a-3af6-4673-8242-4dc9f42d86ef", "comment": "Malware payload (Gafgyt)", "value": "3cd5ed3104ed86ed0071eeac6a4dc7e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190901, "uuid": "965dfd77-61f5-45b2-8048-9bebdf1a6074", "comment": "Malware payload (Gafgyt)", "value": "6e0149ab0278615e016f2d47de72515c8d5d2887137c4a9fed621451b54667dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190901, "uuid": "cf36ffd0-8e7b-42d6-8279-69bf43e7ef99", "comment": "Malware payload (Gafgyt)", "value": "e7cb41b1640f1aaf95fb7ec798f446de1c866991", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190901, "uuid": "7af3ed2b-9376-45aa-bb1c-cf5fa313d3d5", "comment": "Malware payload (Gafgyt)", "value": "2a262c8834e3aa5442d4f88d7ebd98f130595de92b57ec601e093ceb3fceebaff1a265cda3ead8e00cb2b140c291fde8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190901, "uuid": "01a9df0a-2e83-4eb2-a69c-842e83e542ce", "value": "E8E33B09E6408B57C1D2277AF6CF424A3333ABA4A7DB33055938ABF43FC27995E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190901, "uuid": "964d9043-c3e6-47dc-966d-3fab09e69558", "value": "3072:LrbFJCact1nLNCn4IP9S6xfnc///M/9dcWVMXOmpwfvRQfZn:LrbXCact1npCB9SIfn4nM/92WVMXOmpf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625190901, "uuid": "c25360cd-f280-49a3-b8aa-04d4d055b3d4", "value": 152703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625190901, "uuid": "77ce7fa9-7f9c-4a2b-9260-05b8b7487773", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190901, "uuid": "df5674e0-f2ab-4980-8c99-d663f64ae2b5", "value": "3cd5ed3104ed86ed0071eeac6a4dc7e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b77868-db6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625253550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253550, "uuid": "31fcf1cd-0bcc-4cd5-adde-558c277de732", "comment": "Malware payload (Mirai)", "value": "61efa7ad25051bb425162e9a02eb9e81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253550, "uuid": "01f13806-06fc-4919-8990-f0fb62fc315a", "comment": "Malware payload (Mirai)", "value": "6f8a5bd7017b259845800684404ab05ee7699e2c057b0674c72de2a6d375c9cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253550, "uuid": "37bc7b43-3e19-4516-9c8c-0998b7441b94", "comment": "Malware payload (Mirai)", "value": "08cbc7f4edaa264900a8fc32087c141981e2e9af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253550, "uuid": "a6e77368-653a-400e-a87f-bf2078c9d512", "comment": "Malware payload (Mirai)", "value": "6be20ddee51818aa5e09a4073f6a41508967509882d0fbbdf8fcd3afa3168ea444edb7db8a24a958dc6d53c4c52a2619", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253550, "uuid": "d66799b8-d484-4c28-8444-fec39656e599", "value": "1E337DB5C579EDE8D1144A78BE248B789723E400C6932EFADA44C6699083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253550, "uuid": "d8a8acd1-0ec2-415b-bbe2-01c911687630", "value": "768:jaixFwtLSYAagMo0ebB4iZvQX3hyWfs3INgCJUU/qMCqKomQRCvL:jaQFwtOGSvQXxfs3kgCJt/qMF/RCvL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253550, "uuid": "328884a9-534f-4cb4-87a1-6a5bfd457031", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253550, "uuid": "243a7126-306d-4dba-b251-004b75cd3ff3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253550, "uuid": "eed22d88-104a-4c2d-a677-4199dabaa539", "value": "61efa7ad25051bb425162e9a02eb9e81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb8bf20-daf5-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625203510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203510, "uuid": "72d0b941-b225-44ad-911b-22c7734b714b", "comment": "Malware payload (CobaltStrike)", "value": "84caf3588cf3d0d0e57a546569c4e5fd", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203510, "uuid": "aa48d63d-8c6a-42f6-b3d5-d9541ea04929", "comment": "Malware payload (CobaltStrike)", "value": "709fe79070349671a355d87fc0e11415b325caadc5e4d2f389ca55ad01e3d599", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203510, "uuid": "02a8ff78-fbea-4f37-a85e-f9e093496a15", "comment": "Malware payload (CobaltStrike)", "value": "9a29ac44e312d7a8363eb08dffdd25560445e68e", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203510, "uuid": "7da15d80-1dcc-4213-86f5-10b6f40815e2", "comment": "Malware payload (CobaltStrike)", "value": "1b4bbdd5f896183ab8e975048972f71296932b408b7310cdbcf88cb7adcbc8923fab82ee8f4d7d72b6c26bb7df9aaa01", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203510, "uuid": "4bece1ac-84f1-414a-8acc-b90f3aa34e96", "value": "3124DF39A98BDB1CCD16FB725085706AEF5EFDCBCAAF1882F15DDE0602DA1B12341464", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203510, "uuid": "dc58db21-ceef-4c14-8dd5-11f878ea10dd", "value": "829da329ce140d873b4a8bde2cbfaa7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203510, "uuid": "c62d243b-69a9-4248-8e8c-1853ada54c8c", "value": "3072:c6jbYuiILQuxSgDtA8tZZDy2xf7PXaAZW06ep6ftAhCFknJcCEln5xUe2MF0:c6vY3UJSgD+M9YAZW0QyCFknJc75125", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625203510, "uuid": "9ad12abe-7478-4409-bad3-fe1f7293c375", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625203510, "uuid": "9bc64d0b-450f-4706-887c-a1354ff906ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203510, "uuid": "64c4ba17-64fe-4a61-bae5-8355d9bd46dd", "value": "84caf3588cf3d0d0e57a546569c4e5fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1c7dbb-db62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625250129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250129, "uuid": "6b4fc141-fa70-4203-a340-1649375d7106", "comment": "Malware payload", "value": "5a15ca04f68fe9e72f925bc6bca3db08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250129, "uuid": "e44760da-bfd5-4d35-b864-36b87975191d", "comment": "Malware payload", "value": "7555ab9b130a51f76de2cf1d0c738dd13744cd3ccc64090dfbd1b13dc7958b7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250129, "uuid": "f5221b18-24dd-499b-8b56-b5181bf05ce4", "comment": "Malware payload", "value": "94055f151499fd7c0e9352e9ac30b83af8d7628a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250129, "uuid": "6b261ccc-7118-4c5d-9b94-a16a34021423", "comment": "Malware payload", "value": "96495739f8bc52e424c08a266595c92ca2afa5ba48efb9b08b5c4196ab0d8513c41e438a3a057955dddf2843120160e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250129, "uuid": "bb20d46a-5e84-435a-9525-fa7590f292be", "value": "D8F2E052E9254A13FFFF3A754CAA83924B892BA172BCC9F312005FB45543A62D3648CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250129, "uuid": "8d383c0d-087f-4fb5-bd71-796e688f6d19", "value": "768:DHjObYgSEZUiqxUJdmKlnNUPUh14EIy4uVcqgw02NWXzP58Bi:zjObYDEZBqxUJdmKJiVEz4u+qgw06WXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250129, "uuid": "3b059627-019d-4d2e-8fb3-1b8c9e0fad5f", "value": 34800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250129, "uuid": "976a4b7b-17d7-4037-9494-6031a238bbf8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250129, "uuid": "d5c4e356-db1d-49af-864e-a7735695480b", "value": "5a15ca04f68fe9e72f925bc6bca3db08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14fd2db6-db71-11eb-875b-42010a9c0053", "comment": "Malware payload (CryptBot)", "timestamp": 1625256429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256429, "uuid": "17ddb903-3972-4496-b013-76cd296c52eb", "comment": "Malware payload (CryptBot)", "value": "5a3bc03f57ab36fb016ab8c6c8d248f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256429, "uuid": "31e013b7-cdc0-4b95-b3f2-7c229b9e5500", "comment": "Malware payload (CryptBot)", "value": "756ccf827ebe06d96fe8f88a43693332b0fc618ac747304b5b372b74f208abae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256429, "uuid": "d9cc59bb-ad15-456a-91d9-4054864c2d6b", "comment": "Malware payload (CryptBot)", "value": "2c8ad7ae4bce581009047c6242dfb369a657d794", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256429, "uuid": "420d3b73-5032-44e5-8e64-d55725e6e346", "comment": "Malware payload (CryptBot)", "value": "e1bba89d733943f4e4c82c324756f9ea7dcd87f42f789b5cea233d413dff2aa0a74da9b7058a41da96b710bb413c8dd7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256429, "uuid": "98550bc4-c517-4bbd-be2f-ae2c3bc3766d", "value": "B4F412527700F076D4614D301C6ED761979AA87259278943F3AC2F6E6E3F2C12AFA363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256429, "uuid": "906ee2c8-9840-4894-9d94-be5cd792d459", "value": "ba9b0f2c256a509c08b05c60ed64bfb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256429, "uuid": "87fc384e-ff7b-4617-bc10-0a432904f1d8", "value": "12288:gzQadEV6h4thKzwogAT0KBBiwpbYdYMPXKRBhy4ZQxLM:gGjtRoUKlAYMfKRztQxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625256429, "uuid": "b653a4b7-0cd9-489c-b299-69283502a280", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625256429, "uuid": "5c400bec-6b4e-4e30-ae13-0eb54af67ab2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256429, "uuid": "590030b2-af95-4077-a0d0-4ffe76723e62", "value": "5a3bc03f57ab36fb016ab8c6c8d248f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb4eeef-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226785, "uuid": "4847becf-34dd-42f7-84e4-de773a19bec9", "comment": "Malware payload (AgentTesla)", "value": "296f369decd12d95360b63edc2353eca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226785, "uuid": "3126628e-529a-4cef-8ac3-bc3212389c86", "comment": "Malware payload (AgentTesla)", "value": "768346b8124137be2bd3df87a7ce2613446ddbcbd1ecb6761e7a902cd9f17b19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226785, "uuid": "7b062c14-b9c2-4fd0-8ae3-6908c2244c59", "comment": "Malware payload (AgentTesla)", "value": "7114a3dcefde64f9f890db2daa19b3461038040a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226785, "uuid": "714b8055-f06c-4736-85c4-db95a52bbcf4", "comment": "Malware payload (AgentTesla)", "value": "b9d554784e49467b554949525c5d1a42296ed22a612a086a17ec3d15ee6265fc4cb5f9526da23e57c0e4b7f9648642f8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226785, "uuid": "fae813ce-7570-4298-b0d3-047344c70ee8", "value": "97E47D312BA95635E0B69FBDD5A1108197EDF623AF03D85C78B901C94713E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226785, "uuid": "ff42b4e3-f802-4498-95db-3fbf3ba4b4cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226785, "uuid": "c84fa716-5a7b-4f8b-806a-00a9e1744f0e", "value": "12288:vojGMwLBbX5Tyq7diPRjRm+fBTZZ8LxwkaizdbKa90TIcR:vojGMmFdiZjRmetZ8LO6zdbKwDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226785, "uuid": "25088430-e960-4ee1-97d0-8006fd441752", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226785, "uuid": "9d75cd73-4417-4741-bc9b-7b193cf1a8cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226785, "uuid": "fe78dda2-28e8-463c-832b-f5e101f53624", "value": "296f369decd12d95360b63edc2353eca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17420929-db4b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625240112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240112, "uuid": "94e4f0b0-08e9-4ab9-b05b-09c9ff9f15b1", "comment": "Malware payload", "value": "82a2866c0c9a74be7c8be8985841cead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240112, "uuid": "339ca863-6600-4ce6-9be3-7955e89c8d80", "comment": "Malware payload", "value": "76e1b0e0e76b03cad8bc3c5d0f811e6a14ab34f2c0f57d9b8ce060709b5c82bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240112, "uuid": "6740f340-c6ad-445f-95d8-6b80f05f28ba", "comment": "Malware payload", "value": "eb49492b31464a3c0f2617b095054bda02427f15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240112, "uuid": "16f7a1d7-3fe1-4079-b80c-685537642d6c", "comment": "Malware payload", "value": "3ff932d71cfcec30f64a12ca06817d06807a5f0371394653dd3ec03da2a6925a051630d931e2d4b375ae06147fdbb020", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240112, "uuid": "257d85a9-f97d-4f8c-80eb-8cd568056466", "value": "C4F2E130EA85D0B1E5C26EB5D0DB80D7861311ADF679F25361082878C9EA64B787F78F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240112, "uuid": "2a825be8-fa8d-49c4-a981-f9ff319b107e", "value": "768:wk1Ad+hrTxdXhyT1vSj64mqr0g/Pk5SnStEm7ZC1rrt7lEszq3UG:wk1AdGrTxdXh4vSj64m20g/PkYnd+qFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625240112, "uuid": "412ce6fa-ed43-47ab-95d6-a1d01c23344f", "value": 36452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625240112, "uuid": "2cc00eb4-59f9-4666-90d2-91573949632a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240112, "uuid": "414efb6f-43ce-4f9a-a610-0fa0247a8eb2", "value": "82a2866c0c9a74be7c8be8985841cead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f61bea-dafd-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625206614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206614, "uuid": "682c7996-5e4f-4a29-af28-93bb19fc04d3", "comment": "Malware payload (Loki)", "value": "83ebaaa4be265a4f56b93922507072e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206614, "uuid": "2aaab4fd-2e6d-416e-89fe-d5dfcb5300fb", "comment": "Malware payload (Loki)", "value": "778e33b811672935ff792d47f92b504644a19af130be967fd868e9f5b5a8c887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206614, "uuid": "15d2450d-86b5-4afc-9008-4c987408f4dd", "comment": "Malware payload (Loki)", "value": "e39dcec2dd84992054822c688e8630773b22825e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206614, "uuid": "c589b7d5-d930-4ac4-802d-642e9a7f370f", "comment": "Malware payload (Loki)", "value": "ef536471d67dad0ed1a0fc306f883f549cde3dd9d3560e70fbfc8b6caa3883866b2d7c987c445a73bd9ef8afd3ec2a12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206614, "uuid": "5a329c16-5410-4db7-bd20-69708414a6f6", "value": "5655D4D93650F6DFCB57C9728A681C74AAA06C67830B9203946335AC9A7F977CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206614, "uuid": "a85c5dbd-e078-418c-82c9-a5011a44b69d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206614, "uuid": "03fca8fe-48e0-42ef-9f29-c78385e677b5", "value": "12288:HC8EjFk33yB+ZBEQD7Ub1sX4RKRUW3sUIB7y1DoMXlCKFNPa0VnkbQwhOUHk217c:Jo+82XQKRPW7yCMdNPKsiPNeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206614, "uuid": "14fb46f2-0656-487c-9c9d-7c9099306d0c", "value": 1319936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206614, "uuid": "194e86e9-b771-454a-9a1b-0d5dc5ca4937", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206614, "uuid": "8fed4ba2-6d9a-45b0-8373-9758d1f7962a", "value": "vr23ZyeH19W2bUa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0006c8b3-dada-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191540, "uuid": "9e1385f8-753e-45fb-aa4d-478d69f2195f", "comment": "Malware payload (Gafgyt)", "value": "744de07764adae850098b36559a3d056", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191540, "uuid": "1d7b967b-a5e3-46b2-ac9c-d07146575b48", "comment": "Malware payload (Gafgyt)", "value": "7810c2b313e96bb79ea9540959df5b75377a952b6e7d7c3b096871bb6213547d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191540, "uuid": "45014095-7161-4843-8f96-2a0eea089408", "comment": "Malware payload (Gafgyt)", "value": "5980c3a4395b791d5e35d54607f036cb293e6e7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191540, "uuid": "690c52e1-af70-4908-972e-1776e7225a4a", "comment": "Malware payload (Gafgyt)", "value": "e40ffcd70caf1d8f650fbca9933926e8b487841ccae276f4bb13600d7667a3561c736145e6c667b4ff77c688997e756b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191540, "uuid": "d8236540-597b-45ec-ba49-0b4fb65668dc", "value": "05733C43B9619F77C08669B522B75E300B53B9911F4F1B99713CAAF8074B8CDB80EB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191540, "uuid": "098a702e-0146-4662-91c0-e54bd29a3846", "value": "1536:WPM0nfJMKoe1tO8bfL0aiNa4CF1dBmj9VqYLe8f26e:eHRToqbfIu4yNmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191540, "uuid": "5e60b128-34fc-41c3-b170-c87f45c86b06", "value": 80431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191540, "uuid": "3079b683-09b9-47c2-a8c6-4a397935808a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191540, "uuid": "bd77e77c-d05a-4be3-9d90-f73b693e4769", "value": "744de07764adae850098b36559a3d056", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cbc35d-db2b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625226629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226629, "uuid": "f9e176fe-1f43-4aaf-ab63-fd56d8817120", "comment": "Malware payload", "value": "a170a4ded11fcd705cc4c5d0f0f931d0", "object_relation": "md5", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226629, "uuid": "b157a3fb-0f83-4097-958c-0f58969dca8d", "comment": "Malware payload", "value": "782b601de98dd44c474770195fe8c91465465180e15cc3eef0cb89ab596b0588", "object_relation": "sha256", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226629, "uuid": "356059c8-2c12-4397-a0dc-b8cb115ee1f8", "comment": "Malware payload", "value": "738301274b8842e8375208a9d1a128f92e3426a6", "object_relation": "sha1", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226629, "uuid": "13fa6715-def3-44e9-a50e-2e99c2790c42", "comment": "Malware payload", "value": "d729925990b3c1145c282c3f238894e6d460601d5fb7e1aa069f07a1f0b0d7bca4e8a7674922d87217510e6b665e36ff", "object_relation": "sha3-384", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226629, "uuid": "4871a92e-7b4c-460b-916e-7f10f38d8457", "value": "E022B66CEA67439D8F8D73A446749D8C47E8767CE3804102397CA375278BF2B9B26871", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226629, "uuid": "e76682a7-5847-4c66-be48-a31f1c599005", "value": "192:8t69wnzdJkYM4v/4+Q/0C241ol9sTFXvf+qI4gkxAOUtNjtBw:8Q9wnoXz/j2vl9sTFXODEAFt9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226629, "uuid": "8844eeda-fb7b-4de2-8f30-4e9ee52ec623", "value": 10577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226629, "uuid": "92db8f42-687a-47c4-a3a9-41fc90818f9e", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226629, "uuid": "05a7b0b9-deb6-4929-a78f-cf709e0fb076", "value": "v.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded7174c-db2d-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625227562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227562, "uuid": "562c1fb1-e68a-453e-9c01-fd15b6c5789f", "comment": "Malware payload (Loki)", "value": "71a2b0940baa4e0409d397a3500cc1e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227562, "uuid": "5fdb9543-f437-48ec-87dc-517aa545383c", "comment": "Malware payload (Loki)", "value": "7842fb54799218ff1915ee26b0c44f1fcacc60c9edeb94241cf2961d1d92a20b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227562, "uuid": "f94b7187-6a21-458d-9d24-6b54c03411d0", "comment": "Malware payload (Loki)", "value": "93557d3c8b913e0788b3167c7f89270a9effe1c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227562, "uuid": "19aa4ebb-f156-42b9-8352-8414f2286c04", "comment": "Malware payload (Loki)", "value": "790eb5ea1b8fbbf0792ac6c87ed3a880a1f335787b330a4bc1050ee0a2f045145dd5b86e5c8a9232997db890a33972d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227562, "uuid": "74ec7674-21b3-4d94-8d04-0bdd5469aead", "value": "16F419A8369070AED4B7CA77CAAB6C68E6B9B0375B1B5507601302DD4B0E943DF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227562, "uuid": "2e85bbb5-129b-4223-b183-00dc444583a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227562, "uuid": "3703522b-504e-45f4-ac7f-56e09cc03feb", "value": "12288:nobX+oFENAohpmUHJi2qgU7ZaoSsjXQwZOHo1riZZhR/5V57seQ/nUKEY5aBXceV:oQiHHkSiZZXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227562, "uuid": "aa2b38fe-85fc-43af-a021-2f3e467b1ff8", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227562, "uuid": "cfadb3d1-b325-4586-acd4-978296f29955", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227562, "uuid": "d9a6c591-a6fb-464d-ac8e-322465b11f18", "value": "DHL Consignment Detailspdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a97c0e-db4b-11eb-875b-42010a9c0053", "comment": "Malware payload (NanoCore)", "timestamp": 1625240193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240193, "uuid": "18b03e6b-be4c-4ba3-8e2b-96c501eea5df", "comment": "Malware payload (NanoCore)", "value": "a38d097a4eee6500629e1f4cc76da1ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240193, "uuid": "8af97839-3446-4841-976f-9913dc599d8e", "comment": "Malware payload (NanoCore)", "value": "785b415f9df4411c2af809c0982f54a073281e2781db7c4ab26d69208e68a384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240193, "uuid": "38805e9f-ef28-4ac9-84f9-2bbcb09a3bee", "comment": "Malware payload (NanoCore)", "value": "62f3a47574864e61a7d73e1c5a6128e5dbdb00c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240193, "uuid": "64787ebf-7324-483a-9903-e14dd55e85aa", "comment": "Malware payload (NanoCore)", "value": "d076280f96194928dc2bce1e3cd5ddc1f982cda369c48f178b4314d378a365f1425fa94e700240a77da25995d3f1fe32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240193, "uuid": "56032143-6343-4e12-a6d5-cd0360252d00", "value": "2E351202BAC148B2E4B719314A3A6B046C7D7D301F25DA5FA7D418ADDF725816A38FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240193, "uuid": "d764ece9-f973-4db5-8c4e-b5d8f87cb999", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240193, "uuid": "683fd8b3-9d1f-4d29-847a-f1e2e23f3a53", "value": "12288:PQnk3GDYKGcblqQJ8kTuTZvGIEBXSm4/nzbuTFLW45K16Uc+MZ2bg6ge69TEfWnF:BAOcZpJVuNOIEBX2/zuZ5UDcajyJrQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625240193, "uuid": "5a388de1-9241-4d0f-9bf8-0c9a13469a4c", "value": 1160733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625240193, "uuid": "df328fda-26ab-4ae5-8ae9-bb8ea59d778c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240193, "uuid": "79bd4d6d-1b55-45df-bf32-82428532b746", "value": "P.O_3QS002021.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12adfe75-db4b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625240104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240104, "uuid": "61652ff1-c31e-47ae-99f6-40ae50555b35", "comment": "Malware payload", "value": "bdcc7fc4c94a5072ef3cd7edfd583d63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240104, "uuid": "e4881d3a-5f11-47b1-9f7a-af62f5a4fa4b", "comment": "Malware payload", "value": "795aa87aafb555f1162d8b47053ec5a2174de297f1e53d279b13892157630c61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240104, "uuid": "a813a068-1ce0-4375-8e0e-3894f7a66c01", "comment": "Malware payload", "value": "0a0059dc96c6a959e1c568d8dd071c9fd7db922e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240104, "uuid": "e75851c8-226a-423a-b960-4acccc1db6ce", "comment": "Malware payload", "value": "8de0a188d0c0bf5cef9e5767f3125d490afd7afb7d185a6d5db7e6e1c3603a1c74b9310837ab057f3a7fd75d75cccf2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240104, "uuid": "1b04fb15-8ab9-40c0-bd2e-b5ae66647f5e", "value": "23830705E550972BC1C227BAFB9F825E33232E64979B33115A287FF42BF179D1A39121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240104, "uuid": "5a5902db-c3d9-41e9-b2fc-921a08cb3121", "value": "1536:96nDo1vQWHqpQifvQ9adVSH5anOV0aIiY6xwsPU:118Q9adVSHUnOdra+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625240104, "uuid": "cd5e4c12-adb0-45f5-a1b4-9cdb37660713", "value": 84677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625240104, "uuid": "ea3a71a0-0656-4fcd-ac19-da25365c8778", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240104, "uuid": "72a5a7ce-2bf5-41ea-87ac-5a09fca62dca", "value": "bdcc7fc4c94a5072ef3cd7edfd583d63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f123b8-daf5-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625203498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203498, "uuid": "98e73bf5-5e55-4982-92dd-6970b35392bf", "comment": "Malware payload (Formbook)", "value": "69d628b5257dbea9d516506ae30c8547", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203498, "uuid": "5ae60b30-a058-4b72-a99f-9f63f7fb0bd5", "comment": "Malware payload (Formbook)", "value": "7a0321ba98c2658818ea4fdbc730942042717acee9bf54c37b0f6980e9e469db", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203498, "uuid": "ed9c48ec-ec76-4133-bffc-1dd65dc627e8", "comment": "Malware payload (Formbook)", "value": "1729a1c1795e7041f2ab12c781428751cf9aa4cf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203498, "uuid": "4dc262c6-78e7-42d2-98f0-2ec1d57f3cac", "comment": "Malware payload (Formbook)", "value": "2cbca2892f6ef2e7f2f61321941257d297dd131865ef225d7b4b6fcd1a542cdd413fdc8c148653c8e7a8997e5eac724b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203498, "uuid": "c55b148e-b4a0-43ad-8675-1c440dd5062d", "value": "ACA3020BA48284C67DAF0B11E3B26F95C91B7D69DC7108E7A613F49DA53801CADEF91C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203498, "uuid": "604d96cc-de96-404b-9c29-138799dd9c9e", "value": "3072:mIDC9bZgaQFejqaqZ4hMRYitnmsZIHjKKFtEQxFrnw:mmsZQFejqlqb+ZOKKHLw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625203498, "uuid": "144d489d-4f59-4cb4-80d0-d49301fce261", "value": 105849, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625203498, "uuid": "c84296c5-293e-40ca-b705-1c5998066ea8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203498, "uuid": "f17b9261-53c1-4f0c-a307-0ef9f6c12ebf", "value": "NL PURCHASE ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe656037-db62-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625250378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250378, "uuid": "e39ddb8c-5f6e-4125-93d3-ccc54633b67a", "comment": "Malware payload (Mirai)", "value": "69de0576a2fade0db0eff6b6d4b1e28b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250378, "uuid": "f2a8efab-4ec6-443e-a821-e1acebed3ca7", "comment": "Malware payload (Mirai)", "value": "7d329eb7b467e0030a928d9d9c7962cbb18f991a7015c5fc392b60064a33e9e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250378, "uuid": "b1cd66aa-d895-443b-bad4-7a3b0b84736f", "comment": "Malware payload (Mirai)", "value": "8ac014e7190b178c5345e76b411b06bef1bf23f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250378, "uuid": "5383b78d-0833-4898-b1db-b5077a3cc781", "comment": "Malware payload (Mirai)", "value": "f54e893c84651a292042393db703ef0977de40aaf745aa1d279b470ccac8827689b71191087b3b989c1d383ab913fc04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250378, "uuid": "9354c074-2ce3-43b8-b19e-62ead604186c", "value": "6D635CC4A597ECF8D85009B53136FB235BB7F13B342AD98BC3DD6563B842602E10A69D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250378, "uuid": "2ad308af-8784-41e2-abf0-d586f52b7764", "value": "1536:roG5+MJXLvZYSI5BlrqVXmCarEuVrymylZpR64TjT6pMrJLh:aMJXLxYSI5BlrqVXFU7AlB6Cj+urx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250378, "uuid": "54a95790-b7fb-431e-90ef-f2b624747d82", "value": 67636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250378, "uuid": "8a8b27bc-8c22-4dfd-b9a2-00aa749fb7b6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250378, "uuid": "deb6bfe3-74a9-4b2f-927f-2bee80f29287", "value": "69de0576a2fade0db0eff6b6d4b1e28b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b373b2f-dafe-11eb-875b-42010a9c0053", "comment": "Malware payload (Redosdru)", "timestamp": 1625207235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207235, "uuid": "39b64405-05b0-4377-a72e-b26bdecdf7d8", "comment": "Malware payload (Redosdru)", "value": "6c77c76454570716846ba6815034ba10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207235, "uuid": "a1d73fff-d58b-45c1-8b1e-3a2f4de9164b", "comment": "Malware payload (Redosdru)", "value": "7e2d72b0a1edfdcbff3274250989bebcfae867c42f1417057c8a5adc4c2daf58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207235, "uuid": "d139b562-7a6a-4eda-9efa-2d6046a22fcb", "comment": "Malware payload (Redosdru)", "value": "6d561bb28aad02ebd31563af498d763a529900df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207235, "uuid": "a51102ef-e7c5-4568-a23d-5b12209f96ad", "comment": "Malware payload (Redosdru)", "value": "70162156a20e58572b9ab2b9117e8288713bf3ff80e902f56a17d8d4129471423aedec66bc077ad4ab31367843611cbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207235, "uuid": "459e77f7-37e2-472e-97b5-d4673b64d7d3", "value": "E473C002FA95C066D05F48B19813CB78165AFD922B8B8F577580BE2FFCB27656F21280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207235, "uuid": "268ad7c6-6198-4d60-aeb0-f26c7864af26", "value": "7dac6a3c6231c427b0e3eee9e808d65e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207235, "uuid": "7391698b-116f-4b96-8f0a-73f15a3204a7", "value": "768:KYVNd+RLgdC85OhXarCuthQazw5zwTCunEQWf0oE6jxdCjq/awSpW+Nzsj8EZMuS:XVNoRKCWOhXicluEPrHI4+KZqi5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625207235, "uuid": "9af6c328-0fd9-445b-ad6a-899905945fa8", "value": 74240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625207235, "uuid": "ee7dfdd1-7c31-41b6-b207-2ddf7456322d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207235, "uuid": "66f79777-a468-4d79-8e5a-91af518ae1dc", "value": "6c77c76454570716846ba6815034ba10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3edae2b2-db1e-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1625220851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220851, "uuid": "8a49de86-c8d2-4ac9-8ef6-3bc03d335b62", "comment": "Malware payload (LimeRAT)", "value": "d15872e94e5148e2186ec70ac5d6971d", "object_relation": "md5", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220851, "uuid": "0c25d402-9033-41c6-8f56-7be793291df6", "comment": "Malware payload (LimeRAT)", "value": "7ef7fb9a4c66c7baf6b4ad158ff19fa496e7bfc4ed9d98c920054016c00b6cdd", "object_relation": "sha256", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220851, "uuid": "f89fcee3-03c5-4096-8976-c23fd08e7917", "comment": "Malware payload (LimeRAT)", "value": "3b4e3e5e79548c06a029a8d796b2c3b2ae682ce2", "object_relation": "sha1", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220851, "uuid": "8c222def-9ab0-4a6e-875f-2bacc6fc00e7", "comment": "Malware payload (LimeRAT)", "value": "9bc188b32eeadc86a9e343bec692da1292213fe2878cbd4374da140079c44e633528eaae4a741cf2752965f2593498b5", "object_relation": "sha3-384", "Tag": [ { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220851, "uuid": "e717bcc2-5372-4774-9a4b-e3d99c105f06", "value": "2F4512153538AFB6D9BB10327C96C7363B291E0205D882BFA5BCB166F6B31235742B4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220851, "uuid": "37b167f8-37a1-4c14-b64f-eaf2a54c33f2", "value": "24576:oDzFt1XGoE5mXa1DLMCYboSfIh6BViVRJd+kcznfGwsORVk3Rog:o3dGou1NLUophlVYkczn52J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220851, "uuid": "db38b3ab-8ec5-46b8-b64f-ec04218b112f", "value": 1227208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220851, "uuid": "067484e6-966a-4a25-99ca-8755140ee791", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220851, "uuid": "1afb12cb-1c05-4052-a950-369257f24851", "value": "DECL G50 EURL!.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf43222-db49-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239504, "uuid": "3b1c60fe-5f1e-4612-a000-afdaae409e16", "comment": "Malware payload", "value": "0d6601ed73891d2b31ad52df14abd75e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239504, "uuid": "a4b226ca-4b68-44b4-ae98-f934993f4357", "comment": "Malware payload", "value": "7f13e203881e95a8af004cc5e17e9c5a0f4cb42e36fe4d44f301deb733805752", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239504, "uuid": "7dea5a07-d12e-4122-885c-20e446c9d1c8", "comment": "Malware payload", "value": "c49823bcffb043ab29eb7360ac07475354d27a6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239504, "uuid": "e70b1dd6-9bfc-407e-b98d-cde9d1274aaa", "comment": "Malware payload", "value": "7ce8720aabe76de680bae734b4a800d8f0d6be41f0d71fd810cef4baa3e060b07b7571713517e28124006409f057e5a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239504, "uuid": "3d9ea1cc-4d69-4c75-8ee5-1b9fad7b5063", "value": "7E531947771D0B9BC48B5AB02CF737F187AABD6112AA5180E10DFFC44776AB86121F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239504, "uuid": "64e56be6-f96d-48dd-89ab-f7cfcc1a79fc", "value": "768:nUIaNczaeEJaViAk8WOdWEZzbVYivr3pPJ+J4U8Qr2pruJCXk7cnAb7IUPS7n7Z6:OJ3V8pVY+42U8Scr10wnAO7n7Z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239504, "uuid": "d913a914-e7ee-4d3f-a62a-22e2165609ed", "value": 64843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239504, "uuid": "698f9752-cc9b-47e4-9944-c0ffa73d45f3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239504, "uuid": "e56c57d6-8069-4a58-a229-061f3127e9c8", "value": "0d6601ed73891d2b31ad52df14abd75e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60ed73a-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625233560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233560, "uuid": "d474b702-d343-45d5-bd31-0848d6a4b5c8", "comment": "Malware payload (Mirai)", "value": "a4c31f3ce648942f61fb49615ec94f19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233560, "uuid": "85030cb2-f698-4ae9-b4c4-f91526932024", "comment": "Malware payload (Mirai)", "value": "7fbabe998aedd3600bf02015bed5cb68efcf8489156630f2be9feb7eedba4c2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233560, "uuid": "81548e61-8835-4a4b-8c18-be7f450cabcd", "comment": "Malware payload (Mirai)", "value": "eb17b337d429eea65bc732568f7030bf4a7d82a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233560, "uuid": "73c72ad2-ba6e-4058-854a-4261e4abd074", "comment": "Malware payload (Mirai)", "value": "b2a6dbe127c746b0db8100d8cb890f7b258f1c4d85d5825b94c50e05da1f369e5f066c6d8aa10239e90a13db60aec548", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233560, "uuid": "926bfc2b-acf7-465f-951f-010e6e623202", "value": "8D93800AAF611FF7E89EDC374AD92B0524DD511A20AD7B39B930D818F25B30F19E3865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233560, "uuid": "f0f363c4-9b79-42e6-a7fc-3460f7e870ad", "value": "1536:NYCYxrXP40ODyPwHRQ9PlzTRfyToNoZq9i:qCYxrKDy46NC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233560, "uuid": "d632ca3d-9c38-4a7e-84f4-836bbfc7be03", "value": 92100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233560, "uuid": "701a1191-2a4d-432c-950b-808424846685", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233560, "uuid": "5705fcef-7d4e-40f1-9094-741dbd11106d", "value": "a4c31f3ce648942f61fb49615ec94f19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58bc611f-db4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239792, "uuid": "d74314f6-a9ad-403b-99fc-a629145d0302", "comment": "Malware payload", "value": "7b1c08476b7588e595ab420d72296d94", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239792, "uuid": "acb9e52f-44a5-46ed-9fd6-8fa1d0a911a7", "comment": "Malware payload", "value": "813ac86260235b190565993c48874499d346280362fdf5cc1eeaa03f408ee86b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239792, "uuid": "f2cf4e84-38a6-4859-9ac3-779631cdf5b2", "comment": "Malware payload", "value": "31be18d37cb393ae0bfdbd1e6af70feba67f0bc4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239792, "uuid": "27ee5e5b-98d4-4820-a324-71eff5cb0f9d", "comment": "Malware payload", "value": "c2fe834fb888feffcc820f439601ca15156f18763acb25c52c63c4742fd4d1b36f5945e889d6f996aaccf3b12c0df2d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239792, "uuid": "eaf12905-391b-49b1-bbb2-80d6b54e2707", "value": "3203E13C720A14D8DE42D47452D013207EBD4BB2E096FC9A0249FA61895ACF1BE74EEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239792, "uuid": "1b8b87ad-dc9d-415b-a2ea-08e37257ab27", "value": "768:SPWl1tts6R5AFhPQ0CNDjphb25Ak3O6tgK8HhW+kwdJgGlzDpxYsb:3l1tt2Fh+ZpZ+Ak+6tgzW+r3VrY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239792, "uuid": "9fc4be8b-613f-4564-b47e-ec88abf64ac7", "value": 38804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239792, "uuid": "5de71126-15ad-4a2b-b3fb-c8fe2e2c3774", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239792, "uuid": "ef6d6207-ee8d-4834-874e-5ddc328c9ba3", "value": "7b1c08476b7588e595ab420d72296d94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bf7b8c-db35-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625231036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625231036, "uuid": "9b4427ee-cba1-4e84-892d-7317856ee6b7", "comment": "Malware payload", "value": "cbb39d70f6c8e81d2b96073a8c72bb20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625231036, "uuid": "aae27cd2-5a1c-48c9-bc57-dd432624eb9d", "comment": "Malware payload", "value": "831c7d8b75738072e74020f61670ebde2e88b4f72cac941cdddf09d5de263a18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625231036, "uuid": "38e923d5-9da8-477e-aa68-32fe50e2f462", "comment": "Malware payload", "value": "d6d4c7c348642d26f77688f10468b354d55d9684", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625231036, "uuid": "187c1e76-882d-4df7-9b2a-21a4ff6cbbc7", "comment": "Malware payload", "value": "2f91bfe39d549a7c2ba184ac73e1a477833812cbb2f4511d62fc9e6ef3380233a42386ff5256428e22c51f1eb2319420", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625231036, "uuid": "f9e665e1-cd96-4e08-a583-144d96f8815f", "value": "E8E423C95B863E75E8FB97B8D41FB520D416C05CCABC33E98483ED14B46F389889A172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625231036, "uuid": "8e9cc193-191d-4ed8-90ec-8e17abeaf2c7", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625231036, "uuid": "20ceff05-9f75-4915-a159-235fb6a28481", "value": "12288:AYV6MorX7qzuC3QHO9FQVHPF51jgcazaN78i5Pnr4I9Xr8+QbrfiNn3WOXPw:fBXu9HGaVHtL5fkIa+kfiNPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625231036, "uuid": "97fb5cf2-3a83-4640-842e-2df0a1957f69", "value": 701952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625231036, "uuid": "15a3124d-b9ed-43ee-8ead-d9b76e9ec20c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625231036, "uuid": "379b3d39-fcda-4827-a266-be9050eed659", "value": "WhyNotWin11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96bec829-db88-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1625266525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625266525, "uuid": "eb27adfc-db65-4e0d-9354-f218fa1f8d6a", "comment": "Malware payload (DiamondFox)", "value": "66905788e3fb350a6134a1f2bf7bccfc", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625266525, "uuid": "16969d02-5fc4-4667-8ee4-bc6b3902f6bf", "comment": "Malware payload (DiamondFox)", "value": "83571a7d91666d2bd461324573379810b2674e640ebd739b24cb4a91c00345ef", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625266525, "uuid": "c8b44614-5010-404a-90fd-f492e0a14159", "comment": "Malware payload (DiamondFox)", "value": "b8d03df995e0657a11697f668d8ea437089b8e47", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625266525, "uuid": "cb583612-5f2d-40c9-a983-f797f100f966", "comment": "Malware payload (DiamondFox)", "value": "b9088b643b64565317ea15770f60a94248ca33b1288d8f4e7138a80b877d1d8a01e095e262bb483a225bbe0d4bfe8f16", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625266525, "uuid": "4a615685-8541-412a-a80b-8d35eb3060b6", "value": "BA2633403AD2D0BBC7C500B76714FBFF99BAC78807140AAB77651B1D3B7E8AC9629584", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625266525, "uuid": "8177b3e3-3b88-47a4-b064-9c6df21f85ba", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625266525, "uuid": "b06975b8-2e0c-46d5-b776-7a13e58978ee", "value": "98304:xxNTswIPQdVU62lN0y5EZ1rFoOtl08WxlwEmjB6tfmCvLUBsKLCqq:xv3VU6sEZ1Zvl08Qwxt6tfPLUCKLCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625266525, "uuid": "98a2d729-560e-4c87-98bc-dd741277c333", "value": 4723995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625266525, "uuid": "6f205b18-9ae5-415e-8533-48dcd5410417", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625266525, "uuid": "0743b3d4-3f4d-4007-9de6-ac3dc9b38b05", "value": "66905788E3FB350A6134A1F2BF7BCCFC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b687fbf-dafc-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625206296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206296, "uuid": "0448eff4-5828-41cc-b0ec-3c165d8de3c3", "comment": "Malware payload", "value": "5686d00772232618044588e01ed317df", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206296, "uuid": "c6838b42-a4f3-4c8a-8422-32640195d91d", "comment": "Malware payload", "value": "835bb8f0fb1dc107fe890b434cb7f8ea206ea5bb07eb50cf2c2c715942ed4baa", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206296, "uuid": "ea698ef9-ae7a-49d9-8983-68ff98584a70", "comment": "Malware payload", "value": "a359e0b0d670a11d2ca5ddc5061132d76e5f6e4c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206296, "uuid": "07f46944-5a03-4372-8491-704cfe7f4b00", "comment": "Malware payload", "value": "3074473d5cc62e4e758a95ae1b20ea375df3c897ba494f222cf1be3c87f4ad75537f07f214b7c2f0c8f448d6f1f84201", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206296, "uuid": "f509425d-a66e-4d80-b5a5-596105804bd8", "value": "CCB255433ED5D2E60AB5BC43411FF73A4B7EBA98C47A491DE491420FDEDA52848133AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206296, "uuid": "9f3f4984-56c6-4f3d-b950-84304feb6c82", "value": "768:KzbKzzzzzzzzzZzzzzzzzzzpzzzzzzzzznzzzzzzzzzfzzzzzzzzzqzzzzzzzzzQ:v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206296, "uuid": "5ebbb98a-60bd-4b3e-bb44-baa422481f6c", "value": 24984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206296, "uuid": "901528e8-f382-4efc-aa3e-7777d777b28b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206296, "uuid": "1cc12f14-1bb8-4556-9a07-2e9989397b88", "value": "MO63562377.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcef46d2-dafc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625206513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206513, "uuid": "a42b9484-0a39-454c-86ad-a760150db423", "comment": "Malware payload (AgentTesla)", "value": "5b327a3df82cdcd9e52e594b960112ea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206513, "uuid": "37ce779f-e154-45f9-a786-d050b456dc20", "comment": "Malware payload (AgentTesla)", "value": "8408707aaa2dc1118bda9431f110e265d716b5cb5bc0ca8a9655828cad8b7b0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206513, "uuid": "bd5ee806-098f-4fd9-be5a-81fd590fab83", "comment": "Malware payload (AgentTesla)", "value": "842e6d5d2abe47fd4b5b1d566b6daabb638cd436", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206513, "uuid": "52b16a6c-0acf-4477-bd08-940cdd2c486a", "comment": "Malware payload (AgentTesla)", "value": "2d02134630d4fd620dd424ebc953d443b6b6e856f4140efb2c920f800989fb4ab7d40945332e09b980ff89162b746a55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206513, "uuid": "1807b79d-7975-447e-8960-13cd02a5d6a4", "value": "43C401013D26B282C2598B76C9D3D1A30B306D1E2621DA2E68EC7FEBF5763574F0174A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206513, "uuid": "44f8d4a5-b85f-4db1-ba6b-0c405c591751", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206513, "uuid": "612a2872-3605-4380-8c5b-0edb2e69ad97", "value": "12288:8rEFVzMFBlDOdJf6t7ViSy99TRqUU3Kk6A:3a23StRs99TwUCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206513, "uuid": "68b1c98b-fbf2-4dcc-8ba8-efea9d4691d2", "value": 543744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206513, "uuid": "b25d3300-c535-4eca-bfb6-987bb470c2c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206513, "uuid": "2c1a2517-8032-4f14-86c9-6d0fe725f036", "value": "Vessel's particular_DRYBULK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e38e9f5-db79-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625259961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259961, "uuid": "8e7facdd-d487-4ccf-a382-9899208d593e", "comment": "Malware payload (DCRat)", "value": "8200e9229e3bcbde18eb0be7e90a691e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259961, "uuid": "2d57f36e-804d-4698-adc6-a2cf742e2946", "comment": "Malware payload (DCRat)", "value": "88771c803925c9b53a6eeedbf38e34bbb20cc6ab5861ca8789b1efbdda0cbbb2", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259961, "uuid": "c1bb8c36-6088-4b6d-a655-101682a1c232", "comment": "Malware payload (DCRat)", "value": "bbe63015b898a1bdc94057e1efcd79c351897ff4", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259961, "uuid": "04432804-ca89-484b-86b6-117d1dfee2f2", "comment": "Malware payload (DCRat)", "value": "a59dedc42b8b2af30b8481daf9232371aa276e242b3e096fb21173478ab854806e37f4af7f7d45dc748f0299a1b80767", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259961, "uuid": "d7acc9d5-1263-4fa1-93b4-c6767cebb091", "value": "B2355B242EE95025F17B5F7896E879E5CB7EBB623B52B90E01900F850E23741DC94B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259961, "uuid": "2a9acdf6-1d3c-49c3-b693-0997a2353753", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259961, "uuid": "0f84ad38-d79d-4c1d-bcbd-21b1c1df74c7", "value": "12288:JRZ+IoG/n9IQxW3OBseWVhQkdbDqnOGk5+FWM36pv8ZcYoMW2MYKxSKh2YdWnf3Q:B2G/nvxW3WwjQkpD+OGkoQpvQUMWcznY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625259961, "uuid": "7975deb4-b067-410a-bb6e-3da1e81637d8", "value": 1113242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625259961, "uuid": "56d36d5b-1093-4741-b5ad-95ad55aee399", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259961, "uuid": "9bc46417-af5b-4f8b-bd7c-2cf33da9ba93", "value": "8200E9229E3BCBDE18EB0BE7E90A691E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8004ebd-db21-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625222370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222370, "uuid": "f23c627a-34eb-4b95-9530-3bcf9f0c497d", "comment": "Malware payload (Formbook)", "value": "955e4e99156906c0feb34239ede1e942", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222370, "uuid": "18bb8c4d-fa41-40b6-9c93-c7af88bbd5ff", "comment": "Malware payload (Formbook)", "value": "8a10e17372d6f0d1216481058f73b83733ffbdd61ccb4a92ac7543b0308bc5ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222370, "uuid": "5c3832bf-69cf-4772-85b1-b0cf58b2c489", "comment": "Malware payload (Formbook)", "value": "d1a84c7342ee2654cc41a48a3c8e0581336d8cd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222370, "uuid": "2105782c-6e5c-4f25-ac6a-62fe3b11ceef", "comment": "Malware payload (Formbook)", "value": "5f178a07cff5c0b21d35e3f6a5d94f949e40fa8a744fc95d99e6ca935d7e33f16ad7d204ac96402d4a7168e7d75ab9b7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222370, "uuid": "a2846501-d548-448a-8075-4eb078f33027", "value": "FC1402696760C8B3D77153315A2683979FF6DA112948530BB7808FBFFE135E28E4B242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222370, "uuid": "348a9e53-72e2-4643-92fa-385a92e6c5db", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222370, "uuid": "6625f3cd-fd14-49cf-a1a1-5cb54807cff3", "value": "6144:iqjIK8MYl9vxY5qE6JlIgbxMO+A6TbJg+YmbqzqhzTP:zpiW5qE6rI++A6TdgIT5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222370, "uuid": "24d1acf7-f367-4ab9-a0fe-f5befcdc9859", "value": 197759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222370, "uuid": "24a5460c-d857-40d4-b129-efe2ff188c83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222370, "uuid": "d6750be2-35b0-49ad-a958-52b22fed2770", "value": "955e4e99156906c0feb34239ede1e942.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64135fda-db6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625253555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253555, "uuid": "1371ce3a-9476-4fc1-8524-7c12a1759376", "comment": "Malware payload (Mirai)", "value": "cea2def6f4043d9a4383dee712f144f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253555, "uuid": "b6dbd542-a4bb-4b85-8516-66a6b062683b", "comment": "Malware payload (Mirai)", "value": "8a3f8e5d4b4dc41eda911401fd747fb85bb2953f41fc17ae252bb21e0e34781c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253555, "uuid": "9e68ca41-afa2-4598-a23e-776a10670441", "comment": "Malware payload (Mirai)", "value": "fdcf37c4f4fff4be8ddc4a994317f7aacc471c60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253555, "uuid": "53f5da19-53d8-4688-b24e-96c6889dea84", "comment": "Malware payload (Mirai)", "value": "0f3d37faba927075a3ce0f787fb0d01e700b251581d3e781608e7e070236b6bba9f280becf99f29a3079db64445bedde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253555, "uuid": "769bf0b7-1c68-4f76-86cc-daf28898e016", "value": "58B2DF15C1463DB0EBFB6DF46AC5E2E137A00EB9B7278CC109C877135A0287A2B54DE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253555, "uuid": "088c0d88-16e5-4ad7-849a-059d7302250a", "value": "384:tA0AeimAzNCdvw1PwIWFtWDhq2BdVScvD74HpnKRB/ihdJLM4uVcqgw05VxJs:dApCdvwJ+tSjhv8pn7hT44uVcqgw092", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253555, "uuid": "57de6f90-4352-4352-b442-8371f39194b0", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253555, "uuid": "a53efb85-4991-4689-ac61-447503e5a833", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253555, "uuid": "349d8195-7e39-4549-b725-abbc1c0c3108", "value": "cea2def6f4043d9a4383dee712f144f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d0572d-db2e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625228003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228003, "uuid": "a2f6a216-e6b0-42e0-a939-f9fcb13fa321", "comment": "Malware payload", "value": "182d476186264acb99c5e937e7873464", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228003, "uuid": "2e1d77c4-1268-41df-b915-3865aced972f", "comment": "Malware payload", "value": "8ba3fe03f29ff301d2664a6d24cbe2ab96d9333cb48ef5ee4ad85482d3bc14b9", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228003, "uuid": "a067791c-4e3c-4d90-94c6-aab9c4c4c882", "comment": "Malware payload", "value": "7222842af82fff5402e657ac00d535b3d6da0851", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228003, "uuid": "3355d3ed-0dbf-48d0-b700-a75e4a89d053", "comment": "Malware payload", "value": "a2a152cfa91713bc320b4c5fdf2e7852b0e08abb04c3ff4fb175d28e327d183cb46d2ae30b9a7af0c6f13ce1bf6cc51b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228003, "uuid": "f90a605b-cabf-4c22-a799-74d8a0bc39df", "value": "0E241249E127E811EF9F5077BEF92EF1176A442309584533E631341CD8ABC6ED2287BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228003, "uuid": "333af019-104d-485e-bb34-a43596d1097f", "value": "6144:fJpA9B3udhOegxjtPiXAuGTODqAW+iGkrN7p56Fz:Bu9l2pgxjt6XUyNW+Md56Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625228003, "uuid": "37c29ef2-ea2b-40aa-b5bc-7379ccec2baf", "value": 217957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625228003, "uuid": "c4b56d99-08f3-4e3a-9096-d2d135582aa0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228003, "uuid": "26afc321-a15d-4eed-b59e-bd7492e50d40", "value": "vv.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35d2643-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625227113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227113, "uuid": "26a4f127-6d0b-4041-b021-887fe11a957d", "comment": "Malware payload (AgentTesla)", "value": "4dc9eb384017307b85f54d372bf7d0ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227113, "uuid": "89ddabde-04d4-4538-8a55-9b61271bb937", "comment": "Malware payload (AgentTesla)", "value": "8c4f7c2b31342c5b77dc44b448486bcd97b18af82216c677fbf87f6c09f4a497", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227113, "uuid": "a0646404-8d25-4ec3-85f4-410dec5e4949", "comment": "Malware payload (AgentTesla)", "value": "e11ef323aebb52400933c26c4b81695341495439", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227113, "uuid": "39186ec7-dc69-4209-8659-e813a9152290", "comment": "Malware payload (AgentTesla)", "value": "d3f8a95ec9126366b05fb2d91ba8542aa1829e511147c6ce1ddb25826bdb9842b3cde80e0e3f9690741302175017ca8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227113, "uuid": "474bb966-5a85-4b14-9e56-1e38038cfe4f", "value": "02053A68369070AED4B7DA77CAAB6C68E6B8B4375B1B550B601302DD4B0E943DF700B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227113, "uuid": "af6714a2-14ec-4f31-a714-3256c24470a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227113, "uuid": "59c1f08b-037c-4031-8de2-c0d117c5898e", "value": "12288:/w9zAyXNQLXXpZ7jHEPWyJlaCB5wp2x7Q05HkQnc+h24ixhvjn9P+xkOXu0UzRB5:4Zlz5wp2x735VT25xhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227113, "uuid": "5729a5b0-d6d5-4507-bb92-640e21202cf5", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227113, "uuid": "5d942abd-732c-45b3-807e-c2220b27d6bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227113, "uuid": "3cac3506-4afa-4af7-a3c6-b09906794ea6", "value": "4dc9eb384017307b85f54d372bf7d0ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0485b03-db21-11eb-875b-42010a9c0053", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1625222357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222357, "uuid": "2713103b-c03d-4a7b-a44e-38aa44e19f94", "comment": "Malware payload (AveMariaRAT)", "value": "f599c14bb641fc4c716f48c2bd638c50", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222357, "uuid": "fb5848da-8836-4923-a3dd-0a6dbf0ad38e", "comment": "Malware payload (AveMariaRAT)", "value": "8c8d70c0b85ee643beb5b116e926a58e0d73d06d8bd53c8ff7bfee80c8e779d9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222357, "uuid": "636409d0-f32a-45e5-8e9d-4644c7e185fa", "comment": "Malware payload (AveMariaRAT)", "value": "d1103b1963c3eb88dadfd6ce8abe4f2be0e1faef", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222357, "uuid": "a32ed7e8-eac4-4acc-866b-219125f6311a", "comment": "Malware payload (AveMariaRAT)", "value": "7b7d73491ebf311859cbcc373372738c95e9b2bae181d1392c0105690ad06a91f53369106c765deea192a4e44ece58fd", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222357, "uuid": "1afeb26a-0fac-41d6-90c5-328c78536065", "value": "62B39E13F7E54835F3B201B01ABD7E7ACBADF9701628C49FA394854B2D31846EA25397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222357, "uuid": "68c9e38f-f2bf-4abb-85ce-1577c16e2f2b", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222357, "uuid": "7c640282-666b-4a0b-9964-f99812a2a993", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE016:K1VmhaH8EFvW+0OVE0s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222357, "uuid": "555880d1-cde8-4a2c-af13-4aca8cffc6f4", "value": 111474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222357, "uuid": "a2f9bb00-077f-4d51-8227-9696430c5f3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222357, "uuid": "4dad98a1-880e-437d-8b0d-3393e55b325f", "value": "f599c14bb641fc4c716f48c2bd638c50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b56c7d-db2e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625227941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227941, "uuid": "b33a0ab5-b0e3-407a-b94c-b62bb5c249e3", "comment": "Malware payload", "value": "a24810194082b4203d2fdad2bcc12e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227941, "uuid": "34a2559f-7e90-4f2d-9b5d-7a61c250d561", "comment": "Malware payload", "value": "8d33877e15839f23454566fa63895f4296b2c8053df69c9bb717d31016b7c809", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227941, "uuid": "9df8141a-23ed-4303-bead-b63c17e3b378", "comment": "Malware payload", "value": "dd4690d48947fcd670c648a0db438ac6bc2bc6b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227941, "uuid": "b206ef35-f5e3-4921-8209-903c430155df", "comment": "Malware payload", "value": "13ff1a770b97cd4ce14fb98dd0c21f88dcbab70ccfb2fd50e8fd86c42395cf1f4c5e23a81e3b914e8c7db293d7abab13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227941, "uuid": "c9d90dd1-0917-4695-a0cd-79cc48325716", "value": "60053AA8369070AED4B7CA77CAAB6C68E7B8B437571B550B601302DD4B0D983DE701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227941, "uuid": "72821f86-04b4-443e-b2fb-ed5dfdb8665b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227941, "uuid": "2c62811c-6a6f-4d57-924b-bbe43ee263ca", "value": "12288:tkx/Wsd8dQZmpC4KdIqMbizSPaJekAbMf32xZSrGp/A7tBTVORN9htlEyJgle7hP:28IQikHkAbZxZScApBToRN9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227941, "uuid": "6ff60ba3-d5fd-4b57-a571-a9a5135aefd9", "value": 811520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227941, "uuid": "a8800d28-cdfe-4386-90e6-a3716fd42615", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227941, "uuid": "cb7719e9-5147-455d-9c8a-db36f5411d26", "value": "PI pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0caa7a02-db4e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625241383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625241383, "uuid": "04a6de8b-a95e-48c1-a4d3-f1f12f73d836", "comment": "Malware payload", "value": "4cfa5fd33097dde8ec22792a51e3b15d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625241383, "uuid": "f51afd7f-ee36-4b93-ad09-06d216637b15", "comment": "Malware payload", "value": "8d9640d9bc85ad90350e69784bdd48a92dc051817751d96b7068e2a76c5ff8d2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625241383, "uuid": "f182b7b2-9cc5-482a-91a7-b15289bfa2a0", "comment": "Malware payload", "value": "698f14676d152142a477bd8097284f6978f53978", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625241383, "uuid": "65a4a276-d7ae-41df-b7a4-72924b627dbf", "comment": "Malware payload", "value": "38ed7d673e9b31f61eba133d631264e8ddc729c3a21d20348a1c912bd43f65178c61896f29aeebf79bf02a3011bc28d8", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625241383, "uuid": "680df4b1-fe99-4253-9204-c82c9a21305d", "value": "A2E35B1775D2CCF6C0038A7216DFA2516463FE3F06672143B788BC656F3D9990AAABC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625241383, "uuid": "502b70b7-504c-4ff2-a8f1-c8ee64703691", "value": "3072:j1g6DVHhlgKGKf8XhRu953mCutJ8adPF4KQTjs9VmBnHebjfciNGmS+rk:9Vld0Xrg4CutJ8adPF4fQKHebjfciomy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625241383, "uuid": "df69951f-35da-4dba-bb90-607f7842dee2", "value": 149000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625241383, "uuid": "a213a7ea-aced-4da2-86ff-57927c1e7207", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625241383, "uuid": "aecb8134-38ab-42d3-b593-aea1095807c8", "value": "4cfa5fd33097dde8ec22792a51e3b15d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0394a917-db63-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625250387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250387, "uuid": "653ea40c-66d0-4e31-bf76-2e09d4357680", "comment": "Malware payload", "value": "6b8e1cd3ae491c130300fe3fe6406dee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250387, "uuid": "f15a991a-3dde-48ae-842a-ae454c084cf4", "comment": "Malware payload", "value": "8dea47e3fefee3e5259a1f40e08ab3a2c54877e313f7d81de949e0b8f52c2d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250387, "uuid": "ab9c230f-a312-48bd-ac58-5413ce488f3a", "comment": "Malware payload", "value": "73f7ef3d41819ae808be765a0ce143e94cf62802", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250387, "uuid": "8b26bedf-9475-4aea-9d31-b7a2c4107366", "comment": "Malware payload", "value": "0442ab2a25b27cd2dc135eb55d41ce946f8d7e9b4adf7534ec2fc03eb4a50226b0129936e3591e4402036ca69530525f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250387, "uuid": "fcf778de-8ba5-4f49-9cd5-292eb6c31acf", "value": "62F2D1BB628A5760AC5D08BD5E2FB945CC04730E86043276FBC99C39B65EE502E0E8DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250387, "uuid": "cdc6e826-d608-414e-a6b6-f403d88451eb", "value": "768:WB5I3Z6rnaMv+vepstIQOrYasrE1MonbcuyD7UiyqU/8CGyM:sT7aMv+2psZwvPnouy8ZqvJyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250387, "uuid": "b654db46-ba48-4a89-b444-0a06d8525b79", "value": 34724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250387, "uuid": "9d8fcc54-15ff-480d-8776-5e6d74aa8143", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250387, "uuid": "8f76a797-1bc3-4b1f-9e47-b353a4ec8e22", "value": "6b8e1cd3ae491c130300fe3fe6406dee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0427a881-db22-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625222471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222471, "uuid": "b80d521b-292e-4664-b0b6-417cd39553af", "comment": "Malware payload (AgentTesla)", "value": "2ff1f8db596f7fb8bbb3b99d2c931779", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222471, "uuid": "921ccddd-3dbb-4ef0-87d1-fbcd08bc5ba2", "comment": "Malware payload (AgentTesla)", "value": "8ed58f06094292e16e162dc9eaea2841152796cb76ed5d8ae2c2f3013958d303", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222471, "uuid": "14a3a0d3-bf48-4440-8784-9cb2e1a947a5", "comment": "Malware payload (AgentTesla)", "value": "d22db90a74d2c78a5b9bbf60d330d9b2944df8ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222471, "uuid": "10490216-9470-41a6-94b7-96398a8ca166", "comment": "Malware payload (AgentTesla)", "value": "265db57071f68b2f51e8989ca90f4784ee27f136cd81d5911c089f80f0fcc270919d97949bc9b9e991a75d497b335353", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222471, "uuid": "f8bf4cf7-b344-4976-8ff2-259bb8085b17", "value": "A4C4126935EDB0DED473FB779ED87C94E92977375B07510E2083038A850A982CEA1A72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222471, "uuid": "f8593ab6-9150-44d6-b1c9-6f928414e2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222471, "uuid": "f2d87539-6273-4bac-978f-9853ce0e1b81", "value": "12288:vgpDrm4T1RPlGBK98HBnb/vJd1NTTtZYdmPI8xMIuV5D//H:IpDrvlGBK+zvhiP8x0Vp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222471, "uuid": "2adf78a4-7668-42a2-82cb-9f0d18c6cdee", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222471, "uuid": "280a9d06-b6e7-42a5-8bb7-2bbd5de108e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222471, "uuid": "e6fcc362-a2e8-4d3f-8fcb-f8de96c80689", "value": "2ff1f8db596f7fb8bbb3b99d2c931779.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f097dfb-db4b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625240125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240125, "uuid": "32e50a5a-5be2-45eb-a768-40e837bae416", "comment": "Malware payload", "value": "f1068bb2b9ff2a818111e4e1782265ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240125, "uuid": "b68d3dc2-532d-4f14-b495-0239d02a09a8", "comment": "Malware payload", "value": "8ede199613dbcc93f5416a0836a50d44d74b3fe9f7b2fb60fbd76c0043d257d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240125, "uuid": "834bcf42-0222-4966-aa2c-5497a14e99e8", "comment": "Malware payload", "value": "9528b16971f1d61763e3f49d70533ee91e8f218a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240125, "uuid": "d9926a3d-187a-46e6-bbf7-227d9ac800a4", "comment": "Malware payload", "value": "70888e4221dcc83bade23527ca07e81ee0ff800822f7c5a0b0364997e3e4c64932dd8a5a4bbd33b114a41ed6366c975b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240125, "uuid": "122d2512-b63d-4b01-9814-a0a0013b22d9", "value": "F543E84399A29FB7C156A9B565BB4A340763BC115F0F0B89212DBAF8437B5CDF80E720", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240125, "uuid": "c9da8358-0b68-48cb-a2ac-c17417c56a9a", "value": "768:GRzVqTMM4mYzboX9T/wN+voKFZ5CfBkbTC04cu53ySn7sUJ:yqP0cCgAKd8kHC04c2n7sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625240125, "uuid": "f16c37a2-5b6b-425e-95f5-d155d7c0211e", "value": 60124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625240125, "uuid": "2068e35a-9836-4d74-80e5-6f9739407bf4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240125, "uuid": "cb69f9d4-6daa-4ceb-974a-6c4e22893504", "value": "f1068bb2b9ff2a818111e4e1782265ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13235e05-db1e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625220778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220778, "uuid": "7e155286-1756-4e74-9fcb-a6dd92c9c95d", "comment": "Malware payload", "value": "a9dfc9bb197870f393d7365d8548b360", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220778, "uuid": "cefd1713-5aad-4523-b173-bdf7dbb1ccb3", "comment": "Malware payload", "value": "8f4bbec32d35781820a54601b7bd40cd84654b9e3e50290979a5a3b7c0d14905", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220778, "uuid": "ead676b4-7aa6-49d0-9df5-a3517f4461b9", "comment": "Malware payload", "value": "0bef41519b7903dc6f19761ae83a4c6ac91a52e1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220778, "uuid": "e7ea0c89-1e9e-4327-8bd6-c8826577aced", "comment": "Malware payload", "value": "20446c847090a36404b0822d9820464483f8462a81363a2cb586c6f00b6f3087181421a7721b4a598111e9b878f49901", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220778, "uuid": "b050e5c2-4731-408b-980e-f3b95bf997f6", "value": "CE152341DFA90F8BCB856275DC63B85A12CABEAC9344E0FB6394738F117F3260997416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220778, "uuid": "8735af8a-8634-4ce4-8977-c6990105ae87", "value": "24576:BbsyZHYWA1dn42KeI929OyxVTqRBHacQ+HDWJ3UFREvk:Ed4DZlvpSJWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220778, "uuid": "71c52657-76ad-4689-8c64-20cd8ddb998e", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220778, "uuid": "ae585018-0036-44b4-88e2-8dda5aa2127d", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220778, "uuid": "087e83fd-c481-4940-b75f-19fecb51b14d", "value": "purchaseorder", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2867f85b-dafa-11eb-875b-42010a9c0053", "comment": "Malware payload (Adwind)", "timestamp": 1625205351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205351, "uuid": "40f0cab3-d6fe-4819-8250-445501402823", "comment": "Malware payload (Adwind)", "value": "d651c13b5bb651f5c3d41693063abe95", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205351, "uuid": "d83ebfa4-3b93-4f3d-b072-691393ab71f1", "comment": "Malware payload (Adwind)", "value": "8f5c580c2434abd23b73fcc729e9d3ff58d470483bc70401f7bd572b9308db4a", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205351, "uuid": "dcc30248-cc09-40dc-a293-26cfae2695b1", "comment": "Malware payload (Adwind)", "value": "011cbfb4bc50d8ab9c4a04c888699ce77163a973", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205351, "uuid": "cf532376-48f9-4e15-a6f0-5fce64130bfb", "comment": "Malware payload (Adwind)", "value": "7dd72a825af084b12ecb585c538ee4479f638964fa500627d8aa4084a8ae34c4a2ad2c21a60d9fdb336f315b9fb454c5", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205351, "uuid": "b1be3342-9c20-435b-baf4-0429a294c193", "value": "C6259E1F90C40332EEB8C00558E7162747D8D79AA709946FA6FA2FDFE625D9C1C0E29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205351, "uuid": "f1377c1a-426b-45b0-b154-2c922ffcd15e", "value": "12288:7QXmCS9DPsxOsXCJPS2ISm5VlTzawP7GuY7y36obGDhuErWRW+JJF+c0hLKz71:7emCcDPsYtmoA7UyK6UU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625205351, "uuid": "2b5cb6e2-5995-4cae-8567-99602777514c", "value": 1033366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625205351, "uuid": "aedaadc3-3ede-4164-850c-c8b1a57c3183", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205351, "uuid": "b8ed9116-4d9f-4f70-83f1-09242cf65762", "value": "IMGS-00988-PRODUCTS-PO-PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb377e7-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625227102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227102, "uuid": "4d358e03-3aa1-4221-a88e-0392323c9eb1", "comment": "Malware payload (AgentTesla)", "value": "64b53dc7fa2ca1ff03f6dcb19537ce78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227102, "uuid": "49fc11c6-a949-4109-b298-19aa34067096", "comment": "Malware payload (AgentTesla)", "value": "904f197a96c632a57856a8bd12dfd84d10e9b6c4609b075199780e10b58673d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227102, "uuid": "815b84b8-5cd5-4ab0-bd5d-369256107ae7", "comment": "Malware payload (AgentTesla)", "value": "be399d166c7a75ac133685fc5e76ebe2ea841ecf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227102, "uuid": "92ac6aab-08c3-49fb-9d32-1abcc4d90f40", "comment": "Malware payload (AgentTesla)", "value": "b80aa91e4e08938b0d90267421997c56be77edf123caa98088fe29375246a288b30df07f4bd2861e1bbc547320f830f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227102, "uuid": "7b88692a-9142-4ae1-9b8a-3b7b983c4b0c", "value": "BB052968369070EED4B7DA77CAAB2C68EAB9B0375B1B550B601302D94B0D943DF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227102, "uuid": "0fe412cd-f0e8-4433-9828-382d90e30c9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227102, "uuid": "cc32cd08-ab8e-4a1c-8259-869e8c1f2726", "value": "12288:F6BbsNhMCIm7lpcWqwHLO0sfOrpvpRGaAax5pwJISdfueSrh1uxpuZyJG3DN741B:IelHLOWrf0WflEeZSB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227102, "uuid": "3998ed72-fae9-490e-bafb-0b8928bc920a", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227102, "uuid": "89ebb4a1-ceb9-4034-b54b-dbb1dcf9b932", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227102, "uuid": "06364e03-78a2-411f-9eaf-13a05e89b14d", "value": "64b53dc7fa2ca1ff03f6dcb19537ce78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72005c24-dafd-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625206763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206763, "uuid": "53218bc6-a49e-4611-8e45-55386c3e627f", "comment": "Malware payload (AsyncRAT)", "value": "7ec9d551045bdf9ba25ff78a0d4d5098", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206763, "uuid": "c609280e-9eb3-43f7-869d-e4c36e2b5bf7", "comment": "Malware payload (AsyncRAT)", "value": "910dadc749cd8e207f752bd9012108ad3e82df6c1f69096c8d2d94631d157eb2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206763, "uuid": "f79e09e2-7672-4785-8d32-9e12c0a15773", "comment": "Malware payload (AsyncRAT)", "value": "2bfcb3ed3f7aa2e694a3ddef8785c3508eb89a5e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206763, "uuid": "dc1b37fe-adff-4bb4-8c11-56eb422d294c", "comment": "Malware payload (AsyncRAT)", "value": "7dafcc799059307049607cb344d9c5f512545ede76ad91ce770e32fb9954e85f17e338941e6669c823779c26d8916c58", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206763, "uuid": "6fbc8e59-d0f0-40c7-89e7-b6e1b7099e06", "value": "E3216AAFEEA4B1D517A98FE72A2914C9F195DC8D04800417F324B792BE2DE10ED87734", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206763, "uuid": "15763071-610f-49c1-b7da-986508769e8b", "value": "24:gQrKVO9ug7waIzK7ObLfsOLX1iLBHkhLQwvsfmnlvJiV53p/T0OE3yrfV:BuVO9n7AK6bLfsOLliLBEhLQlmlkV53V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206763, "uuid": "f0476ab2-48f3-4b84-8db6-7ae2ce3c6274", "value": 1258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206763, "uuid": "5f8bbb4f-8f44-4603-9dfd-d502c2b50b13", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206763, "uuid": "6b794640-f903-47ab-a6dd-3aca61a52473", "value": "2-JulyStatement_ID210710101531837.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc17ddd8-db0a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625212579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212579, "uuid": "38bcb1f7-3ac5-4b2a-9495-88a8abdd18c9", "comment": "Malware payload (AgentTesla)", "value": "9bd23005277509c6ff0e28c226715313", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212579, "uuid": "f3823771-afbf-4cad-b827-9e86c6ce2a81", "comment": "Malware payload (AgentTesla)", "value": "915c4f38aa51645084c1745bae8495d8c571f2b813bba72ba0b28f98bb94ad5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212579, "uuid": "19a4d01f-3db1-44e1-ae77-90c5ffa3cc15", "comment": "Malware payload (AgentTesla)", "value": "a4712c6a0cd1ef164e6ab4cdffed3929372376ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212579, "uuid": "bbd8c592-7e8d-4850-9214-1b70461b0489", "comment": "Malware payload (AgentTesla)", "value": "a0ec3725215c41ca4510cf1e23d99e48db0373252d727a74b989b451ef9a4d6ae7e3c165fedf9051faf30f15e7a83a22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212579, "uuid": "6834b73f-1a2b-423c-9274-b3df595240cf", "value": "C70317DD969C48D2E13FF934CBE07A011730A5BE254D80BF50A6AAD3C881BD3E7D951A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212579, "uuid": "f0d157d2-6654-42bf-9ea7-bd44edc3e285", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212579, "uuid": "e6a8b59e-737e-4de4-837e-2326dfb765a1", "value": "768:l3+aDrtVmKM0JdYbK4GflArMtqPZm8SuYnvbcPWuNkCN8fM58fMh8fMyhgG:J+aDrtVmeJdBAIqx3S3zcPWuhN8fg8fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625212579, "uuid": "cb9e7412-5ec2-4335-9d30-6af3c8e94b08", "value": 39000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625212579, "uuid": "5c85e2ea-689b-47d5-800b-6a049a180d74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212579, "uuid": "d5402719-dab5-4218-aaf3-20408de82986", "value": "9bd23005277509c6ff0e28c226715313", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c73624a-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191212, "uuid": "d6880181-5556-4821-8595-fad9368b088d", "comment": "Malware payload (Gafgyt)", "value": "99f8479133123e6a497d15382b0ac067", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191212, "uuid": "a9a261f9-676e-49a0-8ea4-49ab180f561d", "comment": "Malware payload (Gafgyt)", "value": "9173cc2a4965f7b1ea0fb97e7d050a9b668cd89308c3002053e0056c8fab81c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191212, "uuid": "1acc00ab-8022-4684-9f95-bc6f3824f2d2", "comment": "Malware payload (Gafgyt)", "value": "55ce4a6e5e6178964a0bbccc093531128859ef65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191212, "uuid": "609fbfc3-f241-45a0-892c-2904044ebd8c", "comment": "Malware payload (Gafgyt)", "value": "3a64752667d7e9385cb925a01aa92a8c893bce12097b1030d05e48ed861e192381256dbd380d36ca9022e3cf73c3a741", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191212, "uuid": "9ae33be6-4ecb-42b3-802f-430e1aa0673c", "value": "FF93F893F901DF73F40A977604D74B217630FBA14A932A62732739A6AE322D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191212, "uuid": "ecb6f4f1-355e-4d7d-97d4-a2cb9cbd9903", "value": "1536:k4lQv1Sh8LrjAGJ0+QmiaGEe4V987DtgiyrugNN8fsTmQ9VqXjewf2Le:V6v1SWrBJpTZo7RgiyruUHmQ9VqXywfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191212, "uuid": "47509d86-500b-42fa-b788-4aa5aa535bda", "value": 93257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191212, "uuid": "491dca83-38e6-499f-a7c7-a595f473941c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191212, "uuid": "ba826a21-75c1-4ac4-85b4-521067436312", "value": "99f8479133123e6a497d15382b0ac067", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1632f403-db4c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625240540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240540, "uuid": "ab7f4ea8-a7c6-459f-9509-613f77036e2f", "comment": "Malware payload", "value": "318a3984d6f20a51c326bcacd83bf11f", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240540, "uuid": "05f53416-257f-4ce7-b321-00200a0cc7c3", "comment": "Malware payload", "value": "91f02fd041dc80fe5ad1c0ba9c0b273772af9c63e49bb602aa9c8d59cb276892", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240540, "uuid": "813379df-ae1f-4170-b27f-74d9ed11c08b", "comment": "Malware payload", "value": "fbb43b06f54fd891030b08497d757170fa2eeeda", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240540, "uuid": "e58756eb-3f3a-4170-8065-f8ea49147490", "comment": "Malware payload", "value": "39623bf6a0e2d1e0162db7013b89895181f850d663f1d47da1b5082c021c922b2b20c4c958447320b729ed38e4cba24b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240540, "uuid": "67ca3c54-75a1-40ec-bc89-e08dbd1d49a6", "value": "7B9423C8F9BFE837DECF11BF86801B1E01B5054642EC4877F731B8ACC999D26526994A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240540, "uuid": "062224d3-d754-4241-973e-4092092cfd7d", "value": "12288:fku9lPzblcNLwYAKtlLFWqJ1YBCXr1XMH:ftPflcFwH30cCxcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625240540, "uuid": "ca607ece-2b39-4770-803f-9a9c23500d7b", "value": 435260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625240540, "uuid": "dfde6680-482d-4bfb-b4eb-ab405992d9fe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240540, "uuid": "d0bb1bb3-4b1f-47ec-9f77-c868645e312d", "value": "Gift Card 0796907.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242f297f-db3f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625234980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625234980, "uuid": "f6888d17-f430-4cc3-8ea4-4b2ceadde073", "comment": "Malware payload", "value": "9e384c7249745f54b64792d2f8b5b53c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625234980, "uuid": "03f4e323-75f8-4d72-b399-570b66a3f067", "comment": "Malware payload", "value": "95004ce72c4126abf44c49586cd277fcdad1ff2b2d463ecae509997786c24e2f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625234980, "uuid": "f9d22f29-d9a4-423f-92e1-2e31b551bc28", "comment": "Malware payload", "value": "b8b7fe86c35e65cb553ab49688a25032c55ac8f1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625234980, "uuid": "7553d49f-c257-4879-ac05-a4fb0fbc905d", "comment": "Malware payload", "value": "8c3c09ffd45a3ef29a4f736161b7d492029050aeb26e27634d8f6dcaa4329d8fe1702501334d3768279099a80d3a4975", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625234980, "uuid": "84df0097-a046-4f84-8f97-be6b02e61f45", "value": "7E228E38D646FC16D122143DE05842F8FB6A5093EA52F82B204D779C0F612C7478FABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625234980, "uuid": "7dad4bb6-a721-424f-84ae-4d2c1337b16e", "value": "96:kHcIMm57P6vdXzhdmGJa6T/n/jNTM0N19aZ4WV6Y+IDl0FuMWKeULKfSDtQD802B:ScIMmtPIeG/bMOmVWFuMp2oQD80Ni3JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625234980, "uuid": "77c3a61a-96b3-486a-a127-9dbd42b4799a", "value": 10338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625234980, "uuid": "bd9bb0db-e10d-467c-979d-0f0a1f5e76a7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625234980, "uuid": "92b2a54e-9780-49bc-b2a3-28bd568b0132", "value": "PO09872121.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e3880e8-db68-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625252606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625252606, "uuid": "ddb8e672-aaeb-40a5-abff-3129d8b3ed0d", "comment": "Malware payload", "value": "249a83cad5200dab39c42deeb1a48064", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625252606, "uuid": "bb5bc226-d463-4e11-812b-e5125e50f60f", "comment": "Malware payload", "value": "959774f310680fbe77c795d90ea0449347b050e367894acbacb3cfb195c159a4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625252606, "uuid": "46cd7b3a-0326-492d-a68b-8903d0879779", "comment": "Malware payload", "value": "2732240b826e1e806d281ef7b03983128dbd0304", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625252606, "uuid": "5528c504-f607-4e78-80c8-c5c81190dfd3", "comment": "Malware payload", "value": "6e44b629c0499902d195e1f8142cc43afc977bcc3e8399a057e79b1931f8575965cbb4b0095df3ef78287068b34cbd18", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625252606, "uuid": "16fb0f5c-424f-45d7-8b7a-47ac84f197d6", "value": "25F2E1F14A8A5C57DCDA0EB5DD7A8B54523FBAF6BDCB32842A0C133CAB834432D95251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625252606, "uuid": "d1981951-700a-4f93-899f-d28da5d25045", "value": "768:4blSnlo8SuLltghIsCF4J+vFBwHyakzAWyE3UO1EfxFN:4blSFXrgIsCvdBwAAQ1E9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625252606, "uuid": "3cf58c0e-7eca-4380-bdd9-f9cde53ea9d6", "value": 35648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625252606, "uuid": "00b7b305-c96f-441f-b7e6-63f3489aa825", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625252606, "uuid": "de73ddee-2e71-47f2-8e9e-f26a4fcd4f18", "value": "PainfulThaGodInfectedYouRetards.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba3efeb-db61-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625249837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249837, "uuid": "c8ba091f-2c5c-42a9-ad20-97b11468ef83", "comment": "Malware payload (Mirai)", "value": "1c4c424f3735ad95e9d96de06e544480", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249837, "uuid": "16ce1a95-3f42-4b97-9f6e-4ac200490d29", "comment": "Malware payload (Mirai)", "value": "95a58f9940ba71c3be2b080d2716496a8441aff7e9f1b73dc189c7457af7c1ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249837, "uuid": "16037ef5-6918-4306-88fa-a31721824274", "comment": "Malware payload (Mirai)", "value": "4c635be4ab5a08c17da1eada7fd015249a34b311", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249837, "uuid": "a3b54c04-3625-408b-97fb-e48e9cfb0b6a", "comment": "Malware payload (Mirai)", "value": "e5ccc2c06fc7c6cbae19a878b29b0b0636b76e61794523fe768b25ba454c8dd6903e999ae553ee32ebe18bcbc407cb86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249837, "uuid": "066e4841-f86e-4bfa-ac92-f307b29a277c", "value": "3673294678919A26C6E413BAF67E40CE371567A8E2DF7217CD116F4133CA81F0EA7742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249837, "uuid": "0a0d4041-b36f-4f97-afff-a6ef088c7f3f", "value": "1536:a8qLaG/sHlgCiZ9iaSeYe1Ob59IEI67OgV4wpX0PQKgIVa1083+:a8qLaGq7OQ4wpk4gsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625249837, "uuid": "b8442320-66a8-4dcd-a7da-b2e725a12f3f", "value": 76040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625249837, "uuid": "9046c3a6-1e49-40ca-b8d8-853db2e643b0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249837, "uuid": "ff2cabd4-15db-4595-bc11-75ba3def3e58", "value": "1c4c424f3735ad95e9d96de06e544480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42765575-db76-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625258653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625258653, "uuid": "87ab898e-05dc-4eb9-b942-989bf12b1ff3", "comment": "Malware payload", "value": "276c689a9ec02a59d62a7827d8a0937b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625258653, "uuid": "4c733b3c-32c3-49bd-823f-23b84ab4b0d3", "comment": "Malware payload", "value": "9705645d10fb93692ae082852b0e34838603ba6de0137ab42d0a07c3371a99b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625258653, "uuid": "360067e4-c85e-49f2-a285-123f75787f03", "comment": "Malware payload", "value": "005d4f89dcb58eace2e88424272f8240cdfb1c1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625258653, "uuid": "ddaa7a30-82c5-4ed8-8dfb-f25ee142d0c5", "comment": "Malware payload", "value": "817d07e5a0502699d4cf5a268b320937c756b3867ba500b1e09cff82ede18ba2d49e9ff1aa00be58d3e55c19e011a822", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625258653, "uuid": "1a30440e-1b07-4fae-8c26-2584613b0713", "value": "857602E2252E4350F5A28CFD4FE2ED9014B83FBDBAB240761345FBC768755B8920568B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625258653, "uuid": "55ad2ef3-2475-4fc6-bd26-ccdef7f08f79", "value": "f73528e50c78c71eb8f5363d7464152d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625258653, "uuid": "ab6051d4-446f-433a-8f8a-ae26b583183c", "value": "196608:Lc/WpEsh1l5jD+qRAEkVv7mkO3HexS3bm84Tt8:Q+jj7uqWEkF7ZOpIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625258653, "uuid": "4fcbce8b-e1f3-40ac-865c-6b13d9753694", "value": 7447040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625258653, "uuid": "5d6b1afd-9ce3-46f7-b376-c1ed4f085d31", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625258653, "uuid": "bad2b5e4-577a-4402-a1f5-84c8c74d51a4", "value": "276c689a9ec02a59d62a7827d8a0937b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f902246-db55-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625244501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625244501, "uuid": "8c31ff5d-fd90-4949-8b3f-88a54185318e", "comment": "Malware payload", "value": "365085f84384209912b9c7d5ff22c5a1", "object_relation": "md5", "Tag": [ { "name": "Diavol", "colour": "#99FB38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625244501, "uuid": "01991442-34fd-4529-9f0a-57903aaef38c", "comment": "Malware payload", "value": "9753aa0861a3f7689476ec1c808cc6a242687d7d6e2091c1e414a9ae9139a603", "object_relation": "sha256", "Tag": [ { "name": "Diavol", "colour": "#99FB38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625244501, "uuid": "0b5fdc29-21aa-42a8-9dfb-58cbc646046d", "comment": "Malware payload", "value": "9e6d650c19f9d911e3dc3b784de4f5f48ae5a46c", "object_relation": "sha1", "Tag": [ { "name": "Diavol", "colour": "#99FB38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625244501, "uuid": "646a2795-2ada-4244-aca0-0518e2bc4a50", "comment": "Malware payload", "value": "ea04af9cab5c94d44ea8aa08ccdba20e3b60e839abe977cf78504d62a926fe5cc2a831e1630f2b474e4ced9706e2f709", "object_relation": "sha3-384", "Tag": [ { "name": "Diavol", "colour": "#99FB38", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625244501, "uuid": "664a488d-ef77-4bf9-a092-70caea944cfc", "value": "E281962F56A0C59CD22145B74B6790C063BEA3073397059FBB4E01B93F857970D67AD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625244501, "uuid": "fba0e73d-8ce4-42b6-bbe3-789cbd71f766", "value": "45c78cd5e165b894b425bc90d06defbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625244501, "uuid": "cc5f8007-65cb-47de-9ff2-0f0db61b89ab", "value": "48:aE7oYgwsEllNuPFltOxMJ62ZUoyKeBiglN2VSCSCl:3PgEllNCtG4yzH6SCtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625244501, "uuid": "8cd7f150-dc7a-4e65-9e27-fd94b9d5cd20", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625244501, "uuid": "f0ec6c88-56e3-47ba-8044-687821ffe1c1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625244501, "uuid": "ea5e9953-d0c6-4cdf-8963-214f6893f121", "value": "9753aa0861a3f7689476ec1c808cc6a242687d7d6e2091c1e414a9ae9139a603.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6388bf48-db62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625250118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250118, "uuid": "45464a4a-799d-487c-bba9-cff95c6ea539", "comment": "Malware payload", "value": "a2429f3494a383401339824117d51c36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250118, "uuid": "dd848459-48ce-4871-a293-37eed251c590", "comment": "Malware payload", "value": "97872105a7c9714d6a466c0638f6c64652cb373984b115081c9d97474c30266c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250118, "uuid": "d26caf86-1eba-44b3-8961-49880379624c", "comment": "Malware payload", "value": "8e44c61088d49c6031a389cbd051d3d4f735990d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250118, "uuid": "ad414b33-3dc2-4e06-b1d1-7396befdb0b1", "comment": "Malware payload", "value": "d5ff7b5ca3a0b385a27bbde983de644197f0866c0ee137624d85dfe22d3dc43666626da7bde4cadd05c2969e74262ea4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250118, "uuid": "577c8c24-1f66-4713-bcfc-eccb258860e9", "value": "CF93F893B801EEB7F40ED77644D34B24B270FBA14A531A32731B3966AE762D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250118, "uuid": "a9888632-45ed-4248-98b8-51589b9b8a5e", "value": "1536:zk56YnMKW1gw78tAgVdYyIiV1MH9OSHYVeyi679l5Ma2GHFBmzSNVPXsCRfhBX:Q/s1JyVdYyIiVuH9iZ2YmuNVPXVRfhBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250118, "uuid": "b48680a1-1939-4972-8af4-f3cef377308e", "value": 90724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250118, "uuid": "af579248-7d9f-4f88-9af0-2bf965c80b73", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250118, "uuid": "24561b2f-1641-4eb5-bc2d-759fb6136323", "value": "a2429f3494a383401339824117d51c36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f25a4e92-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191517, "uuid": "27576303-5b6f-4d81-ae32-f1a7f892a675", "comment": "Malware payload (Gafgyt)", "value": "76591c7adba64b2091e7b3a55cfaf357", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191517, "uuid": "4bd54101-84ef-43b0-9e86-adc03bb43f91", "comment": "Malware payload (Gafgyt)", "value": "97fe7ad061650f91777418f6731d43dfa0aeffedea06967411226d5ba60ddf8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191517, "uuid": "fc860a2d-6ee9-4765-a604-fc3542b8c04f", "comment": "Malware payload (Gafgyt)", "value": "28d82b7d1482abb68b9e5b13f7503e7c77e7c8d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191517, "uuid": "eb5d1216-bf04-4a25-80fa-338cdd9072fe", "comment": "Malware payload (Gafgyt)", "value": "f47f59c86b44020816b85959f4550220b0e4e949d6cd10e34dd295d7b1227105d77eaa9d12137fb061e10416558ca35c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191517, "uuid": "a0d21f47-20b1-4713-a58a-587a46b13e8a", "value": "E2C32A3777270A23C0C9587201E31331BBB6D78938F98387AA906DAC6F179C43916BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191517, "uuid": "40e5798d-e16e-4e07-ba41-c13c74bf8f4f", "value": "3072:B2BR6aiCaqSiaaii6KyC6aMQrN8aOzSUmPe1UnJ/SMLFqweAEDJW:UBR6aiCaqSiaaii6KyC6av+j2Wo/SMLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191517, "uuid": "09e2b90e-6524-4ea5-abf7-2be87921e1fd", "value": 122879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191517, "uuid": "9aa0325a-899f-4370-adce-0f14a5d6db0f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191517, "uuid": "b24859e0-3b9b-46ae-84d7-e2e5bb2d763c", "value": "76591c7adba64b2091e7b3a55cfaf357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "068f9f08-dafe-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625207013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207013, "uuid": "c992f293-213e-4b13-ae55-81e3d85c9b9c", "comment": "Malware payload (BitRAT)", "value": "ec53952fb4283023725a5f9bfaa4741b", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207013, "uuid": "09101961-fc2e-4d56-be64-f5cfeca6e890", "comment": "Malware payload (BitRAT)", "value": "9a4407f9dab46013f44f33007023209be5aeb572d3499a92ea49f7ec10ff15a7", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207013, "uuid": "41c73abc-77c7-49e2-8968-8819f9b53f7a", "comment": "Malware payload (BitRAT)", "value": "6f1251a01128b6a02e8c81fe0ecb1135c9d8ea0b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207013, "uuid": "86e0ac10-3847-498d-85eb-d2f0c54bcf4c", "comment": "Malware payload (BitRAT)", "value": "8d0141dcd509ec6fd366ffd5a60fca95fac51efc966aafce7f9c90a3874c3a0236476ecd9a234cd4b5c06bf7913b7880", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207013, "uuid": "1cec9331-14a5-4ba6-a888-771691551077", "value": "DB25041C2B5EFF88F6B205D274454A68872E9798F30928509E5F318C87FC9A23759ED3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207013, "uuid": "3982aa65-c649-428c-9976-6716247b5896", "value": "6144:PNoP3eJAtq+tL3BwV7erhE2g9PBJk5p0YyZVr0DkZmb+WtRGMRfrhoZqKwwY0Nx5:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625207013, "uuid": "83ee2ea0-4f62-4749-8576-e9dc3f48e29e", "value": 997432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625207013, "uuid": "463821e8-733d-4edf-b352-9855db57246f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207013, "uuid": "f910b1bd-6094-41a0-8876-e8f9ddb529d0", "value": "ec53952fb4283023725a5f9bfaa4741b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d71c11-db8b-11eb-875b-42010a9c0053", "comment": "Malware payload (BitRAT)", "timestamp": 1625267760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625267760, "uuid": "0dd58ea2-4358-450c-81aa-5fedc5e8a71b", "comment": "Malware payload (BitRAT)", "value": "9b994dcabfcbe22e199acbd93116428a", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625267760, "uuid": "b0e4815d-4083-4139-bd41-37af0ea058ff", "comment": "Malware payload (BitRAT)", "value": "9ab36aae09fac3a4cc6dc61baa78cd617b5d79050a14e670db21332e7b66ed35", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625267760, "uuid": "1210057d-539f-4e6d-b75e-e30f57c14852", "comment": "Malware payload (BitRAT)", "value": "7107be25ace2d396b44191b113328e8edf645ab7", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625267760, "uuid": "14d2d09a-3434-488f-a3fd-7145fd3677e5", "comment": "Malware payload (BitRAT)", "value": "68b470038548d4462e7daba9575bda25728b985e75883cf0ad7b947f535ecc17464851b2b2b22c0330f81b1319fa951e", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625267760, "uuid": "ff1a1e03-363f-44ab-a23c-8c06c07b91a9", "value": "8A7397576091B2D8E2B708745D06E8783708AB366CC4D14CF833561CDFA29FA78DD9EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625267760, "uuid": "47d8b103-3e01-40bb-bc65-7db64d3a7424", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625267760, "uuid": "b73f1068-db17-4244-8361-8b9429e7c745", "value": "768:SBwNVkC7DFp/trvOsr8elDO8l+NHNqGJa9AbabObP6jqkvo6itt8o8DxWoE1Vqol:Qwbt5trHORq0aF2dD0XG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625267760, "uuid": "f340eb53-dd30-49f6-a284-82ca1fa32e17", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625267760, "uuid": "6b391015-3f79-4204-8281-d11fc5a5f231", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625267760, "uuid": "084410ab-a303-4119-af07-ec53896bb219", "value": "9B994DCABFCBE22E199ACBD93116428A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6dcd16-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226944, "uuid": "71a6e781-cc7e-4f9b-b800-bde1b39369dd", "comment": "Malware payload (AgentTesla)", "value": "0c928623c2a0cb13d70073d17a6960bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226944, "uuid": "c2e76b98-1349-4459-9d6c-483fc8ce94c6", "comment": "Malware payload (AgentTesla)", "value": "9b1e279b34854ab1042d78c5507168420c3af40b88eaa9f66a458c554e6a42fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226944, "uuid": "da421440-d7be-4a77-bbff-cf6de57204b5", "comment": "Malware payload (AgentTesla)", "value": "878be930881948519f755a610990db03cb38818b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226944, "uuid": "4dfd01d7-17df-4108-acd1-0110a77ef466", "comment": "Malware payload (AgentTesla)", "value": "9e8ae06f71bc24954faa458f2cbe656623daff3066fe822de0e75992327a200bbf079cf541403de3e7cd0991bc983f7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226944, "uuid": "d466d20a-5681-4619-ab94-7c547fea2dd3", "value": "F205296836A470AED4B7CA77CAAB2C68E6B9B437570B550B601302DD4B0E943DF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226944, "uuid": "3212c91f-180f-4f63-bd53-6f460246171f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226944, "uuid": "5105b65e-c611-49d0-8958-05ad35c797ea", "value": "12288:bjtLXVR71oTHpiQXSL+8EVRh6/NyLP42WGDoyOyiEb8Bvd4BokuxEmThjwamuk7m:fYiS8p/NfMoyriEb8h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226944, "uuid": "3332572b-471f-46a6-9cb1-6a1e62477003", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226944, "uuid": "721c18f1-643b-4c1a-bde5-7502968af0e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226944, "uuid": "efcddbef-b0c2-4820-bffe-90ea92db275f", "value": "0c928623c2a0cb13d70073d17a6960bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d71824c-dadf-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1625193925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193925, "uuid": "a372e266-13b9-4e9c-a99f-87c7c65a0954", "comment": "Malware payload (DiamondFox)", "value": "b33669fdbb7b6f59ab6a2a2cb1f61da2", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193925, "uuid": "10d15f69-b4f9-4f37-aff5-d517dd15a9ca", "comment": "Malware payload (DiamondFox)", "value": "9b57d08d13cd432a759c074c78969c21197119d3168d2496f507ace00feaa829", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193925, "uuid": "cc59d42d-2bf2-46a8-b626-5b8c23f36c20", "comment": "Malware payload (DiamondFox)", "value": "678629843c893558e809fc2ac3622d0e224324d4", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193925, "uuid": "232e8d43-b9d6-44e8-8087-42a496ecb398", "comment": "Malware payload (DiamondFox)", "value": "a238c3f8f4b8f41d3ca5ad558ea8e5700107feb4bc876689ee9799216c8e8d595acbb411835c0b1506d9893d89c10516", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193925, "uuid": "3857c9c6-6fad-421a-8853-8946f5f78c45", "value": "5F263337BB785883D0730377DAE909571F6AA93D11E9C32E1352609FBA431912B69F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193925, "uuid": "1cc42f39-0a8c-4394-a904-3fc9af351dc8", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193925, "uuid": "31742a0f-5d12-4551-b39e-ef6a9c222cb2", "value": "98304:J3EnjTKtZuy/JKK9ApfcTMBLlrM3oWUSklGoesvdQaTVy2:J0XokQKKcfcTfYWWlGoeE3Vr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625193925, "uuid": "a3f303c0-b9ed-4b07-b37d-3650e2cf46f9", "value": 4751997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625193925, "uuid": "fa19f178-fa51-45a7-b384-b2589ff536ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193925, "uuid": "eb812dbd-08fc-41d1-b190-bd08b726fe49", "value": "B33669FDBB7B6F59AB6A2A2CB1F61DA2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f100cb66-db2b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625226733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226733, "uuid": "cc69e006-3ed3-4203-b58b-41e7190a7cfd", "comment": "Malware payload", "value": "4cc53c562f33ec28c3f5ca7d18e16491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226733, "uuid": "eeeec832-a419-4aac-af5c-37fc84489afb", "comment": "Malware payload", "value": "9bd52703dba9fde3dda64118f9404ed8c3aab6cd3c6b6924f173fcbd5d83fd96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226733, "uuid": "c832e989-8948-46e4-88a0-e62c0b58aaae", "comment": "Malware payload", "value": "3ee2b73c635e4f96af059c16b3e6402ce48389bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226733, "uuid": "b9afe9db-f209-49c3-911b-219589399376", "comment": "Malware payload", "value": "7307f8f371eaa839352b3da7382bee6a082e8bb0c75ece8f0751cf34ed9d71c1419ef07ee1f9fe978600e55e03a21e9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226733, "uuid": "34aff15c-5d42-4d89-ae96-bcb279632716", "value": "BE04C22733A7C576C5C42230E4A1CB3B2668CD1307B4725674C6AE9BBD6B28D4DBC2E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226733, "uuid": "91ea4363-5bd1-40af-87dc-c81b1d8d0d6d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226733, "uuid": "833cd972-339a-4f54-80e4-3e5161e37e4a", "value": "1536:VxSPDYLbezSJV/FBbEEUaVcbwcwZ06TFx0LIgPKr66YScgFh+UQ4/4/42:VxS7KbezaHB4EjOwvqeHgCvcr4/4/42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226733, "uuid": "efdf6e23-a7af-45d9-a3df-e9e500198345", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226733, "uuid": "bbeb550b-b340-4a0d-8f34-dbcd3251d46f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226733, "uuid": "d264167c-6739-48f9-b68b-d722cac01d14", "value": "4cc53c562f33ec28c3f5ca7d18e16491.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e55b8a27-db2b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226714, "uuid": "08eb903f-fabf-43dc-9bb6-b28c04c1ac0b", "comment": "Malware payload (AgentTesla)", "value": "d8d6d04820a117daf7babbe0b5a0d3fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226714, "uuid": "3831782c-4bfa-4417-9821-3df5b3daed7f", "comment": "Malware payload (AgentTesla)", "value": "9d1382945fd211ec3308c7a3959695b8736b1c169bed3e7c3ccedcab7d963d71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226714, "uuid": "1dfb83f7-a814-4f42-858d-146f075bcb2a", "comment": "Malware payload (AgentTesla)", "value": "174aaa1b0fd347e140d9cb39f780deb1de4839c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226714, "uuid": "36d524e6-c31c-489c-a4b4-35584ce62c43", "comment": "Malware payload (AgentTesla)", "value": "87bf965bf7918f7b47c2496ae1987d3b9fa74373d6e4210f36dce6baa6324f6f1799cbcdd3bce876d72cad04716e6c9e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226714, "uuid": "f6e26425-70bc-4b3c-a812-aed739ffa74d", "value": "23053A68369070EED4B7CA77CAAB2C58EAB9B437571B550B601302DD4B0D983EE701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226714, "uuid": "c5e4fee4-bab1-41c7-9805-e1891410420c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226714, "uuid": "eaaa3e50-3fdd-4051-bb4a-35f2f913c79c", "value": "12288:7QNJlhTrphwTFpgmt5ZgtIsm1RrYhzv6BbXT3/YM0FsTSCVoFUM3H4Dxfst4o/Yz:kSgtErYhz65zwM0yVs2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226714, "uuid": "596efbfa-765e-4bf6-b789-e0b03736f821", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226714, "uuid": "488741f3-fcfb-488d-9443-1ef8a6d921f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226714, "uuid": "fdc9f790-8198-475c-972b-eea7e4ccaf89", "value": "d8d6d04820a117daf7babbe0b5a0d3fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9149f8a-dafe-11eb-875b-42010a9c0053", "comment": "Malware payload (GuLoader)", "timestamp": 1625207420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207420, "uuid": "2c78c0fd-0e4e-475d-a3c1-83caf017295f", "comment": "Malware payload (GuLoader)", "value": "cb056487420b3a710d204c6d45328bca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207420, "uuid": "834ca76b-5e95-49e5-897d-f776cf707c23", "comment": "Malware payload (GuLoader)", "value": "9db6c93a5088b8b8ad42da6dd88ed3c76ae3b6cde4f6f05742befdd4951a0550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207420, "uuid": "8d99f1d3-342c-4028-8136-15424772cfe6", "comment": "Malware payload (GuLoader)", "value": "0d0f58b475654af95ef892d6a3b59c504cbb2b64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207420, "uuid": "d630c713-f3f6-4613-8b10-e17f2bcbbb36", "comment": "Malware payload (GuLoader)", "value": "8f5869c088a88586689958f5d26c79633bd23c8b9c1ebdeb62e68f14c4f6f7cf52f0d3e493b037ecaa0e1a98d0cc3f7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207420, "uuid": "3f9d65ab-52f2-4204-b2e7-f9ff8b234d68", "value": "CE65F0221ADFC834D32B033CDD98AEBC5D24A87275A8FDC6F3A6351E1AD4581D65C06B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207420, "uuid": "b069e13b-0551-4ccb-9926-5a00e5c0535f", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207420, "uuid": "a1e84c32-5547-4a38-8553-d78dc955a336", "value": "24576:OXtfMdAG/BghXoiZqA/ykBoEM20M2jSv/ZdyEdvTR+dwo2qnItjwwDlJMLrd6dvD:OXtRG/4Xoc/yk6EwMWgrj5TRwp2zUwD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625207420, "uuid": "75f0b043-a3e4-4b0c-be78-c54316e4149c", "value": 1534656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625207420, "uuid": "34ec9426-a3e1-4e05-9ab9-f5fec5110a34", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207420, "uuid": "ca97f218-9719-4225-a967-33d3d92f9bbd", "value": "cb056487420b3a710d204c6d45328bca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f286bb5d-db71-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625256801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256801, "uuid": "1795c18a-0bf4-4f38-a609-d5ed5fa3f638", "comment": "Malware payload", "value": "376e493eb862c62bcf5cfe24a281c92e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256801, "uuid": "ce22f7a1-84fc-4495-b8cc-57bfbaaf42e5", "comment": "Malware payload", "value": "9e227bab952b3eb138d547c9205d77e1274789689bc7be63b72b9d9505a5f08a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256801, "uuid": "c563bb14-754c-4d3b-9211-13559083612f", "comment": "Malware payload", "value": "52675dd9d6567f1cf4e700ba7689fc7909f1747e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625256801, "uuid": "87617bdf-d5f3-4526-bbc0-91794b4cb4b4", "comment": "Malware payload", "value": "48f77d80e5530030df78762bda6f53c033481bf213b4f77485c1f0fec13cd313493b04f85dbb5e3a094e1f080a3be86a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256801, "uuid": "020db850-4ef6-46dc-b6fa-23e92ebe83f1", "value": "CC552381B76D4CA6C4AF1DB29F737A4049736C54293095273A72BD8E2C311BA1C37E9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256801, "uuid": "b3ffcc60-87a1-46e6-9038-f9e5ce271164", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256801, "uuid": "e3211c75-6206-47f9-8538-30a3ac10f4bd", "value": "24576:m3BV1ZGqB29yhO1M+ubggtJAramkLKNw/j+9MJWG6pn4GzBX7Ia4m/YFydoRfvjF:S1ZG99+Od6ggtSWmTxeJWGF6BXcnsAfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625256801, "uuid": "c7a319b8-4306-401b-b701-0f4a16d77262", "value": 1337067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625256801, "uuid": "a2613a56-45b9-4bbf-92be-7fefa761cb61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625256801, "uuid": "4ce614d7-0735-44eb-9371-7e1bcb045f4f", "value": "376e493eb862c62bcf5cfe24a281c92e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91a42a1-db69-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625253268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253268, "uuid": "1054b050-ffd7-42c2-a7c7-47c65e901753", "comment": "Malware payload (Mirai)", "value": "38e2ed9b807bf94cf88802f41f8ecf4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253268, "uuid": "c41b7861-e1cd-4c19-af31-eb31cfc66c81", "comment": "Malware payload (Mirai)", "value": "9e3ab8803a1095dc615f67044688ae8be2e25127c7ff2f10b6923c1175f48a7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253268, "uuid": "fb7bfa4a-8d10-45c1-87fd-c8f64cebdeb9", "comment": "Malware payload (Mirai)", "value": "3fc542512b4a3f33ebec3b4ef73167a4317d6800", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253268, "uuid": "d92bebde-e321-4dca-8d9e-44d7d7640e5d", "comment": "Malware payload (Mirai)", "value": "1a30628f1bd8c38f71e153185605ad1e72a77049c9bca122040252ebdb82316b6376c0128879272b16318bc2ad7ad4e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253268, "uuid": "866f5991-c57f-47cf-975d-12ba54258d19", "value": "FDC2D0DCB1047D90CD986CB586EC02F14A59A6D6739E8F5DA33249C4A5B7C0B35E60F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253268, "uuid": "b5bdaed1-4fea-458b-8b95-b895a3b2e8aa", "value": "768:MxCUFskb2JgIs/RboqfiBJops+TOHcXYC+W5:mCrJgHt7aWpXTKoY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253268, "uuid": "a67c5fed-7dd5-45eb-abe2-5b2799154928", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253268, "uuid": "d9595b90-b68e-4092-9bef-178fb53d4d10", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253268, "uuid": "ebf298d1-39cf-4ee0-a40e-a98f811675f7", "value": "38e2ed9b807bf94cf88802f41f8ecf4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be27e179-db69-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625253277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253277, "uuid": "5cbad4cb-c649-4cd1-b4c2-dc36332f535d", "comment": "Malware payload", "value": "1453a075f89ca0c83fbc4be1aa50e130", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253277, "uuid": "44efc627-533b-4f0d-8769-3a4da55567f6", "comment": "Malware payload", "value": "9e99d5dbe3c26e4b87dc8b60414f9ba1c16c37b2c9672f5f184210c4a3404759", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253277, "uuid": "405bfae8-dd20-4ef6-b835-5ac245c9f075", "comment": "Malware payload", "value": "f5026a899cb6c84b4670fe9508d215f3ca81d4d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253277, "uuid": "e8302267-091f-4515-b6d8-50d24f69c53f", "comment": "Malware payload", "value": "979140978cabe934865508610bba5d026996c013e3d1260d391237b89adbf972ebd71cfed77ad5203176cac0367fa2e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253277, "uuid": "5fd9ee16-accd-40e7-8574-643c4fc1a144", "value": "4D04D05DA7FA84C3F0AA30365491E97E57CC608DCD7CCA23938CF96DAAD7D519242B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253277, "uuid": "cdebde94-0d98-4578-aabe-bfa3c7d6db8c", "value": "31961e0d42c09d6d2dc71e946d393be8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253277, "uuid": "26de935d-3a3d-4dc6-95ce-e2deeec33e1b", "value": "3072:sbvVgvf5rn6RN2bf1bnkCwMWU8BY4BbMcCffffffffffffffUQo9+dK31bKZfffj:kV4floN2bfBuC8BY4FBsnssQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253277, "uuid": "2db91848-e4d2-4b44-baa9-05f8aa0ac768", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253277, "uuid": "faa24b7e-e364-48c4-bca0-7b4c091554eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253277, "uuid": "eb70a864-4e89-414b-a292-f0e574975d49", "value": "1453a075f89ca0c83fbc4be1aa50e130", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1041bef-dafc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625206466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206466, "uuid": "47d606fc-f0eb-4586-ae68-1986049290c4", "comment": "Malware payload (AgentTesla)", "value": "1750cc351256aa28d74e6b77985e8b8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206466, "uuid": "1717ae67-043c-40c7-8c2c-4c9e2b299d75", "comment": "Malware payload (AgentTesla)", "value": "9f2e08425fbeaaea9d92e472bc4e6b9dcfb578fdcf4dab4f6169490ad366be3c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206466, "uuid": "35c99ef7-150f-4f3c-a741-7453b0bcc043", "comment": "Malware payload (AgentTesla)", "value": "3de8ea8dc223217c7068e2edd6bed6e618f980d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206466, "uuid": "5270902a-744d-4360-ba64-132ffc5b0ac8", "comment": "Malware payload (AgentTesla)", "value": "04edc58af506d095bba27318c504c1b557d64b5ad14127368fc44d601f129d7b39e876fa07d3b190f48f15abcd0e459d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206466, "uuid": "c24a2fd0-7794-4ffb-bce4-13a50ede6510", "value": "4E451288D59B5575C918DB3A021E09235CACCE24288CEDE18E1664F6917ACF35F2FF36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206466, "uuid": "b7480278-03a6-4ffa-b90a-43ca875d88af", "value": "24576:e4bGuA44V/2cCVcWQsS50D6FOsSVu0PZneK7ADzoLsET7SarO:em4ZhCO550D6sK0HsXDai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206466, "uuid": "df9c5249-1ba4-439f-b6f9-67a5b53d26d1", "value": 1223512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206466, "uuid": "7b7ee005-b69e-4c66-be2f-5a9aa64c511d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206466, "uuid": "6f69ccc5-fa67-4244-877c-a087a6132697", "value": "4600160458 ETLA LABEL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8714871e-dad8-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625190907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190907, "uuid": "1c6b1ccc-94e2-43a7-aa3a-3be2c6d49213", "comment": "Malware payload (Gafgyt)", "value": "3e68566b45fb98ac04dd14d6fdb0d6d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190907, "uuid": "f8c3e003-72e9-4cfd-add0-28c6a176a06d", "comment": "Malware payload (Gafgyt)", "value": "9f8d26332cc8c467dc1ce568d51394b56e9a73676aea6bd9ee2ae132f49ba149", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190907, "uuid": "63be3945-fd45-4e87-9c6d-7e8dc49f589b", "comment": "Malware payload (Gafgyt)", "value": "b137d09a5b41f8187dd4e1e400cd2dfe57320fe7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190907, "uuid": "a78c59e1-60d6-4ce5-b8e0-2e5ea2b676ea", "comment": "Malware payload (Gafgyt)", "value": "7e97d3a4fc02f7033d496e9f26f32ab66449b3c3f844b9b3a05233620eeae22616c0ec1cc338f8bcdb48a884a97cd670", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190907, "uuid": "c4d1048b-1f32-465c-abcf-86eaf991dcdf", "value": "AF23F1DA8BCBB183F6045330C42FBDD9ED17A6E61CA20E563B874A40E5620D8DBB6546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190907, "uuid": "55666e87-8a12-4559-b86f-585e6e305419", "value": "768:j7XLZdxk1Jr5s16E1Terq2rlxP7/7/NEKqJpL4sZ0oFu9:1dxWr5tj7lxTjNEKqz3+oFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625190907, "uuid": "441b16a9-6c11-4109-8c19-de524861d3e3", "value": 45620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625190907, "uuid": "f4650a6d-d935-4b2b-bd96-7cd60736214e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190907, "uuid": "eb4b323d-b217-4e71-84f4-cb67d1e83434", "value": "3e68566b45fb98ac04dd14d6fdb0d6d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32da2bf4-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191196, "uuid": "0db0708b-b6f7-43a7-989b-bfb470c6d256", "comment": "Malware payload (Gafgyt)", "value": "e98a36d8fb03c014ebb366bdbf13e0e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191196, "uuid": "5f6163c4-2b53-4722-be8a-2e95cfc702c3", "comment": "Malware payload (Gafgyt)", "value": "a0240c4cf256fa47464b84a7312087521fdb561a51299bd8dc4f8d87f79c8cf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191196, "uuid": "ee41b928-25bd-4902-a3f0-8267b1f82108", "comment": "Malware payload (Gafgyt)", "value": "5854cae1e2d567516520904ef62a0a76400faa60", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191196, "uuid": "b2ddec4c-1d2b-4d11-a769-bc035caa74db", "comment": "Malware payload (Gafgyt)", "value": "f2aa2463aab5c5809de4d2411ca34ea73717122b24b54fafc5be22aea1c76f81c35de44de3f93d886b1b30bf456d963c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191196, "uuid": "1d82ba09-edd4-40b4-918e-6a1605dfe72d", "value": "21B3B617BB618FB7C81FCE3306AA8901108DA59612D97B6FB2B4D96CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191196, "uuid": "ed2c98e8-4fb1-4e2b-b804-4b27e55fe27e", "value": "1536:ZLeT8AhSgCSkSHMwKJrZkhzw4dI6vwgck1H2zfgB4UmkiSFxfC7xbXe:ZKkSHpKJr6fvw4UYKUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191196, "uuid": "bd50002c-e9c0-48a5-8e1d-a118a2316735", "value": 117385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191196, "uuid": "9f07014d-9404-4c23-9a25-f6b727f5eaac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191196, "uuid": "f02c368b-5aa0-455f-9542-934cd32a3f19", "value": "e98a36d8fb03c014ebb366bdbf13e0e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b08ffc6-db58-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625245675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625245675, "uuid": "3c5346dd-cdb4-4e65-a33b-5eb97a45c9bc", "comment": "Malware payload", "value": "8344f3ebbf53e62d36cf94f4ee8d618a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625245675, "uuid": "32823035-89cf-49b4-b6b7-c3fc23813bf6", "comment": "Malware payload", "value": "a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625245675, "uuid": "89ab957b-b39e-4462-8bc7-8aee54b23459", "comment": "Malware payload", "value": "56f35812195a5db0746a39641be477181daa3bc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625245675, "uuid": "9b3313b3-935d-407b-950a-484c1ff37f75", "comment": "Malware payload", "value": "4cb578c9178a213e47a318fecc3d0350adc17bef060380de0194af01843a130ae56cfca657117adeb2fbf020950a1b3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625245675, "uuid": "1ee30e25-a8ae-482e-aa58-d3dae8618ec5", "value": "5AE5333076F85572C759E5FB581B382193F222C2D431D99F029316BA9580F70879FEAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625245675, "uuid": "0455a91f-95c3-4ff0-a49c-d96d522823fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625245675, "uuid": "c15b08e6-b37e-4b52-8365-893a5f520f6f", "value": "49152:usmhnqAs9pJc0dnKh+Q0N1rs+vIUSg+6+8ohnRh1Na1OKM6nYAKhFQpSH3Oh5gxh:0qXpy05Q0N1rsYSZ6BoXh1kkypSH3Ohs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625245675, "uuid": "b480a23d-c4bc-44cf-91f6-acab7f3f74f9", "value": 3039744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625245675, "uuid": "e397c2e5-481b-4b79-914c-b2592e60c5e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625245675, "uuid": "fdf779ac-5b22-457f-984c-00602f8ba71d", "value": "a35bc86667197881479f85069d295aa12d92ae21d08bbbecb04b5eafdac4aa7f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd35cf4-dafa-11eb-875b-42010a9c0053", "comment": "Malware payload (Bandook)", "timestamp": 1625205654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205654, "uuid": "b56edcc0-b83c-45c7-bd12-fc36f1dacdec", "comment": "Malware payload (Bandook)", "value": "e1eb9c64795efe3f07b450c5b846ce18", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205654, "uuid": "f15f6bc4-a064-462c-9a2e-01252996ca6d", "comment": "Malware payload (Bandook)", "value": "a37c79c57ae9e2d681e5f9ef92798278d2bec68bcd91f08d96768e3fe8d5af19", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205654, "uuid": "23fc786d-ea6d-4e60-95b3-64aa0db34315", "comment": "Malware payload (Bandook)", "value": "e289feef635f51e0bc9383bdb7decefff9d13147", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205654, "uuid": "899f53ec-3b40-43ac-9f33-fa6d13e76c1b", "comment": "Malware payload (Bandook)", "value": "3234e837835ed4bcc8aca50c4a8b52f0e09ac1842c83d90e852d37ecb8ae73c49120142815b43447cdca789c21d0dda9", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205654, "uuid": "78d93a25-1f40-4fe5-855d-ab793fd4ff1a", "value": "F11533A76569A20D2167B773B9689C02F6C251B34EBB948CF4C120D7123E704EA6F35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205654, "uuid": "1fbb81d3-aed4-4a00-a1e4-edc9512f0e03", "value": "12288:L0E1njnBgVDIoEdr4xIxuchCBOsb1dRtNNKug95Z1jud0LRznWcJZ7ucjGUMIPQi:L00pGwg0s/NNKB1juu9yMZ7ukG5KHbL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625205654, "uuid": "a79ada8c-5b52-4076-9163-d56ba0d56b36", "value": 913278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625205654, "uuid": "baf8455f-12c2-4aa6-bb84-d1d2ecc4687f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205654, "uuid": "25e0d7e2-619c-4975-8398-af1b00e256ef", "value": "COTIZACION 21.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3777a73b-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191203, "uuid": "7021f5ad-f765-4fe8-a8fc-4411c3454098", "comment": "Malware payload (Gafgyt)", "value": "001ebfce33c5e15f861d8f8756a908a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191203, "uuid": "d0971bce-6a6d-499b-99a0-490c8394261e", "comment": "Malware payload (Gafgyt)", "value": "a564fbe80a015a6fd93f8155c43d86d288ef0afd520656cda0043677235fd9aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191203, "uuid": "c0cdd40d-e09b-41dc-be9b-0275a4e075c3", "comment": "Malware payload (Gafgyt)", "value": "3b1ea9168fc5a058f94ab393ec55d7b4190862a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191203, "uuid": "3b3c6646-3597-4c43-ac2e-20f2c6d71116", "comment": "Malware payload (Gafgyt)", "value": "4e3aea7094ea3597ab8b559abf3c72e58bb0eee6048056fdab44150d3ab6dc9dfbb349495627c999220d76aec65f843b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191203, "uuid": "ea92d336-8162-40db-8458-4125245f066a", "value": "AE13F21A948C1ED8CFF959F1AE436085F3AE1A0B572A6EE36B8B3B403C1403D554DED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191203, "uuid": "e0d79f6c-dfbe-4d51-9f19-c9d4825f87f7", "value": "768:4432BK/iahP5n1u8y0jXxDIVc5/8V/JbQwncUO3D4uVcqgw09AxFjFsRRlJ1RKPN:443cK/rLy0jBDIVfbQwn4T4u+qgw09AJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191203, "uuid": "11b62006-6b41-4e07-b9f9-c4ab45e55a26", "value": 42904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191203, "uuid": "abbad49e-0cdc-48d6-bb0f-25dd5c1de79e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191203, "uuid": "ed4ab7fe-e786-4ee2-8a29-2d8d777684e8", "value": "001ebfce33c5e15f861d8f8756a908a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b3b7e98-dafd-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625206698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206698, "uuid": "20644a7f-382c-47b7-9c45-919e2c034b98", "comment": "Malware payload (AgentTesla)", "value": "079fb78d0d12b110db6995028dced00d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206698, "uuid": "1b0c3a97-ed22-4b98-9682-d3a9b2a95a4c", "comment": "Malware payload (AgentTesla)", "value": "a5ab7191270ac7eaa3eb13ea3951774daf25f975c1333fe83c77bb6024f0970a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206698, "uuid": "eae4dd97-1e25-42a3-85c4-7bb885690c18", "comment": "Malware payload (AgentTesla)", "value": "7c85337d49f09031f4431414b5cf8f30eac208bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206698, "uuid": "905341c9-2d67-4e15-bed1-abd60efc2cdc", "comment": "Malware payload (AgentTesla)", "value": "eadf8d107a219341ead67843b07d511577370b9677d5720696e828c3ec69fa8949e50ec64be04c5ff9133d8e59216f82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206698, "uuid": "9556295d-12ef-4a82-a9a2-c948120c366c", "value": "AF7433A4119F8272E6488E4D35C0B1895E75FE9230CACC2963AECA71DF55AF62FC45C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206698, "uuid": "506fe5c5-4950-4f3a-b505-05d60f341f68", "value": "3072:9tBrB2BrB0hK6C5Oj4BUJZTTfPavDOz79Wzj/i4qHcnfuiWFWUtIxhXb5hSbjaDa:ZVcV0unVdzFD1RDAUwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206698, "uuid": "5d72cdf4-bdde-4325-9706-988338ffe7fd", "value": 342882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206698, "uuid": "00994b54-ca5f-4775-a09d-470465114e29", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206698, "uuid": "83df0976-fdcd-43c4-9a46-19a3f402b51a", "value": "Invoice 2334.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7fe89c-db62-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625250372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250372, "uuid": "0e6fb45e-86ce-403d-88d7-8f73233dbe53", "comment": "Malware payload (Mirai)", "value": "12bee5d25141627706ea0391572eb294", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250372, "uuid": "058a32b4-b676-44b5-80d6-f05c71eeac3c", "comment": "Malware payload (Mirai)", "value": "a65cb80a90de1b041da48eefa3fea874b43e7b870c5cb8dd0106ada1b9645fc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250372, "uuid": "101bd7ba-4bfb-43b0-99b7-59ca61ca7860", "comment": "Malware payload (Mirai)", "value": "770f6d2629d802c41875ba6d986359ad80063b59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250372, "uuid": "b35c2e1e-f6cb-4080-8343-78f563ca569d", "comment": "Malware payload (Mirai)", "value": "38f63bc0906383a92512f90dfbb0a5f1ecb72df38464fa0975ecbd128e9842292c48c2869560a7d7dc46ec1f4f0e2624", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250372, "uuid": "f2461fdc-577a-460a-a35f-0a0e13dfc87f", "value": "77E35C46FB818E03C4D5177AB6EF424933229764E3DB730799185FB43F86A9E4E63602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250372, "uuid": "6873ae0d-e25b-4c99-b7cf-e41fcb7044c6", "value": "3072:Pj6Stcgfr6LY6dUuQP0F6o73wB2QT115gWDLvKObEXv4mM/9jTfmuwS+Uzd:Pj6Stcgfr6LY6dUuQM6oe2QT11+WD9EU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250372, "uuid": "c84ae40d-d129-4973-971e-3eeaca7bfa0e", "value": 148102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250372, "uuid": "8c371aa4-46e8-40f1-845c-4b83666e1836", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250372, "uuid": "ed527a01-81a9-4c16-80fa-949dcdb17ab3", "value": "12bee5d25141627706ea0391572eb294", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7894e8-db61-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625249815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249815, "uuid": "6408a1fe-e47b-493a-b649-120afe4f029b", "comment": "Malware payload (Mirai)", "value": "971637ea3343e5bb059822ce8288875b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249815, "uuid": "b8412344-72fc-4256-b4e8-b6747cb634a3", "comment": "Malware payload (Mirai)", "value": "a68a5fa9021b961e4edc7af815bcad3622d652d0a8d87aa24dfbd7d35d0be375", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249815, "uuid": "8459c225-923e-448d-9d0a-4db3ad09b499", "comment": "Malware payload (Mirai)", "value": "ff8c960fd8a78262e3169f2465802ba663eba46c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249815, "uuid": "37356fbe-7668-449b-a687-301b61e07fd4", "comment": "Malware payload (Mirai)", "value": "a96ae46d83079a8cedc879652b8da31102e40261cfa7f498c3c76b2c0f50c2d39ace45deabe8d6e6b5b3397cc8bf097e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249815, "uuid": "7669af5b-83b6-4d4b-8888-380417458b9f", "value": "50639EB6C418EC54D0594278E1208D391B13F418B2637EF69ECA8697405BFB8F61A7FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249815, "uuid": "45f40caa-62b6-42eb-848b-3dd056a7fb55", "value": "1536:O/PVd1rO7nhaZBeGV3O2daPP9HAjvlEJorcdiMCR9a1083:OHVHknhaZBeG+PlwESYAMfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625249815, "uuid": "2eb50030-eb30-4177-8f9e-8f48cc8aba54", "value": 67844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625249815, "uuid": "1cd653c7-9d92-4e99-80d6-9f500e68f628", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249815, "uuid": "d6b45920-e7e6-4ecf-9c84-5aed97cd8678", "value": "971637ea3343e5bb059822ce8288875b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72bc13ab-db06-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625210630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625210630, "uuid": "8e5cf1e1-680a-4193-a152-324f6a9d105f", "comment": "Malware payload (Formbook)", "value": "b59e72b55c09881ee7966289eb37a0a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625210630, "uuid": "b41fcbbf-1371-4bf6-9e60-37403e9c3f92", "comment": "Malware payload (Formbook)", "value": "a6b7f7cc0b732bd64663fc8c69b3d88a155a2fbf6e0c0857435cb277d86e2e80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625210630, "uuid": "613d1818-9410-4452-ba47-70ad862d82ec", "comment": "Malware payload (Formbook)", "value": "4b3b19df4c34b4ec38c7e5e7c80ef4ac2aafcb4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625210630, "uuid": "8a30eed1-970e-46fa-b916-328adce50191", "comment": "Malware payload (Formbook)", "value": "279ff72e4611f1cd5d50afb66d2125c178f2f25b4ea10797cfa15ec15063ca3e659835f16cda6bfce572e8eed6e81a2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625210630, "uuid": "17b1a9c1-1142-48ed-89f9-381636a8e918", "value": "3C1412077390E4B7D7A346308DBA25127FD58708A0BB178727905ECDBEB23E5582F9A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625210630, "uuid": "aedd916d-df54-4627-b026-6013d3dbe309", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625210630, "uuid": "4c453cbc-fa21-42fb-a530-d5b81996cb72", "value": "3072:iBkfJpRXATwMdFCcGbXLArW7oMjSCreC5Z+lTXZz/whJEd0HnDC2jTS6w/mv11sb:iqjIKXsKLxZKXF/wLEMpRhvsb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625210630, "uuid": "2c2b37a8-1a2e-4651-8bb3-9120d2af5c71", "value": 197085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625210630, "uuid": "0cb56bce-84b5-4be4-a6a6-143321439665", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625210630, "uuid": "437749f0-0ed3-4efa-896c-5b5fc60d7613", "value": "owen.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd99dea-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625233545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233545, "uuid": "0c8cc32e-cc8e-4b6e-853d-d947c1e4e432", "comment": "Malware payload (Mirai)", "value": "307d6af38a65f9e7c1c07f2c0b27d409", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233545, "uuid": "c1d6e6a9-450c-4941-b2f4-58a82cb22e90", "comment": "Malware payload (Mirai)", "value": "a723f5cab79d6e1eed07a51c26cdef5ff23dd368b4211f541a905be8e82d8800", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233545, "uuid": "a4d34c7a-aa91-480e-87b5-e4a9e6087de0", "comment": "Malware payload (Mirai)", "value": "32cbe613feaf2dc8de5f9850fea7ae0530713de3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233545, "uuid": "1fcf480b-a618-4b28-b0e0-3d77f80145ad", "comment": "Malware payload (Mirai)", "value": "925864a106826c2ac21b114f1cec03f6dda38b282d1baebde385a6ac2d863e5bba0a5506e2c038cdaccb922348b5146c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233545, "uuid": "c81c1248-0162-4697-8c4b-99b9335624de", "value": "B7539DA5C4AC9D98C6264678F614C839AB23A00C62A33DF6DA57C656941FDFCF01C7F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233545, "uuid": "c1f3762f-72b3-4eb5-89cb-751626a4456a", "value": "1536:K/ue90IlCalyZyuhx+vACs2U/SO/Sfs3zO/QSwtPlCXGi:KGejAGyZyuhxaU/Sjf+iYdtPlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233545, "uuid": "f7590fdf-ebc6-4c9f-a1ae-c3c28e2adb81", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233545, "uuid": "a64fb500-17fd-4525-9756-513579b27aaf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233545, "uuid": "898735a9-ca92-4f6d-9a26-b02e6ec9b4df", "value": "307d6af38a65f9e7c1c07f2c0b27d409", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69c8e6f0-db18-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625218346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218346, "uuid": "9cee5378-381f-4126-ad6a-469498cc3ce0", "comment": "Malware payload (AsyncRAT)", "value": "0cc7fc4b0b6ac5db13661f7d4f1544d3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218346, "uuid": "00af7156-a446-43a5-a105-381ed493e362", "comment": "Malware payload (AsyncRAT)", "value": "a72d1d21eaf2f89f06ea807db188ee0e4c6ada5e966568d8543e4c3dbd5c7c73", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218346, "uuid": "c4feafa1-859a-41a1-a880-eaaa1b28e8f4", "comment": "Malware payload (AsyncRAT)", "value": "689fc5e89eb7f0b63d497f4f48756b4b5fb3b4c2", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218346, "uuid": "2a4acdf6-0583-4e0c-b72a-23e915ba235e", "comment": "Malware payload (AsyncRAT)", "value": "1b8681ed1a39f242afe4db4f5549bb21ecbcb13bc62365d9efc7c1d4bb3db219f4da83ac8208803e27affaf07b1d0b47", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218346, "uuid": "ec1ea2da-8238-446a-bac5-35a62bffb55c", "value": "44231B0037E8813BF2BE5F7898F26145867AF2672603D64D6CC451DB5723BC69A026FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218346, "uuid": "1f66697d-d140-4c6f-98d7-0d88c8d5a97c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218346, "uuid": "fcf79c0a-1644-43dc-9ef8-e9b1cc263fb4", "value": "768:YuwCfTg46YbWUn8jjmo2qrzwqsKkPIqzjbegX3iVrelBoFWBtOjCYBDZex:YuwCfTgp/26q3bhXSVmBoFWBsjbdex", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625218346, "uuid": "4fcc1f3c-9ab1-4ff9-8f70-4d752e464625", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625218346, "uuid": "dec0363f-96fe-43bc-8134-2af5d5cf8ad9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218346, "uuid": "d66caa95-eab9-4bc7-9ffc-1f3bb054bf7c", "value": "SRzbtaJv.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbef962f-db69-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625253273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253273, "uuid": "d0780e51-830f-412b-94e8-497d6e7326be", "comment": "Malware payload (Mirai)", "value": "94053275c51f467959fbfec40fe97050", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253273, "uuid": "f2f01947-1929-45a5-b785-9c2f6a8ea942", "comment": "Malware payload (Mirai)", "value": "a78860d8fbffa355a984205ef8a127d32132cf22da0caba5dd5b0eefa2400046", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253273, "uuid": "d88dc365-2a15-4428-a1a0-a11692cfc04a", "comment": "Malware payload (Mirai)", "value": "d38722923b964842dd68fb039e179b9a0ccf500b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253273, "uuid": "43c3ec45-d15e-48b3-9686-43ff6872ac95", "comment": "Malware payload (Mirai)", "value": "718a5e57213d570e38ce5a2a03a0c97f8f5622469245110e4b0e47efec758d4a615ca67a333802630c37a26486769e27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253273, "uuid": "69711f5a-89ed-4772-aa85-f9deced12fd4", "value": "00C2E0684F6445D8E4B8C0F40A10036A2D4D0FBAAC12CC869DB8E39BEDD78B57967FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253273, "uuid": "8b7c3558-4602-4e38-81ee-0ce96bc11b55", "value": "768:12G214DFypXjs4WfL7YWJgGlzDpbuR1JQ:12GdDgpjsPYCVJuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253273, "uuid": "c4d57f98-d765-49c8-87ba-9957b223d52c", "value": 26176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253273, "uuid": "d79a3510-1a6f-4d9a-ac69-e0e320323a3e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253273, "uuid": "f179e87e-a7b9-439e-b986-ab79c438d146", "value": "94053275c51f467959fbfec40fe97050", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b4d8349-dacd-11eb-875b-42010a9c0053", "comment": "Malware payload (OskiStealer)", "timestamp": 1625186163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625186163, "uuid": "665328f6-dd3d-4751-8ba3-5726c1cacd30", "comment": "Malware payload (OskiStealer)", "value": "a7851f7e7a463d24322afa49d6f12354", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625186163, "uuid": "e1290b2c-65d1-4799-9c44-088ccee72c43", "comment": "Malware payload (OskiStealer)", "value": "a8a6545e0b964a202a9a836d1580d3c88746fc2c56ce246738f4e5ac12cc6277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625186163, "uuid": "366e60b4-9594-4cdf-8f14-51d7d5e94576", "comment": "Malware payload (OskiStealer)", "value": "634d14f9ae2d98fddc525f793b48233e765bee9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625186163, "uuid": "9134b679-1d5e-44b7-9000-2c77c962cc2f", "comment": "Malware payload (OskiStealer)", "value": "8010ccc9dab0cf700e5c7ff4a635a465611c658047c18eec5fa3f256ba447c8e4e7d5232d27e29c09499a8cf49ce763b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625186163, "uuid": "b2c6ffa7-3290-4f95-bd94-e41de6bbfc20", "value": "7A146D30B690C035E86310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625186163, "uuid": "bec53824-8fd9-4b9e-93df-c96f6a38f2d0", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625186163, "uuid": "ef855199-3e7a-40d6-97f9-f947db28a7eb", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIC1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pNv1Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625186163, "uuid": "99ab3d3d-2800-4ef0-838f-478de9830e01", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625186163, "uuid": "f79d010c-7b3c-453c-a93b-7fa78d58a850", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625186163, "uuid": "90b2631e-4f4f-45e7-be22-f9bb939a3884", "value": "a7851f7e7a463d24322afa49d6f12354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf046d2-db6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625253543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253543, "uuid": "2d781ab5-2dd7-45c2-aa89-88cb089f4ced", "comment": "Malware payload (Mirai)", "value": "11753b17ee24914b96f68fca5dfba7b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253543, "uuid": "371502b3-4fa8-4270-8d61-adecc702ec3f", "comment": "Malware payload (Mirai)", "value": "ab34bc49a418d6ab243c97eaa9c7d6801d582e99a7dbebe4972cf1329da57dd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253543, "uuid": "d9c8ee01-90bd-4ed9-98d2-fda4f1c845ae", "comment": "Malware payload (Mirai)", "value": "87a20b7ba0e8e1ede1ac55a8293d6b6456291a1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253543, "uuid": "d3ffafe2-da51-4946-85d5-9ca0090a628c", "comment": "Malware payload (Mirai)", "value": "0cc5d54e4290ea47817087118d4caf07cf6b9a250bc11adada73d440673769129eb73b8180bf628f1de11dd94173d00f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253543, "uuid": "13b523f5-90ff-41a7-957a-68333a13e533", "value": "8BA2DF1520CDA832C1B0A577A63DD642A76A8BFD91FE33351C0D16DC92C6500E6BFAC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253543, "uuid": "e638d028-53a5-4e5d-b912-24222b0cc574", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TULcxOr2MLH6WZdzC7osUbVqle1xrsq/Aphymdt:Ypoh/DxCvhdRVxOamdPNhbRAps3UozJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253543, "uuid": "d175fe73-7ca3-4b50-8120-950a7162c53b", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253543, "uuid": "cf71e171-dca0-4205-8553-70dddb205e09", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253543, "uuid": "8c050f8f-a578-43fa-a460-b5a9ba101de3", "value": "11753b17ee24914b96f68fca5dfba7b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87e3a83-dafb-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625206130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206130, "uuid": "e3a7f8aa-cffa-4aed-87da-86aec86df084", "comment": "Malware payload (AsyncRAT)", "value": "9b42e9d875e57393d80aab346b035b16", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206130, "uuid": "0fa77848-1dec-4148-abe8-5ffc71cd52a5", "comment": "Malware payload (AsyncRAT)", "value": "ac529e653e09259760c0d040792e18021f039882d38b3e1d1c949c5150e2c5e2", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206130, "uuid": "47d7496c-7cac-40fc-ba21-07621e094414", "comment": "Malware payload (AsyncRAT)", "value": "9e60b17757499c78d1e363248ca3c0ef2c6b1fec", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206130, "uuid": "7086539a-b130-4f00-babe-083748707a91", "comment": "Malware payload (AsyncRAT)", "value": "2aa1a8d78f6b4dc7259e58e9b9f166d4ea93fa03e231f0b00eb39b807339f8fded8b3eee34ce89fb518dd334ce0ae360", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206130, "uuid": "cb6a5451-973c-4567-be57-4e6156d1bdf2", "value": "49D47C3D59BE2137D1BDD3998BC88C2BF840D66771217E7998D703A5870AA8379C213E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206130, "uuid": "6ced46e1-103f-47e5-abf2-634d4a0be8c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206130, "uuid": "b74da9d9-468c-4f33-aeb8-d8a0f3752759", "value": "3072:CWxE6kt868akI/P7lacu1H3ExVERd45Jfg:CWxE9m0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206130, "uuid": "44f94a1e-4db0-489c-892b-d25254466da8", "value": 617472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206130, "uuid": "3b184cb2-0f82-4ff1-a911-a85a2bee2865", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206130, "uuid": "38fd0e5b-179f-4ad0-bf70-bb845d67ce82", "value": "RemittanceApplicationpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977575dd-dafb-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625205967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205967, "uuid": "98c96a62-a623-4bbb-9d15-c5431e17e722", "comment": "Malware payload (Loki)", "value": "f4c19020d90f7d367b4ac6ea3f708eb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205967, "uuid": "f1fd8cb2-6922-4d09-a9db-c733e605e2af", "comment": "Malware payload (Loki)", "value": "ad2be9cf672a906a4e35b84210c95c3f2b0ebf1e55be6e2006498575b8871865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205967, "uuid": "2db6b012-2eb9-4986-8276-5840a0666919", "comment": "Malware payload (Loki)", "value": "1d6f05f1ea273a13bb37cebe716e42d1d0132d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205967, "uuid": "261c65ca-e614-4b8f-80db-ef8de79b897e", "comment": "Malware payload (Loki)", "value": "ff50c023858327d6f02f06ad0c6e9f4637ee952a732169ff9c629364089c16ea1e609d2b52ff38aaa60ebad9f97241a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205967, "uuid": "bbc15fcb-b9de-4a63-8d75-e988a5675d44", "value": "1315A49D726076DFC867C876DAA81C64EAA0747B831BD203902316EDEA4D997DF140F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205967, "uuid": "820c4da6-558e-4b88-95d2-fb8d4caabc4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205967, "uuid": "8a8d4eee-d198-41d8-b2b9-b6eef304e214", "value": "12288:DjMl9se/wLyiPwofwADU8g/4XaTl9DeSzJSgUNUtAxXm0zn/NhxrY3wz9pK7r8or:DYl/wdPzoAQ8C4XAnv2sAxXm0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625205967, "uuid": "b9f071e5-59bd-4340-9841-f2ab1bfe174e", "value": 932352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625205967, "uuid": "429a5bcb-7e9c-4bc7-9cec-f98caa9a8598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205967, "uuid": "f2685a16-0f76-4d8d-90e3-f45dd50cad37", "value": "RFQ210702.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e168e7f2-db1d-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625220694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220694, "uuid": "1975dfff-bfff-471e-9931-0fbd0e52931e", "comment": "Malware payload (AgentTesla)", "value": "0f2d7c68b39735c57f756cfd7721b72b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220694, "uuid": "5dba4ee9-4aea-4c15-810b-7ac97d41ff17", "comment": "Malware payload (AgentTesla)", "value": "ad92fb41b56509723d240def542d1d154b40e74a93b9736d5bad20c61ca26650", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220694, "uuid": "a3720b09-9e0c-421b-a13f-8003f4637b12", "comment": "Malware payload (AgentTesla)", "value": "1a0e627c406620961cb3139456527cf3157af41d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220694, "uuid": "80219c47-81ec-4aa6-b5f1-bda47def0ad0", "comment": "Malware payload (AgentTesla)", "value": "00d707940b763deb6d3e78d1bd6a618c1e8f9174a4cb6601ca395bc58a138266ef81b5f9e24a2ce62f6cdb85c0b0a67f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220694, "uuid": "a0097800-caf0-4525-aa8e-18ef7e45250a", "value": "6EF423281F4C0299BB5356FD22ADF3002B8CBC669DD30E1FB434D0F5C5A2B5953A6AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220694, "uuid": "90989724-1804-4886-ac5b-5ceef9057f11", "value": "12288:2WxQRJLZOBJU/UiKFbILKP64kE3EyAOUkP+XyJNH2wp8Zfg7MUrvKhHOG:/QRfOz3iKWLGFULObPRKejrvKhOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220694, "uuid": "05b9b13e-8064-4ba9-8827-d54f80e41cc2", "value": 771646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220694, "uuid": "28762c64-0975-4dcd-b80d-b01fba1eda28", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220694, "uuid": "910a50ea-b892-43b6-9c94-1e8716f2b4af", "value": "NDP1801turkticaret.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd23584-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226913, "uuid": "5b3cf8dd-fd20-44da-b4c9-b9bff749244c", "comment": "Malware payload (AgentTesla)", "value": "9be97fca4c22d1911bef95e5a9cbf158", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226913, "uuid": "ec9f6dad-1230-4941-8ab9-240acbfbb170", "comment": "Malware payload (AgentTesla)", "value": "ae39c1c47739a0501d1e6808cac3ee5d4d31c06f18cf069ba1acbf31fab4a3c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226913, "uuid": "320eb4a0-018e-4ace-8908-00c68f501ee7", "comment": "Malware payload (AgentTesla)", "value": "574ee48c1ee4d159839ab98179387c21097f958b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226913, "uuid": "2f0eab7c-5b94-4589-bc4f-407761f03d98", "comment": "Malware payload (AgentTesla)", "value": "2849e716d7f9c266798c0c0efc5b717f3f5c8bdd580543561cce41a17ce669024f35e075fce3985a58d69fcadc239f56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226913, "uuid": "fda8e177-1acc-40b3-afaf-2587ecd59ca7", "value": "2A053A6836A470EED4B7CA77CAAB2C58EAB9B037571B550B601302DD4B0E943DE701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226913, "uuid": "f51d87fb-2500-4754-807e-f515a7999273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226913, "uuid": "c5b20eed-2747-4634-aa10-e0e0e7c2443a", "value": "12288:VpIAoWSIinZoepwBhEPYgPUoqMdk8soGXe68bz1l+4RxDcPAL7FUCSrBxS6m8nMG:zVEPYQQHXfs1l7nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226913, "uuid": "96ea54a8-9b11-4896-9028-2b6bce376993", "value": 797696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226913, "uuid": "223fd965-9378-4131-8a5f-da7c7e0fa912", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226913, "uuid": "f8b094dd-35e7-4f67-801c-461e1333f972", "value": "9be97fca4c22d1911bef95e5a9cbf158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ae220e-db17-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625218143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218143, "uuid": "069ccdb6-8f29-4179-95f6-29073b231727", "comment": "Malware payload (AgentTesla)", "value": "c035bffd4035748b61ee6169ca0d6fba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218143, "uuid": "a391b740-194c-4a2e-bcb2-b1034125913c", "comment": "Malware payload (AgentTesla)", "value": "b00aad6e3c47d288f4d317a9c6608f5dbe579dd33e643f48ed84661beb8764f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218143, "uuid": "a9792f60-91d4-4eb8-a7bc-7fe96d0ea167", "comment": "Malware payload (AgentTesla)", "value": "e7d04e9ad780101d8108db31e9d95f26c8fc4b7c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625218143, "uuid": "8993e8ff-bc8a-42f1-a5fc-af5bde7fb3ab", "comment": "Malware payload (AgentTesla)", "value": "0ac2151047104a05b057a14d40fde192cdd9328b52e96e6a97b91923f246970b259a0b8bfb092bcea69fdf951e8af004", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218143, "uuid": "75f4fa38-4c6d-4212-a0a3-1cf1af962c44", "value": "12E48E141DA94026E4FA5FBD86E0E572536EEE232F03985C24F63ED73773642D9E012A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218143, "uuid": "5f658592-c160-461c-84e8-d3fc83292c52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218143, "uuid": "f9b97371-3c49-4773-ab92-85eeea3db4ef", "value": "12288:MdMW6BbX5TyqtPGmFyfnBsGBLkRNs0oxf1BUL5XsKcsnbCiEu9uqu0P:IM/DtPG8oWieef13jy2uu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625218143, "uuid": "316a82bd-49c4-416d-9485-c00275b235ea", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625218143, "uuid": "07a6466f-876e-4387-a4f5-afe652a7b772", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625218143, "uuid": "dcae17a3-3d68-493c-a5c8-271ef42eec42", "value": "zam\u00f3wienie nr 42150149.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd93377f-db21-11eb-875b-42010a9c0053", "comment": "Malware payload (LimeRAT)", "timestamp": 1625222352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222352, "uuid": "21ce0c5d-3264-4adb-abf2-379043b979fa", "comment": "Malware payload (LimeRAT)", "value": "3fa987a5c0b7bbffa5a9b0af84c2e1bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222352, "uuid": "7b3c6b27-6c3f-46b2-9df3-1c62dd61d02c", "comment": "Malware payload (LimeRAT)", "value": "b0591adfa77f4f140417a218b047ec7fc3b5764389d362ca7607341bb72b675b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222352, "uuid": "62465c1b-251d-4a2e-8648-f028650358a6", "comment": "Malware payload (LimeRAT)", "value": "b4cdef6ea42069e2c404f6d4e85db72c60730df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222352, "uuid": "058dc305-e0d0-4fc2-9d03-522eecb56b0e", "comment": "Malware payload (LimeRAT)", "value": "667c41bb87b05c82dee60406ea898088ad22b4df42ff7b5fbe0dd4c5d2290d200b0ea24e12b422fa06ea3effd7ca201c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222352, "uuid": "8b026cf0-2969-49db-8c17-3579e9946816", "value": "DCE4F8A8369070EED4B7CA77CAAB2C68E6B9B437571B550B601302DD4B0D983DF601B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222352, "uuid": "0c6ef7ee-c12b-495e-a736-88f1fae06aa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222352, "uuid": "638f58a9-0962-43d9-850d-6bd414650fc7", "value": "12288:8NDOlX9ccQbApmmfon3NJSrwKu/ZCl+FqDOEW6lkjdLooZlDMHU1kme2tJUyS5Kk:0P3NNKuxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222352, "uuid": "4b2729c5-9609-4dad-a0ed-f41a7b48da84", "value": 665600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222352, "uuid": "a4c2903c-6f1d-4cec-8677-3c1120b9a148", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222352, "uuid": "c0241053-e5dc-4618-acf8-ff5f551f0f13", "value": "3fa987a5c0b7bbffa5a9b0af84c2e1bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a51a25c-db34-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625230400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625230400, "uuid": "d8fc906b-6ea7-4f30-90f4-f6858b06d120", "comment": "Malware payload", "value": "caac1163f5750786c309d300801bfb04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625230400, "uuid": "c4db6a14-ef2f-4936-8096-fa7d46583d1d", "comment": "Malware payload", "value": "b0bd075285f348ce2e90bbfe62e2f082b78a82dc554304009c16191253b3aaa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625230400, "uuid": "e2c1adc7-1650-4d10-a02b-64ff5755c860", "comment": "Malware payload", "value": "65df0cfad98cd4b020e6fcf1288abafed7e05531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625230400, "uuid": "2e482252-a56c-4b3f-8527-244dfe6f1018", "comment": "Malware payload", "value": "8e738e7593cb67fb4b3b94412ff14389f6dffa7197d7688949d005d508325493515438e74acc948a9341dc14a1ba1b72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625230400, "uuid": "0dad8872-9f52-4531-baa7-13507266c13d", "value": "FA057C2036845B79F0BE8F7387939160A3FDEA17AB16D90C7CA502CA1767F43C6B1616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625230400, "uuid": "16203eb3-e864-4002-9e56-cb33e0890875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625230400, "uuid": "256494fe-9dd2-461a-81b6-782556a3eb59", "value": "12288:uhAyAy1EOGQyYHbNCTJoBQBYq5R3K3C33oKjIbsv87sGBsMTeTbuy:uyyBRCdgQBv5R3KS3BIQvZK6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625230400, "uuid": "ac2f455a-5662-4455-a218-ccf555f50455", "value": 874496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625230400, "uuid": "115b8e73-6e63-44b9-bcbb-ff7beacfae46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625230400, "uuid": "b943909d-759f-419b-9568-7ca041894fae", "value": "Invoice & Packing list pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9920c5-db3f-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625235078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235078, "uuid": "f2e817b6-495e-4f6b-994b-141b95dbf9dd", "comment": "Malware payload (Loki)", "value": "0d1a409a8bea11db9891a6e38a496657", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235078, "uuid": "57ac5963-5754-420a-a1b6-a1cdc76c6cf2", "comment": "Malware payload (Loki)", "value": "b160f4c05c4e22fb013437501d7ef585f7b5d041480f2d7419261dcdbf3c341b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235078, "uuid": "09145520-d969-48e5-87bc-c42068c64614", "comment": "Malware payload (Loki)", "value": "c522abd18063c0dad7579c61c4a4a085916fe562", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235078, "uuid": "3f9d4640-6f44-444f-9b04-3e584f3d515f", "comment": "Malware payload (Loki)", "value": "0eac4322aa8ce70f1d694923be5345019ef3d46448b9738ec68f694ebf8b731ddd1f649a71a102d8029fa3a33359283f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235078, "uuid": "60866c9c-7b33-442e-bb08-c94be9b4d53e", "value": "CBF45C203A845B78F0BD8F7343939160A3FEEA17AB16D94C7CE506C91B66F43C6B1616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235078, "uuid": "2d315035-7641-4d1d-b717-331254fa55bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235078, "uuid": "3eed76da-a7bb-4218-9144-cc6552ccbbbf", "value": "12288:x2KNS1EOGQy+HHkrr915J6LK7V+wqwdlXvUM287q:x2KNsnkrBFp70wdd5vz287q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625235078, "uuid": "5135be85-927d-41a2-816b-49effa794675", "value": 783360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625235078, "uuid": "75703a20-5d42-4f62-8bba-6104f711cb8c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235078, "uuid": "1711b1ac-bd7b-47a9-aa41-2cc2a0eb8ddc", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aecc3569-db04-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625209872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209872, "uuid": "53b52f30-5e01-41e8-93b8-0ae131ff9e58", "comment": "Malware payload (Loki)", "value": "bc8b50b6a11269ee38311b3fa4df309f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209872, "uuid": "bdfa1035-47bd-473b-b4f0-4edfad784d36", "comment": "Malware payload (Loki)", "value": "b1ec17858b3f2267763c44d569c272eafbae5ac893575a8a0db0cd066a42baf8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209872, "uuid": "1cb35797-a1cb-4022-9240-ec4d977d9bfb", "comment": "Malware payload (Loki)", "value": "47b34c1e6c0be4009aa751eb3b9cf8f1e2fa31a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209872, "uuid": "b91ceef6-d1c6-4af6-91f4-06c2047f6149", "comment": "Malware payload (Loki)", "value": "0f04bdd681eb0d39ee9a2710d874719e02d20e226e5fa26e87ccfc57aeb1d768f9a0c065a534f811de2a612001bcfc21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209872, "uuid": "5016eb6a-a13a-47dc-aa58-71e77504d235", "value": "F5F41A6836A070EED4B7CA77CAAB6C58EAB8B437571B550B601302D94B0E943DF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209872, "uuid": "3a226d08-9a6d-45ec-9dca-b6daa296fb9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209872, "uuid": "b245b4d5-4fdc-4b5d-9f35-cf3a99924ffb", "value": "12288:R6tNo6juhQBGpkdULBk4R6x2lkHuRPFwNtOis1vyjaOdkoz+AiLoDKKGVKx3WPk0:UeLBtsg6Huzjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625209872, "uuid": "24adb5bf-29e0-40fc-805a-a98fc8179957", "value": 731648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625209872, "uuid": "ab10a546-b29a-40fa-bd04-b6f2c4e7301e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209872, "uuid": "7ff98f45-6130-4c98-91e4-1c45a8dc2906", "value": "WE09858577444.BAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f6292b-daff-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625207523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207523, "uuid": "5bc6be96-a4f9-4873-9b17-a78bf90c9d71", "comment": "Malware payload (Formbook)", "value": "3820355aaf10b2e48f5936b545c9ee06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207523, "uuid": "ecd77d72-c0c9-4b86-b5ce-77185e0e22d1", "comment": "Malware payload (Formbook)", "value": "b21e4b93bd73868c7dcd13384c55c8c9b562abd7d858497a45f8a804ff639866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207523, "uuid": "e1ce57f8-84ba-4ec4-b2e8-4235264dc782", "comment": "Malware payload (Formbook)", "value": "42c19326b98d92238c0d862e801bf37d943ada0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625207523, "uuid": "16f34532-f811-4f4d-89a2-93c20376dfd7", "comment": "Malware payload (Formbook)", "value": "96cb0bbbcbba6ad1f49c3fe43fa3b3b28b8005bff4a4d20092d07b10223d38c8ffdd80db7eda19ea8d4383c348406a1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207523, "uuid": "f6fd61e1-718e-443b-8bf5-3dbe7cfd8d2d", "value": "D81412127AF1D0BBD2A707F05A72F4209BECC10945810267ABA89F5D7A376C3992E1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207523, "uuid": "77aaca5d-3f0d-4fea-85da-22e9ea3daa48", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207523, "uuid": "763da368-9183-48b4-8a25-7925c25d9120", "value": "3072:iBkfJpRXATwMdFCcGbsI8UGjAUo+Y4KHnJGAgQiO0RO7pCdVrqT65Z8iGH64IFVl:iqjIKN8Y+Y4KHUAgQx0ROmuM8iGa4mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625207523, "uuid": "c7a3b0a4-c006-45ce-aa21-d346033b6caf", "value": 198814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625207523, "uuid": "b03745e1-ec1e-4ab4-b706-4d985a6df3a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625207523, "uuid": "c841c922-5d3a-44b7-8237-be3a0dafbb88", "value": "3820355aaf10b2e48f5936b545c9ee06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231934e4-db4b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625240132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240132, "uuid": "74e4744d-db63-4460-bba6-0926373a311e", "comment": "Malware payload", "value": "652421e702c11d9ee436d36d10f4778c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240132, "uuid": "44308fd5-c2d8-46e6-a075-d5b35ff82598", "comment": "Malware payload", "value": "b287556e479bd178a003f2c8a35f8c9308f3fe6c85bc007755576217ab439c38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240132, "uuid": "c0521d3b-1996-4c3a-93b2-322923ebb805", "comment": "Malware payload", "value": "1c50b30a205c782e221b40e77a0fe6de8b93a7eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240132, "uuid": "39efcbb8-abd2-4da7-be43-14e992b3bdf3", "comment": "Malware payload", "value": "c12baf94c9753d857ac8f37c2813b1bab8f14ebf6db4238f472127df532a322f23b4e7a4936aa82eaeaf5b2641961cde", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240132, "uuid": "d6f57fd6-9b01-47d3-a02c-96766f4d0523", "value": "C1530292948AB53240F41DF7D53491A1F66D883DEBFD27B766B0C2B639F290E8437092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240132, "uuid": "af161b8e-4c6a-466e-a6f9-a40ff1f38152", "value": "1536:EFIr7byPnQ4ang4smYW4fvhnqYD78Jx7/cZFWzqP:R7+PnQ9n1smr4fvqJx7/aOqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625240132, "uuid": "1c2c3c40-f46f-49aa-a673-42952e71df19", "value": 62520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625240132, "uuid": "f40bfe70-b661-42a5-9db4-5511372c13ef", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240132, "uuid": "c84a45a3-4d48-4f7c-b2a4-9fb14e7e71b8", "value": "652421e702c11d9ee436d36d10f4778c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5146e21f-db62-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625250088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250088, "uuid": "1bf1e9e4-68d8-4bd4-ac97-b1edfd6d397a", "comment": "Malware payload", "value": "062744501bd49bb3cd9c16ce6725e640", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250088, "uuid": "b2bf695a-0bfe-43d1-8218-966cb1dc8e5f", "comment": "Malware payload", "value": "b2f6a0ebd4ab4ac3744e9094d4725abd3439b3f1a56a22a4449718a8805edb3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250088, "uuid": "d095f6df-c314-49ed-8f69-7317fb5132ad", "comment": "Malware payload", "value": "94d25e616dceb9eab4a30dbf511103f4dd5616c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250088, "uuid": "65f7f07a-f93a-4a52-b349-b6dff1eaa9a1", "comment": "Malware payload", "value": "1489ebeee1f34d58a77d5be7d9259f7328a63bc9f51a2b68a17e7f05b46af4c7b067290eb483fe7667a700860f6a189f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250088, "uuid": "272d6bd7-ebd8-4439-80b7-f7b5fa18d04d", "value": "D003F1DE09F82496D9DD4E7FDCEF17A2BD45B0C38219878C932998052609843B7EA4FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250088, "uuid": "6e8796cb-a76e-486a-8e3f-707b363ed209", "value": "768:adAtm6tPTgpHhZhr8ONglNLDebAHXWRs86DIWdNM:KAFlgpBjEj8mIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250088, "uuid": "4344988f-4919-428d-9098-5c9939c2818b", "value": 38384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250088, "uuid": "7a1b6de5-7b25-4860-8a51-e2a7a8a8393b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250088, "uuid": "38dcee4c-7844-4173-9311-30119c2497ae", "value": "062744501bd49bb3cd9c16ce6725e640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fd746c-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625233263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233263, "uuid": "1e66db24-38cd-4975-9e0e-725f6837cc3d", "comment": "Malware payload", "value": "a93df191228591c17d571d8aa8d47e37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233263, "uuid": "e3c9afa1-5420-4851-9214-2d395c28d6b9", "comment": "Malware payload", "value": "b350c521490294d110e170a0dc4f79acd735899660e7293310342f983223199a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233263, "uuid": "68ae6293-a1d3-4041-b23b-4a366f54f711", "comment": "Malware payload", "value": "d4b948a36135552d72861716d3f323e2bf06d373", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233263, "uuid": "3c203792-1d41-4e71-bff9-c782998bb0e5", "comment": "Malware payload", "value": "799792e2cf53f389c3505dea367096d7b6d05ebf83f02b9af0b76cbdb91694cd654c176773fa3dfbebda62a7d1b234c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233263, "uuid": "60323e01-2d2e-4ae7-bd27-e1c53b22f0a8", "value": "E4F32B3B26231E53C0C4487201E31334A9AACF6E38BA17D3E9893EA56F369943575FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233263, "uuid": "9f5c6041-c968-493a-b01b-654f1a2a5ce8", "value": "3072:wJCDSCAtxIroPw6N9f5utJ8adPF4KQThs+gr8nP07bUSQ07GngfCk:wJBCT4/TxutJ8adPF4f3gr8P07bUSQ0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233263, "uuid": "d9b98193-3439-4fc0-938e-a3bf07d0ff5e", "value": 162471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233263, "uuid": "5e7baeb7-fbce-42ef-8649-4d5e2462b176", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233263, "uuid": "7c024eb9-1ab3-4558-bb92-d88eed18f871", "value": "a93df191228591c17d571d8aa8d47e37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e7d9426-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191188, "uuid": "735aa158-6dbb-4fbb-906e-37587efcbeef", "comment": "Malware payload (Gafgyt)", "value": "12a074e08e679bcfa418bb9a51f2505f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191188, "uuid": "319e48c3-b8aa-4aac-b1dd-6cbd4be64070", "comment": "Malware payload (Gafgyt)", "value": "b4451b79a2f1ea62d9f639699d5328e0d7dddcdf7f4d59adbe2efee25f3fe0d4", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191188, "uuid": "91130d08-4e71-4bc6-a66e-804b4fdbd908", "comment": "Malware payload (Gafgyt)", "value": "794ef0ab0b3601337ee3458af4f30ba47e18fd3c", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191188, "uuid": "d9d010e0-b497-49d5-88aa-545a4f24cd63", "comment": "Malware payload (Gafgyt)", "value": "16c252239014821902f9fb4461bb5fa948f28436efd6dac0355c199c2269ff02580e8b3204a70af9c382e4bf1ee9be79", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191188, "uuid": "07ce5aaf-ebe9-4c87-bed8-1fc1ad62b287", "value": "6123E11B74B7D3BAC420D476F8991381BFF975179B270B7B08D866DED8621A93A30B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191188, "uuid": "c9e77ff8-8b36-455c-9335-f56a1b6aa217", "value": "768:Oe/UMkKPr+BnEK5aat4RnTrq9AnrlfpzV3+kDfx0ZfG9Pz6ZYGAXzTTHhp:3UM7r+BEK5aaaRnTW9Cfpzdrwf+mfAXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191188, "uuid": "83c486d2-6653-4360-8e37-8d4c58eaa2fc", "value": 46420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191188, "uuid": "add815d1-e30a-46d6-8aca-fb43d301b90a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191188, "uuid": "d52eb766-b770-4719-a918-0a7d9f1d84df", "value": "12a074e08e679bcfa418bb9a51f2505f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bd00a0-daf5-11eb-875b-42010a9c0053", "comment": "Malware payload (FickerStealer)", "timestamp": 1625203228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203228, "uuid": "7b804b01-f0d7-4813-a26b-29beaf3cc650", "comment": "Malware payload (FickerStealer)", "value": "d1e2fe84f7a0fef291286debd3db4ed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203228, "uuid": "41cf3db0-752b-4a9e-89a5-c0e66e93f61a", "comment": "Malware payload (FickerStealer)", "value": "b4d894ec7b766058bba20651d201f6dc0ba0134653e3196ebe4634dee59adcee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203228, "uuid": "9da48dc6-5998-4cbf-bf49-475bdb928f8d", "comment": "Malware payload (FickerStealer)", "value": "8db0758745adfa8789a5c228e14915be26c05be9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203228, "uuid": "7e15fd4c-9702-4474-8f03-8e70a9b9115d", "comment": "Malware payload (FickerStealer)", "value": "da0b8197bb51ec34438eef1d3db869753ff4ef3ef7cab9665fb8a9c0028d562a0373c2ecc1f1d61a2acaa8704c7d430b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FickerStealer", "colour": "#3E5652", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203228, "uuid": "fbec58cb-e69b-4c90-bd76-e89fedf508a0", "value": "41848C00E790C039F5F226F49AB99378653D7EE15B14A1CB63D52EEE5A356E0AC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203228, "uuid": "569898fc-1701-423a-8e6b-a3ac5d2d4363", "value": "88be4c18f1a5b5e08e67d5348e0895f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203228, "uuid": "542cb145-90cd-47e9-879a-bdcfce7479c4", "value": "6144:H2KV4HUGVUubrRcGm4wiiFCGEGh3CnF2NBldztQo7Ur47BVZzVteI:HXVqhFRcGm4wvCGE+CFGzvQoDPZz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625203228, "uuid": "dd848add-3dc1-41ca-8554-195a0849dbce", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625203228, "uuid": "2c5cda7f-2663-485e-961a-3ffa1d533c76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203228, "uuid": "d5918ac3-eb05-4011-b8d3-1e6bdba1fe24", "value": "D1E2FE84F7A0FEF291286DEBD3DB4ED8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "035155bf-db85-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625264989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625264989, "uuid": "43853310-47f2-44e8-9b8b-05b14253e5b3", "comment": "Malware payload (Mirai)", "value": "91175350bd127f11a29c04dd195d9973", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625264989, "uuid": "3de88be0-c259-457f-8469-3ad80c13f185", "comment": "Malware payload (Mirai)", "value": "b5b54a85842c94dc8d3e366f394efa9b0303bcd525671410ea8bcc53a9b3a5ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625264989, "uuid": "91243f82-9712-48b5-b35e-18fb4c19b5f5", "comment": "Malware payload (Mirai)", "value": "a1e19ef411a4f98b36de80baf162c3cf1330964d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625264989, "uuid": "65375955-41c6-4fcf-9e5f-d2d473e3a592", "comment": "Malware payload (Mirai)", "value": "526d5e9f28b87ab095365ac2531f204aa8a8aa15571ae9a635111c94f0d707c7e576246852d4263e41a70f4174a99411", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625264989, "uuid": "b31b64a3-117f-4cc7-9553-b25677d9b2d1", "value": "B343F191930F50A5CBB01C31D17E95C3124D2E3E5AEF6112621C4BFAB9AA514B37BCB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625264989, "uuid": "d7c278a9-c47e-41a0-987c-8ef465ec87df", "value": "768:00cbrAIPehG1Ta/yJIsrMDXXgEfroxLs9fdtWml+nqQjq3UIo2tD22uc4qo73+Zh:V8r6hAUHAls9v9rQEom6qopome", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625264989, "uuid": "1cd63f5c-181c-428d-a442-07cbd60912f4", "value": 56076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625264989, "uuid": "9942267a-6a32-4830-adf3-881ad34a4363", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625264989, "uuid": "0ce32436-3630-4408-b1cf-39322947f659", "value": "91175350bd127f11a29c04dd195d9973", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be65b17-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226886, "uuid": "8c13afd7-37a7-4ade-8d93-07f2c7e6dfec", "comment": "Malware payload (AgentTesla)", "value": "813d892f7d4f1ef7ae9da6a1d677887d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226886, "uuid": "dfb5b8d4-ea7c-4db0-b676-902384786739", "comment": "Malware payload (AgentTesla)", "value": "b5cda4879c63a2c1981737153ed7833d1723c3548dc46971ce09a7a4f515f396", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226886, "uuid": "7ae4b24e-5ce6-4cef-8a6f-695bb0130514", "comment": "Malware payload (AgentTesla)", "value": "0c5fa5427aca6ae84e70f12b01169c3aa1ff1dd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226886, "uuid": "35f62bf7-829a-474b-8b82-66145796fc9e", "comment": "Malware payload (AgentTesla)", "value": "c88cd3fbd7aba961034dc314313ab4eb446d3257aeb53169b23f679a961f3dc840a97491fe06a229ffececfc89370c81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226886, "uuid": "ad36b73b-0690-4818-a54c-87b83a973b66", "value": "9E052A6836A070AED4B7DA77CAAB2C68E6B9B437570B550B601302DD4B4E943DF701B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226886, "uuid": "ac2b3020-414b-4dc8-bb45-59b811333569", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226886, "uuid": "e31e19c3-11c8-47d8-8a91-bf9a7f73d6e4", "value": "12288:w+yraUxg1owfp94TOE9pryYNAFNSQ0KHcPIUfK9wjbIUz0tWc5WeW4erqwTHyJry:zgh9p/mFcKg3Ym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226886, "uuid": "3dbe095a-1530-438d-a815-5dde953e7c81", "value": 809472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226886, "uuid": "43575f68-134a-4400-ad1a-5fa4a541a4f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226886, "uuid": "04f5b8b5-fa26-4652-abbb-89b408393298", "value": "813d892f7d4f1ef7ae9da6a1d677887d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6d695b-db1d-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625220714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220714, "uuid": "20c4159b-57b4-4815-9da2-dc5769282263", "comment": "Malware payload", "value": "f5c8c6ff728bf0de944b9d7372701bd8", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220714, "uuid": "e0a2d57d-34bc-4cdc-a62f-86652d9ae3cd", "comment": "Malware payload", "value": "b62f4d81261af27c2b2bed4ef5ab48701b9e52d320bc8dd031f825c0a41dfc23", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220714, "uuid": "fdca616a-c218-431c-87a5-61b9fea9984a", "comment": "Malware payload", "value": "7bcd37ff6538b9aade7d2d6ab98a7565545158b2", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220714, "uuid": "8c1f0f9f-c79a-4188-9fc2-b0c86dab35c7", "comment": "Malware payload", "value": "323fd19f20e2dae9205babf005142765d2fedb22b3c1d5a25b18e5d27f88579d8b89cbfc719f6b9dfaaaf1cc19266a8d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220714, "uuid": "1693ce3c-36ee-45e2-9801-34ecadcff3b7", "value": "6664237440D23A0E8F4DD2E2851E9DAC4F7E2A0737E13598D2B8D3528BF86BC3965B44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220714, "uuid": "8f9b24fb-0e6c-4b5c-981e-eaea595b6d41", "value": "6144:+KgdkaHLM0GaYpXnCrmJCY4B/pxETAh+Y7ePZ3J2oR:+KGrM0BYRIWmB/pxjAblVR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220714, "uuid": "d1e10fc1-b24b-455f-b3d1-cc455616600d", "value": 323480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220714, "uuid": "432bd2ef-5732-4144-9afc-c5dd7b8de321", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220714, "uuid": "aef228fb-ef4e-44f1-a0f6-942f3b8b2f89", "value": "Proof-ofPayment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b572fbcc-db69-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625253262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253262, "uuid": "0f45755b-15c7-48bd-b8ed-7576296f5d68", "comment": "Malware payload (Mirai)", "value": "d887ae3928e68c465c478752691ec6c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253262, "uuid": "114b3853-4d81-4733-8c0b-6d638347a730", "comment": "Malware payload (Mirai)", "value": "b70a9306aeb1bc75e2f87996c8f9ceb5f4c9b3ad461626b156229624fa1a6aad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253262, "uuid": "031028aa-03e0-44fa-b989-611327d124ff", "comment": "Malware payload (Mirai)", "value": "4c479c80f6a080f805c562b526f6a9f9fbade953", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253262, "uuid": "29ae4fbb-2cb0-45c7-afbc-ebd446a9a41f", "comment": "Malware payload (Mirai)", "value": "df15fc83e1cd0a6222ff1f4a5a5ba4229ef49ddea0e7bd94e646d64f7383ef8985952d035fd37c78006c6317411cacc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253262, "uuid": "4a9f7f4d-8c3a-49cc-b922-dfb939a5db3d", "value": "48B2F12086EF4B87C190813750EC49A875B557D4438F4A975A47FA7EE30271E4F23BB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253262, "uuid": "809b0b8d-b91a-400c-8323-f498004d7167", "value": "768:R/QOC0Yhn6ROHxVe0IbVAfoMfVaKex5OOaYIcn:R/nihnVS5wVaKeHYmn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253262, "uuid": "2ca14373-ad25-48d5-af2c-93fc9b7bf1fc", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253262, "uuid": "b47a7878-249f-48f5-bd0d-f25828f6c9c2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253262, "uuid": "a4f65161-3d31-4efd-8c8c-197243fbfac2", "value": "d887ae3928e68c465c478752691ec6c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410eef49-dafc-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625206252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206252, "uuid": "74d4f073-ac15-4786-aed6-9c84dc9c33ea", "comment": "Malware payload (AgentTesla)", "value": "1e97d1f8c9f30308ba74d14f9b47a0ce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206252, "uuid": "63707c36-d266-4e03-b72d-779d06832bc8", "comment": "Malware payload (AgentTesla)", "value": "b7c7749973d2896ad809e3327ad6657131c3444282dd261d5fe9f7c2bfd9c220", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206252, "uuid": "e7f0c80b-f510-40e6-b480-8bba634168ab", "comment": "Malware payload (AgentTesla)", "value": "0bb727743bab01893b705f648f433173239eb650", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206252, "uuid": "1c4a5026-f742-4834-8218-cce6d0530522", "comment": "Malware payload (AgentTesla)", "value": "77ac36426bb4a673aa5bd7841c53e3e2879e48265444e225b76ec696b2954f2adf1f2fd49d5d5d996320e3d32b89b54e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206252, "uuid": "0c439fa2-251d-4c90-abf5-a6fcf8d4f29b", "value": "7D0382ACD48702988F866BB82B0F2F44054D7A6EF7949572367C93362BD2C7F152693C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206252, "uuid": "a71b60e8-f478-46e2-b758-d925e2a6294e", "value": "384:RU3WQrToYg5YCMUiKEqkfZ51oyzzlMVJ4JD3+E:C3WQr0Yg2gEq8Z3olJgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206252, "uuid": "2de91fa9-f77b-4e2f-9354-a18fa169a2ba", "value": 39283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206252, "uuid": "609a7de1-fafa-4f6e-bdb7-20100e4dc102", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206252, "uuid": "926ca5b8-8606-4f6a-b3e9-3beb7fd40e6f", "value": "Order No. 211128.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d6d014-dad1-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625188038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625188038, "uuid": "a18299f2-c434-40ae-990c-a0446c78fafb", "comment": "Malware payload (DCRat)", "value": "b5778b0910d369161a4eed8e9f1008fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625188038, "uuid": "75824113-ed9a-44e4-adaa-b7fb3133b742", "comment": "Malware payload (DCRat)", "value": "b7dfe1dd45facf6c6212fb648dad7168c00ac0e97fe546d0667d564faf9ccf2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625188038, "uuid": "31271463-0b8b-4b8a-9c0b-27f66207fc00", "comment": "Malware payload (DCRat)", "value": "1cf72466857d209069e64ee059d6cadf7015c3ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625188038, "uuid": "87841ee7-05f9-481d-817e-5343d01825fd", "comment": "Malware payload (DCRat)", "value": "de84c392ff70e1b7402db632e724305d19fdbd116aa48b6645ae5a236e9a4f9bece06e40e4a9fa04cc16e378b6306df7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625188038, "uuid": "5b2e49c4-b25a-40e6-8017-2d11ecee5bac", "value": "3684F141B6E611F7EAE60A7140A5B21FEB357738971098DBD35C3D524A82BC25A3C3F8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625188038, "uuid": "7c5d61e0-ef9a-483d-b710-106a22a20876", "value": "5877688b4859ffd051f6be3b8e0cd533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625188038, "uuid": "d5a27998-32f4-42ef-90c4-13f35bc2f454", "value": "6144:/ldk1cWQRNTBm+ytFdVsHUCurSLC7bOftPw71T6GVBV/3I/yCl:/cv0NTQFpSiGtPy6uVfI7l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625188038, "uuid": "f9e0df93-2145-4d51-b333-d59f487f618a", "value": 372632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625188038, "uuid": "b95f7e65-10ec-40fe-b8c1-a4b77ce2e2e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625188038, "uuid": "e67bab6c-e15c-44fc-a6c9-d00ba7923a66", "value": "b5778b0910d369161a4eed8e9f1008fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c30b044e-db25-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625224079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224079, "uuid": "78c5267e-9c08-44c3-a7cd-01d69efd5bab", "comment": "Malware payload (AgentTesla)", "value": "9535f77699d58f860627e0588fac2a83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224079, "uuid": "5b811ff6-8a19-402b-bc34-6b7def7654ab", "comment": "Malware payload (AgentTesla)", "value": "b8c656b6c5d5bd141d4a8c2c358bae13a4d4e4a6f7e363f7d060a8287ae39cbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224079, "uuid": "a2b6d358-8954-4acb-94df-5e24dd2f3bbc", "comment": "Malware payload (AgentTesla)", "value": "b9d760d9d4bdcd243764ea860e3968e4f3aca942", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224079, "uuid": "2f54f533-6287-4945-ac9c-42c92aec9047", "comment": "Malware payload (AgentTesla)", "value": "ca9fbc1e07243ade51e8454d18efe4085a9655272a9afd24dcdd8bd16c0c5afccf54f16b1fd42475d5f5fcc96338f944", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224079, "uuid": "3d34fa80-b1da-46cd-b87e-683325ed1020", "value": "09B4122C3BE9B09ED037DE7A66E53CA6A725B1326707411E5053438E1A1FD82CDB187B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224079, "uuid": "4e577ae5-e9fc-4ea3-9dfc-82b379de05df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224079, "uuid": "aaa656c7-5097-433d-b08c-a95b5f9a3eab", "value": "12288:hBxiN7L0kAfPdFt3X2CnJekJDT28HzwRLdPgf3Hiv2a+Q8l6P0P3XV4TeI:hmNPVyt3/nJnJDrHkPgf3HFQ8l6P0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625224079, "uuid": "31737522-59e6-40bf-8934-5bb1543b2bb1", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625224079, "uuid": "bc3c524a-1150-4ee4-ab49-9dd9d838e7de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224079, "uuid": "bb6d7e11-6a3e-47cb-a72e-f5e0f2239c36", "value": "INV CONFIRMATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6062a78f-db41-11eb-875b-42010a9c0053", "comment": "Malware payload (Amadey)", "timestamp": 1625235940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235940, "uuid": "30a069f6-b4b2-4328-8d68-d44c93932011", "comment": "Malware payload (Amadey)", "value": "449cbfbb03ba095601f308df5ef2360b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235940, "uuid": "11c50dac-46ff-4e02-9c63-6572515abbcb", "comment": "Malware payload (Amadey)", "value": "b94a2a3b2f0f5de3a222f3efbcd52fac565f4d97069ec19fdcaeba676374558b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235940, "uuid": "f6d4e41a-a77b-4f4d-aee8-e89b9484f653", "comment": "Malware payload (Amadey)", "value": "a47b283e9c7e074d477838fecd5a9b2d27eddd98", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625235940, "uuid": "859ebb0b-b77e-4e37-b004-9ec297cd50b3", "comment": "Malware payload (Amadey)", "value": "70dc81df5bb389f6f53713b8559f24034f9bbd67391524f0ca391a3700c345ab8206b9d147568f87d0c9047dd915aaa7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235940, "uuid": "e49523df-c7b4-40ef-96f2-87a167d19a29", "value": "60458CD125C1CC31D76202798C5DAA1823A96D2D9F2C4AEF33C8B65B1AB5EE1B33351D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235940, "uuid": "b34b5767-8aec-4ba4-b392-083a31e59b95", "value": "bb0104cbcda9d71760f34228343d9b77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235940, "uuid": "47c8b355-70ae-47f5-bb3a-3bd474a92df3", "value": "24576:wg5zf3l4MK1SyC0jNnPertKUHyux5dCfL+3lt/lFmiev:NzfCDJeYUHp5K+3lNjmiev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625235940, "uuid": "2a1fd2c9-03b0-4a9d-8961-db9717f627af", "value": 1174528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625235940, "uuid": "2e1c972a-1d6b-4f68-b049-1b6452d7971d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625235940, "uuid": "7ffdfa48-1e0a-43a8-a7d2-f3cec41f8713", "value": "449cbfbb03ba095601f308df5ef2360b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b300d74-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226777, "uuid": "ed777bdf-7a23-4718-a8d1-8a76851c7f28", "comment": "Malware payload (AgentTesla)", "value": "230a844ea89950512217bd427294daac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226777, "uuid": "b3d6a542-01ad-451e-a4d5-fd7cc4d16b75", "comment": "Malware payload (AgentTesla)", "value": "b969161d369b24f3ad9769f506bfd82a35ff0b6b31a90e7ccc9a86507647ba2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226777, "uuid": "a9cc206a-560c-479f-9ce3-1c70079a2a34", "comment": "Malware payload (AgentTesla)", "value": "9c2cd311c5e651952b7fa2a3af991ca2fd7315ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226777, "uuid": "dbfc8199-5ca7-478d-8ae8-066e35ba96d1", "comment": "Malware payload (AgentTesla)", "value": "8eb85813e7a5f01e0e7022f9117c4d6ef95bd29f71f369d4d205b132183a69bca4b9281daccc90fe814e8a3ec884b7fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226777, "uuid": "a2b95cc1-a96a-4ef7-af90-41de3bce69b3", "value": "8F053A6836A430EED4B7DA77CAAB2C58EAB9B437571B550B601302DD4B0E943DE700B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226777, "uuid": "ae2786aa-2469-4ee2-b060-26e9fa522526", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226777, "uuid": "bdad7af3-c743-40c6-bd00-637914f7cd1d", "value": "12288:QQ1s0Z+USIhJpAkLmIx9I+REFoUGTwQN0zZ9pywdctVwXjqLFqo/PXhSHRjJMj2H:tn/I+RjmZ9BdmIQF1fh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226777, "uuid": "9082de5f-a913-4753-bf56-769b51b7cb72", "value": 826880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226777, "uuid": "8b333c17-17c0-41f7-a7a0-6a5d1cfbec29", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226777, "uuid": "8191c15b-3370-49c1-9aae-48fa2687479b", "value": "230a844ea89950512217bd427294daac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f880cc9-dafa-11eb-875b-42010a9c0053", "comment": "Malware payload (Bandook)", "timestamp": 1625205524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205524, "uuid": "d411d809-3a6c-427f-9457-34b0b23210b6", "comment": "Malware payload (Bandook)", "value": "19583e49060d0c8aceab98c090bd15a9", "object_relation": "md5", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205524, "uuid": "dddd9054-7846-452b-ae32-4a575afe9aff", "comment": "Malware payload (Bandook)", "value": "ba1355c5e24c431a34bae10915f7cc9b4b1a8843dc79d9c63f1a13f0f9d099f7", "object_relation": "sha256", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205524, "uuid": "35c0838c-777b-48cb-bead-77daaac9a2ca", "comment": "Malware payload (Bandook)", "value": "10d6aa331ba06495bcfd9866067910f248d2a4e0", "object_relation": "sha1", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625205524, "uuid": "97cf3866-d917-45d0-a921-9aacfcf0860a", "comment": "Malware payload (Bandook)", "value": "11da100dfe254f56aa88f294049945c86f69cef207ca549609d7fe132db354933e3a1eeee2217bc060cdd1ce93e8287a", "object_relation": "sha3-384", "Tag": [ { "name": "Bandook", "colour": "#5D19AC", "exportable": true, "hide_tag": false }, { "name": "Caliente Bandits", "colour": "#3754E2", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "TA2721", "colour": "#3ACAFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205524, "uuid": "263c8745-c98d-4c98-ae27-7036ea9f4963", "value": "A3F2BF68C311BCD465806A1173AD87B388CB18E7254E1997798CC3D32F41E93C47ABEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205524, "uuid": "5c9cce27-9bbf-47cf-a8c6-2f2c9273d159", "value": "768:kTGLIsYEMAUIHRUqSHS30sgmkxr7CAZnSD3oDdQU9jcf8:RprfxyHSPkxruAZSboDH9y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625205524, "uuid": "1c4d8066-b2d4-4a05-a80e-80201ffd0b88", "value": 35514, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625205524, "uuid": "d7aa6911-8e81-4ac6-bbe7-095260deaeef", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625205524, "uuid": "abb05a5a-2cb1-4c3d-bad3-16626e7e8fc6", "value": "cotizacion corporacion alfeca, c.a..pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524c2abd-db4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239781, "uuid": "49c88f25-095b-4268-a514-4ee94eb402dd", "comment": "Malware payload", "value": "cefe704c9b28123f1d4049b3c1a0cdef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239781, "uuid": "07650f4c-7bb6-4574-9457-cf2a05b94e51", "comment": "Malware payload", "value": "bc76c42df9eb1ffd22c6bf68be2d46233a7d22b6ed1018181e8c8e7bb77f8d68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239781, "uuid": "29030104-e216-4031-9286-4ff205e43fdf", "comment": "Malware payload", "value": "fefc184a30160dec32048fb02be8c74a89c89912", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239781, "uuid": "010554c5-ded8-4f88-b958-56c0d0de7488", "comment": "Malware payload", "value": "7c0ce5076693a390c7c09d876a999667cc370b06065457b3112e7cb5f4edeaf6805f5fe0fd1c990b5ee00c05c3143e30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239781, "uuid": "8221561f-0907-4bc0-b456-21b458b96264", "value": "48630B45F951872BC2D237FBE7DE439D3B365E145BAB3301AA247EB027F17982A29110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239781, "uuid": "3ed1481e-f99d-454b-adf2-9671cf5c181f", "value": "768:tnwBJULiiow61Gis4onDNNjwoqnyUM7MQKCrn8jlPoDTCBpp5LOCvae0822Hn3i0:pKuTiMpNEhe1F8jlQD05LOCva5+n3i16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239781, "uuid": "43784ec4-fc6b-426b-b910-ee72e2ae2f74", "value": 69825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239781, "uuid": "ca14ed99-ff75-4cef-a574-a50d3dc8fae1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239781, "uuid": "c44b7722-f1cc-4341-a688-4218c87a5484", "value": "cefe704c9b28123f1d4049b3c1a0cdef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e4694aa-db1e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625220823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220823, "uuid": "b8b1c64a-6fff-46bd-be11-56f2a2ec8f6f", "comment": "Malware payload (AgentTesla)", "value": "7695321cdd92ac0e205ecfc16e7db676", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220823, "uuid": "e0c47cb3-8bff-4a43-ae2e-ab18402576fc", "comment": "Malware payload (AgentTesla)", "value": "bd92d6bc139f26dbf58bed3b560730b241974cc5d2195958a24c437b754df599", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220823, "uuid": "e22ed65d-29e1-4d9a-8474-3c3090abbee6", "comment": "Malware payload (AgentTesla)", "value": "0484b8ce98160be72291f0eaac95f2549159b90a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220823, "uuid": "4d448303-51d8-40f8-9d98-28a5ff2c0d79", "comment": "Malware payload (AgentTesla)", "value": "7bb42f7b8b5a1d75bd57f9ca97609a36a1ff0e55c97b67dee315b7ec32b3f00a0560fcf320a20dc4a62723cb06660c2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220823, "uuid": "bac02898-b8e2-4446-8eed-f567c42dd54e", "value": "0B91F9B06D7C2A66CC6F8526AC74FC2802EAF48761DA2EAD314CD487273E7426C17D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220823, "uuid": "c5bfbac9-2c2e-4bc9-9b42-c3d66308570e", "value": "96:nsJtqUoLJQ6K9Sm+u63hw/cyAZTNs6d81F4S/64/HX:nsJtWFKEZ2cppNIDDHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220823, "uuid": "a5a53430-08fb-476e-b45d-0b7a24566417", "value": 4209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220823, "uuid": "8de5ac8d-dd3e-410b-8fd2-880f570b9a50", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220823, "uuid": "6a44e95c-8934-4401-bd63-4b891c6a50e1", "value": "PFI20-21044 PFI20-21008_NEW INQUIRY.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d25fa8-daf5-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625203554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203554, "uuid": "34de3a7b-8838-4def-8fca-edcdbd8beaae", "comment": "Malware payload (CobaltStrike)", "value": "bd1bd48ac45dde8d5be61f80d65ec178", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203554, "uuid": "697d8527-c110-4665-930a-14ccad3a4d29", "comment": "Malware payload (CobaltStrike)", "value": "bdcd3c7a1ac09028788acfa177ba75f1140745f686a1e5923b2520f522ad51eb", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203554, "uuid": "e17aeed3-ddb7-4f4a-9bef-956ddd6c100e", "comment": "Malware payload (CobaltStrike)", "value": "90bfd7db8a11f5e588f6da43c0de5bbf101ab2a7", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203554, "uuid": "a02c555a-7a4b-4e59-b7c5-573b410d3366", "comment": "Malware payload (CobaltStrike)", "value": "eeb2e8f2e9332ac4feabe7f37a6e7f1b0cf0e3546fa37371d731a000fdf8f81bb5f2e9098ebb667e474b43a7c9d84924", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203554, "uuid": "5e17a405-4cc9-4c7f-99f0-c3ba2eeeeaf4", "value": "4D46B032E941B165E9F914F7E3FA4EB648E99C54672780C3A1D03CC885726D32AF924F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203554, "uuid": "b2b3ec24-634f-43e9-9583-3077a55094b2", "value": "14e9ba73b159e38631f09383f4a40be7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203554, "uuid": "3766cd6f-8369-4b6e-899d-6c1b9343a1ba", "value": "98304:GjvIvLbe8BAWhHwMZ0U8c7hVH+0sxFBivhpEF5Qw:iMZbVHVsxKvS55", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625203554, "uuid": "095fb5ad-5fb7-4567-b7df-375e4451354a", "value": 5881933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625203554, "uuid": "dea01491-20ce-4b70-a861-43f0715207bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203554, "uuid": "7007ebcb-9b47-4dfb-924c-18b849cf387e", "value": "bd1bd48ac45dde8d5be61f80d65ec178.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a093e2d-db4c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625240546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240546, "uuid": "a02a929c-8c9b-4385-8ae2-20bab6604623", "comment": "Malware payload", "value": "1032e6ffdbb406b3ee80d7c50989e2b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240546, "uuid": "2effb42c-95a9-4cf8-bbeb-fa32c6ce3c7b", "comment": "Malware payload", "value": "be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240546, "uuid": "acb1ea8c-66cc-4fcb-934d-e377ec206fe2", "comment": "Malware payload", "value": "fb63c770ba76d25f181be481acef62aa2cf5f82c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240546, "uuid": "d41dc373-1f76-4c19-a9e8-e963ca0d4048", "comment": "Malware payload", "value": "3f1a49d3a0b974208ec5e643fd2abd4309a9d29e107a0ca98bf0436843361132d8e8936c3d33c2d53662a30fb1fc5a5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240546, "uuid": "62b381eb-832a-491a-aa56-b4c743084b7e", "value": "9F056B213B844B79F0BD8F7347939160A3FEE917AB16D94C3CA502C91B66F83CAB1516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240546, "uuid": "05fe9d56-6b49-489b-a5d4-0abbb20af9af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240546, "uuid": "3b9815d1-8552-4413-b25d-de8cc039d611", "value": "12288:Fenl1nt1EOGQyuH6f7/+53zS5sBUVzW8uu6M:Fenl1nDafL++Vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625240546, "uuid": "5d9b4d6e-834c-4195-a72f-2f869a65d2ef", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625240546, "uuid": "3796b670-bd5f-44ff-8461-6e86f181b598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240546, "uuid": "6ce2a457-7358-4acd-9a7e-0cff29b8b70e", "value": "PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4364f4a6-db0b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625212698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212698, "uuid": "6ce4bc27-159d-4fdb-b42c-046dce64bf0d", "comment": "Malware payload", "value": "75d02072449a4c7105fde54b956894ac", "object_relation": "md5", "Tag": [ { "name": "45.67.230.53", "colour": "#A87796", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212698, "uuid": "2d5b919c-8076-4c37-bdb1-c135f1a57522", "comment": "Malware payload", "value": "be97d7ae3b2d876f027d99d8d61dbca92513f4975336c2ebc26cf8a0839b67b6", "object_relation": "sha256", "Tag": [ { "name": "45.67.230.53", "colour": "#A87796", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212698, "uuid": "95f0a68c-1db6-44d1-b725-55b8fbc97e02", "comment": "Malware payload", "value": "e5e6e100876e652189e7d25ffcf06de959093433", "object_relation": "sha1", "Tag": [ { "name": "45.67.230.53", "colour": "#A87796", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212698, "uuid": "3d01ac10-ca26-42db-87c5-9d5249931ddb", "comment": "Malware payload", "value": "85e5fcc0c1d66ec936acada9dc191f023c5c593a58273b46ae892c339094ab1e6a99fc51fe326e77dd5c1036f035485c", "object_relation": "sha3-384", "Tag": [ { "name": "45.67.230.53", "colour": "#A87796", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212698, "uuid": "f2689cd1-fb17-4cf2-b14c-7df164664e0c", "value": "23855C03BAA74CB9C4D2DEB4874BD373D93478554226293F3A89DA303E52E605F1EB61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212698, "uuid": "53255198-81e7-4550-b8ae-65c34239d8ba", "value": "24576:AXgsrCV6MYc9efNHn2WxeBTP1QMCrUm1as4Uyy:AWJKH2WxeB1QMCrjtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625212698, "uuid": "a0804466-54b1-424d-9249-7d696fb15c62", "value": 1706936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625212698, "uuid": "ae58966d-c349-40af-8c68-19c95eab35dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212698, "uuid": "a55e169c-0b72-412b-a421-62fb38af2c0d", "value": "be97d7ae3b2d876f027d99d8d61dbca92513f4975336c2ebc26cf8a0839b67b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1215fc9c-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226789, "uuid": "d4292aae-b2c6-49c0-b1d2-c65f94e0df2e", "comment": "Malware payload (AgentTesla)", "value": "b06e8bd5506008defc38137bd8c3bac5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226789, "uuid": "ea21be97-cb6c-4259-8554-f44ca7bb4c61", "comment": "Malware payload (AgentTesla)", "value": "bfbfd4fc08a68c83272b173e76e69ff2d15ad1961e5c8e90ca7fde8eff890f04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226789, "uuid": "a75007b4-3038-4c66-875f-073f6e7b9250", "comment": "Malware payload (AgentTesla)", "value": "decc20afd572f6e7c429ef747136259858611e01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226789, "uuid": "d21b2df1-f330-4f01-ac4d-5b6499cd6899", "comment": "Malware payload (AgentTesla)", "value": "4533463bb3705c966d75723a7c67d8157059739a5b2dd4ea8737d0f8362e943c0b9613b9391e481951c235f3c7995f7f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226789, "uuid": "0efe1c5c-5840-4b47-bf82-fa80aa96c8ac", "value": "EEF48D311BA85A35E0B69FBED5A1208197EDF613AF03D85D78B501C90753E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226789, "uuid": "0f87c50a-5593-4902-a4b7-1a28f42ab30f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226789, "uuid": "a42e2664-6037-4870-be2e-507db1833e9f", "value": "12288:LwR/FuZvwyBbX5TyViJmmUQ6zZZJ5zxXg2atcSmeLNR5ea3kUneWgU5xGf5piJ:LwRduZvjnUQ6rDzpAtcNcNR5F5eWgwxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226789, "uuid": "594bf04e-7e09-447a-b035-b571859f3f61", "value": 723968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226789, "uuid": "fd8e0fa4-86c0-4f09-87f4-6ea7f6869f9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226789, "uuid": "f95f5118-52cc-4095-8d50-64191efe9beb", "value": "b06e8bd5506008defc38137bd8c3bac5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91d71a86-db48-11eb-875b-42010a9c0053", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1625239029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239029, "uuid": "4f797714-d3b1-4275-8c42-202f7d39d81d", "comment": "Malware payload (RaccoonStealer)", "value": "bcde62a5f00acfb323a4b08e7b1ac178", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239029, "uuid": "cea27be1-934e-4b5f-8643-97f5f6700969", "comment": "Malware payload (RaccoonStealer)", "value": "c206b1ee7cc6257e6e1f0f0ac468ca87feef0ff56dbf1428933e2e99c3898c35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239029, "uuid": "34e67651-c04a-448d-99c2-3cb62a6c144b", "comment": "Malware payload (RaccoonStealer)", "value": "e9308fe82a56999f625f72e614bb207a1f951d08", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239029, "uuid": "fecc8bd2-96ff-4453-b5d3-9abe21c5979c", "comment": "Malware payload (RaccoonStealer)", "value": "e90fb0d2b116e8efb40efbbaaa23d7cd14f32ba6d3597302f6f61717e98590fa2c3df90d215a5ec70aa1587fea148c37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239029, "uuid": "d766ad1f-8006-4ff8-9793-b37da854a9e9", "value": "C2E4E02B73519D43C76D0876C0C3513017B39D9713B3DA0A39C6225A0E6B7EA9D5AB8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239029, "uuid": "b2c6fc72-1519-4a73-b63d-cf6fc84ab0ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239029, "uuid": "0a9355c7-12d7-4e9e-8ff0-1c98d10e63e7", "value": "12288:IPEA5x+ZjsEw/3MOpcRygHJ1itJENrbrn6rCPUh/BIy:pw/8AcQgHKtJENrbrkCPUhpIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239029, "uuid": "b5908a7e-3558-4042-a05c-648d416c3e79", "value": 671936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239029, "uuid": "7164fb29-287a-407c-9b7e-a6d47e5d109e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239029, "uuid": "f0681882-3832-4c79-a00c-91e4a567e6f1", "value": "bcde62a5f00acfb323a4b08e7b1ac178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82933950-dada-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625191759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191759, "uuid": "0d70e08e-bcc1-4262-a131-ecb307d55f44", "comment": "Malware payload", "value": "ad0404b16fb2851effd6458b870c18b9", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "regsvr32", "colour": "#512BBC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191759, "uuid": "5d845655-0bac-465b-afee-c4ee22f4b650", "comment": "Malware payload", "value": "c20a8e24bd98e33dd755ccf9869df03e4005cca793b29c4c80c0c2c30698cd2c", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "regsvr32", "colour": "#512BBC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191759, "uuid": "ff794689-61c4-4640-bb18-4aa794ae783f", "comment": "Malware payload", "value": "81bd574d1918bc52774528fb12c13147f5e0a2cb", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "regsvr32", "colour": "#512BBC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191759, "uuid": "3875cecc-8c29-4d34-a276-0f3b6afae970", "comment": "Malware payload", "value": "f09d156cea94c936cc35e0423b056915540f4dd8458671f53dc4b52e6efe69338466fd7d99ced8cb2b1ef76450fd6605", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "regsvr32", "colour": "#512BBC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191759, "uuid": "5831b1c1-c080-45a9-b784-2155e360f784", "value": "897412F137D49C82E5632630A5F8E7BA5B37BBA4024511870BEC9FAF7E442429D31289", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191759, "uuid": "be77d237-fcf5-4087-8512-d99da13725bb", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191759, "uuid": "75ad43a4-35af-44b7-8dae-38ed294885fc", "value": "6144:isWHOdGaSyRWkCu6/IfB2s2V+SGzDnOqQ1DBx7ZdvZv:wHaS+Cu6Af1y+tO5RNdvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191759, "uuid": "94620ae8-e260-4ddb-8eb5-51bce9579d9a", "value": 351936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191759, "uuid": "c64c2c5f-7358-4a73-817e-974942893812", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191759, "uuid": "91b9738d-6bb5-4899-b196-f048f1852dbf", "value": "02559833.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d47ba8-db2e-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625227621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227621, "uuid": "96e03b26-b544-4aa7-aa0c-a63a87b2cbba", "comment": "Malware payload", "value": "9f565a7a08363ccf1a6403e4bc232909", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227621, "uuid": "69880ce5-0b1a-463e-9644-29b20bd9ca3f", "comment": "Malware payload", "value": "c2e5d2f0c63677e5391c6faea8eb8b0da15fcad2b626ea09ae2bafe0144bc2e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227621, "uuid": "22d2d10a-afd4-40fa-a3e6-cc74aa3ae50d", "comment": "Malware payload", "value": "a499b437b9c9ade56e47749ee09effa96b88eaf7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227621, "uuid": "dbbd3821-9522-4733-a6b6-f8d2535f303a", "comment": "Malware payload", "value": "beb20077ab4f80772abd48557ec214d56aa00f11190560ffb6548b02f97aa2b482402866e6c98d30170a5e4ebfe24182", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227621, "uuid": "4e0e0663-c444-433e-bf26-713d1f48c654", "value": "D894E1226641C871D18B11399A7297755EAEBC129BB065CB2FE03EBF6F247C1CF35206", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227621, "uuid": "43ab6bc4-8dea-4ed4-8e26-f4b52edd8e84", "value": "9c7729e7e6125436737710b1ba737d7e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227621, "uuid": "1405d2ea-3522-42cd-9d23-338e5f502ec8", "value": "6144:54Gp1gZmFlZKmP4jrc9/5fS9XJqLSYmHiNKhV5X:JrgZm7ZKmP4jrGg9XKg6Kh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227621, "uuid": "cef42368-243e-49a4-8602-e2f816b37d27", "value": 413311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227621, "uuid": "ccb851ac-8c2b-4b00-ba68-c72c3c7018a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227621, "uuid": "d5c1367d-6efe-49fd-bcae-638cc18dce52", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1f2a6f-db78-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625259498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259498, "uuid": "39ee293e-4245-45f4-961e-f15ac2c63d56", "comment": "Malware payload", "value": "1cf278ebf3767494ebe9a866d503d074", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259498, "uuid": "d82d51df-80de-4eba-963c-eca794ee710e", "comment": "Malware payload", "value": "c35885d8463d1fe937cf5afb628e5f37ac2c33004b90da229dca13d7c8bed87e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259498, "uuid": "0fb08ee4-c27b-45c1-bdb1-203447398b28", "comment": "Malware payload", "value": "a3c1135cb1a2535f24ccb0a8f66ba2d349e63324", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625259498, "uuid": "a227772a-3604-4129-9474-c6c8e8a4e22d", "comment": "Malware payload", "value": "dd7a378d62279910aa65042d865fa3138f690e30ab255a716adb1d685b49c8d665a0f8107182a7ea6d819baf86c49d61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259498, "uuid": "63ea043a-4abd-4035-9bd8-f4aa0328e831", "value": "FDA6339F6F498D56D8AE243E6E0640348DCFAC8B0C85313D6E86F11A29B757F04D7A2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259498, "uuid": "9c5dbfe4-d2af-4282-b12a-1d5ad3b7ce27", "value": "10ba58b169a235c03da1403ac3370f26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259498, "uuid": "0a7d52f0-6af1-4a88-8d9e-2f1943a26140", "value": "98304:NJLkyvpwZXwID4FGhg7BQbKYKwJDoDT11zJ3Xx8oHrPGidolQn5pOOe1FoUwCkAZ:Nlqiv3YKrD59JmcPlPiFvksveu7c9Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625259498, "uuid": "5d9c5755-368f-46fa-9663-fc00af2adfef", "value": 9507840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625259498, "uuid": "8c5409d0-c826-48f0-9087-539cc2a41c1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625259498, "uuid": "6f496d34-8c48-4c8c-92ff-a0543e2002f3", "value": "1cf278ebf3767494ebe9a866d503d074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be0141c-db4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239798, "uuid": "7494184c-646b-4d85-8337-9d58409c4ad0", "comment": "Malware payload", "value": "a1e7e862ac6bb4dc6a18a4b7b9c22f4e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239798, "uuid": "9cfcfba5-3380-4bc0-99a6-3b6a8444cb57", "comment": "Malware payload", "value": "c416cac76701c97a8fa6b0f469e5c0c4448ac0caed4f8e9495efe218a40f0416", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239798, "uuid": "6a61f797-58ba-4ad3-b58a-569e2d8a8bcc", "comment": "Malware payload", "value": "ac66692e83d18d19a62191c91a4907f7c50df0a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239798, "uuid": "c963fe1a-1d58-4375-85ca-43dd2fea9c54", "comment": "Malware payload", "value": "0e074225d449480214dd323d0886c5d01b445f61fce8de6613c16418153bad28bd631bdcfd1d9667f7631dc960e25279", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239798, "uuid": "521cccb0-5377-4ceb-8ef7-cf65824091da", "value": "0C63FB05F955872BC2D237FBE79E439D3B365E145BAB3301AA247EB027F17982A39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239798, "uuid": "f221f10b-1103-4877-91ad-8cd089cd5e8d", "value": "768:/nwBJULiiow61Gis4onDNNjwoqnyUM7MQKCrn8j2PoDTCBpp5LOCvae08l2Hn3i0:/KuTiMpNEhe1F8j2QD05LOCva5Fn3i16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239798, "uuid": "85ea1ec8-07d4-4fdf-8b47-4ef098f77cce", "value": 69825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239798, "uuid": "92333b46-020b-475f-9f16-4b265ac22639", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239798, "uuid": "9b16f828-00ce-4dd9-bee0-6858e804af0b", "value": "a1e7e862ac6bb4dc6a18a4b7b9c22f4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caed50cf-db0c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625213355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213355, "uuid": "176991af-b5b5-406d-957e-b9483796338a", "comment": "Malware payload", "value": "21daa2ff78decfae0dee5277e99d83fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213355, "uuid": "0244b5a2-dddb-413f-a6db-d95d05670a9e", "comment": "Malware payload", "value": "c46cf0aa025fac4cd02a201e5a54bd196245219a10ad428524a49e4dd511382c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213355, "uuid": "0a5eda3a-125f-4a51-b9e4-9c580c558223", "comment": "Malware payload", "value": "633fccd13c27ce03f3c93b6e083472de536b9049", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213355, "uuid": "4347558c-8e64-4e63-b6af-34354c8e9cf0", "comment": "Malware payload", "value": "15ee51726b9435fd4bded63f01335071f9747c4c67af94768352c334f45f6ff6201ada9ac9fae97f8f4441966c99829c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213355, "uuid": "58d6e1d7-c740-419b-adba-ebccd5db4f25", "value": "B6254A23DDAAE013F5A9CD35163987721A364A7EA5944CA33AEE9D32C5014878DFC1FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213355, "uuid": "5697848c-335c-40b0-9a0a-e06b8f08098b", "value": "12288:4njKlBVy76gE/JsHzyse/ZLDTZgzf79U6oG8PSzpGeGBuLbb9tCX0xOYVjw5WZ2a:4KSzNELXZkuObmgw5WZOvxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625213355, "uuid": "98d80279-59e0-4c80-af7b-85e44d7eb177", "value": 963276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625213355, "uuid": "865ddc7c-b58c-4557-bc54-78724d834266", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213355, "uuid": "34a8b86e-d1d2-4829-b39f-5940c355f065", "value": "c46cf0aa025fac4cd02a201e5a54bd196245219a10ad428524a49e4dd511382c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4fbfc6-db4b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625240120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240120, "uuid": "be06f990-3c7f-4cc2-9aba-38cb5b95456b", "comment": "Malware payload", "value": "21fafa0150e80353903a633a38e64572", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240120, "uuid": "31c6972d-4f7f-4f9a-9d14-3086ac4f96a0", "comment": "Malware payload", "value": "c782d6bf98617d7d483f647bc3c92129775b421e0fa9be90dedb255a0054cf33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240120, "uuid": "a5544b47-6a20-4d1f-be67-52688402ae3c", "comment": "Malware payload", "value": "7a4976cfa6250e27daa28f824e65b34142c3b70a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240120, "uuid": "1f0e22f6-b0d2-4a60-8a01-a8226099136b", "comment": "Malware payload", "value": "6c4839a5e8024a1b60e64bf026f5f1497b450091940e62039a9575be980563298f59ea2fdb88d7ffc7e7861ef1fed134", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240120, "uuid": "c4273e09-8465-4acb-b203-cdd1d5ad9c86", "value": "3CF2E084C0AB6DA8F2AD6EF48E94FBC0BFF1C60B2666C41223C51F1549164576A45FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240120, "uuid": "536a23a8-1e1a-49b5-9a2a-4e50da9cd72e", "value": "768:Ab+S3FhHkQ1+7ZQuDo0oGFmm6MNm4y3bpCiILn4uVcqgw02NWXp:Ab+UF17+qYCG4JMMzlCion4u+qgw06W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625240120, "uuid": "1bf7d7e1-5c68-4904-b601-5ecd7bc1c024", "value": 36052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625240120, "uuid": "974a7847-ae43-4705-9bdc-97e24d0c17ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240120, "uuid": "7da034e8-55cc-4e9e-abf9-8d6ea332b819", "value": "21fafa0150e80353903a633a38e64572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e786a260-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625227147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227147, "uuid": "c0c9906e-ef01-4276-b269-66f17f03c409", "comment": "Malware payload", "value": "9be19a18b758c8c167a815d83fff506c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227147, "uuid": "d60605a5-a570-43e9-8af4-714eabbfedd1", "comment": "Malware payload", "value": "cd1021cd2a05b85705422bfa7345af95d23c928807e33befb43ebe0313209f08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227147, "uuid": "caffccce-e6b8-4249-88c9-926f4ca73dc8", "comment": "Malware payload", "value": "2ffc12873d2c0d7bfe0d477464ecd551983cb156", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227147, "uuid": "d2658954-3a94-40a8-be62-e0ae7d59b322", "comment": "Malware payload", "value": "d38b5e30836b49c87b0d834d482a1955015a40ef9c3ded89c5c91cffade2a304219373f22a34c010e019d8a7cb4d6970", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227147, "uuid": "9496d4bf-8111-4bd2-8a22-b3070cbeaedb", "value": "8D053BA8369470AED4B7CA77CAAB2C68E6B9B437571B550B601302DD4B0E943DF700B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227147, "uuid": "2f2ea4e0-626c-4468-8f0e-2142a11eab39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227147, "uuid": "91ea0820-a999-4444-ad07-9cc2852fcdbb", "value": "12288:AeRNo2juhQpqp4MoXj8PO8fpF0fkDNcM/NxUCrhY3E3Y6lan6sPTJeaAgGWxZILp:XdAGKF0fpM//TtRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227147, "uuid": "2a032929-86fe-4b49-b6df-dc25de0bd648", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227147, "uuid": "c6dc529c-61b1-49a4-a8d4-f0a1aab67eb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227147, "uuid": "7283d0bc-2f32-41e9-839e-a77b10fa85c1", "value": "9be19a18b758c8c167a815d83fff506c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cef9791-db05-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625210191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625210191, "uuid": "6149bfbc-f874-47ff-8e3e-d5149ee681ef", "comment": "Malware payload (SnakeKeylogger)", "value": "6f22ec34faeb49fb06ba5cd585c0b134", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625210191, "uuid": "6b6499a0-4d64-42c7-bd90-f32f4ee6bdcd", "comment": "Malware payload (SnakeKeylogger)", "value": "cdc49a39aa8c614eaea40fb990811834f7c8190dac5d2eb3876f3551f31d1833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625210191, "uuid": "773ae657-ee2e-46ca-ad0f-0a3441969be5", "comment": "Malware payload (SnakeKeylogger)", "value": "1a6e5653a0cbf7f3795c3567783a273e880e17cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625210191, "uuid": "5f0fc8ae-2076-4c8c-9830-b541a10e3a84", "comment": "Malware payload (SnakeKeylogger)", "value": "3057e4546ee81e081da563ae54d538d99fcae7997430992a0a72e6a3c1276d0960a73cd0dabca3f46a3853a81bf8487f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625210191, "uuid": "09637ae5-de90-4d66-8496-9e4eeeef4762", "value": "BEB4022C35A971AEE433DA765AE83CA8A77AB1737207520F249703C58D0FD82DE91176", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625210191, "uuid": "1387721b-474d-412d-ba92-f31bdfaf670c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625210191, "uuid": "b4959e49-bd74-464f-9f28-0651a88ce96f", "value": "12288:xaocw7olczMyv/XQoR0Ornbb43DB9we6u:xaocw7Hzjv/XcOrnbb43DB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625210191, "uuid": "2635bb49-0bd0-4a59-b16b-ba0939b09269", "value": 501248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625210191, "uuid": "f2a27978-7b04-4e4b-aa54-b470b198b827", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625210191, "uuid": "9b83a703-8bdd-4aa0-95fe-ac90808576cd", "value": "bank details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e749f7-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191169, "uuid": "6bce7d15-9957-474a-af0f-a78d3a487b40", "comment": "Malware payload (Gafgyt)", "value": "d22f65a9afa483bc2ba92db3063fbe10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191169, "uuid": "740a2db6-f65b-4f76-ba6b-b97a1769f17c", "comment": "Malware payload (Gafgyt)", "value": "d008eef26e8268c1ce80c4037255ca3d06bdebfe06baf0c5d77591bfe18ba1e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191169, "uuid": "b06ac514-53e3-469e-ac6f-c659f7a77019", "comment": "Malware payload (Gafgyt)", "value": "00b55039eec9cf8a28152ebeaa48788df9768b36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191169, "uuid": "907e9cd9-46f1-42dd-af95-14e0da1ba526", "comment": "Malware payload (Gafgyt)", "value": "36fcfeb934eb9c6a190c5ca4b8a45be02c0001d96087bc62fa779dbe34fd418aac1ef452a2bfd64ca8d0e96333623dd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191169, "uuid": "f96c70d0-aa05-4c87-9f50-de243bb094cc", "value": "45932A01F9418727C2D327BAE7CF875D3B36669467D733126A356EB02BC27892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191169, "uuid": "d2475900-24e8-4bdd-954d-6d9ba9a38363", "value": "1536:fTT7FN4P6n3JdUdfAgmWcq1i+FajxHOC6tPQkVOyK9pY2emREqQ4b/X7XSee:34y5d0r1cj6tP3uLY9mREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191169, "uuid": "25d0f529-314f-4071-a15c-0df09fa06a3e", "value": 93270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191169, "uuid": "d3f9cf73-8033-4522-a786-689b4173a204", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191169, "uuid": "e3d0eec2-5c65-4632-87c9-b2e5fd58cf59", "value": "d22f65a9afa483bc2ba92db3063fbe10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88f6e4a-dad3-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625188870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625188870, "uuid": "5c3d5528-09b3-46d5-b306-5b96a9d76867", "comment": "Malware payload (DCRat)", "value": "ac4105dafcf7c4934db1d1b0731fe8af", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625188870, "uuid": "8f7a9c2e-5cbd-49db-9720-9bf87fa938f3", "comment": "Malware payload (DCRat)", "value": "d042b2a26d7ea25ef8af4b67e5b98d485324685f4c180f1519b052d719aa982e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625188870, "uuid": "6ac5da04-07c8-43b7-98e5-df6c43e40127", "comment": "Malware payload (DCRat)", "value": "a5e43629f649f85c5a6d5cade47f51d16afbd683", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625188870, "uuid": "8aec01b2-2371-4166-a0ab-378550d777e5", "comment": "Malware payload (DCRat)", "value": "aa0ea055b8e9922deb505fba34724a6339a31f807705435f7d11a6193f63955d69dfed452c4b07250c32cbc1dbe913fe", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625188870, "uuid": "169cce9c-bca4-44bf-8562-2e29bae47c9a", "value": "74A48C0A33E8AA15E5BF87B5E4F14D6E8771B816A6B2EF4F0AC512991C23740DC40F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625188870, "uuid": "7eb46a1f-8414-4f8d-9fc7-4a8ba585862c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625188870, "uuid": "986f255f-0ccc-4cb3-9b98-6e887c52026f", "value": "12288:XqnOv76LAdDnYA82LZGVTRHw22qVYo02Jz:X+Ov76L2YANZGHQ/V2Jz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625188870, "uuid": "9d9b6148-a5b7-4c20-be25-0344ea418034", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625188870, "uuid": "657a4690-7a5e-4482-bf36-de9f7c8a93ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625188870, "uuid": "7047869e-b32c-4a3d-b5d5-52b3e92b0b4b", "value": "ac4105dafcf7c4934db1d1b0731fe8af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8434df68-db21-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625222256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222256, "uuid": "7c9a4f41-6b28-4dca-9705-4f7b765d2390", "comment": "Malware payload (AsyncRAT)", "value": "c1a35dc2d64de4bcd1485666c10f0da2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222256, "uuid": "3884bd99-cf5d-46d9-ba2a-622968ee6740", "comment": "Malware payload (AsyncRAT)", "value": "d18f90887af67c941602c874d216261aec167c51a7ccc0b112a459b5b3cd3c91", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222256, "uuid": "e1975f8e-a7c4-4db9-aec4-a40a3e7df6c7", "comment": "Malware payload (AsyncRAT)", "value": "8286f54233efc79b3f76c877d165c28c1c920626", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222256, "uuid": "8a93b297-e962-4578-af97-ec77bad551f6", "comment": "Malware payload (AsyncRAT)", "value": "1f23f557bcfaba90db6a5bc86195d84f194bc68357fd629b8027eafed8cf51e232fc8273e9415385205bb0911379f24d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222256, "uuid": "8da2bc19-880e-4738-aef2-6085eaa8d846", "value": "6121D29C2D28F1BA83852B633E2B2CD1EC15CC4E1EC4068F7631F195F809544D8AE336", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222256, "uuid": "ad68668c-832e-46ea-927e-1961b2d1c98f", "value": "24:tF6MvSOKoNU6HzSV0MpwLn/skE+KBtzFnV:76+dNU6HeGMsn0xnV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222256, "uuid": "b8a23040-6ee5-446a-ad12-dc7297925096", "value": 1272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222256, "uuid": "902f9206-7b9f-4890-9b9f-7910efa081fc", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222256, "uuid": "ca0919b7-f817-459c-ab22-dd70ba830cfb", "value": "2-JulyStatement_ID110710101531837.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74776837-db2b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625226524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226524, "uuid": "98aaf004-632c-4727-876f-75b3c2ce8c77", "comment": "Malware payload", "value": "3b0dd37195f6b612b71feac2bb50ad69", "object_relation": "md5", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226524, "uuid": "5ad2adff-73c2-448c-b0e2-a08e1c309867", "comment": "Malware payload", "value": "d1b85d7670f9d954c9fa4301e00d42652b28d28f086a057b66368b5e6a4a15ef", "object_relation": "sha256", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226524, "uuid": "8ae7753c-e6ab-4fa2-a4bf-61e391420128", "comment": "Malware payload", "value": "002f8092202f192c5c97273a7abc1db2ab8d13ee", "object_relation": "sha1", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226524, "uuid": "bdb59fd9-02ed-4256-b480-17717552378b", "comment": "Malware payload", "value": "0de16b0046caa5af510e91217913b375f59e7e6a63b21fb38af1aac1e36642fdb358c0229c3e4c3c77655e1c38eaf440", "object_relation": "sha3-384", "Tag": [ { "name": "dot", "colour": "#798B9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226524, "uuid": "5c30cb0a-0df9-48a5-a107-b544594d20b1", "value": "2F02F6ACDBA3039CDFAAB3B446351C8C4669735CC390461A353CB7B13B87D2A8B12874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226524, "uuid": "19c451c2-0ff8-479c-9a8d-474f7e915780", "value": "96:821kJ6/ez9ownzf+oBftaxuExyqQ3QKRTTjrwR2QasBKWb01ZAOZhvUeV/Ae4n3L:8t69wnzfffEYEx6rwR2WDI1ZXbxPA86H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226524, "uuid": "469c632b-d3d0-4dfe-ba1b-3e448b0968f2", "value": 8828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226524, "uuid": "68da4bb2-d097-49e7-a5d8-9d851c12c9b0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226524, "uuid": "8d497d8d-d670-43cf-8f35-4db91edf1e20", "value": "s.dot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f5c41d-db49-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239524, "uuid": "050e2e72-3a39-4bf7-a244-e23029635de5", "comment": "Malware payload", "value": "ee5501c6ee6d38d3b35385243bec84d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239524, "uuid": "e7755f99-df22-424c-a8af-c802b24c09bc", "comment": "Malware payload", "value": "d2465535ab27adeefa365ea655070a76a4658a4f676fcb6d7a7d23657b10fa85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239524, "uuid": "e30f8beb-03c8-4241-8c6c-431d3cf1899e", "comment": "Malware payload", "value": "219f106bc487605dd144a0748007d11fef7ca740", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239524, "uuid": "f7809ef2-18fc-4506-89bc-dd9df87ae997", "comment": "Malware payload", "value": "ef641c39b7245b69dc13b3d8e905fa56ac15d593a03ff28971122779013704e5a0bffd9e4c3e22a221d4e825cfe1c81b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239524, "uuid": "679b76dc-96b6-4ed0-a573-d222ee66c068", "value": "7A8363693E21BBFEE5A882310BF35F7093952D9237A19345E26CFB181EB124C5C9E354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239524, "uuid": "a7fa4cf0-7cf9-4133-b7bf-8ac1d8a51d64", "value": "1536:2VNd7K93CV3GqSRjwss4oTsxO2rKpTp7GKWqO4SsaHQ9TNFP7:qKP+nTpfWTQMor", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239524, "uuid": "14d52e83-fd0a-4b45-b5ea-006706ce7b0e", "value": 87387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239524, "uuid": "de675e1f-f22b-444c-aea4-d8e370dd6738", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239524, "uuid": "96d3e785-a1b3-42a4-851a-1e8a18545a34", "value": "ee5501c6ee6d38d3b35385243bec84d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16801335-dafd-11eb-875b-42010a9c0053", "comment": "Malware payload (STRRAT)", "timestamp": 1625206610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206610, "uuid": "aaf58eb5-b526-4339-b04a-75ef634c6821", "comment": "Malware payload (STRRAT)", "value": "1e68e02f6247578246f61dd0edb6dbf9", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206610, "uuid": "d326c13e-8db7-4bf2-9ec3-ee771999bfe0", "comment": "Malware payload (STRRAT)", "value": "d4298b4f44f732aa5342e740aa251335d728dc606d7b40e1c61b6d4f47fa3f98", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206610, "uuid": "9e564f66-0a39-4eaf-a617-feeef6eabeb5", "comment": "Malware payload (STRRAT)", "value": "b3ac088a70c74fd1b5791b88089654b4e146df10", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206610, "uuid": "e62e5325-6972-4615-8d41-b8595f69a3ef", "comment": "Malware payload (STRRAT)", "value": "9d25c06aa59efc169f93bcc97d0765de0aaec20bed868379380258df99ce950994daaad7b215089ea7bbc3f2b24b3a5e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206610, "uuid": "a08eec80-864e-4214-bd88-b20a74d5ba06", "value": "A7A3CF2FBEA9C4E8D45B443791198673E50D4A98E505903F63ED04892FB1C3C874AEEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206610, "uuid": "e670be0d-548e-489d-adf3-a64fb9b2116c", "value": "1536:ZmcdvBAnD14PmiCR/Wte4tzZoVP05COgu71gcBuF6xKNqcAUSFMtvLiU:scdvBq4PmezZ2HOgue4o4cAULtzb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206610, "uuid": "01c723d5-02ce-4b7e-b196-53d54d488fff", "value": 106240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206610, "uuid": "0001a74a-4f74-4a83-80ca-8d7802975393", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206610, "uuid": "89c047af-ebb6-4c45-87fa-e529f91961b1", "value": "SKM_C250i21061109190.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf37ede8-db0c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625213362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213362, "uuid": "47f7250d-4b42-4832-b67c-cb8291f5f1c7", "comment": "Malware payload", "value": "6dd5b48be80acd087c02b947d51a0a19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213362, "uuid": "f2f77f79-e309-4d80-9a2b-91359622312f", "comment": "Malware payload", "value": "d55121213189580329b2726fd85dcb6b1b7280f413c56be2bfc9bd2c4556fd57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213362, "uuid": "0b300ded-9237-4a08-bf9e-f1dff7678bfe", "comment": "Malware payload", "value": "e1afe4a89f6beba9c6d4e2e6b5663c91377b0373", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625213362, "uuid": "1241c98f-30ca-4ebf-97ce-095f9b6d22f1", "comment": "Malware payload", "value": "6b98a06b6f180b68f64c149b758161801a76cd180dc4d18cf1a6f58eb92615ccc2ed127895163a6e04aa101d086ab626", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Specter", "colour": "#6E1744", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213362, "uuid": "7e26bc5b-84ee-495d-8b68-ee1fd921ffa1", "value": "80254A23DDAAE013F5A9CD35163987721A364A7EA5944CA33AEE9D32C5014878DFC1FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213362, "uuid": "5f930bac-72a1-4f32-b53a-e821d07249dd", "value": "12288:4njKlBVy76gE/JsHzyse/ZLDTZgzf79U6oG8PSzpGeGBuLbb9tCX0xOYVjw5WZ2a:4KSzNELXZkuObmgw5WZOvxC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625213362, "uuid": "7e0674d6-0331-48cd-a2e7-5212df29f068", "value": 963276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625213362, "uuid": "5e767dc4-8900-4db1-957d-47f093b0e5c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625213362, "uuid": "a5822381-a814-45c0-b90f-4715eb32522d", "value": "d55121213189580329b2726fd85dcb6b1b7280f413c56be2bfc9bd2c4556fd57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af846894-db49-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239508, "uuid": "fc31d4d9-a6af-4ea5-a29b-61a823691281", "comment": "Malware payload", "value": "23df19d9f3fa0904285059e09089b447", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239508, "uuid": "89cbdf2e-ae8d-4507-a4b8-46fc94e3a0d5", "comment": "Malware payload", "value": "d5d1fb23dd27128b444d27b2bfe0cb44ee725e630616bb572de195506223795b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239508, "uuid": "6102ad84-162f-4ffa-b933-b2cf7f600945", "comment": "Malware payload", "value": "34281fae5a4fbcc1fa9e1557ce4309f538475d3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239508, "uuid": "e950bd6b-0c42-45d0-a4af-2ed6ebcfc8e9", "comment": "Malware payload", "value": "951015dacc70bada24b3e343862f4e6106eeb8cc29a49bf852d0ef101614cfe343d6f5f9c3ceef227200823c60cc81fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239508, "uuid": "cdc35a1a-7585-442b-8a57-f7d4058a7dd9", "value": "84433A02A681EAF3D0831AF515D7CB640133FC3A1A1B9E15F79D7DF49B35188B22276A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239508, "uuid": "fc7d6679-9257-4c0b-a058-d313ad8410a8", "value": "1536:lgkdRVgmXVRUrkvFZst9p/y/LSCNAEiRNbL:lgkim/UeCr/bCNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239508, "uuid": "7c2eaf4a-8b1d-4fc4-be94-fcb3b0605b23", "value": 55824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239508, "uuid": "c7e48b7c-34f1-41be-a1bb-c3dfa081b9ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239508, "uuid": "f5fd99e8-a2ab-481c-b51b-22aeec859484", "value": "23df19d9f3fa0904285059e09089b447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3408f05f-db2e-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625227705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227705, "uuid": "77621943-0ce6-4526-be9e-d5e95729d7d7", "comment": "Malware payload (Mirai)", "value": "669391ea9085d8421b4661ae5b89fc1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227705, "uuid": "324ed9ad-127c-4ed9-a303-aa6af14d5a7f", "comment": "Malware payload (Mirai)", "value": "d61bb8947960aafd872f6110d8385926644ad7d600f117d9f28dcb80eb3504c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227705, "uuid": "2071bfde-8478-4c5b-973e-95b208516b41", "comment": "Malware payload (Mirai)", "value": "17113700fbfe15ec3b404349cad2a02ad7c829f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227705, "uuid": "2d94fca3-3011-488e-9e37-17acc744eadf", "comment": "Malware payload (Mirai)", "value": "3b19cf46115a47cb050b9c7cd4beecf0f20f965131a60eaf0b27b7f741deae95df68516d543af7820201355f076b00d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227705, "uuid": "a641fc09-826e-414e-a3d4-98b62218ad91", "value": "C5D2D0355E60AC30CD600DB995B20DD7F2B2DBFDC6BBBE716A4024A59BA500B11B96C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227705, "uuid": "b94c4f31-fdfc-4f83-94da-98033ebe4d2e", "value": "768:fJfzGPI9U1XzC3Ygj0wID9sxE9Tbn3Ys3Uozx:fJaPI9SsdyOO5b3Nzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227705, "uuid": "a86f2069-e71c-4a94-b43b-a949726021ef", "value": 29424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227705, "uuid": "95481f6d-8c9d-4be2-b0bb-a0a236198abc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227705, "uuid": "cb4fee36-97cc-4ca6-b81c-b0f2dac3204b", "value": "669391ea9085d8421b4661ae5b89fc1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc51cc18-db74-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625258106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625258106, "uuid": "0c65eb33-f6f9-4b71-9e72-b30a0648372a", "comment": "Malware payload", "value": "35b76b8187301dece290bd83c7a3a5e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625258106, "uuid": "70339635-6cfb-4b04-a445-e86e72a1b4d1", "comment": "Malware payload", "value": "d6a4310eacb4ab4761b1504fcbe6d5e0da6c6b04563897b527a0de0acca9e83d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625258106, "uuid": "e66148ca-ea30-4a6a-8b74-63b15f09b69f", "comment": "Malware payload", "value": "26439bec59907dc3390fc91a2be7a4c161d4fe63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625258106, "uuid": "c0756e8d-0649-4ad1-936a-f1fe5150698c", "comment": "Malware payload", "value": "4398fedeeec778f4051f295721ba70eaa8bcd8100d7425d04e2155af712edf6e74fc702436df3c57f3ed1f20701a5d9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625258106, "uuid": "654e91fa-ce62-4b3b-bec0-488c8ffcbec0", "value": "7C452302BA82A4B4E0480BB1A9B1FB525F72BC351850DE2F57A1FAEF3D721115539F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625258106, "uuid": "d5dd2327-c5cf-4dc7-a99a-6d7391ceae1a", "value": "be41bf7b8cc010b614bd36bbca606973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625258106, "uuid": "a8768823-3754-427b-9b72-2a1b76bfacc4", "value": "24576:mM/x1ZjhDnkn4CPIy3kcnY00zqkY8ShdnzuJ8vugRWvWT1ruZU:1x1ZjlXCPfkKYRzqNbzu1ZOhrgU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625258106, "uuid": "70a0b606-0813-4953-befa-df772d01ac25", "value": 1236129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625258106, "uuid": "a0114895-ba3c-4d04-a2b0-b6948642af8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625258106, "uuid": "ca44cf11-e385-439d-a851-b1ef83b88dc2", "value": "35b76b8187301dece290bd83c7a3a5e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31857d7-dae8-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625197853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625197853, "uuid": "1e617a07-8eea-4bda-b8d4-714f48173c31", "comment": "Malware payload (DCRat)", "value": "c27703650690caff819ff9466ef6acc5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625197853, "uuid": "2a551872-58c3-4c54-989b-f2ddaa8a7aa4", "comment": "Malware payload (DCRat)", "value": "d700e68d1c067c7bb297805d8429aa95cde9b6ec484c490ebdb01fc9689b1a31", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625197853, "uuid": "208d62e0-c604-490b-82f7-65ed15745124", "comment": "Malware payload (DCRat)", "value": "cde7a5fbea03414bccb57baddbc1b10c305c7e60", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625197853, "uuid": "4d793fda-30b4-4780-8040-d5c37e500c4d", "comment": "Malware payload (DCRat)", "value": "7c0411af7b93f89d3e5d25180f3f928360bbaa29d1b892b2b1f061cd7a72795ea41608582a5f8630ace0e325a4cd4cd4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625197853, "uuid": "cefa8a76-ef7e-4a78-8373-fee9cc49c1c9", "value": "D77533016B757CB6FEA089F5009DB016C12C723297DA3601426BB6D76B9CE353E3ADC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625197853, "uuid": "790b2967-e9ac-4207-863e-c33fa3d1181c", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625197853, "uuid": "a6f2e0b4-945a-4103-8aa3-069e2efbf6df", "value": "24576:MRBoqWdzLCEGgekEqe9qpnLMBJMV1eRXYbpCy2R2ePjYp59Rn9HW:MXBWUfg7eYFM3MaRXR2ePaJ9HW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625197853, "uuid": "8423c378-53a4-414a-9200-cafef0fb2a07", "value": 1684992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625197853, "uuid": "46d7c133-2d0a-4330-a626-5022207a4439", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625197853, "uuid": "c95b9e12-6369-4fad-8c49-959cf4cbcd57", "value": "C27703650690CAFF819FF9466EF6ACC5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ff1e35-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191221, "uuid": "a2ed8d19-fe43-4d9d-8a6f-6904df4f4441", "comment": "Malware payload (Gafgyt)", "value": "58ce55ee1317d39211a69e96b5c266dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191221, "uuid": "cecc561f-a8a1-48dc-8dd3-678a2595e87e", "comment": "Malware payload (Gafgyt)", "value": "d7777e3cb431ee0b3cf2e971a2903997683b56222481968e20bf07b35114ead9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191221, "uuid": "0f7f2c0a-ac46-4b36-96d5-e3efeb163584", "comment": "Malware payload (Gafgyt)", "value": "bee2b65b053b53dca305b331c5b3be6a7adde6d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191221, "uuid": "a41ac5a3-6848-4df2-b2f7-47af18696f3e", "comment": "Malware payload (Gafgyt)", "value": "fa91c47198e04b0b1d77465b0e94cc4405fd537f7de379d86dcaa930a64dcb54ba5c5d7e81fa08a996f71ab0cffdbe0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191221, "uuid": "a569be1f-dd64-4d14-92d7-c30fc11230a4", "value": "77A37C03BA928F77C2866AB919B759304723E8920F5B0B45313C9AF4174F5DEB81FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191221, "uuid": "64cd5481-2290-4c96-9e4c-9d4f1c2f2485", "value": "3072:u9UFN/Dx4RX1HHRc6IoJfdYjkClLVqfmgEL1W:uCHGDHRnIoJfClLVqfmgEL1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191221, "uuid": "e2559062-fe6e-43a0-98e6-a443a6a36847", "value": 107079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191221, "uuid": "fd8a67ca-83e7-44ca-93a9-0c2fca02b0fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191221, "uuid": "970f25d6-4137-476c-9a1d-e3aaca5d6f4f", "value": "58ce55ee1317d39211a69e96b5c266dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff028c12-db0a-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625212583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212583, "uuid": "26773c7e-89f2-433b-ad57-76b82df32623", "comment": "Malware payload (AgentTesla)", "value": "0ee56792e3b9c985e532aeeaccc362a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212583, "uuid": "591157cf-6434-47b2-901e-0a83bc98f920", "comment": "Malware payload (AgentTesla)", "value": "d7d6b5975bd529138490cb9d8ed111c11a592ee1751604732c0e2e4d99832a61", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212583, "uuid": "07d67653-203f-48e0-8e63-c7806e993655", "comment": "Malware payload (AgentTesla)", "value": "001bb5b5963429048e537e21fe2750955e3e3643", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212583, "uuid": "ae9c6176-66e1-40f8-b7dc-8f669edce68b", "comment": "Malware payload (AgentTesla)", "value": "278d2887afbc30df9cf280d3d141874c5bce3e8cbbbaf3c61e51633286e8919fcd2d6e5437ce87b4ab5031cffa2bef05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212583, "uuid": "0a5ea010-2808-4a77-8dbd-ffd3d6f061d0", "value": "28154DA171D488AAF4BB4FB3AD6B642011FBBD5E5A55C00C2959374A17B330260BFF1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212583, "uuid": "fb3af6f7-907c-44c7-923c-ba5f75a6d931", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212583, "uuid": "6c98a5ed-3f8f-4a1f-be20-6a462b2046b1", "value": "12288:YJyiR1EOGQyelaPv0FQ44KYNrxqyJhqoIdIW:YZaPsFQtKwNqePW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625212583, "uuid": "8b06b3f0-ed97-44a8-a4b2-892d4ef0d26d", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625212583, "uuid": "ecbe373e-6095-4388-8da2-d21df899728d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212583, "uuid": "e0da1bf7-c69e-44f3-8a20-bc131b3e316a", "value": "0ee56792e3b9c985e532aeeaccc362a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f748ce-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625233555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233555, "uuid": "71f2c995-f439-4efb-8c58-9a31d0cd40d5", "comment": "Malware payload (Mirai)", "value": "f4cb65ec72086095ff5494fa82ba8bd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233555, "uuid": "a9e47ef8-2005-4d81-8a5c-befd9d34692f", "comment": "Malware payload (Mirai)", "value": "da6d713534a947d207ede3249b1cc45633ef987efdd0d5b48ef86e22d64f7c3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233555, "uuid": "c98a0c0f-156a-46a0-a153-be06773d8b20", "comment": "Malware payload (Mirai)", "value": "45c56dd4c129312da9f70df9412142e125c9e4cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233555, "uuid": "776d2087-5de9-40e1-a9fa-88d4f7d52771", "comment": "Malware payload (Mirai)", "value": "b55a23938e68027ddebfd07f17332259be53cc839b72f012ae3a51b535a4d888af6b12c5bfcb49df9eceb0919699c045", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233555, "uuid": "43386356-5268-4c9e-ac91-ff565a2a8d97", "value": "85530A817C916A29C7D0577BEAAF108E3354ABD9D0DB7347CC044B917ACA90B0D67B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233555, "uuid": "89f06bb8-720b-475e-9ce3-78f6fba93a5d", "value": "1536:dOxGfyRWiPLacGXWzM9l6yTzpl84ETjpk19y20Yvck6YceZWGzDkMH:dOxkyRWiPkjX0QckVcwLxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233555, "uuid": "a7f3f6a7-8228-4d90-9097-ca96e736515b", "value": 62680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233555, "uuid": "41ff794a-9fe9-4a8e-a4b9-2dd43bf9b308", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233555, "uuid": "5bd8a694-3df5-4be5-a241-b8389f338c14", "value": "f4cb65ec72086095ff5494fa82ba8bd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d30940-db2e-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625227703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227703, "uuid": "cfd5c69c-cbc1-49d9-87ac-06af7d1a87e3", "comment": "Malware payload (Loki)", "value": "504ad0762a5e404ff3becdb945c3ff80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227703, "uuid": "8e70f246-67cf-4094-aba8-431187746f25", "comment": "Malware payload (Loki)", "value": "dae4a92ce18215d3078e64a2ae56f091ffbf4946007f44897aaa834fd4348da4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227703, "uuid": "0d4e77ae-5fc0-4767-88cc-29b9d71eb560", "comment": "Malware payload (Loki)", "value": "350cc2e19793c1c934e3e3479c5d803e14c4365a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227703, "uuid": "64f91787-7597-4404-933f-0c4017ed5b7c", "comment": "Malware payload (Loki)", "value": "de97d81d2e403b26ae860bf65f912a8747345cf40461894b8d17e15888d2270726e31403ff2d90fd760e2d601072bed0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227703, "uuid": "31ba4f2a-9ddf-4ee2-b1b7-87b1ecf41d2e", "value": "3A15B49D366076DFC86BC876DAA81C64EA90757B930BD203A02315EDEE0D997DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227703, "uuid": "12db99fd-e524-4282-88f0-2f9e5dc1ffd9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227703, "uuid": "022ec08a-66a4-43c5-8f7d-c742979425f8", "value": "12288:tCwvyGv3TUNC3keDzZO+i5hcVjOjJc9QbXfTiNa+edV5PV/aqKdOA+vcUSCfqFPx:tlBv3L3/XZO5iMJgofca+ezhja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227703, "uuid": "7eb3b856-a163-494d-b206-dfb8abaffa73", "value": 939520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227703, "uuid": "65f7d62d-ca6f-48f8-9d3f-7c03b37949a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227703, "uuid": "3b924e30-1983-4402-bc41-cbe02b113476", "value": "t4joF5EztNVS4H9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4a4041-db39-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625232497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232497, "uuid": "d5f3ce39-dae8-4b65-9ff5-6a35c84f703d", "comment": "Malware payload (AgentTesla)", "value": "152ae6df279e55ac46a37ed95d6ec17b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232497, "uuid": "aabd03ed-a48d-416c-8e7e-646e8b05ca00", "comment": "Malware payload (AgentTesla)", "value": "dd107a0e1045f7f057b77233b622cfacb3e9f5e628cf0698d029eaa881a6c409", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232497, "uuid": "1505d8d6-82bc-4730-8a40-df75a8c90ad0", "comment": "Malware payload (AgentTesla)", "value": "ac4ba7360df85db1f4e04564ea7d648a015277b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232497, "uuid": "07b5cea9-5cd4-4960-b8d7-cf1a95ee06d0", "comment": "Malware payload (AgentTesla)", "value": "f4be0799b603608fe4e77a8eb69f81bf51dc1e2919e1e333ecf66d73cededf3d3aafd2d7de1bbe3243702983f33cd675", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232497, "uuid": "6a78cbeb-5f2f-455b-8b90-828559887c8a", "value": "3FD423E954C92DF3924782219B8B26AC8F83CCD7670B82FA2A06A36D1747F154C5DD1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232497, "uuid": "481a5376-88b1-431d-86b3-53acccbe59f5", "value": "12288:VzItFVj6RYHr9Gka4FyD1icqkAXny53EUwALQfeL0Un6aLV:VyVjWkRGoFu1o3Xyi+Y/lkV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625232497, "uuid": "0d39c96a-ff2e-439c-bd46-4ebcee4ebdf8", "value": 609262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625232497, "uuid": "fc28f50f-943d-42f4-ad2d-b472b837408d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232497, "uuid": "ab7a9aa3-f2bd-40dd-b6f5-cc2f3d12856d", "value": "Photo-Sample 7t09250..zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aaa45f9-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625191182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191182, "uuid": "e62f7a3a-c810-406d-a651-f21016b51375", "comment": "Malware payload (Gafgyt)", "value": "875559b85fab6ba257bbf7eed2162a7e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191182, "uuid": "40a5812f-04f0-467c-82ac-3d7b44e359c0", "comment": "Malware payload (Gafgyt)", "value": "de2c14abc49afd424bc0560aa65c814ae03659c4de723900d77f1ef226b66176", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191182, "uuid": "974adf79-2b07-4a9a-afff-7d10937aba4f", "comment": "Malware payload (Gafgyt)", "value": "1360113be66f0a60d27aa4329f29d096919848ef", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191182, "uuid": "3df527f7-118a-411e-9d71-d3016659cb4e", "comment": "Malware payload (Gafgyt)", "value": "fa3195bd28f8946285010f0eaec080abf9527815e431d6f28c488105f264a52e27c0390b245519e8d7ad097d56de54c0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191182, "uuid": "892d592a-ff6b-45b4-a928-5a89cc5443d5", "value": "F4834B27A552C67BC0C753B41BCBA9229833B4B90B37720A73F47DA82F168D92D5DB05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191182, "uuid": "afc9f095-6505-4edf-aa40-4ecc2aceedc1", "value": "1536:u7p8Y/JjzN1Nmql/udP2OfR2lFhref3Q2ymoIYuOVje+ZNne:AHtzN1MBdPlQlzrevQ2ymrYuOVy+ZNne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191182, "uuid": "084df8b5-7850-4f09-99db-07898169fe2a", "value": 88649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191182, "uuid": "a7d36550-8e9e-4054-bd5a-ada0d3b0b1bf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191182, "uuid": "f4f21a65-7f20-47ad-9079-97351e92a1e3", "value": "875559b85fab6ba257bbf7eed2162a7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6267f88c-db4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239808, "uuid": "8951925f-e14f-4498-842d-84d4c2d0eff6", "comment": "Malware payload", "value": "854632ae88eb0319b79289be2ce06074", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239808, "uuid": "89506e4e-e8e4-4d75-b1da-51fe8ebd59f2", "comment": "Malware payload", "value": "df1e937656b0de4ea3c32bf1b89ae7cba6299b200e9f36c0ce739e680befa589", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239808, "uuid": "805840a8-af10-48ee-903f-943d0b6e89eb", "comment": "Malware payload", "value": "aff4dea744ab734c6b8dfbca4afb9c7c3fef210a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239808, "uuid": "60edac43-9c35-4756-902b-2523bd2417ed", "comment": "Malware payload", "value": "85e1b8d85f23aa80d5ffaf5ae7f409147461bb7ffb55a340618c904ffe7abc28c79bebdf1112ae76d183a2c16c5a57a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239808, "uuid": "76584d0e-7dca-4b99-b369-6cb3672012ac", "value": "E803E14765085860C4A12CBAADE98147F07D7B38D9BABF97124F4321E2D930B76FDC0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239808, "uuid": "7ef7d061-80d3-4c7b-99ee-512a6f7e98a5", "value": "768:FyvfY6RLFrI4nGzE5k6hqWo/qwcFmWtaiRpR/4q3U7jJ:YRLptGokdhJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239808, "uuid": "230543c6-95a5-46de-b2eb-92ead3da7755", "value": 40320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239808, "uuid": "5ff74c37-5c49-480c-9e2c-ae362f050309", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239808, "uuid": "d4516446-3fa1-45ff-8bdf-2f5e4cbe884c", "value": "854632ae88eb0319b79289be2ce06074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2444281-db49-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239513, "uuid": "c6695bd9-f752-4f25-a7b3-9629a9b8df38", "comment": "Malware payload", "value": "df11e3d3285fa996779543e953e92e0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239513, "uuid": "2b40512a-5fe2-4dc5-8e1a-c60c0c859324", "comment": "Malware payload", "value": "e0cc11580a2a5b689eae108dc240dd12c4321fd57542b5b54e60ab15d9132f32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239513, "uuid": "2fac87b0-658b-43ea-ab59-f6d39d181463", "comment": "Malware payload", "value": "ffe473b24bed488fa40241148254b29dc013803c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239513, "uuid": "8664465b-be82-4dbd-919e-973573580e01", "comment": "Malware payload", "value": "c0a048ef8ba8ce04c76f9e10c2e6aec6464c22626254b8107948966e3354e313d3d54d75629063b9c1eb25ee0738d2f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239513, "uuid": "ad0c5c96-0410-421e-8de4-cd1813240e27", "value": "89D2E063A5DEA6FCD91954732EBE3D2E1C01622D561C98B3E68C0772EC81F542B4E113", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239513, "uuid": "58020c5b-f163-4c67-99f7-e3a0bfc6e13d", "value": "768:183tydXgYD98uyhOGUpwgSJnbcuyD7UryqR:C3tyrGuyFGwBJnouy8mqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239513, "uuid": "c6c54c24-40a1-441a-b5b9-fe1894a2dbc9", "value": 29068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239513, "uuid": "7a2bfca2-82ae-4797-af87-21bb7883ca5c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239513, "uuid": "73dec5f6-575b-497a-af8d-cf187587811e", "value": "df11e3d3285fa996779543e953e92e0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7829e934-db43-11eb-875b-42010a9c0053", "comment": "Malware payload (AZORult)", "timestamp": 1625236839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625236839, "uuid": "2ae8c5c9-5682-472c-9f89-442737b8be15", "comment": "Malware payload (AZORult)", "value": "5cd46371f09f5d65d0aeeb13e5fd0fea", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625236839, "uuid": "013b7e9b-826b-472c-a1e2-1501bf8c9281", "comment": "Malware payload (AZORult)", "value": "e13f5a6404df9dd3c5c0e5388d72b3e59e6d43945d56cbb30af732f99950842b", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625236839, "uuid": "6b83216b-7e44-4ec4-becb-fd659f436a8f", "comment": "Malware payload (AZORult)", "value": "47e2bfca0971e8b6246d780c1a28e4023f4ec5cd", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625236839, "uuid": "c4c65c87-80be-4a79-8dd4-db2b175dc464", "comment": "Malware payload (AZORult)", "value": "1e13202220d56d46c31ae5ef5a5af018dda2140569442c10c932e9d960e9288b3dde45d70edd53bf50a3eaaa4fab4cba", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625236839, "uuid": "8bb0b0ae-a4d7-4750-93f2-531a78e138b7", "value": "26D4121879EE12E5D232DE766DA03152A73D7E3B381EDC1C1DC2214D4EE6642C9B2B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625236839, "uuid": "020222c8-d5ec-4197-ae4d-07ea7cba65f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625236839, "uuid": "be0c89e7-af6c-4821-a1fe-77fbc56cf9ea", "value": "12288:cYktKaID2YxhD/gQutEOSBCQsVUUxl5MwXl8xPaDiA:cMaIV7cSyxDMwOUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625236839, "uuid": "d05bf2e3-79ea-4c9b-a2c1-06322fc27f80", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625236839, "uuid": "321c2312-23fa-4d8b-b4ef-d2a1f02ed4e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625236839, "uuid": "77929227-1127-4d8c-b94f-083a3591864f", "value": "e13f5a6404df9dd3c5c0e5388d72b3e59e6d43945d56c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c68bceb5-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625233534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233534, "uuid": "11c41335-5eae-4c39-a31f-dbbc8f137286", "comment": "Malware payload (Mirai)", "value": "c72627a40b51b43c11f0efb4c46d62a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233534, "uuid": "38c42d8d-6461-4c8d-bea1-7755895de8a9", "comment": "Malware payload (Mirai)", "value": "e175004c99417d19607bb15af97efd928699805d830c35b2b3bf4a671dc993a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233534, "uuid": "f6137773-e7be-4321-b4be-d156a5ae0339", "comment": "Malware payload (Mirai)", "value": "0867ffec7335022e027ad7d9f15905101907968f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233534, "uuid": "d212f8d9-9191-4b44-9f4b-43ab57d1bc49", "comment": "Malware payload (Mirai)", "value": "d95269ea447fd05f4f236ea3006f84f315ed866d834ee6291e34cf85e8b9e9020b2fc96659ec013a76c888b3dd233db0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233534, "uuid": "3ac7f33f-67c8-4574-b96c-8748868c85c9", "value": "5A332B8D68121D2CDAD358FD50729F0E9E512211A0A3070FA7ABFEC33D33269EF55988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233534, "uuid": "5a6bb95f-ad3c-4c8e-a237-7880f9ed850a", "value": "768:mouzcCsm4ru2IGh6HHaihHHeIXXdauZj0CGeWxCyVBXtM7edUo+f1prwGkfQexba:moqcCyrBIC6HHaiFu/eJ7edJg1pkD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233534, "uuid": "824ec5ee-6e64-4cde-b079-d631fd0cd15c", "value": 54336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233534, "uuid": "bfdfe9bc-75a4-497c-925c-e20a746a7162", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233534, "uuid": "912567d1-2626-473e-8a60-a1910d83d684", "value": "c72627a40b51b43c11f0efb4c46d62a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0647232-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (DarkVNC)", "timestamp": 1625227028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227028, "uuid": "457c78db-cfa6-4b35-a5b4-084ff83b1d6e", "comment": "Malware payload (DarkVNC)", "value": "17a966140133ecf3bb64d16d19ab6e6e", "object_relation": "md5", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227028, "uuid": "930f7156-b2de-4bbc-b0a7-fad4c1fffd9f", "comment": "Malware payload (DarkVNC)", "value": "e1eceb18a899ae4d5ba7080c8e1bc43f11d05a5998e3a6bd41100a23cbc2137a", "object_relation": "sha256", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227028, "uuid": "b72b57eb-63ae-466e-9c36-65d118179f82", "comment": "Malware payload (DarkVNC)", "value": "bd5c17cd47c677c6d579279befeb1383df8acbc8", "object_relation": "sha1", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227028, "uuid": "2114df7c-dc8c-4c59-a965-c7f39b2baa01", "comment": "Malware payload (DarkVNC)", "value": "646e20711bd2365755401c9af013c5a09cfe776a2db9f69bb25131c00ceeb38b5d19c3a227e4b34c52b9e1962dfc79f3", "object_relation": "sha3-384", "Tag": [ { "name": "DarkVNC", "colour": "#4C3213", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227028, "uuid": "9acce3d4-0a39-412f-9dc7-78787cf3a836", "value": "96941201F260C432C59345B43924C7BC9ABEBD3059A9D5077BD86BBF1F613C2A97A70A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227028, "uuid": "1cc8b233-b377-4796-af7a-b9e2bd7e29d6", "value": "9dd3fd247d4e2f18cf789186e8378400", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227028, "uuid": "cffe7b61-52b2-418d-a414-0effae48d25e", "value": "6144:6FOIujuC4jnZlstQs8oxj8o8yaCAJAqBL7/Nc2m+P0qLEnnWyDLE1dI3i:6FTuCCgA8Q8rpCgv7mNqLEnnWyDqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227028, "uuid": "cd962659-ac2b-43e1-9275-298bbbc17a15", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227028, "uuid": "3f983bac-da14-401a-b9cc-d3616a36e059", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227028, "uuid": "3b9c1563-006b-4db7-afc4-5d23622f250c", "value": "17a966140133ecf3bb64d16d19ab6e6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09a35cf-db03-11eb-875b-42010a9c0053", "comment": "Malware payload (RemcosRAT)", "timestamp": 1625209419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209419, "uuid": "9db48f0f-f398-4ae8-95fc-1451dd5b45ef", "comment": "Malware payload (RemcosRAT)", "value": "26be67019483c4eb6a4b4686ab21b55f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209419, "uuid": "dafef646-96c8-4712-a3ee-550f19ecb7c5", "comment": "Malware payload (RemcosRAT)", "value": "e37767197c44c0abca2550054e6f3806b20c7d1ac8e5d6079bf44421e8dd03aa", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209419, "uuid": "8052fef3-e195-457b-aab3-10362d5b9229", "comment": "Malware payload (RemcosRAT)", "value": "0a0e718186d61aa898065608de90ff037e33bf79", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209419, "uuid": "598d56bd-3c0d-41ea-8558-d24e94871902", "comment": "Malware payload (RemcosRAT)", "value": "98ce9ca615e988beff0945592560fd0141ef2121f38a7ae328c80e6a510e9d96044cce3ff33aaef4023d042bc835fdb4", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209419, "uuid": "99ed2d31-0acd-4e58-be1a-4946300ce4a2", "value": "F505336BF76E43583A2EFB17EABB280C9515C644C8AB55306AD74D01FD9C0EDA06F813", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209419, "uuid": "9bef9f52-1d67-4ca5-a23c-e010af757964", "value": "12288:/LRuNQ6rUzp/btIGXJ2F6vcDHIAghgzPzlM7IPcOVuOm4zThd8lIkdQ73Kzu:/LRuDripxI9vD1+UPzXPcOXm4Rd8lBNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625209419, "uuid": "27981a64-4d25-4dce-bfbc-2e794bc7c4df", "value": 826310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625209419, "uuid": "24d2e462-33ec-4b60-9a70-9d66dbfb8f46", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209419, "uuid": "a4a7f30c-db59-4ef8-80a3-2b7e6e23fe75", "value": "NEW ORDER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf1e31a-db26-11eb-875b-42010a9c0053", "comment": "Malware payload (CobaltStrike)", "timestamp": 1625224445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224445, "uuid": "b8ef8a6c-98a3-4a2a-a80e-450b1c41eb36", "comment": "Malware payload (CobaltStrike)", "value": "7d05de0210deb32c121bb34fd6e19a15", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224445, "uuid": "7d64bc53-d221-4c7a-9b4d-3694d9b99a4e", "comment": "Malware payload (CobaltStrike)", "value": "e59cc3a94f6a5119f36c4e0b3fbe6f04cc474d0b0b9d101163dac75722c809da", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224445, "uuid": "0eef9553-650c-421e-93d0-f23ea91e863a", "comment": "Malware payload (CobaltStrike)", "value": "61aae466904ce3009d5747a68e24761ffebd6a37", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625224445, "uuid": "f561fa41-d1bd-4a6d-b77d-78e648021ce1", "comment": "Malware payload (CobaltStrike)", "value": "dd0fa1d07855712f7b893337c84a5967e9814475dce646111afac5f81e49f48be9732e1c16a255ca9d36c90d99e66578", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224445, "uuid": "924dc0fa-a951-4a7f-88ac-c095126a5bfc", "value": "10547B14F9EE0B2CC7055A77DB52B3B0109E4C844918E4FEBB674ECB50B45E989B2F26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224445, "uuid": "c217f5f2-6f88-4b3f-8c63-b7005672e79a", "value": "17b461a082950fc6332228572138b80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224445, "uuid": "beb45140-d033-4200-b4c0-c1bfa51a6d9f", "value": "6144:PCcg6grIhZEtvvGyXrtfwIpmQSpf39HBAaLkRxLgjMnGU:G6stkLHBAaLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625224445, "uuid": "71cf1365-e663-4801-8ac8-37d8fcc68633", "value": 288256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625224445, "uuid": "018ca1f9-b38a-4379-beb1-725e3c797583", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625224445, "uuid": "8abeb686-170b-4cec-a51e-66a008bc711b", "value": "e59cc3a94f6a5119f36c4e0b3fbe6f04cc474d0b0b9d101163dac75722c809da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6556f661-daf6-11eb-875b-42010a9c0053", "comment": "Malware payload (ServHelper)", "timestamp": 1625203736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203736, "uuid": "dca5b73b-842b-4c5c-868c-e7acd494c7a0", "comment": "Malware payload (ServHelper)", "value": "b8c76065042d1557af857a48a5ac0f3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203736, "uuid": "47695ac7-5b74-4f43-9ecf-e127a8bcb6e8", "comment": "Malware payload (ServHelper)", "value": "e5dcf030290fd293d259f1c8ffbb65328c371e07fa34419af7723429599a7f6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203736, "uuid": "27ed51e9-21c7-4d9b-87c2-738f106f7056", "comment": "Malware payload (ServHelper)", "value": "7b5077cd4aaa5c97a768e9722828ebac94abe1f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625203736, "uuid": "91947daf-1a65-46ea-828f-7bee4738e9e4", "comment": "Malware payload (ServHelper)", "value": "1c507fa5de2d00b354fc7a41c6742dd161bd6795348e0b3a238cd540335189c2f84c40b2ec844e35616696904c1fdd8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203736, "uuid": "648b31fc-b334-475b-b830-44c4e4c7801f", "value": "615622BD1164339CC01FC8745523EE44B2F2562ECEE9A6ADB5EBB6C03F9AC11DA41B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203736, "uuid": "14e87185-3f98-4ad8-95f5-d66f147ac899", "value": "f32b3285ebecf2ab26752aa86ba5f08c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203736, "uuid": "4dc765cb-cac6-4e18-8daf-5654dfc2c65f", "value": "98304:oAShYEJeZ2HQGwwyGmOCU5K+n9soVYqcD37OEfet+oL7WcfguCQ0mlwlNoT3Iotb:oAYzJPHQKiOCU5tn9yFb74LFgP4kNKXa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625203736, "uuid": "5481ee85-c74e-4d6a-9a65-da0b645c9489", "value": 5946368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625203736, "uuid": "e240e83e-62dc-45de-9272-a126c563465a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625203736, "uuid": "41f0cdb0-1f0b-4a4b-8b72-c52bddb219be", "value": "b8c76065042d1557af857a48a5ac0f3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85019ff-dad9-11eb-875b-42010a9c0053", "comment": "Malware payload (Keksec)", "timestamp": 1625191500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191500, "uuid": "9a7dceac-973f-41dc-98f5-8f15a52edad7", "comment": "Malware payload (Keksec)", "value": "649ffcb957c90ff9875a3e06d8bda803", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191500, "uuid": "46178f80-2b08-4323-afc3-d1239b911c23", "comment": "Malware payload (Keksec)", "value": "e719abee14376bfcdae4bed1bdef2692eb7a3d469f28ff1c670a356471c78882", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191500, "uuid": "4cc67318-d565-4ebf-94dd-0612423ef39d", "comment": "Malware payload (Keksec)", "value": "45d7e032f18e21c52d4feb27a6e0880468807765", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625191500, "uuid": "4f44b9ce-19cf-4fb1-86a5-03cab295aaf9", "comment": "Malware payload (Keksec)", "value": "0b451c1342317a4fe29256456f114a35c89b863be4d73e7c6ca534e6b65335a7eff3e71116ba8c317025377a1c612c29", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191500, "uuid": "b051c89b-88a7-409f-a65b-a15cae47473b", "value": "2823F138B3804D9EE85912FA43D817501C791FB1D7C7DCA59A25E9CFA6A112E34C3DCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191500, "uuid": "df0e3942-04f1-4864-85c4-2fc83c0dfd17", "value": "768:4zLIaWTccsEAgAmZ1gMsBFnfA3p6Gx0FJgGlzDpbuR1JScjSGLyQ7kxJnjb7Q:iaTcr+bdcFnfmV+VJuscjSGDgJnjb7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625191500, "uuid": "8c235e86-c2ee-4156-b1fc-ed313b1b9eee", "value": 46736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625191500, "uuid": "2c0ccd95-a774-49e4-985e-d68899d62683", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625191500, "uuid": "6998948d-9c58-41ba-a811-d944fbb5fef2", "value": "649ffcb957c90ff9875a3e06d8bda803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bf494a-db61-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625249850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249850, "uuid": "f6004ffa-95cb-41eb-a631-773b2f6c5e38", "comment": "Malware payload (Mirai)", "value": "092e2a927524393f6ba205e7008c39c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249850, "uuid": "11d87533-d68c-4dfe-9b17-76cfce3f84ff", "comment": "Malware payload (Mirai)", "value": "e759dca86a758a651a04fdf44095fb54dc18ccd36848e0177521a1e496fdda0b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249850, "uuid": "f0b3a0f3-4f5f-4f00-bc7f-39090dc7bc9c", "comment": "Malware payload (Mirai)", "value": "ac048e54eeb4bfce9c5745d1b4bed6c45ce47bce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249850, "uuid": "ec79fcd6-634c-4c20-99ea-e10b936b3935", "comment": "Malware payload (Mirai)", "value": "bd1b1717a003fbab4e6c621eac4bc084b032aab1893061a835a2ce744e263c24b72cdba59fbdc0b64e240c9b8840e04e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249850, "uuid": "743441c7-c184-43d7-8098-d8acf011b770", "value": "7F635C4232680E57D4A60AB4253F17E0C3FFDE6031E5BA896A0FCB574639D37118AE8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249850, "uuid": "88509887-4b23-49b9-8c90-0914600be84a", "value": "1536:MC+sJ0rrQY8XoZRYwcnQl/Z/nEBcf5WswhmScgI+1a1083P9:d+sJ0rrQY8XoZRYwcnQl/ZpYfIbgIfbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625249850, "uuid": "90be7d6e-f2af-4edc-ad96-d0376bdf7bd2", "value": 72040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625249850, "uuid": "1daf84ae-8628-4735-b09f-4837b3f8c897", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249850, "uuid": "c61dde05-2565-496a-972b-1ac91da2707b", "value": "092e2a927524393f6ba205e7008c39c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a6d80a-dade-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625193672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193672, "uuid": "c5a772bc-f7e4-450d-ae9a-f77ce0f4400b", "comment": "Malware payload (RedLineStealer)", "value": "b8b26b1965391551574eba0f1f8ff969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193672, "uuid": "bd12f2e5-98be-4f5e-a5f0-e6308c3b8648", "comment": "Malware payload (RedLineStealer)", "value": "e7cc1a50c3ab054c7c102301d32b802813f0651154f585ac315d0778a81501c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193672, "uuid": "7b909188-8d15-4f4e-ac06-78eb7512ef14", "comment": "Malware payload (RedLineStealer)", "value": "5d2aef9dd2361fdaf3e53ef9e9698620c1a09a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625193672, "uuid": "ffec62ff-98c5-4198-a12f-6ed89a577ed1", "comment": "Malware payload (RedLineStealer)", "value": "353b07aee0ab68e81fd91b709c84b1417f1c1e53fa675188cc658b778efae040b7c14f4a5254f2de68fd1d2ab7187d10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193672, "uuid": "c8deb5ba-2903-48e4-b659-37cdfa7f62ec", "value": "14B52343AA45D8B2D4310AB58518FB75553ABD600B208FEBB3E44E2FBE351D0AF34967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193672, "uuid": "dd3f0d47-28f2-4fd7-8a82-316a8331a863", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193672, "uuid": "8df6afbc-e23b-4f32-8bef-d093da221460", "value": "49152:R3d6nS6kQeleCOqUwfsCUxb552FpfYiyVF0l5AMdscEU1:RonS6H2eCO1w0Dxt2pfEF0LDEU1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625193672, "uuid": "76aa5ce8-8023-48b9-b5ca-d09b7b5047c9", "value": 2492572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625193672, "uuid": "a9365fd8-e4d7-47ef-abfe-34fd99a48a24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625193672, "uuid": "0166410b-3c74-40a7-80cf-00210648e4e0", "value": "B8B26B1965391551574EBA0F1F8FF969.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5c5732-db03-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625209381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209381, "uuid": "94dc9469-dc2c-486a-8c58-43dce58a79de", "comment": "Malware payload (AgentTesla)", "value": "89662d211976d815fbad074786ba33f9", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209381, "uuid": "9def0455-77e7-4c7b-8338-370db8e52915", "comment": "Malware payload (AgentTesla)", "value": "e98509bceeb8ca3b1af3360cbdf47903eabb58ff6851323a189dade834efce1a", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209381, "uuid": "b890b01a-da1f-434c-8ef4-1d7194700a2b", "comment": "Malware payload (AgentTesla)", "value": "31aef16f1c97ba49c0365daf53d6e732111c7893", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209381, "uuid": "3133e5f9-b830-4822-b6bd-5465e07dbd53", "comment": "Malware payload (AgentTesla)", "value": "3b437b5f9d0eaf4344c7ae626769c188bcfed27636abcbef9bb1c471860f6f45bdd11c09acc7c13d783e35da3322e138", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209381, "uuid": "0a10e519-cf0e-4a7a-bab5-a2e1e2ee57bf", "value": "26C423D5E7744FD2D6CA1128733A1D1C197FD06DDBA26269B03A6EE2601337C231E52E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209381, "uuid": "1bc222fd-53e4-4aa7-8398-65b3408a020f", "value": "6144:yKTbK0S/YKHldJmaMgAOJGjXPACjUuBkcZKKgKvZ5L9fNtZK2qI32e0fkFAiD0XT:vbVKZMO+gHcnBZ5bgI32e/gtlAUVh4gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625209381, "uuid": "3bb79804-e9a8-46bb-a57e-8cec40029856", "value": 562082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625209381, "uuid": "c9d31bc4-866a-4493-ba8b-3035e6119ca0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209381, "uuid": "5a9ebf6a-dca5-48ae-9db3-717e126e1c79", "value": "RFQ JULY 2021.PDF.7Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "187918ad-db4c-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625240543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240543, "uuid": "167e4dd9-238c-4bab-bc7f-8facb37ad166", "comment": "Malware payload", "value": "931e108bbd2f6571761a53a8ad260e79", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240543, "uuid": "557ff8d1-2c89-4513-9912-82275ccc436b", "comment": "Malware payload", "value": "ea2395f76f2bb596baa84ede5acca6e8d64ad2580990e04212ec77ac1503e78d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240543, "uuid": "673a76f4-08b4-424f-96d8-c902d3c2ce69", "comment": "Malware payload", "value": "150c1154fb3b66afe486acfe70069701b3e79d7c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625240543, "uuid": "da79cb10-0f85-4afd-9f05-b807e20067a8", "comment": "Malware payload", "value": "a55414eca8b1348e33d0675377df057702c8ffd9841f1e270a9d15ac7171042738ae241b216fe28b8774ac6271880d09", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240543, "uuid": "831bf628-4ec8-4745-a9de-fc84fd517cb8", "value": "F19422C8F9FBF833EECF127AC5401F5E05B5065642D85937E231F8ACC488E259269E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240543, "uuid": "0572403d-235d-4787-8b67-6b60516e40ab", "value": "6144:fApA9B3ucmEb2cc7xcWwY56KYw/pLLFWkv4yysqYJyIYBCnGEM9b0lyxP97LUN:Iu9lPzblcNLwYAKtlLFWqJ1YBCXrYl7+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625240543, "uuid": "53335071-17f6-4291-be24-8b6d6e6ee075", "value": 435756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625240543, "uuid": "39aeed86-dd81-492b-b6f8-dbb57dc3098d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625240543, "uuid": "21fcf4f1-ee8a-4f36-8977-dc4772f07992", "value": "Gift 7333663.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9345c92-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625233565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233565, "uuid": "c5eb6973-3a95-4a14-b3cc-244129fa752b", "comment": "Malware payload", "value": "3f9965083918a002f2f217b6c73a6cc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233565, "uuid": "77417773-00cd-4bb1-86f3-c61f6cf29d2f", "comment": "Malware payload", "value": "ea2bd36b518573b8b85ea034a77702b67629ecfd0623c4e958e7a9d4df4839cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233565, "uuid": "6ebd904f-a8c3-4633-9e34-c6d54e2bf229", "comment": "Malware payload", "value": "20135f0f24c40386a235cf60cdaf9da564f5032e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233565, "uuid": "68e6170d-6639-4627-9292-4d7f979de775", "comment": "Malware payload", "value": "b4e99fc72ee37536f606341e0c496725bc374646d2515f6e813ac9820d543e08da5bf14d175a70c16790f282b89d9684", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233565, "uuid": "a059731e-8544-496c-83a9-2a087d4ac3c3", "value": "73D34CC79541C1F2D4020EB3229BB66A4571BE3F485B5AD6E71A7CB0DF328863229FD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233565, "uuid": "8038e285-11c8-4bf2-8048-4450f20b8f83", "value": "3072:b4GkT9xRAp/gKZ5Ms+XM8f8zvAwetJ8add9QzTs2MxFzWRg47KcX6GcgqBK:b4lTujDZCmvAwetJ8addQFwZWRg47Kc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233565, "uuid": "dd2e7e85-484a-410e-8b4a-7ce108448d53", "value": 133262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233565, "uuid": "3cb81a7f-e902-4387-91cb-d72440c65b71", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233565, "uuid": "ebff57b9-b3a3-4cd6-90e1-6ff710ca0cc5", "value": "3f9965083918a002f2f217b6c73a6cc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3323f1b4-db1e-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625220831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220831, "uuid": "4bb2ee94-fb0b-4d1f-84b4-9481a2cac141", "comment": "Malware payload (AgentTesla)", "value": "0bc96550088344572b1d3a59c39be223", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220831, "uuid": "97dd94e0-0041-4a59-84b3-c7cbba2f30a5", "comment": "Malware payload (AgentTesla)", "value": "ea5b77119d07eb7bde1908da5fa9f9c124209ea050e5f4fa27921f1b0cc16bf0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220831, "uuid": "d33dd44d-c5e3-4e65-b5ad-987f4d8f8f03", "comment": "Malware payload (AgentTesla)", "value": "b0849d12cea434f9af5918c7bae0c7ad9d1c500b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625220831, "uuid": "d04f8417-1ba8-43ef-b650-033a5da3c825", "comment": "Malware payload (AgentTesla)", "value": "343bab40163c77ab680207a80451bbd539edb6252c1a8b507ce86d4222e8fbcdec7753f99e42e97a01a2c5b4054c89eb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220831, "uuid": "e1234cd1-927c-4d08-8343-1ad831d75bbf", "value": "D9614AF99A9C5CE1CE32D29A1EE4BCEF1225329111D3A9A0702C534707390B9DC06884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220831, "uuid": "9100a110-4747-4ac9-b3c3-79282922a8e2", "value": "96:OOaOGvkA6QYmuyrswfLLJA0VaakMUvz5zwH:envq6uyDLG0V+hvzVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625220831, "uuid": "a0ac880f-ff5c-44ab-b761-5597543edbaa", "value": 3462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625220831, "uuid": "f9484840-32be-4c68-911a-1f623c5a6c8b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625220831, "uuid": "f27d876b-e7b7-4ccc-97c0-9bf9afb5492d", "value": "technocast RFQ.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8b55d1-db3a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625232955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232955, "uuid": "4f8af9bf-cd4a-41c1-abdb-f9df7ca48f54", "comment": "Malware payload", "value": "b838725e7c532af5ab9d8487646155c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232955, "uuid": "ccffd363-5c8f-478d-8125-b3fcfd39f3bd", "comment": "Malware payload", "value": "eb622685954a909562a88de7c871008acb80ca86d160b9f664d69d640ce2a2e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232955, "uuid": "e17e260c-4f22-449e-8cb9-5da1c944c131", "comment": "Malware payload", "value": "ad98bff5f58bc17aedeaac86fabc4513fdf69a0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625232955, "uuid": "eca277db-ca38-46d2-a4fe-2f98857577ea", "comment": "Malware payload", "value": "c3111ea7bc4d84ff89ab0ba41dd9ed17fd85f572400ec7482a5e83ff261213841ddfbd8e061ec74b79f21d062e49e588", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232955, "uuid": "d456b92f-da14-4718-828e-82b2d6c696a4", "value": "20E32906F8004767C2C2ABF7B357538D77625FAA5BC73345DA297CB02BE07991A39680", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232955, "uuid": "48cc81ec-041d-4587-a2b5-d0546ab0363c", "value": "3072:HPiBC+5idXDblNYrYY6d+yB7XtCoetJ8add9QzhskAbnsRqBHX4ZtQ6WQGoQTQk:Hc6ou7dpetJ8addQxAbnN1X4ZtQ6WjoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625232955, "uuid": "44a486af-d9bc-4212-88c6-4ffebe347df9", "value": 151490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625232955, "uuid": "cb6b99be-1d85-4325-a7d8-2cc3d52de4c6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625232955, "uuid": "d70195b4-7107-4055-b448-36f7104005db", "value": "b838725e7c532af5ab9d8487646155c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae3e10e-dafc-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625206376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206376, "uuid": "a0ee105e-4680-4fe8-98e2-a70b29f50fd7", "comment": "Malware payload (Loki)", "value": "860d14964f6d253deec9724c7f7fc112", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206376, "uuid": "201d1881-bcdd-4360-9c87-828eb86c0b66", "comment": "Malware payload (Loki)", "value": "ebd169f784115de3f85c67e2694b5a141988af883ed761adc6a434653ed42a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206376, "uuid": "1acb4891-1bba-47e2-a1e1-ac05c1a2e3fa", "comment": "Malware payload (Loki)", "value": "70f6810a3082ad6f43e4c5c79102e422e4d50d3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206376, "uuid": "f2e5550e-d4a2-4afe-a3ab-ba1046f5be55", "comment": "Malware payload (Loki)", "value": "1105cffb559cdbf5c533f673289782098e03029189514acc01136fddafdd44713c87644baf6cbe3992bb2f89295d5857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206376, "uuid": "a23e88be-c137-41f3-b8cb-ad0d3d77deed", "value": "CA84E09615DD5365F16606FA2828E1708F645EAA58E0D7CCFBC4B3A3DEB33D50227C22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206376, "uuid": "49913d11-5061-472f-99c0-505508504c55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206376, "uuid": "769a2a9c-29de-4359-aa59-3b4ee96651d3", "value": "6144:r1c0cmapCiV99LehINeYZBdIzylhq75Bbvt6v6O/xgg5bJY73q4XnAgB:50pFeheNBTy75Bbcvig5u73LXAgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206376, "uuid": "4650361c-9f11-4d87-b295-f48b78a77144", "value": 407040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206376, "uuid": "e6becd12-96c4-40b7-aa4d-17e98d0c4fcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206376, "uuid": "645fa125-ad7f-4911-8420-f715a4bdde08", "value": "Payment Advice_pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03881ad5-db0b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625212591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212591, "uuid": "235f60b9-5b62-4e83-ad6f-e6bc757a4b12", "comment": "Malware payload (AgentTesla)", "value": "f52a7f9c3814cc82a7ca86db6f2c8934", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212591, "uuid": "93cae2fa-de38-43cf-b0ee-e25b044c9627", "comment": "Malware payload (AgentTesla)", "value": "ebdebe69d2d1252847af7fd1a76f19cfe1d828463374a583829a5ac9d6ba1e8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212591, "uuid": "47366162-1cc2-4907-bcda-9a90b16a0545", "comment": "Malware payload (AgentTesla)", "value": "07cb70080ea7bd5be4c78625cddb4f91323e18c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625212591, "uuid": "ec0db6ff-07a6-4045-aa8e-f6d66302b454", "comment": "Malware payload (AgentTesla)", "value": "bc8cfb5fb1e2dfb3e114914aa5a2774c893b5f1954b4aff213f84f6c978cb78df7bb8706d1e68788f436242e8f0699bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212591, "uuid": "cdf56782-c683-4068-8ea6-2eba30116010", "value": "BBA458E694D8FFD7D0BB22712EE4B2004B634B5928155144ABCCB51F3B626DE2392F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212591, "uuid": "93a5ddf0-3a11-42cd-9a5d-7b60eeac717d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212591, "uuid": "3f8846f4-5940-4608-93b6-0ec4db3a104d", "value": "6144:6C2mSW0cmapCiV99LVdrllYb7qluQinWYXZc7ChdioAp64bKR:d2ZqpFVrcelOXZcuPilpzKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625212591, "uuid": "77370c5c-425c-4219-880c-838204db6746", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625212591, "uuid": "323daffc-3cc4-4768-9160-3d6a6de9eeba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625212591, "uuid": "067f8bbd-2017-4502-a4e3-0eb1e96b70ff", "value": "f52a7f9c3814cc82a7ca86db6f2c8934", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2aad39-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226918, "uuid": "41c7d64d-db79-40cb-a466-9b3009f40a1a", "comment": "Malware payload (AgentTesla)", "value": "311ca6d33f3d0826e8c36830e873f22e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226918, "uuid": "c3d02e0a-cbba-4d09-b1ad-948010c74519", "comment": "Malware payload (AgentTesla)", "value": "ec37b5b04a9b9ab8ec6f6d4127b9230f2d3df94d50ef16b23ff69d5ada142bb2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226918, "uuid": "c0106756-059e-4659-9cbc-47ba3e9202fe", "comment": "Malware payload (AgentTesla)", "value": "e545e8e9b5d8454995efb81834393ecf7261d328", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226918, "uuid": "5c266940-0ff7-4065-84c2-9bcd9fd9b364", "comment": "Malware payload (AgentTesla)", "value": "267a52db5965652b48c62ff9b42e61acab33d653933ea21d0be030a988ecd42081a6a38bdbee65e84fdffd91ed8f4d0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226918, "uuid": "036de6b6-dcf2-4114-8fa0-d6ed7082313f", "value": "6FF429A8369470AED4B7CA77CAAB2C68E6B9B437570B550B601302DD4B0E943DF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226918, "uuid": "ba6f5879-e246-47b4-9d38-d4d8a156f7bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226918, "uuid": "3b3a901d-41c1-47e4-9e30-4610a7bf2e99", "value": "12288:4R0PE2jJDOPLpVQ2DeTAvBWDARsOJD9Zr6kFkJ4sgUFnsIL/h/4S9TkR+hZ0MxPS:YrD8AgDAR5IlFPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226918, "uuid": "1a213dae-b7c2-4236-bb64-c5a9c279ef29", "value": 782336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226918, "uuid": "b5e88a95-471b-469f-825a-739ea43ba107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226918, "uuid": "9e8acb02-da4e-42b9-9133-b62fc4809f67", "value": "311ca6d33f3d0826e8c36830e873f22e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54513ea-db61-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625249826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249826, "uuid": "f328e83b-4d19-41ee-ad4c-5e3826c59abc", "comment": "Malware payload", "value": "7fb9b3f470d86fc9bfdb2eb02cb25aca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249826, "uuid": "427aefce-50d0-4fea-88db-a9d8e962095b", "comment": "Malware payload", "value": "ece244bb690c63c0224f9725083a80ae2ca3620bcd3e3fcceab3eb2e115f0cb2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249826, "uuid": "6991ae8f-4b87-46b6-9e45-87f616610b12", "comment": "Malware payload", "value": "ab3782457fdea4c7ef26a0361c035efdbb38364d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625249826, "uuid": "d819105a-ee59-4007-9e42-a9a7c85b6bbf", "comment": "Malware payload", "value": "9681b5170a856f9ba7556178f5de99640ed1ddc907f2502505d84a5b94902e65e9652b72201aaf8f4b95b4011e9b2850", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249826, "uuid": "3e14c42c-b4de-43d3-b5c0-3953c456cb82", "value": "B4F2F1E05186505AE4D5017AAEFFBCCB259DE63E85880EA5C3D47336C4E2FE25B6C390", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249826, "uuid": "c3baf459-7f74-462e-9f45-e386a20ee9a8", "value": "768:UKlQMcsYPRXyL9hG15QZ2V0motnbcuyD7UryqknC98Ti7:rlZcsqXuIfYtnouy8mqkCOTi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625249826, "uuid": "52f63674-cabb-493d-a382-018f61294cfe", "value": 35024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625249826, "uuid": "cd28c405-1821-4e11-b838-ccd4b2eb9843", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625249826, "uuid": "3197896d-6d84-4679-9689-d39717f67808", "value": "7fb9b3f470d86fc9bfdb2eb02cb25aca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3443c7-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625227076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227076, "uuid": "9824b862-16c6-4709-9ee6-caceab72caa7", "comment": "Malware payload (AgentTesla)", "value": "ebdb74e01f6747c5e3e215a404e70fb6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227076, "uuid": "b02c5dae-97ff-4622-a4b3-95f32f642a44", "comment": "Malware payload (AgentTesla)", "value": "f02d9d97a000ab6aa1f4c742d7f0babcf60f301e61461230d7c10edcdd01a39b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227076, "uuid": "ca093471-e3e1-41fd-97db-3cc51f65df08", "comment": "Malware payload (AgentTesla)", "value": "5b1c98840d0b75c81a1365f49f7986ba7cae9dae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227076, "uuid": "9f96c6e0-d75c-4388-b191-0d16423f438f", "comment": "Malware payload (AgentTesla)", "value": "577333b161f244ca85b46c42f853bbabcfbe1d82787ea659820c3d7b95429727821ad0adbf06c189649974ef0f92796c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227076, "uuid": "105495b2-eb7d-489f-970d-0aeef7845f3e", "value": "E2E47C311BA89635E0B65FBED5A5208297FDF6236F03D85C68B501C94713E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227076, "uuid": "bb0f3f37-825a-47fa-a524-3bfb5d6e2375", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227076, "uuid": "14c64fa9-492b-490e-9a36-cda28c910e41", "value": "12288:yQrY1kmhFAzx9FCJYtdnrKx6wZYA1MQ0pv+vbv2e92NOw+BbX5TyhobXhph9Rnpl:yQo92YPSoDbhdxFMoNBK53x3Oz4FrwJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227076, "uuid": "eb660c89-2cb5-4b2c-a279-2724fb3b899d", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227076, "uuid": "3b903770-7391-48e1-b027-98d05087a32b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227076, "uuid": "7c43d38b-e02b-4398-83a1-9eab4a3d9782", "value": "ebdb74e01f6747c5e3e215a404e70fb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce171f1-daf3-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625202621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625202621, "uuid": "b2d4e5ae-31d3-40df-aa32-0ca71615b901", "comment": "Malware payload", "value": "b74015b61e37188b6ace484b1ed23559", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625202621, "uuid": "491763c9-1d61-470c-8125-7e917847cd14", "comment": "Malware payload", "value": "f06415d3df49d9c8f5ac780aaaed14d0cb28d7b24ad6fdac3d043485fd98159e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625202621, "uuid": "db9f72c5-8485-49ce-a2c8-5c355ada1d0c", "comment": "Malware payload", "value": "732aaa46678a6cace74d5023453e78b0444908dd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625202621, "uuid": "0d8b7ab8-4b25-4245-9bf0-21de8dfad946", "comment": "Malware payload", "value": "f90a28026cd57e1459b84dfe373119b12a75ea2dc9da762ed6faec98735fd16211a0fb7a4d27d68e52002d47485b0411", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625202621, "uuid": "cfaff5c8-03ea-4b8b-b960-b479fc4867d6", "value": "8D228D38D645FD26E122053DE11951F4FA6A5093E722B82B209D379C4F612C7478FABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625202621, "uuid": "7c380459-a069-4a66-9fbb-11b1b9a5deaa", "value": "96:kHcIMm57P6vdXzhdmGJa6T/n/jNTM0N19aZ4WEO/+IDl0FuMWKeULKfSDtQD802Y:ScIMmtPIeG/bMOYDWFuMp2oQD80Ni3+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625202621, "uuid": "d326af7b-6373-454b-be39-4257ba1e0329", "value": 10338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625202621, "uuid": "b5fff041-566e-4a64-b9f4-f0f34b4738f2", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625202621, "uuid": "c09d5e17-869c-4cc1-805f-70b61dd7d610", "value": "pi2.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebb8cc9-dafc-11eb-875b-42010a9c0053", "comment": "Malware payload (Heodo)", "timestamp": 1625206543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206543, "uuid": "caef3a17-5e6e-49a5-b876-39098e209a81", "comment": "Malware payload (Heodo)", "value": "e530dcbb466abbd695afcd9f22bbeb66", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206543, "uuid": "89a9e779-5365-4184-ace4-2a0095926b0e", "comment": "Malware payload (Heodo)", "value": "f0aec42c4adf98c914904d1fd3db75d1db56591088f12e27849cbc427aaf6c7d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206543, "uuid": "a6aef7b6-1db8-49ff-b2b3-9909c4f92c93", "comment": "Malware payload (Heodo)", "value": "932405dda9c39c637f76955f2860d58e46945bf3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206543, "uuid": "7ec4c808-f839-4bab-a493-d2d9945449e8", "comment": "Malware payload (Heodo)", "value": "51317899eb81c1fedfbf7f9a1b6875daad17311200b22d28dbae0403eaf2a953a454dd84f17f51a89c9534be18dd2292", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206543, "uuid": "0af240d8-404f-4a8c-83a6-110dd5089f62", "value": "D5C402012E56B583C1658B36D0D2D6235BB12E5D6620E66EA9FD3FEEF7397030E02709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206543, "uuid": "16b7276a-5f42-4fee-bbda-e3a7dd1143f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206543, "uuid": "8400a43d-5d86-40ba-a4d1-618918e203db", "value": "12288:pOCEFVzMFBzN9X1InNcIIv76A/+AsMCWhmgvERuRAVdKHqKUU3Kk6A:pCaBz6NcIItGAs5Whv8JdEXUCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206543, "uuid": "605a7e57-08ed-4303-b267-f4eaee251a27", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206543, "uuid": "8c372def-384e-44d0-8ca8-edf549cbfe83", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206543, "uuid": "e2450285-cbea-4a75-86fd-63ab855b3d3e", "value": "AGENCY ENQUIRE_v1-INUSO.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6670a0b7-db4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239815, "uuid": "292b3f8f-ea0d-432b-bdb5-73b43f2c6f98", "comment": "Malware payload", "value": "28a7ba89b237866ef06334ee737dad48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239815, "uuid": "89f72383-edc0-4b5c-9567-88d4e178e9c1", "comment": "Malware payload", "value": "f0ce9eb82e30ed88c2607fdd3d83f85e98050119becaa31e425ba609a420240e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239815, "uuid": "1d414876-4059-4b49-8045-ab92018d1604", "comment": "Malware payload", "value": "4c93ceaca3e850b53f5ecb60c5764ae8b026523f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239815, "uuid": "538558ea-7696-47d2-a0ba-46ec332da49c", "comment": "Malware payload", "value": "c9a06388bcbd770e8aa5aebf26c0f338c1439163b88aa57f16c3a9c4a255e181043fef6f19350dddc03a501db18c36de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239815, "uuid": "6be00776-3fb2-464e-9abd-c7277f06767a", "value": "5003F139EC9C0E88CDCC477C605CD7756EEC6081A15E279D170AAC522A3448BE4CF8BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239815, "uuid": "248cdcc0-d0b9-408b-abe4-da0e24f4f5c5", "value": "768:jCTCqdab2OtriLNIv3bAShNzMmhIslD3ZiWRy:+ab2KmLGvZhIslD3ZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239815, "uuid": "8601d662-a6d3-4768-80f2-6d33deeb5e8d", "value": 39164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239815, "uuid": "29cb9419-a394-4140-9d7d-d8dc0e22736c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239815, "uuid": "35b33ea0-0579-4a23-a374-59b359ba0b10", "value": "28a7ba89b237866ef06334ee737dad48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea6308b-dad7-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625190625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190625, "uuid": "ad4a88bc-fe76-465b-b6bd-a0016d81d1e2", "comment": "Malware payload (Gafgyt)", "value": "fd5b92fc34e999a6e8537ac4b62bba6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190625, "uuid": "d67e4622-ea49-4786-81a0-7a3cc5616262", "comment": "Malware payload (Gafgyt)", "value": "f1023cffce52c4661c3701a998104016996196291a63a5e7d21c38787629480f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190625, "uuid": "b54bca02-908f-4682-bcc1-6caafefdd8c8", "comment": "Malware payload (Gafgyt)", "value": "b08db51cce7b43330e079049a3666e4c3ad70fb0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190625, "uuid": "da3cd9ef-c1bd-48d3-884a-015737305b01", "comment": "Malware payload (Gafgyt)", "value": "15aca077a003f7d05f578afeff49f4c79a8a3b497dbcd8a712c4828268cfc7a2705b6ae7f8f3e65f1fdcb005f8ed8334", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190625, "uuid": "46fde412-8db9-4587-b8bc-ed08ec7b92c2", "value": "5FB32892B905DEA7F80ED67604D34B28B730BAA10F531A22731779A6AE771D42C23F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190625, "uuid": "fc565ff0-644f-4ba2-a8e1-cab8b75da742", "value": "3072:Kc2MGdFBs5fRpdFISu8lVLtozP3xyQ4N8TBOzMm7mNLVqyeAEL8W:Kcg3iVLtoz5yQHIIemNLVqyeAEL8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625190625, "uuid": "6208a5d6-2d60-48c2-a3c3-5772d263fe9c", "value": 114581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625190625, "uuid": "76e9cbf7-02e9-4bff-8ea9-32beaa1c6da0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190625, "uuid": "b693141c-bb25-413a-b8d8-f707772b727d", "value": "fd5b92fc34e999a6e8537ac4b62bba6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d127ccb-db62-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625250107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250107, "uuid": "b696f5d5-e107-4188-b3b4-d8b4094c8b37", "comment": "Malware payload (Mirai)", "value": "efd8575241b8848b2cf768796df03e8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250107, "uuid": "d864a75e-8a3b-476d-97c8-0cda87940a31", "comment": "Malware payload (Mirai)", "value": "f196c97a29643673238828a80ccdee28f59163729eb5eb45fe0a736eea947b92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250107, "uuid": "25d85e68-42d6-4a5b-a02d-75427837f5bd", "comment": "Malware payload (Mirai)", "value": "f434633dea2ca27a203a961de6e7056e86e9a789", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250107, "uuid": "2d7178d6-ffca-4748-b245-81a90a448b22", "comment": "Malware payload (Mirai)", "value": "23d2ec99d19e4157703e6ba540aa93e78716b26f1871cd5e8bb68e61178ee778a2ed13f6e3b5a384e2942700a854e2b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250107, "uuid": "4195b62c-f43d-44d8-b979-3d2a7d1e6093", "value": "D093C6457B750FF7E89FCC374AEA2B01288D561A61E93B767A34D808F24B25F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250107, "uuid": "0e66670b-a603-48ad-9538-ff25e1bed749", "value": "1536:7qrWVPcjE5arIU9UoR3ZQxBg+d8v43VZdBrUxa10c3qI9:+WVPcjE5aZItVT7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250107, "uuid": "745c25dc-494b-4ecc-bef6-76aba23096b8", "value": 93232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250107, "uuid": "d5c20f30-07c9-48cd-a32d-009748c32770", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250107, "uuid": "02003e08-7187-4707-b3ec-29f1f402356d", "value": "efd8575241b8848b2cf768796df03e8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a5fb1d-db62-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625250113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250113, "uuid": "cc2cdf44-40ab-4d5c-b6f0-d74a8e72d123", "comment": "Malware payload (Mirai)", "value": "2b868691d54708d1b27a3b613e1e83f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250113, "uuid": "d4214eff-839a-4dfd-a226-e53135f550b1", "comment": "Malware payload (Mirai)", "value": "f2be11c3c97529b2ec5c4d7ceaa4496291c241b551d6c308479d13aaef1e27f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250113, "uuid": "45ad9377-e460-4496-bbeb-1527da722eae", "comment": "Malware payload (Mirai)", "value": "c5d7da105a9a5e86ddafe4ade812dae7dc29f845", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625250113, "uuid": "edb13a5b-c846-4565-9f2b-a0583ae10f7c", "comment": "Malware payload (Mirai)", "value": "5727f8aa5742becef69a60e01074bc7afc50bbc6aebce5f3815bba9a1abc1e40062de2da02370d9213c293fc4e4efecd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250113, "uuid": "ff22b60b-034b-4b60-b99a-404a4f36e490", "value": "785318527C916A2AC6E0237EF6BE118E3314A7E8D1DF725BCC105B017B8991F0DA7B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250113, "uuid": "ee7e01a5-53d5-4aa2-b17c-8030a240fdef", "value": "1536:A9SLMUveN5zse2RhB3yeIualIU3EtMDS1MtzF8TBI0PBeJsa10832:wSLMlNrtz2VVZMbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625250113, "uuid": "e079589e-6bbf-48c6-b0b0-bc0a440c66f3", "value": 63976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625250113, "uuid": "f2862786-ce32-4dde-b245-2ed598cb0268", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625250113, "uuid": "019a9777-9d60-4459-a49f-9e2d75cae750", "value": "2b868691d54708d1b27a3b613e1e83f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4148efef-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226868, "uuid": "e1beb8fa-fb90-494f-91a8-2dcac53b26f9", "comment": "Malware payload (AgentTesla)", "value": "8164a1349e8383533cf3558270c76a02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226868, "uuid": "2957a62c-52e3-4af5-bf5d-417816e87d61", "comment": "Malware payload (AgentTesla)", "value": "f469d130a06088304f4b4f8250d178ea47e6823775ca7dc94aacdf75d5b3f0bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226868, "uuid": "e8130c18-aea5-4174-a66e-2ea27c415aa5", "comment": "Malware payload (AgentTesla)", "value": "e84c120c2e125b65fa3fd388c6ef21fc2bc175d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226868, "uuid": "ff5e2e9b-1ff3-454a-af4e-cbb9aa1e534e", "comment": "Malware payload (AgentTesla)", "value": "537a14d54192bd175f31ec16cdac98842970a0dece0450307ef3d8c3bc2448d8f8c79af6775e15776dd7ebba8fb429f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226868, "uuid": "3aadd223-02d0-4afa-b9d5-0f7c37ec117c", "value": "51E48D342AA95635E0B6AFBDD5A1208197FDF623AF03D85C78B501C50753E83C9F262E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226868, "uuid": "be754f29-6c93-40c9-aa7d-78bb8783d585", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226868, "uuid": "ee660e60-bd48-4be3-bd18-644a84708f2c", "value": "12288:/GznL1wuBbX5Tyndr2dyNi2ZxrXkduwzLDUF+am6+D:/GznL1H2Z7N5bkduwzXXam6O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226868, "uuid": "e8e190a6-b49d-4cc0-ae92-fe4434eeaa40", "value": 698880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226868, "uuid": "a3afd8ad-6862-4e6e-b503-31808c0c07f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226868, "uuid": "15f5c05b-500d-4f5e-906b-540436a7a71a", "value": "8164a1349e8383533cf3558270c76a02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d956759d-dae5-11eb-875b-42010a9c0053", "comment": "Malware payload (DiamondFox)", "timestamp": 1625196629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625196629, "uuid": "8c8b7728-5e41-4026-9f70-8d8a04690d7a", "comment": "Malware payload (DiamondFox)", "value": "bc3aa3605f8cdeaff689403c4b2eb935", "object_relation": "md5", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625196629, "uuid": "ae9aa8e9-1526-49ee-a6cb-1abcf2f9216a", "comment": "Malware payload (DiamondFox)", "value": "f50bfd1953c50abebcd913294e482f19619cf6187d34fa1c5356f8772d2f9447", "object_relation": "sha256", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625196629, "uuid": "d0ec00b9-27af-4ee6-9ae6-c259a034c134", "comment": "Malware payload (DiamondFox)", "value": "81bd2099ec713cb76aad2efab8f372974331ba9d", "object_relation": "sha1", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625196629, "uuid": "bea61908-30b7-45b3-aad6-f956b2713baf", "comment": "Malware payload (DiamondFox)", "value": "f335399090665bf644bcce752e917b1ea145d5425056d1949afc1e04f94c99e9a4eca08306e05e7234592ef6f2e29060", "object_relation": "sha3-384", "Tag": [ { "name": "DiamondFox", "colour": "#EB8395", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625196629, "uuid": "ad99758c-a6b7-4b66-ad9e-32d2e14ac07d", "value": "CC26335262D1E613DDCC8572AE7DA154E724A214B2F29E8CB227785F3F164B848CEF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625196629, "uuid": "7243a645-18f1-4021-a1dc-e04c8a19fa3c", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625196629, "uuid": "2796a501-0568-4b86-905a-63417f4f724a", "value": "98304:JizqSUvX6ish+EM/rFu1jzTKJ0SDVaUCa3Ui/YwCq39:JizSqjhp8rYpzTKJpmOU4xCy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625196629, "uuid": "fcbd1791-e8da-470a-a139-a44568c83cc6", "value": 4751698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625196629, "uuid": "1a651298-6360-40a6-b17e-bb0fe5387aac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625196629, "uuid": "9b4e3adf-99f6-4a1c-99ff-4ea1fdc523f7", "value": "BC3AA3605F8CDEAFF689403C4B2EB935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32f49f2-db2c-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625227086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227086, "uuid": "adc2f045-87f8-4a54-9aec-f0df67c28ecd", "comment": "Malware payload (AgentTesla)", "value": "d33862b61cc533c23945095736b28026", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227086, "uuid": "a8ef73f9-2567-451e-8a33-5ee4504985ca", "comment": "Malware payload (AgentTesla)", "value": "f5d78ab0a30f777dc5591b20493c9b925c9db805857f22f897bc36cabcf1424f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227086, "uuid": "8a9e70ee-eb64-4458-8a87-6bc1a9b4f266", "comment": "Malware payload (AgentTesla)", "value": "87cf85074b840f3575c8a38d4872b116ae203f46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625227086, "uuid": "263c0ae7-7d67-4ebb-8a19-6ef5a53010a0", "comment": "Malware payload (AgentTesla)", "value": "5e1b06ad96097347daa4535053250acbe704d05c3b8e5adcb45c1bb9b96931f1ee87bab39d7191eadfd78d360a4498d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227086, "uuid": "d4a1e91e-94ce-4094-8a9c-9b8979e6a2c7", "value": "C80529A836A470AED4B7DA77CAAB2C68E6B8B437570B550B601302DD4B0D943DF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227086, "uuid": "93ff4b4f-4761-4a16-8e57-715ab283610f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227086, "uuid": "9a95ef59-371f-44ac-9f6d-aa670d600a0a", "value": "12288:8WrSxjhQ0IjtpasBpTOhRm1kzgObZAzSVkHu1wVRV75uwgHEohrOfIdR6XAmoqak:D7BpT+RvMgmWkswz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625227086, "uuid": "528e806c-604f-4406-8c69-e67a92f31502", "value": 808960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625227086, "uuid": "56e442d3-36e8-4d83-8054-a656ad4a5203", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625227086, "uuid": "dd252872-15fb-44da-9bd4-18de19a3b4ff", "value": "d33862b61cc533c23945095736b28026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a263fb-db21-11eb-875b-42010a9c0053", "comment": "Malware payload (AsyncRAT)", "timestamp": 1625222250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222250, "uuid": "21dface2-1fe3-433f-a8ca-83024a2500c0", "comment": "Malware payload (AsyncRAT)", "value": "8fc4d0fc6853c719f1303d2e44d2bd79", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222250, "uuid": "a884f822-e579-435b-bec4-5e53129a8bf2", "comment": "Malware payload (AsyncRAT)", "value": "f5ee49fbe5a225c008e3382f9fa2317c825d77667fa114e990c39a648baf4f87", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222250, "uuid": "93b5f548-ed0e-4ea0-84ca-0125c0b4b696", "comment": "Malware payload (AsyncRAT)", "value": "433ebe878cf310261229eb3c3cbb35ec77ca99d1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625222250, "uuid": "43b4a62a-c1d4-49c5-91c3-0363db91366d", "comment": "Malware payload (AsyncRAT)", "value": "4241a4f52f9fbc6e4d934a51e21c46e724161142a49b081276cfc00bb6e9e3bd8f7b41b9fc972194376df5b06fb809ee", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222250, "uuid": "2b8a6cb3-313f-4c22-862a-ccd773e9166a", "value": "40219A5D3E9822D4279E87FBAEBF21C1D0B99C8A2AD81607D4907C8E7258D17C94A770", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222250, "uuid": "d6fe59e6-f11c-4a95-b179-fefc4dc03a32", "value": "24:YkGYvIWi5hA33xf14hy+jKRaMTws/CHbQbSH7224HlsomjrP:fGGpi5hO3xf14hy1ac/CNqZHldmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625222250, "uuid": "1d5a4e1c-57f8-408c-9a97-8b0b1f6a1bd1", "value": 1211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625222250, "uuid": "3b5e9ea9-2a8e-441d-87f7-c7419aed03ce", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625222250, "uuid": "df9062ff-cef0-42b3-a770-6049c1ad102c", "value": "2-JulyStatement_ID510710101531837.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0c796f-db6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625253538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253538, "uuid": "334ac806-2fea-4f9c-ad58-5d57cf498585", "comment": "Malware payload (Mirai)", "value": "832964a8546d7a8851389cb77b944979", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253538, "uuid": "6b8a0bd5-bb30-4b63-b76e-4379372d6924", "comment": "Malware payload (Mirai)", "value": "f69ea878e3de2b5feb573475ee81a07ab89894bf9963367f48c9a0318c3ce185", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253538, "uuid": "6368fae9-0e60-4be7-9eda-d22ba998db16", "comment": "Malware payload (Mirai)", "value": "d80cce2abf5de4b99f08830203b30f9fce6a8bbc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253538, "uuid": "d0c01b5b-93db-48d8-9551-8f09b5cfb5dd", "comment": "Malware payload (Mirai)", "value": "2039721dbd1c24642994d34cbb05746bb0630ed93e48f7b925ccd480c4fdc7703e6797c88a0ad705bb5ec26202cd0705", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253538, "uuid": "23b6eeae-f2af-48c5-8765-b9f8ee026501", "value": "5F23010104527923C03C69F7C9A14A489BEE62BC917D7AE2298D8F3CADD5D82DDFD9C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253538, "uuid": "e8704eed-56d7-46ed-938a-6422c548ef62", "value": "768:aK7y1XGOK/oSD4boxRVYFqHYeEUdcicuJiiUnJ9q3UELWt/iw+kvBGg6+fYtrBHq:E12OKAS8MRVYFqHYuBcZn8LWhiw+kvB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253538, "uuid": "e6bbbd78-959b-42d6-8b14-a3a974d9c62d", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253538, "uuid": "664172b4-272a-4039-834f-a92400d1e25a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253538, "uuid": "9bfb710a-7b41-4ec4-95b9-d49359aac065", "value": "832964a8546d7a8851389cb77b944979", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ee1939-dafc-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625206364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206364, "uuid": "2169b71b-ee47-46de-9ce0-3028e0e9c0ec", "comment": "Malware payload (Loki)", "value": "38f54f08708c887b1e944025a97863b7", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206364, "uuid": "33912355-49c3-4bf6-b47b-9b9b027fe148", "comment": "Malware payload (Loki)", "value": "f6adf38d068773afaefbd23976e26aae04861d4e4f33793076f29fa2f4ff69a3", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206364, "uuid": "572e2b8a-4472-4568-8bdd-09b3907cac2b", "comment": "Malware payload (Loki)", "value": "cbff03ca360a255d4336a549baa1b70cc6ee1cfc", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206364, "uuid": "7a493683-5f08-4825-88d0-e4d12d3c657a", "comment": "Malware payload (Loki)", "value": "8245ec1c52ca2009b051e311c5337f7ad3f35d4ae2127132b87f1c3726a3ab5755f0fa71574712f8674b70d3bb7cfccf", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206364, "uuid": "d039244b-fbd8-4fb1-83ba-829c2727df9e", "value": "8A5423F16ACF0B183F671660B460D0815462BB7B66904E0AECD85AD03B7EB7F176D829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206364, "uuid": "af735d55-ff6c-419b-9bcf-019b51a90465", "value": "6144:ZQOxPEhINeYBBDIzyHhq75BbvtCd6yfbCgljhYgz0:ZtEhetBVc75BbodAglOgz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206364, "uuid": "a4b672b3-66f4-411e-8e0e-a4861dbb4c95", "value": 301591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206364, "uuid": "453f7d1f-51ca-49f7-afca-b1694b7a6e74", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206364, "uuid": "27cde9c0-cd7b-4aae-90eb-57b1afb5242b", "value": "Payment Advice_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdc22979-db2b-11eb-875b-42010a9c0053", "comment": "Malware payload (AgentTesla)", "timestamp": 1625226755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226755, "uuid": "ebf86131-1348-4d38-b8b4-2b357a8e9dde", "comment": "Malware payload (AgentTesla)", "value": "c7df3a988586b9a2d2fd027d88117237", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226755, "uuid": "6ce81393-1023-4496-9a81-7cdf5e093af7", "comment": "Malware payload (AgentTesla)", "value": "f75ad0983d7c3b68c2111ede42de14998d0df954779d7d0f67d874b7602b5482", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226755, "uuid": "0b80b5bc-2a0d-4297-8dea-ed101bf05610", "comment": "Malware payload (AgentTesla)", "value": "560c46da04ea1c9717ce54aa10dce318e46f6df9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625226755, "uuid": "c3c5c972-70bd-426b-b68a-ab5a28f20205", "comment": "Malware payload (AgentTesla)", "value": "49644fd9e085c43db1e03edd361512f3a5a8e23da1205d3dc60f60b0a80c56b19be5a66cc87a1a008051295d82389794", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226755, "uuid": "da2f9688-60ac-4d23-86bf-61dca5c995da", "value": "C5053AA8369470AED4B7CA77CAAB2C68E6B9B437570B550B601302DD4B0E943DF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226755, "uuid": "190d3324-ebae-4f54-a698-c9785e27d4b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226755, "uuid": "5c61b392-5b51-4e0c-87ed-843961727cd4", "value": "12288:F2RLXxR71or2pmv5bWJxViBVfwPPf8S88DEQrQjytAX7wO4b5azwMtNOGWLBbRMJ:s/XVayPfRMQyyQS5a/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625226755, "uuid": "bc1c5845-455d-465a-8b05-97a50b54427d", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625226755, "uuid": "205cdeea-908e-437e-a653-db0488706063", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625226755, "uuid": "bb525716-8bd6-4761-aaf1-4dc59d46c9db", "value": "c7df3a988586b9a2d2fd027d88117237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6786fe6f-db6a-11eb-875b-42010a9c0053", "comment": "Malware payload (Mirai)", "timestamp": 1625253561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253561, "uuid": "179597e0-f249-4475-a192-ea15d3d4d7f1", "comment": "Malware payload (Mirai)", "value": "06956ce810516c4b85bc856507112476", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253561, "uuid": "fe9484ec-6d72-4658-9b49-b8e4cb306575", "comment": "Malware payload (Mirai)", "value": "f7afd844a40f2e35ef2e753e60beb896d1a9c3f426a7f00a7b5cdcaf15900908", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253561, "uuid": "73c29f73-5d6a-4c6f-91e8-b7890f509f75", "comment": "Malware payload (Mirai)", "value": "2d1e90951e690dcd9cb07dd2414edf74c4e8350b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625253561, "uuid": "e67d0320-093a-4461-b226-e5cbf73b4a94", "comment": "Malware payload (Mirai)", "value": "633d808f3941a55799b04f42807343de399ebb75735e435a2c4596ca54fe6bfe4490a31ff21c0b09a599d3845103df7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253561, "uuid": "e4d922fb-75a3-4ce4-8444-92a60be0956c", "value": "61333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253561, "uuid": "1e946f85-8225-4bb0-b0cd-deb279a98f80", "value": "768:8CeKEfhe5XdrbenQIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380Dd:dsfIBZemlJDFj0imvppqmUJP6Lc8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625253561, "uuid": "ab8bae23-d61a-4638-b0f8-7f15574c7d40", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625253561, "uuid": "8603a63b-8931-47dd-a3c6-c4fb3733c395", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625253561, "uuid": "c22c20d4-d8b2-4085-8b9f-76e8c9275a33", "value": "06956ce810516c4b85bc856507112476", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e04dba2-dafc-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625206274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206274, "uuid": "3f30024b-0381-497f-b49b-a7faabb92b28", "comment": "Malware payload (Loki)", "value": "3a8045ccb04f502d579e2e65504a3496", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206274, "uuid": "e4f19f48-7023-4237-9897-cad5d4c17cb4", "comment": "Malware payload (Loki)", "value": "f83dea2ee9ba89fbb520e108bb98012ca7a73208a0c1d7b45c8cad795c2f9d9e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206274, "uuid": "38429f5b-7e16-4bb5-a565-95b17051d98c", "comment": "Malware payload (Loki)", "value": "384445a41ecfa23b8e75a8f8fd1f3ad48a526e1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625206274, "uuid": "e17a6d43-2e0b-4c64-9c06-d7a979a230c7", "comment": "Malware payload (Loki)", "value": "2bdb80b23c1c8a0dc5a52ee7ad6f3df69146d43f105d3a77ee85f9d5a88f5a4615c3d0a8c54d68522866e9ee57ef82e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206274, "uuid": "f80232be-a231-4b15-9beb-ca6321f94bea", "value": "34F41968369070AED4B7CA77CAAB6C68EAB9B437570B550B601302DD4B0D943EF701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206274, "uuid": "75798c93-0c00-4503-8c7f-3e667a6084b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206274, "uuid": "74447d91-8874-45d0-aeab-1f5b620d825c", "value": "12288:m6FyG0c2+nsgp2rsn0Qy3HRArbUpA1yn72aEcNnH3Vo+kpmS5aateOR/1/fax12M:ZqxDOcnGcNnXVo+kQS5Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625206274, "uuid": "32b69ab3-1f19-46d6-ab1f-e3bdfac7a226", "value": 728576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625206274, "uuid": "e9f67037-0e11-46b7-89ea-f44918bfa299", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625206274, "uuid": "45d4cbd8-598f-40e6-a2b8-5029d00fb8a7", "value": "50% Advance TT JPEGimage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b59da17b-db49-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239519, "uuid": "9bb8764d-06bc-424b-ae1f-6e96a2a57e92", "comment": "Malware payload", "value": "3edc60b1a9715cb990446fe6d01f91b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239519, "uuid": "e01ebb53-28d0-4689-aade-65dc18f653e3", "comment": "Malware payload", "value": "f83fb597c6ad16844ea120901719cb2ed18f8bf2860676fc6e6ea75d82ac283f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239519, "uuid": "935654e3-02b1-4177-927e-c11e48af50fd", "comment": "Malware payload", "value": "97f6ebcab510cd621c9c9dfaf7748e1ab76f3a9e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239519, "uuid": "7af8dcc6-7e61-49fb-9996-a6c268d7ed3f", "comment": "Malware payload", "value": "1ea7c95cde710334c2f534e2ef5fd871735644da9a435ad8cf775ca2894fb0db36a9afa05e15a6a92789346c9d05791b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239519, "uuid": "3fa74da9-0c9a-4c30-8fc8-cf6c1f5bb519", "value": "BA836217AB61DE77CC5ECE73069A4501208EAD1A12D82B6FB2A4F95CF77784E08E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239519, "uuid": "bc6057a3-f132-4bcb-ad21-e0b51fab8645", "value": "1536:6xkqLeTRMGM8ZCQMdYgZtV0niZzVDIPMygNFP7:6xxdXdRdygr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239519, "uuid": "4c22e3eb-e647-4b1f-af65-f47101ae3410", "value": 87387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239519, "uuid": "f908b3d1-d471-4c06-860b-989846d24ade", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239519, "uuid": "c20cbb97-657a-4e0a-863b-1cd7a2ee6af8", "value": "3edc60b1a9715cb990446fe6d01f91b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c989ccc4-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625233539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233539, "uuid": "053babf4-8b1b-4a2b-9640-a4030a4c3c40", "comment": "Malware payload", "value": "f62bad563cf8435710f6708fef3bfbd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233539, "uuid": "9c5f92b0-76b2-4dd5-a1c5-9848405e16bb", "comment": "Malware payload", "value": "f87fe390d946be4903c6b227e31add4fded50845a78d1f03091f00f4f3ed290f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233539, "uuid": "be23b2e9-cb7e-4e79-8092-0a7c405c0db0", "comment": "Malware payload", "value": "4fbefecc8005d90d221c48f107ea3db42800ac6f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233539, "uuid": "95c2706e-41b5-4f7a-b7e4-f33e1d1e5ceb", "comment": "Malware payload", "value": "d9fcd649bf0ffbae9fb5809a76f23d316741e06ebdb8cc41c628bceef61d0bf110a1d2c58d84b596171417994e5369c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233539, "uuid": "5d7ca7f3-10e5-41ec-8e0b-afb27f3954c9", "value": "C7F32A02E4104766C2D257B6B75B628D73235FB99BCB3311CA187EB02FE079E1A3D691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233539, "uuid": "d98d3dbf-8054-419b-a489-1f462a4a1469", "value": "3072:knSISgo0VkweYfrGir/aGSgNLGlrG7qntJQetJ8add9Qzhs5lnVmcrzBmyUQ0LK2:grGca3gYE7qtOetJ8addQ8lnVmWBmyUV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233539, "uuid": "f137e4a8-e947-4655-a50d-640a32843052", "value": 172385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233539, "uuid": "42fe0ea6-da20-40b5-ab9b-23bb1a480225", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233539, "uuid": "cfd5403e-b47b-4b1a-ad96-698c2ea1f2a5", "value": "f62bad563cf8435710f6708fef3bfbd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f102725-db4a-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625239803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239803, "uuid": "d60da0e7-c907-48a1-9124-3e31acd32185", "comment": "Malware payload", "value": "d9170e89e073edefffcc8c6cf056d3ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239803, "uuid": "873b04bc-b573-429f-ad71-a43921c37f60", "comment": "Malware payload", "value": "f88a762a31506ac78f886c40e0be630c740dab925eef9646f7f368b8747fde04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239803, "uuid": "9d794784-4622-4d6b-97d3-60ba2377350a", "comment": "Malware payload", "value": "8758bd80026b57b29043f5eef2bbaebbe0dfcccc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625239803, "uuid": "65a02e89-fa32-46bb-9c38-05566c0422e5", "comment": "Malware payload", "value": "6855a664a80aa7d8734f517000297885a595543950ce371b0c04bd2bc9b44a9ff7e88e2eacec9a3ce88f841f7a2e54ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239803, "uuid": "adaff0cf-0ecd-4c2e-a2ed-c8dc3ad05d72", "value": "2A430706E583CAF3D8830AF506E7956A0672FC2A0E265E5AF71D7CF4AB374C87116352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239803, "uuid": "61605554-5d8a-4480-bef2-948c5aacd2df", "value": "768:nkB/ND+S+Jltw2vdAwjae8//vO03PA6oqQsLXFIZSVXa15D+I5h3U0ztwNbAC:u/NKTnAI18HG03y50FySZaDd5YNbL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625239803, "uuid": "5dca21a6-7bf2-498e-a5d7-dfb66d6e2445", "value": 55824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625239803, "uuid": "4667c556-1962-4617-ae71-600b4bdb6296", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625239803, "uuid": "1702395f-bb27-4d66-adf5-bc85cb547576", "value": "d9170e89e073edefffcc8c6cf056d3ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42cb054c-db11-11eb-875b-42010a9c0053", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1625215274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215274, "uuid": "c94695c5-b760-40f1-8c4a-dee0428a7e91", "comment": "Malware payload (SnakeKeylogger)", "value": "11a6161eb8cb335885badc7514dba6c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215274, "uuid": "13353d21-5e0a-497e-af03-603c544f8ec3", "comment": "Malware payload (SnakeKeylogger)", "value": "f8e4c7f5480d6b302e4870ca9eb28118ee47dd0dad4b689450782dfce53b8685", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215274, "uuid": "22f79136-2b85-4300-885d-1ab5d54bcde9", "comment": "Malware payload (SnakeKeylogger)", "value": "c86543d3797d611922afa5fec100c985df0e3fce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625215274, "uuid": "972f6734-64e3-4317-b24e-7e9d7204ca62", "comment": "Malware payload (SnakeKeylogger)", "value": "687f04c362f935074b65043ab2ae357b6c4a59d84d4525d7da055da6d351c63f77c2e88cf531904ac023359010d0d290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215274, "uuid": "095cca00-5f66-46de-b533-3e39165ffb60", "value": "75F409683A9070AED4B7CA77CAAB2C58EAB9B437571B550B601302DDCB0D943DE701B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215274, "uuid": "d7f6fba7-c8ed-4c98-9bab-883c49dba501", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215274, "uuid": "a3f81db7-f8bc-4833-8454-1c723ee62903", "value": "12288:5ml5MOXSx4x3p4H0WlomgKzhyZtoSHarka2dZEniI/fEzJ9mXrQu1uKT35x45H7l:g0nrg6hD6/AnEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625215274, "uuid": "c40810f5-baf7-414a-8f96-dd210e8afe2f", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625215274, "uuid": "ebe56ae0-abb3-40d0-ae5b-6c88b6b9d739", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625215274, "uuid": "5dc006d6-fdbf-42b2-a344-1b7f3cf96857", "value": "RFQ___FL.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199435af-db3b-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625233244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233244, "uuid": "cd3d4653-11f4-4f31-ab29-3cac4f0f5d33", "comment": "Malware payload", "value": "f50d19ee42b1687220266a1905dffa35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233244, "uuid": "a003857d-1575-4ac2-8bee-6f997454290f", "comment": "Malware payload", "value": "f9e80930eda2df349d220557b8a3f8601b1fd4239b8bb993d0ec948951143a69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233244, "uuid": "8c894ebf-4d0f-4f5c-af84-615d2408ed47", "comment": "Malware payload", "value": "85538c4bea59f876f608c97df22b778be97f7cc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625233244, "uuid": "c064496c-6d9f-45d2-b497-bdb186a43d45", "comment": "Malware payload", "value": "b2b7d7d975708417feb46f202070be8b6196dc37d4ae6e75e5219f232225e1f5fc4205ec8512df9892e9e8885cd7ae01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233244, "uuid": "11f5db5b-9bec-4f9c-9079-5bd30067d2ad", "value": "3AE3086F7B0807E3C48749B12D7763F04BE6AEB202E611C1E55ABE405B725B52627FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233244, "uuid": "1529c603-9cd1-4dfe-9c4d-587618cdeea1", "value": "3072:jKOxRHIpEuu7MInzNW26+etJ8add9QzhsV1Z6bUKQiVhgBJk:jKOxltuOMWlTetJ8addQc1Z6bUKQiVh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625233244, "uuid": "92687c53-299a-47b2-9d64-b920d28bbc1e", "value": 149772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625233244, "uuid": "b2ad4ac6-cdef-4db6-9b15-9ed20558635a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625233244, "uuid": "aad95c81-d042-4d84-af9a-15cdf868cda3", "value": "f50d19ee42b1687220266a1905dffa35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3baad2fb-db8e-11eb-875b-42010a9c0053", "comment": "Malware payload (RedLineStealer)", "timestamp": 1625268949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625268949, "uuid": "22155882-6d5a-494f-8931-3813018fe4ee", "comment": "Malware payload (RedLineStealer)", "value": "a0c5664aa4a6a4f84d1d8af648c10b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625268949, "uuid": "08675757-e7d9-4484-8914-033dbb977fde", "comment": "Malware payload (RedLineStealer)", "value": "fb68afd0254bcaad62a35fe249e9bbcbd10697e900473676576c7fd6c859a293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625268949, "uuid": "bbfd633c-306b-4197-9a85-f4f9d561c394", "comment": "Malware payload (RedLineStealer)", "value": "59ae34134303fa91101159f632e681560391b3d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625268949, "uuid": "cf81a49f-13f9-441d-ac67-29595471b44c", "comment": "Malware payload (RedLineStealer)", "value": "f1a0cfe2f1d7e81edf98260536d343e50552946e40366c081cc94fa0b8cccc69586079a0619e6165ae4f1d3c7c89e074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625268949, "uuid": "09084b35-2c4c-4e00-aaff-4e19b9c1a8a0", "value": "F7E4F111B5D08071D5721D3819F8AB346A3DBD301F358EDBA3D43A2E5E305D29A3ABA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625268949, "uuid": "76a78e20-ef64-4d2c-98ae-519845630cfe", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625268949, "uuid": "7bfd7f39-51e7-4652-a59a-fc6fa81d19be", "value": "12288:VOOfN590uu6opX+t4sP0XEg112rYvqefXU+468QZ467XKtFYev6DXfdd:YOfNkuu6oLsMXN1WqqeW68QZ46jKLYeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625268949, "uuid": "6a0cb4a3-87e1-4001-b459-71addc68c4df", "value": 702145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625268949, "uuid": "fb32d406-32a1-4f26-9cfa-8ae12119e2e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625268949, "uuid": "3a328be9-599a-4695-8e99-89dc4eb4a05e", "value": "a0c5664aa4a6a4f84d1d8af648c10b8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237d5a8d-db2f-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625228107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228107, "uuid": "65f98123-2349-4be4-bc1a-5ac0b1c0e966", "comment": "Malware payload", "value": "cdd1e74513490d49a0dfd8da1dc8fff7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228107, "uuid": "dd8e7bd7-22d9-4f21-b4d5-5434a79cf85f", "comment": "Malware payload", "value": "fd19f74934073d1fbd7801b6216c55857af494226b4627c7641e9332ded83c2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228107, "uuid": "b6bd9aec-6635-49c2-814e-f67deaa2c2b0", "comment": "Malware payload", "value": "30b71f9176a4fc7f5983621fb1cf78e83221c6f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625228107, "uuid": "823366eb-bb87-4fe3-bfa5-9c64315ec7e9", "comment": "Malware payload", "value": "5f0c36493c0d1b1f6ceecbf5df3e44e8fc27f490650e6169fb0766c892fe14afbc389dbe35c67c9326c58a2947f55c5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228107, "uuid": "0e1058f9-a5f1-4f21-982d-51e1fb140f2d", "value": "1A86334AD9D96439D1652E7CAC06A38F2F74BE140C03D15FEBE8AF0F1C798C54668AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228107, "uuid": "15890c47-de77-4f11-ad1a-6093568d72a9", "value": "de1fa96ad5bc81910ffb7ed552e29d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228107, "uuid": "904e6419-9ecc-4ccf-b6da-028c167be880", "value": "196608:S2ZzguBQ8IvfVilWy9K+8OgJLcvHXPp10ia1p8Xxq022t:SXEAalAigJLiAiIp8Bq022t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625228107, "uuid": "5639366a-b019-48fb-8213-207bbcceaa3a", "value": 8152386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625228107, "uuid": "afebd2bc-3d3f-492e-9bca-3b01c3f3b3b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625228107, "uuid": "254cc9e2-aa08-4ead-8677-aae509ebcf7d", "value": "54 45 53 54.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4863308-db45-11eb-875b-42010a9c0053", "comment": "Malware payload (Formbook)", "timestamp": 1625237852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625237852, "uuid": "3129c804-ba58-4986-9894-5fd78a61fe37", "comment": "Malware payload (Formbook)", "value": "87951a378a7d4009df00d15a2351ad96", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625237852, "uuid": "2fe19a66-5f88-4d18-ac66-8fdc89a74e3b", "comment": "Malware payload (Formbook)", "value": "fe185d885e1bc9984a6cbbf494e051c20ef6ba67102414a96720aace1c4744ac", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625237852, "uuid": "f9b023de-487f-4b7f-83f4-feeca207c0ae", "comment": "Malware payload (Formbook)", "value": "25316468553d9a381ed58ae9b33fccad3ffa78d6", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625237852, "uuid": "8e2667bf-586b-461a-a297-ba3380772172", "comment": "Malware payload (Formbook)", "value": "4d179c475343891601a5267d1f3703214aaf6e4a811509d2c923f038a017b8db42714763be3de6de12edee0568233fd2", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625237852, "uuid": "281ddff5-a288-4d7f-9f17-44c24eee686a", "value": "9BC423AEC5C2EFB9B39AA7D94D5C3D12114CE89538CBD0B94321ACFCD9AED1260B5C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625237852, "uuid": "10e2dd9d-ecdc-4dd9-85a9-1993d5dd2d0a", "value": "12288:l8inUr7DkrshbozME1A3MfUVu+Bb16Df4JaSD7ZoR3FNzlWli8awG28:eehAbYCOUVC40SD7Zy3FNzgpT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625237852, "uuid": "7b4fe888-f8e5-4187-a1b2-0b2e62b2c7f3", "value": 570039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625237852, "uuid": "c2545c15-e7bc-447e-ade8-178c0e9c24d3", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625237852, "uuid": "aa8e8c3a-0539-4ae5-9a79-f0c272f191db", "value": "Yani Sipari.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "431fcaf4-db03-11eb-875b-42010a9c0053", "comment": "Malware payload", "timestamp": 1625209262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209262, "uuid": "5f072a76-2856-4ae7-a623-48f152367f65", "comment": "Malware payload", "value": "cc9090fe1a198ab14a3f0fb99c77ab9a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209262, "uuid": "93e07f93-e40b-4302-8c62-ecc10e4c91cc", "comment": "Malware payload", "value": "ff7c668805abe8209eefd27ade1833f87ca3aa7df28e56dbea37f58ea84494e2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209262, "uuid": "5bf2a3d8-f5e5-4a15-ac2c-136d11505928", "comment": "Malware payload", "value": "b538d3a8ab3114f6e2c860398a6522cd197b1dfb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209262, "uuid": "4b4f1585-0dfa-4f25-a9c6-7b533fb227f7", "comment": "Malware payload", "value": "70872526352ddc815678c64df13699d1378d9daa7a03061eaa26cf896ae7ef481129aae313951fdaeabcceaafdb79756", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209262, "uuid": "25b86bd7-054f-4f55-b317-c8b3735a2b32", "value": "AF7302296723098DC43A3CF9B58AD766394B1B2A244F005801B9E5BA5FF71CCE5E9326", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209262, "uuid": "c1c41495-de0d-4632-8ebd-150ddbb51aa9", "value": "1536:XtBTX941eYF8NblpuvnwanQ3zWYq40LZ51g6Dobt+:biMYFJvw6Yh0b1gKobt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625209262, "uuid": "59fb89c4-25f5-4196-8413-ecf850a4b11e", "value": 79640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625209262, "uuid": "a4dd646a-55c5-4295-9998-6b2bcd753126", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209262, "uuid": "cefdbfca-496c-4129-856c-6c043c56f8c0", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebbac76-db8c-11eb-875b-42010a9c0053", "comment": "Malware payload (DCRat)", "timestamp": 1625268337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625268337, "uuid": "6c248ad9-df12-4fb6-96b5-b142391bd717", "comment": "Malware payload (DCRat)", "value": "7b7d03aad6ddb0e421ab5bba1a796484", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625268337, "uuid": "e799fd4c-7d28-4afa-8fa3-9ab4a477bae6", "comment": "Malware payload (DCRat)", "value": "ff8bcaa8c3a792db0f191e003d3c72a3dc532f849e2f495254c6252e5b61382c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625268337, "uuid": "8e80a2c8-d865-4e3e-a13c-8822cd2a21c2", "comment": "Malware payload (DCRat)", "value": "00d725c6694554a632902b9e0ba59efb849278d7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625268337, "uuid": "dff39805-4c4b-4156-9c8d-faaba4364401", "comment": "Malware payload (DCRat)", "value": "49320f04e26a8646cdd406053d255f64361cb3d7d64de96fbf3dd74b82846065006c4d5c2891be3aba40dab05e411f15", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625268337, "uuid": "a1bc8926-e15b-479f-9787-937ad761fa0f", "value": "A5E4F9242EE95529F17FAF7D95F079AA8B7EB6633713994E009103860723B41DCC1A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625268337, "uuid": "437bc5e5-62d7-4e9d-a788-dd41e4b4fc79", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625268337, "uuid": "22712119-0452-4bd8-a148-288df1e4112e", "value": "12288:yqnOGk5+FWM36pv8ZcYoMW2MYKxSKh2YdWnf3CpHO:y+OGkoQpvQUMWczn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625268337, "uuid": "da5338cb-3c74-40bb-9f34-4b01957b4801", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625268337, "uuid": "fc3e0f57-348a-4e51-97c2-1342f568830b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625268337, "uuid": "4a261066-4ed8-438a-bb1c-b996a4539e74", "value": "7B7D03AAD6DDB0E421AB5BBA1A796484.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2aaf89b-dad7-11eb-875b-42010a9c0053", "comment": "Malware payload (Gafgyt)", "timestamp": 1625190632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190632, "uuid": "7a1b1578-5aac-474d-9a33-d9c640817fea", "comment": "Malware payload (Gafgyt)", "value": "44e09bd79154552a56592e08bf970fb4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190632, "uuid": "6a4fec76-cf31-43d3-9d4b-d9488d3c597d", "comment": "Malware payload (Gafgyt)", "value": "ffccb9da74b66df8b0f91ea59cb003132dcc80e763d5bf1fbb29657ecde9b8af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190632, "uuid": "224fbf66-4700-42ee-95dd-3158e5837f0d", "comment": "Malware payload (Gafgyt)", "value": "f21a062de0f56bfd1e8efbc0187c5bbef32448ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625190632, "uuid": "8897a20b-c53a-48ba-871e-d4f17900f4c1", "comment": "Malware payload (Gafgyt)", "value": "d6affed6c3dffbd0d0835d1788760a906a039377cd762aecf317f59a7acb3e8546805c571149c83791b2fe3a3a3e87d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190632, "uuid": "419c76b6-18cc-4423-a8c7-9632b3c3b4a0", "value": "5BB3842A7E22AFFEE168823107F75F70879522D227919386F26CD7181E7128D1C5F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190632, "uuid": "8f5762b5-9a12-4e91-a29b-56253af314b1", "value": "1536:P7ju1Tepq+XLYh2rKVneDLNTTeTUdAOnirmJrStUmkiSFxfC7xbXe:WsQiLNTryOniarStUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625190632, "uuid": "fbcf576c-177f-4a1e-80ce-2b434ba6d7b6", "value": 117385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625190632, "uuid": "07b9e772-599a-4327-ba4b-b6badca8733b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625190632, "uuid": "b288861a-2f9b-4dd3-930a-c5d28577d546", "value": "44e09bd79154552a56592e08bf970fb4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0768595c-db04-11eb-875b-42010a9c0053", "comment": "Malware payload (Loki)", "timestamp": 1625209591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209591, "uuid": "2617f41f-5ad7-4314-a08c-9b7966acd38b", "comment": "Malware payload (Loki)", "value": "f8f5b3bad883e0b62fed5af138449db6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209591, "uuid": "3da4a8af-6ef8-44d8-998f-6f1398958d48", "comment": "Malware payload (Loki)", "value": "ffd51d05e6374da6d8db1eb2b2e43b2a61436524231edba8d1803c58ef27845a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209591, "uuid": "11524375-48b7-4434-9b71-043534463799", "comment": "Malware payload (Loki)", "value": "a09c250244420c43e83433d2a54a784b1400417a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1625209591, "uuid": "62936eb5-7365-4a39-a1b8-ff372a90d28f", "comment": "Malware payload (Loki)", "value": "f468ae653ab83a087c0b647a9f0435a9dd2946059b7902206cc0ee42afa9a357b470dba872877281bf4b2bfe9a505ba3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209591, "uuid": "55b89a6f-56e0-48c3-86fa-4add115c355c", "value": "62F41968369070AED4B7CA77CAAB6C68EAB9B437571B550B601302DD4B0D983DF700B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209591, "uuid": "c3a1a713-4b45-4ec4-a5f2-286289fcbc6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209591, "uuid": "0dd8c0dc-c7d7-4aec-a5ad-09dd074f7d67", "value": "12288:xeRNo2juhQpqp4gMWQWnCvyQUdhcJr5mMu762SN7Rq4r9fMV/Y3EsKta6ruPqw2m:4tW/nF+7mMH2K7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1625209591, "uuid": "45d58d61-eed5-4f10-a0fc-2c50114a87dc", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1625209591, "uuid": "554d0514-6d06-4156-bd30-8238bdc4adee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1625209591, "uuid": "d67cd56b-2cad-448a-a1ca-cd423f6f7e9b", "value": "f8f5b3bad883e0b62fed5af138449db6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }